@n24q02m/mcp-core 1.18.0-beta.2 → 1.18.0-beta.4

package/build/oauth/jwt-issuer.d.ts

@@ -1,6 +1,24 @@
 /**
- * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * JWT Issuer and JWKS generation for TypeScript MCP servers.
  * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ *
+ * Two signing modes, selected at construction:
+ *
+ * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
+ *   keys generated on first run and persisted to disk so they survive restarts
+ *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
+ *
+ * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
+ *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
+ *   container replica converges on the same key without a shared volume or
+ *   external secret store, so OAuth tokens survive container recreation
+ *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
+ *   the raw public key.
+ *
+ * The two modes are different deployments that never exchange tokens
+ * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
+ * intentional. Each process runs exactly one algorithm; the verify path uses
+ * that single alg, never a {RS256, EdDSA} union.
  */
 import * as jose from 'jose';
 export declare class JWTIssuer {
@@ -8,46 +26,54 @@ export declare class JWTIssuer {
     private keysDir;
     private privateKeyPath;
     private publicKeyPath;
+    private credentialSecret;
+    alg: 'RS256' | 'EdDSA';
     private kid;
     private privateKey;
     private publicKey;
+    private okpX;
     private _initialized;
-    constructor(serverName: string, keysDir?: string);
-    /** Must call before using issuer — loads or generates RSA keys. */
+    constructor(serverName: string, keysDir?: string, credentialSecret?: string | null);
+    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
     init(): Promise<void>;
-    /** Return JWKS payload for /.well-known/jwks.json */
+    private deriveEddsaKeys;
+    private loadOrGenerateRsaKeys;
+    /**
+     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
+     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
+     * mode emits an OKP JWK.
+     */
     getJwks(): Promise<jose.JSONWebKeySet>;
-    /** Issue an RS256 JWT access token (``typ="access"``). */
+    /** Issue a JWT access token (typ="access") signed with the active alg. */
     issueAccessToken(sub: string, expiresInSeconds?: number): Promise<string>;
     /**
-     * Issue an RS256 JWT refresh token (``typ="refresh"``).
+     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
      *
      * Defaults to a 30-day (2592000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the
-     * browser PKCE flow every hour. Same key / iss / aud as access tokens; the
-     * ``typ`` claim is the only thing distinguishing them, and
-     * ``verifyAccessToken`` rejects ``typ="refresh"`` so a refresh token can
-     * never be used as an access token at the ``/mcp`` resource.
+     * mint fresh access tokens without forcing the user back through the browser
+     * PKCE flow every hour. Same key / iss / aud as access tokens; the typ claim
+     * is the only thing distinguishing them, and verifyAccessToken rejects
+     * typ="refresh" so a refresh token can never be used as an access token at
+     * the /mcp resource.
      */
     issueRefreshToken(sub: string, expiresInSeconds?: number): Promise<string>;
     /**
-     * Verify a JWT access token and return its payload. Throws on failure
-     * (bad signature, wrong issuer/audience, expired) — the same jose errors
-     * existing callers already catch. Additionally rejects tokens whose
-     * ``typ`` claim is ``"refresh"`` (throwing ``jose.errors.JWTClaimValidationFailed``)
-     * so a refresh token cannot be replayed as an access token. Tokens with
-     * ``typ="access"`` OR a missing ``typ`` claim are accepted (the latter
-     * keeps already-issued pre-refresh-support tokens valid).
+     * Verify a JWT access token and return its payload. Throws on failure (bad
+     * signature, wrong issuer/audience, expired) — the same jose errors existing
+     * callers already catch. The verify path uses the single active algorithm,
+     * never a union. Additionally rejects tokens whose typ claim is "refresh"
+     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
+     * be replayed as an access token. Tokens with typ="access" OR a missing typ
+     * claim are accepted (the latter keeps already-issued pre-refresh-support
+     * tokens valid).
      */
     verifyAccessToken(token: string): Promise<jose.JWTPayload>;
     /**
      * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as ``verifyAccessToken`` and throws the same jose errors on
-     * failure. Additionally asserts ``typ=="refresh"`` (throwing
-     * ``jose.errors.JWTClaimValidationFailed`` otherwise) so an access token
-     * can never be exchanged at the refresh grant. ``JWTClaimValidationFailed``
-     * extends ``jose.errors.JOSEError``, so callers' existing ``catch`` clauses
-     * around ``verifyAccessToken`` already catch it.
+     * issuer checks as verifyAccessToken and throws the same jose errors on
+     * failure; uses the single active algorithm. Additionally asserts
+     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
+     * an access token can never be exchanged at the refresh grant.
      */
     verifyRefreshToken(token: string): Promise<jose.JWTPayload>;
 }

