@winstonsayno/mcp-gateway 1.2.0 → 1.4.0

package/dist/security/lockout.js

@@ -93,25 +93,30 @@ export function withLockout(auth, lockout) {
         if (!lo)
             return auth(req, res, next);
         const ip = req.ip ?? req.socket.remoteAddress ?? 'unknown';
-        const wait = lo.lockedFor(ip);
-        if (wait > 0) {
-            res.status(429).set('Retry-After', String(wait)).json({
-                error: 'Too Many Requests',
-                message: 'Too many failed authentication attempts; try again later',
-                retryAfter: wait,
+        const locked = lo.lockedFor(ip);
+        if (typeof locked === 'number')
+            return proceed(locked);
+        locked.then(proceed, next);
+        function proceed(wait) {
+            if (wait > 0) {
+                res.status(429).set('Retry-After', String(wait)).json({
+                    error: 'Too Many Requests',
+                    message: 'Too many failed authentication attempts; try again later',
+                    retryAfter: wait,
+                });
+                return;
+            }
+            let passed = false;
+            res.once('finish', () => {
+                if (!passed && res.statusCode === 401)
+                    void lo.fail(ip);
+            });
+            auth(req, res, (err) => {
+                passed = true;
+                void lo.success(ip);
+                next(err);
             });
-            return;
         }
-        let passed = false;
-        res.once('finish', () => {
-            if (!passed && res.statusCode === 401)
-                lo.fail(ip);
-        });
-        auth(req, res, (err) => {
-            passed = true;
-            lo.success(ip);
-            next(err);
-        });
     };
 }
 //# sourceMappingURL=lockout.js.map

package/dist/security/lockout.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockout.js","sourceRoot":"","sources":["../../src/security/lockout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,eAAe,GAAgC;IAC1D,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;CACpB,CAAC;AAaF,MAAM,OAAO,WAAW;IAMuC;IALpD,MAAM,CAA8B;IAC5B,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,KAAK,CAAiB;IAC/B,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,SAA4B,EAAE,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;QACvF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QACvH,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,EAAU;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,EAAE,WAAW;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,EAAU;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC;YAChE,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,CAAC,CAAC,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,cAAc,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,WAAW,CAAC,CAAC,QAAQ,iCAAiC,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;gBAAE,MAAM,EAAE,CAAC;QACxF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACjG,CAAC;IAEO,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC3G,IAAI,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,OAAsC;IACtF,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpD,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,0DAA0D;gBACnE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YAC/B,MAAM,GAAG,IAAI,CAAC;YACd,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,GAAY,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"lockout.js","sourceRoot":"","sources":["../../src/security/lockout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,eAAe,GAAgC;IAC1D,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,GAAG;CACpB,CAAC;AAuBF,MAAM,OAAO,WAAW;IAMuC;IALpD,MAAM,CAA8B;IAC5B,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnC,KAAK,CAAiB;IAC/B,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,SAA4B,EAAE,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;QACvF,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;QACvH,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,EAAU;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,EAAE,WAAW;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,EAAU;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC;YAChE,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,CAAC,CAAC,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1C,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,cAAc,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,WAAW,CAAC,CAAC,QAAQ,iCAAiC,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC;gBAAE,MAAM,EAAE,CAAC;QACxF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACjG,CAAC;IAEO,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC3G,IAAI,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,OAAyC;IACzF,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE3B,SAAS,OAAO,CAAC,IAAY;YAC7B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,0DAA0D;oBACnE,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;oBAAE,KAAK,EAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;gBAC/B,MAAM,GAAG,IAAI,CAAC;gBACd,KAAK,EAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,CAAC,GAAY,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/posture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/security/posture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpD;AAID,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,SAAa,GAAG,eAAe,EAAE,CAiE3F"}
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/security/posture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpD;AAID,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,SAAa,GAAG,eAAe,EAAE,CAwE3F"}

package/dist/security/posture.js

@@ -58,6 +58,9 @@ export function securityWarnings(config, now = Date.now()) {
         if (!jwt.requireExp)
             add('jwt-no-exp', 'JWTs without an "exp" claim are accepted forever: set auth.jwt.requireExp: true.', 'info');
     }
+    if (strategy === 'oauth2' && !config.auth?.oauth?.resource) {
+        add('oauth-no-resource', 'auth.oauth.resource is not set: the resource URI is derived from the Host header. Set it to the public /mcp URL.', 'info');
+    }
     if (strategy !== 'none' && !sec.authLockout) {
         add('no-auth-lockout', 'No brute-force protection: set security.authLockout: true to lock out IPs after repeated failures.', 'info');
     }