package/build/oauth/jwt-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,YAAY,CAAQ;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB;IAO1D,mEAAmE;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B3B,qDAAqD;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;IAS5C,0DAA0D;IACpD,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7E;;;;;;;;;OASG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAWjF;;;;;;;;OAQG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;IAYhE;;;;;;;;OAQG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;CAWlE"}
+{"version":3,"file":"jwt-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAU5B,qBAAa,SAAS;IACpB,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,gBAAgB,CAAe;IACvC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;IACtB,OAAO,CAAC,GAAG,CAAU;IACrB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,YAAY,CAAQ;gBAEhB,UAAU,EAAE,MAAM,EAAE,OAAO,SAAmB,EAAE,gBAAgB,GAAE,MAAM,GAAG,IAAW;IASlG,qFAAqF;IAC/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBb,eAAe;YAYf,qBAAqB;IA0BnC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;IAc5C,0EAA0E;IACpE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7E;;;;;;;;;OASG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,SAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAWjF;;;;;;;;;OASG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;IAahE;;;;;;OAMG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;CAYlE"}

package/build/oauth/jwt-issuer.js

@@ -1,27 +1,80 @@
 /**
- * RSA JWT Issuer and JWKS generation for TypeScript MCP servers.
+ * JWT Issuer and JWKS generation for TypeScript MCP servers.
  * Uses jose (industry-standard, zero-dep, Web Crypto compatible).
+ *
+ * Two signing modes, selected at construction:
+ *
+ * - LOCAL single-user (credentialSecret unset): RSA-2048, RS256, kid="key-1",
+ *   keys generated on first run and persisted to disk so they survive restarts
+ *   on a real machine. Behavior is unchanged from the pre-stability-fix code.
+ *
+ * - HTTP multi-user (credentialSecret set): Ed25519, EdDSA, signing key DERIVED
+ *   deterministically from CREDENTIAL_SECRET via HKDF-SHA256. No disk I/O. Every
+ *   container replica converges on the same key without a shared volume or
+ *   external secret store, so OAuth tokens survive container recreation
+ *   (Watchtower :latest redeploys). kid is the base64url SHA-256 thumbprint of
+ *   the raw public key.
+ *
+ * The two modes are different deployments that never exchange tokens
+ * (iss/aud are server-scoped); the per-mode algorithm split is permanent and
+ * intentional. Each process runs exactly one algorithm; the verify path uses
+ * that single alg, never a {RS256, EdDSA} union.
  */
+import { createHash, createPrivateKey } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import * as jose from 'jose';
+import { deriveJwtSigningSeed } from '../crypto/kdf.js';
 const DEFAULT_KEYS_DIR = join(homedir(), '.mcp-core', 'jwt-keys');
+// RFC 8410 PKCS8 DER prefix for an Ed25519 private key. Prepended to the
+// 32-byte HKDF seed to build an importable PKCS8 key (jose 6.2.3 cannot import
+// a raw seed via importJWK d-only).
+const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 export class JWTIssuer {
-    constructor(serverName, keysDir = DEFAULT_KEYS_DIR) {
+    constructor(serverName, keysDir = DEFAULT_KEYS_DIR, credentialSecret = null) {
         this.kid = 'key-1';
         this.privateKey = null;
         this.publicKey = null;
+        this.okpX = null;
         this._initialized = false;
         this.serverName = serverName;
         this.keysDir = keysDir;
+        this.credentialSecret = credentialSecret;
+        this.alg = credentialSecret ? 'EdDSA' : 'RS256';
         this.privateKeyPath = join(this.keysDir, `${serverName}_private.pem`);
         this.publicKeyPath = join(this.keysDir, `${serverName}_public.pem`);
     }
-    /** Must call before using issuer — loads or generates RSA keys. */
+    /** Must call before using issuer — loads/generates (RSA) or derives (EdDSA) keys. */
     async init() {
         if (this._initialized)
             return;
+        if (this.credentialSecret) {
+            await this.deriveEddsaKeys(this.credentialSecret);
+            // Don't name the source env var in the message: only serverName + the
+            // public kid thumbprint are logged (never the secret), and the literal
+            // "CREDENTIAL_SECRET" token trips the SAST logger-credential heuristic
+            // for no real benefit (parity with core-py jwt_issuer.py).
+            console.error(`JWTIssuer[${this.serverName}]: HTTP multi-user mode, EdDSA signing key derived (kid=${this.kid})`);
+        }
+        else {
+            await this.loadOrGenerateRsaKeys();
+            console.error(`JWTIssuer[${this.serverName}]: local single-user mode, RS256 key on disk (${this.keysDir})`);
+        }
+        this._initialized = true;
+    }
+    async deriveEddsaKeys(credentialSecret) {
+        const seed = deriveJwtSigningSeed(credentialSecret, this.serverName);
+        const der = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+        const pem = `-----BEGIN PRIVATE KEY-----\n${der.toString('base64')}\n-----END PRIVATE KEY-----\n`;
+        this.privateKey = await jose.importPKCS8(pem, 'EdDSA', { extractable: false });
+        // Recover the public JWK x via node:crypto (jose has no seed->public path).
+        const jwk = createPrivateKey(pem).export({ format: 'jwk' });
+        this.okpX = jwk.x;
+        this.publicKey = (await jose.importJWK({ kty: 'OKP', crv: 'Ed25519', x: jwk.x }, 'EdDSA'));
+        this.kid = createHash('sha256').update(Buffer.from(jwk.x, 'base64url')).digest('base64url').slice(0, 16);
+    }
+    async loadOrGenerateRsaKeys() {
         mkdirSync(this.keysDir, { recursive: true, mode: 0o700 });
         if (existsSync(this.privateKeyPath) && existsSync(this.publicKeyPath)) {
             const privatePem = readFileSync(this.privateKeyPath, 'utf-8');
@@ -42,24 +95,32 @@ export class JWTIssuer {
             this.privateKey = await jose.importPKCS8(privatePem, 'RS256', { extractable: false });
             this.publicKey = await jose.importSPKI(publicPem, 'RS256', { extractable: true });
         }
-        this._initialized = true;
     }
-    /** Return JWKS payload for /.well-known/jwks.json */
+    /**
+     * Return JWKS payload for /.well-known/jwks.json. Always a `keys` array
+     * (multi-key-aware for future rotation). RSA mode emits an RSA JWK; EdDSA
+     * mode emits an OKP JWK.
+     */
     async getJwks() {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
+        if (this.alg === 'EdDSA') {
+            return {
+                keys: [{ kty: 'OKP', crv: 'Ed25519', x: this.okpX, use: 'sig', alg: 'EdDSA', kid: this.kid }]
+            };
+        }
         const jwk = await jose.exportJWK(this.publicKey);
         jwk.kid = this.kid;
         jwk.use = 'sig';
         jwk.alg = 'RS256';
         return { keys: [jwk] };
     }
-    /** Issue an RS256 JWT access token (``typ="access"``). */
+    /** Issue a JWT access token (typ="access") signed with the active alg. */
     async issueAccessToken(sub, expiresInSeconds = 3600) {
         if (!this.privateKey)
             throw new Error('JWTIssuer not initialized');
         return new jose.SignJWT({ sub, typ: 'access' })
-            .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+            .setProtectedHeader({ alg: this.alg, kid: this.kid })
             .setIssuer(this.serverName)
             .setAudience(this.serverName)
             .setIssuedAt()
@@ -67,20 +128,20 @@ export class JWTIssuer {
             .sign(this.privateKey);
     }
     /**
-     * Issue an RS256 JWT refresh token (``typ="refresh"``).
+     * Issue a JWT refresh token (typ="refresh") signed with the active alg.
      *
      * Defaults to a 30-day (2592000s) lifetime so long-running MCP clients can
-     * mint fresh access tokens without forcing the user back through the
-     * browser PKCE flow every hour. Same key / iss / aud as access tokens; the
-     * ``typ`` claim is the only thing distinguishing them, and