package/dist/security/posture.js.map

@@ -1 +1 @@
-{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/security/posture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAAG,UAAU,CAAC;AAEvB,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,OAAe,EAAE,QAAyB,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAElC,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,GAAG,CACD,2BAA2B,EAC3B,iDAAiD,MAAM,CAAC,IAAI,wDAAwD;YAClH,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACxF,GAAG,CACD,eAAe,EACf,sHAAsH;YACpH,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC9G,GAAG,CACD,gBAAgB,EAChB,uGAAuG;YACrG,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,GAAG,CACD,oBAAoB,EACpB,GAAG,KAAK,oGAAoG,EAC5G,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,qCAAqC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QAClF,IAAI,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,KAAK,sEAAsE,EAAE,MAAM,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,wBAAwB,EAAE,mFAAmF,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,GAAG,CAAC,YAAY,EAAE,kFAAkF,EAAE,MAAM,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5C,GAAG,CAAC,iBAAiB,EAAE,oGAAoG,EAAE,MAAM,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,GAAG,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;IAC/G,IAAI,GAAG,CAAC,kBAAkB;QAAE,GAAG,CAAC,eAAe,EAAE,4FAA4F,CAAC,CAAC;IAC/I,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,EAAE,mHAAmH,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/security/posture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAAG,UAAU,CAAC;AAEvB,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,OAAe,EAAE,QAAyB,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAElC,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,GAAG,CACD,2BAA2B,EAC3B,iDAAiD,MAAM,CAAC,IAAI,wDAAwD;YAClH,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACxF,GAAG,CACD,eAAe,EACf,sHAAsH;YACpH,uFAAuF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC9G,GAAG,CACD,gBAAgB,EAChB,uGAAuG;YACrG,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,GAAG,CACD,oBAAoB,EACpB,GAAG,KAAK,oGAAoG,EAC5G,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,qCAAqC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QAClF,IAAI,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,KAAK,sEAAsE,EAAE,MAAM,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,wBAAwB,EAAE,mFAAmF,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,GAAG,CAAC,YAAY,EAAE,kFAAkF,EAAE,MAAM,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC3D,GAAG,CACD,mBAAmB,EACnB,kHAAkH,EAClH,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5C,GAAG,CAAC,iBAAiB,EAAE,oGAAoG,EAAE,MAAM,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,GAAG,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;IAC/G,IAAI,GAAG,CAAC,kBAAkB;QAAE,GAAG,CAAC,eAAe,EAAE,4FAA4F,CAAC,CAAC;IAC/I,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,EAAE,mHAAmH,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/state/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * State store factory (`state` config block).
+ *
+ * @module state
+ */
+import type { StateConfig } from '../utils/types.js';
+import { type StateStore } from './store.js';
+export { MemoryStateStore, PrefixedStateStore } from './store.js';
+export type { StateStore } from './store.js';
+export { RedisStateStore, RedisClient, RespParser, encodeCommand } from './redis.js';
+export { createStoreRateLimiter, StoreAuthLockout } from './shared.js';
+/** Build the configured store; `memory` when `state` is absent. */
+export declare function createStateStore(config: StateConfig | undefined): StateStore;
+//# sourceMappingURL=index.d.ts.map

package/dist/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/state/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAwC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAGnF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,CAY5E"}