-     * ``verifyAccessToken`` rejects ``typ="refresh"`` so a refresh token can
-     * never be used as an access token at the ``/mcp`` resource.
+     * mint fresh access tokens without forcing the user back through the browser
+     * PKCE flow every hour. Same key / iss / aud as access tokens; the typ claim
+     * is the only thing distinguishing them, and verifyAccessToken rejects
+     * typ="refresh" so a refresh token can never be used as an access token at
+     * the /mcp resource.
      */
     async issueRefreshToken(sub, expiresInSeconds = 2592000) {
         if (!this.privateKey)
             throw new Error('JWTIssuer not initialized');
         return new jose.SignJWT({ sub, typ: 'refresh' })
-            .setProtectedHeader({ alg: 'RS256', kid: this.kid })
+            .setProtectedHeader({ alg: this.alg, kid: this.kid })
             .setIssuer(this.serverName)
             .setAudience(this.serverName)
             .setIssuedAt()
@@ -88,20 +149,22 @@ export class JWTIssuer {
             .sign(this.privateKey);
     }
     /**
-     * Verify a JWT access token and return its payload. Throws on failure
-     * (bad signature, wrong issuer/audience, expired) — the same jose errors
-     * existing callers already catch. Additionally rejects tokens whose
-     * ``typ`` claim is ``"refresh"`` (throwing ``jose.errors.JWTClaimValidationFailed``)
-     * so a refresh token cannot be replayed as an access token. Tokens with
-     * ``typ="access"`` OR a missing ``typ`` claim are accepted (the latter
-     * keeps already-issued pre-refresh-support tokens valid).
+     * Verify a JWT access token and return its payload. Throws on failure (bad
+     * signature, wrong issuer/audience, expired) — the same jose errors existing
+     * callers already catch. The verify path uses the single active algorithm,
+     * never a union. Additionally rejects tokens whose typ claim is "refresh"
+     * (throwing jose.errors.JWTClaimValidationFailed) so a refresh token cannot
+     * be replayed as an access token. Tokens with typ="access" OR a missing typ
+     * claim are accepted (the latter keeps already-issued pre-refresh-support
+     * tokens valid).
      */
     async verifyAccessToken(token) {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
         const { payload } = await jose.jwtVerify(token, this.publicKey, {
             issuer: this.serverName,
-            audience: this.serverName
+            audience: this.serverName,
+            algorithms: [this.alg]
         });
         if (payload.typ === 'refresh') {
             throw new jose.errors.JWTClaimValidationFailed('Refresh token cannot be used as an access token', payload, 'typ');
@@ -110,19 +173,18 @@ export class JWTIssuer {
     }
     /**
      * Verify a JWT refresh token and return its payload. Same key / audience /
-     * issuer checks as ``verifyAccessToken`` and throws the same jose errors on
-     * failure. Additionally asserts ``typ=="refresh"`` (throwing
-     * ``jose.errors.JWTClaimValidationFailed`` otherwise) so an access token
-     * can never be exchanged at the refresh grant. ``JWTClaimValidationFailed``
-     * extends ``jose.errors.JOSEError``, so callers' existing ``catch`` clauses
-     * around ``verifyAccessToken`` already catch it.
+     * issuer checks as verifyAccessToken and throws the same jose errors on
+     * failure; uses the single active algorithm. Additionally asserts
+     * typ=="refresh" (throwing jose.errors.JWTClaimValidationFailed otherwise) so
+     * an access token can never be exchanged at the refresh grant.
      */
     async verifyRefreshToken(token) {
         if (!this.publicKey)
             throw new Error('JWTIssuer not initialized');
         const { payload } = await jose.jwtVerify(token, this.publicKey, {
             issuer: this.serverName,
-            audience: this.serverName
+            audience: this.serverName,
+            algorithms: [this.alg]
         });
         if (payload.typ !== 'refresh') {
             throw new jose.errors.JWTClaimValidationFailed('Token is not a refresh token', payload, 'typ');

package/build/oauth/jwt-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;AAEjE,MAAM,OAAO,SAAS;IAUpB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB;QALlD,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEzD,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAE7D,0DAA0D;YAC1D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,gBAAgB,GAAG,OAAO;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iDAAiD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}
+{"version":3,"file":"jwt-issuer.js","sourceRoot":"","sources":["../../src/oauth/jwt-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;AAEjE,yEAAyE;AACzE,+EAA+E;AAC/E,oCAAoC;AACpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;AAEnF,MAAM,OAAO,SAAS;IAapB,YAAY,UAAkB,EAAE,OAAO,GAAG,gBAAgB,EAAE,mBAAkC,IAAI;QAN1F,QAAG,GAAG,OAAO,CAAA;QACb,eAAU,GAA0B,IAAI,CAAA;QACxC,cAAS,GAA0B,IAAI,CAAA;QACvC,SAAI,GAAkB,IAAI,CAAA;QAC1B,iBAAY,GAAG,KAAK,CAAA;QAG1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAA;QACxC,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,cAAc,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,UAAU,aAAa,CAAC,CAAA;IACrE,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY;YAAE,OAAM;QAC7B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACjD,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,2DAA2D,IAAI,CAAC,GAAG,GAAG,CAAC,CAAA;QACnH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;YAClC,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,UAAU,iDAAiD,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,gBAAwB;QACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,gCAAgC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,+BAA+B,CAAA;QACjG,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAkB,CAAA;QAC5E,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;QACjB,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAmB,CAAA;QAC5G,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1G,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEzD,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;YAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAElD,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAE7D,0DAA0D;YAC1D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,IAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACxG,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QAClB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAA;QACf,GAAG,CAAC,GAAG,GAAG,OAAO,CAAA;QACjB,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IACxB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,IAAI;QACzD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,gBAAgB,GAAG,OAAO;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAClE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iDAAiD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;SACvB,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF"}

package/build/storage/backends.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pluggable credential backends.
+ *
+ * A backend stores and retrieves OPAQUE ciphertext blobs keyed by a string.
+ * Encryption and key derivation live in PerPluginStore; backends never see
+ * plaintext. This seam lets MCP servers run serverless (e.g. Cloudflare Workers
+ * KV) while stdio/VM deployments keep the on-disk layout via LocalFsBackend.
+ */
+/** Stores opaque ciphertext blobs keyed by a string. */
+export interface CredentialBackend {
+    get(key: string): Promise<Buffer | null>;
+    put(key: string, blob: Buffer): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Map-backed backend, primarily for tests. */
+export declare class InMemoryBackend implements CredentialBackend {
+    private store;
+    get(key: string): Promise<Buffer | null>;
+    put(key: string, blob: Buffer): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Stores blobs on local disk, preserving the per-plugin layout. */
+export declare class LocalFsBackend implements CredentialBackend {
+    get(key: string): Promise<Buffer | null>;
+    put(key: string, blob: Buffer): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Minimal injectable HTTP client returning status + body. */
+export interface Http {
+    request(method: string, url: string, data?: Buffer, headers?: Record<string, string>): Promise<{
+        status: number;
+        body: Buffer;
+    }>;
+}
+/**
+ * Stores blobs in a Cloudflare Workers KV namespace over HTTP.
+ *
+ * Error contract: 200 -> data, 404 -> absent (null for get, no-op for delete).
+ * Every other HTTP status, plus transport errors from the HTTP client, raises --
+ * failures are loud, never silently returned as data. Error messages carry the
+ * status only; never the token or the response body.
+ */
+export declare class CfKvBackend implements CredentialBackend {
+    private readonly baseUrl;
+    private readonly token?;
+    private readonly http;
+    constructor(baseUrl: string, token?: string, http?: Http);
+    private url;
+    private headers;
+    get(key: string): Promise<Buffer | null>;
+    put(key: string, blob: Buffer): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Select a credential backend from the MCP_STORAGE_BACKEND env var. */
+export declare function backendFromEnv(): CredentialBackend;
+//# sourceMappingURL=backends.d.ts.map

package/build/storage/backends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends.d.ts","sourceRoot":"","sources":["../../src/storage/backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,+CAA+C;AAC/C,qBAAa,eAAgB,YAAW,iBAAiB;IACvD,OAAO,CAAC,KAAK,CAA4B;IAEnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AA0CD,oEAAoE;AACpE,qBAAa,cAAe,YAAW,iBAAiB;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzC;AAED,8DAA8D;AAC9D,MAAM,WAAW,IAAI;IACnB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC7C;AAqBD;;;;;;;GAOG;AACH,qBAAa,WAAY,YAAW,iBAAiB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAM;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,IAAgB;IAMnE,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;IAIT,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMzC;AAED,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,iBAAiB,CAWlD"}

package/build/storage/backends.js

@@ -0,0 +1,167 @@
+/**
+ * Pluggable credential backends.
+ *
+ * A backend stores and retrieves OPAQUE ciphertext blobs keyed by a string.
+ * Encryption and key derivation live in PerPluginStore; backends never see
+ * plaintext. This seam lets MCP servers run serverless (e.g. Cloudflare Workers
+ * KV) while stdio/VM deployments keep the on-disk layout via LocalFsBackend.
+ */
+import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
+import { getHomeDir } from './home-dir.js';
+/** Map-backed backend, primarily for tests. */
+export class InMemoryBackend {
+    constructor() {
+        this.store = new Map();
+    }
+    async get(key) {
+        return this.store.get(key) ?? null;
+    }
+    async put(key, blob) {
+        this.store.set(key, blob);
+    }
+    async delete(key) {
+        this.store.delete(key);
+    }
+}
+function validateComponent(name) {
+    if (!name || name === '.' || name === '..' || name.includes('/') || name.includes('\\') || name.includes('\x00')) {
+        throw new Error(`Invalid path component: ${name}`);
+    }
+    return name;
+}
+/**
+ * Map a backend key to its on-disk path.
+ *
+ *   "<plugin>/config"            -> ~/.<plugin>-mcp/config.json
+ *   "<plugin>/subs/<sub>/config" -> ~/.<plugin>-mcp/subs/<sub>/config.json
+ */
+function keyToPath(key) {
+    const slash = key.indexOf('/');
+    const plugin = slash === -1 ? key : key.slice(0, slash);
+    const rest = slash === -1 ? '' : key.slice(slash + 1);
+    validateComponent(plugin);
+    const base = join(getHomeDir(), `.${plugin}-mcp`);
+    let path;
+    if (rest === 'config') {
+        path = join(base, 'config.json');
+    }
+    else if (rest.startsWith('subs/') && rest.endsWith('/config')) {
+        const sub = rest.slice('subs/'.length, -'/config'.length);
+        validateComponent(sub);
+        path = join(base, 'subs', sub, 'config.json');
+    }
+    else {
+        throw new Error(`Invalid backend key: ${key}`);
+    }
+    // Defense-in-depth: validateComponent already rejects separators/./../empty/NUL.
+    const baseResolved = resolve(base);
+    const pathResolved = resolve(path);
+    if (pathResolved !== baseResolved && !pathResolved.startsWith(baseResolved + sep)) {
+        throw new Error(`Path escapes base: ${key}`);
+    }
+    return path;
+}
+/** Stores blobs on local disk, preserving the per-plugin layout. */
+export class LocalFsBackend {
+    async get(key) {
+        const path = keyToPath(key);
+        try {
+            return await readFile(path);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    }
+    async put(key, blob) {
+        const path = keyToPath(key);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        await writeFile(path, blob, { mode: 0o600 });
+    }
+    async delete(key) {
+        const path = keyToPath(key);
+        try {
+            await unlink(path);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+    }
+}
+/**
+ * Default HTTP implementation over global fetch.
+ *
+ * fetch resolves on 4xx/5xx and rejects only on network error, so status checks
+ * in CfKvBackend handle HTTP errors while transport errors propagate -- matching
+ * the Python httpx client behavior.
+ */
+const fetchHttp = {
+    async request(method, url, data, headers) {
+        const resp = await fetch(url, {
+            method,
+            body: data ? new Uint8Array(data) : undefined,
+            headers
+        });
+        const body = Buffer.from(await resp.arrayBuffer());
+        return { status: resp.status, body };
+    }
+};
+/**
+ * Stores blobs in a Cloudflare Workers KV namespace over HTTP.
+ *
+ * Error contract: 200 -> data, 404 -> absent (null for get, no-op for delete).
+ * Every other HTTP status, plus transport errors from the HTTP client, raises --
+ * failures are loud, never silently returned as data. Error messages carry the
+ * status only; never the token or the response body.
+ */
+export class CfKvBackend {
+    constructor(baseUrl, token, http = fetchHttp) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.token = token;
+        this.http = http;
+    }
+    url(key) {
+        return `${this.baseUrl}/${encodeURIComponent(key)}`;
+    }
+    headers() {
+        return this.token ? { Authorization: `Bearer ${this.token}` } : {};
+    }
+    async get(key) {
+        const { status, body } = await this.http.request('GET', this.url(key), undefined, this.headers());
+        if (status === 200)
+            return body;
+        if (status === 404)
+            return null;
+        throw new Error(`CfKvBackend get failed: HTTP ${status}`);
+    }
+    async put(key, blob) {
+        const { status } = await this.http.request('PUT', this.url(key), blob, this.headers());
+        if (status !== 200 && status !== 204) {
+            throw new Error(`CfKvBackend put failed: HTTP ${status}`);
+        }
+    }
+    async delete(key) {
+        const { status } = await this.http.request('DELETE', this.url(key), undefined, this.headers());
+        if (status !== 200 && status !== 204 && status !== 404) {
+            throw new Error(`CfKvBackend delete failed: HTTP ${status}`);
+        }
+    }
+}
+/** Select a credential backend from the MCP_STORAGE_BACKEND env var. */
+export function backendFromEnv() {
+    const kind = (process.env.MCP_STORAGE_BACKEND ?? 'local').toLowerCase();
+    if (kind === 'local' || kind === 'local-fs' || kind === '') {
+        return new LocalFsBackend();
+    }
+    if (kind === 'cf-kv') {
+        const baseUrl = process.env.MCP_KV_BASE_URL;
+        if (!baseUrl)
+            throw new Error('MCP_KV_BASE_URL is required when MCP_STORAGE_BACKEND=cf-kv');
+        return new CfKvBackend(baseUrl, process.env.MCP_KV_TOKEN);
+    }
+    throw new Error(`Unknown MCP_STORAGE_BACKEND: ${kind}`);
+}
+//# sourceMappingURL=backends.js.map

package/build/storage/backends.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends.js","sourceRoot":"","sources":["../../src/storage/backends.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAS1C,+CAA+C;AAC/C,MAAM,OAAO,eAAe;IAA5B;QACU,UAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IAa3C,CAAC;IAXC,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACrD,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,MAAM,MAAM,CAAC,CAAA;IACjD,IAAI,IAAY,CAAA;IAChB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAClC,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACzD,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,iFAAiF;IACjF,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,YAAY,KAAK,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,oEAAoE;AACpE,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YACjE,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAA;QACjE,CAAC;IACH,CAAC;CACF;AAYD;;;;;;GAMG;AACH,MAAM,SAAS,GAAS;IACtB,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO;QACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,OAAO;SACR,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAClD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IAKtB,YAAY,OAAe,EAAE,KAAc,EAAE,OAAa,SAAS;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAEO,GAAG,CAAC,GAAW;QACrB,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAA;IACrD,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACjG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACtF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;IACvE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,IAAI,cAAc,EAAE,CAAA;IAC7B,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;QAC3C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC3F,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;AACzD,CAAC"}

package/build/storage/home-dir.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared home-directory resolution with a testing override.
+ *
+ * Extracted out of per-plugin-store.ts so that both PerPluginStore and the
+ * LocalFsBackend in backends.ts can honor the same override without a circular
+ * value import (per-plugin-store imports backendFromEnv from backends).
+ */
+/** Override the home directory used by storage modules. Pass null to reset. */
+export declare function setHomeDirForTesting(dir: string | null): void;
+export declare function getHomeDir(): string;
+//# sourceMappingURL=home-dir.d.ts.map

package/build/storage/home-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-dir.d.ts","sourceRoot":"","sources":["../../src/storage/home-dir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7D;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC"}

package/build/storage/home-dir.js

@@ -0,0 +1,18 @@
+/**
+ * Shared home-directory resolution with a testing override.
+ *
+ * Extracted out of per-plugin-store.ts so that both PerPluginStore and the
+ * LocalFsBackend in backends.ts can honor the same override without a circular
+ * value import (per-plugin-store imports backendFromEnv from backends).
+ */
+import { homedir } from 'node:os';
+// Module-level override for testing.
+let homeDirOverride = null;
+/** Override the home directory used by storage modules. Pass null to reset. */
+export function setHomeDirForTesting(dir) {
+    homeDirOverride = dir;
+}
+export function getHomeDir() {
+    return homeDirOverride ?? homedir();
+}
+//# sourceMappingURL=home-dir.js.map

package/build/storage/home-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-dir.js","sourceRoot":"","sources":["../../src/storage/home-dir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC,qCAAqC;AACrC,IAAI,eAAe,GAAkB,IAAI,CAAA;AAEzC,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,eAAe,GAAG,GAAG,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,eAAe,IAAI,OAAO,EAAE,CAAA;AACrC,CAAC"}

package/build/storage/index.d.ts

@@ -1,3 +1,4 @@
+export { backendFromEnv, CfKvBackend, type CredentialBackend, InMemoryBackend, LocalFsBackend } from './backends.js';
 export { deleteConfig, exportConfig, importConfig, listConfigs, readConfig, setConfigPath, writeConfig } from './config-file.js';
 export { decryptData, deriveFileKey, derivePassphraseKey, encryptData } from './encryption.js';
 export { getMachineId, getUsername } from './machine-id.js';

package/build/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACrF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,UAAU,EACV,gBAAgB,EACjB,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,iBAAiB,EACtB,eAAe,EACf,cAAc,EACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACrF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,WAAW,EAChB,UAAU,EACV,gBAAgB,EACjB,MAAM,mBAAmB,CAAA"}