package/dist/state/index.js

@@ -0,0 +1,27 @@
+/**
+ * State store factory (`state` config block).
+ *
+ * @module state
+ */
+import { MemoryStateStore, PrefixedStateStore } from './store.js';
+import { RedisStateStore } from './redis.js';
+export { MemoryStateStore, PrefixedStateStore } from './store.js';
+export { RedisStateStore, RedisClient, RespParser, encodeCommand } from './redis.js';
+export { createStoreRateLimiter, StoreAuthLockout } from './shared.js';
+/** Build the configured store; `memory` when `state` is absent. */
+export function createStateStore(config) {
+    if (!config || (config.store ?? 'memory') === 'memory')
+        return new MemoryStateStore();
+    if (config.store === 'redis') {
+        if (!config.redis?.url)
+            throw new Error('state.store is "redis" but state.redis.url is not set');
+        const redis = new RedisStateStore({
+            url: config.redis.url,
+            connectTimeoutMs: config.redis.connectTimeoutMs,
+            commandTimeoutMs: config.redis.commandTimeoutMs,
+        });
+        return new PrefixedStateStore(redis, config.redis.keyPrefix ?? 'mcp-gateway:');
+    }
+    throw new Error(`Unknown state.store "${String(config.store)}"`);
+}
+//# sourceMappingURL=index.js.map

package/dist/state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/state/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;IACtF,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG;YACrB,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;YAC/C,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB;SAChD,CAAC,CAAC;QACH,OAAO,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC"}

package/dist/state/redis.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Redis-backed `StateStore` with a small built-in RESP2 client (no extra
+ * dependency). Supports `redis://` and `rediss://` (TLS) URLs with optional
+ * `user:password@` credentials and a `/db` number. Commands are pipelined on
+ * one connection; the connection is re-established lazily after an error.
+ *
+ * @module state/redis
+ */
+import type { StateStore } from './store.js';
+export type RespValue = string | number | null | RespValue[] | RespError;
+export declare class RespError extends Error {
+}
+/** Incremental RESP2 parser. Returns parsed values and leaves partial data buffered. */
+export declare class RespParser {
+    private buf;
+    push(chunk: Buffer): RespValue[];
+    private line;
+    private parse;
+}
+export declare function encodeCommand(args: Array<string | number>): Buffer;
+export interface RedisOptions {
+    url: string;
+    connectTimeoutMs?: number;
+    commandTimeoutMs?: number;
+}
+/** Minimal pipelining Redis client. */
+export declare class RedisClient {
+    private readonly options;
+    private socket?;
+    private connecting?;
+    private queue;
+    private parser;
+    private closed;
+    private readonly url;
+    constructor(options: RedisOptions);
+    private failAll;
+    private open;
+    private raw;
+    command(...args: Array<string | number>): Promise<RespValue>;
+    /** Run commands inside MULTI / EXEC; resolves with the EXEC reply array. */
+    transaction(commands: Array<Array<string | number>>): Promise<RespValue[]>;
+    close(): Promise<void>;
+}
+export declare class RedisStateStore implements StateStore {
+    readonly kind = "redis";
+    readonly client: RedisClient;
+    constructor(options: RedisOptions);
+    incr(key: string, ttlMs: number, by?: number): Promise<number>;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    pttl(key: string): Promise<number>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=redis.d.ts.map

package/dist/state/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/state/redis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC;AAEzE,qBAAa,SAAU,SAAQ,KAAK;CAAG;AAOvC,wFAAwF;AACxF,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAA2B;IAEtC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE;IAYhC,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,KAAK;CAmCd;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAOlE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uCAAuC;AACvC,qBAAa,WAAW;IAQV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,UAAU,CAAC,CAAkB;IACrC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;gBAEG,OAAO,EAAE,YAAY;IAOlD,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,IAAI;IAyDZ,OAAO,CAAC,GAAG;IAqBL,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAMlE,4EAA4E;IACtE,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAW1E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B;AAED,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;gBAEjB,OAAO,EAAE,YAAY;IAI3B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IASzD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvB"}

package/dist/state/redis.js

@@ -0,0 +1,263 @@
+/**
+ * Redis-backed `StateStore` with a small built-in RESP2 client (no extra
+ * dependency). Supports `redis://` and `rediss://` (TLS) URLs with optional
+ * `user:password@` credentials and a `/db` number. Commands are pipelined on
+ * one connection; the connection is re-established lazily after an error.
+ *
+ * @module state/redis
+ */
+import { connect as netConnect } from 'net';
+import { connect as tlsConnect } from 'tls';
+import { logger } from '../utils/logger.js';
+export class RespError extends Error {
+}
+/** Incremental RESP2 parser. Returns parsed values and leaves partial data buffered. */
+export class RespParser {
+    buf = Buffer.alloc(0);
+    push(chunk) {
+        this.buf = this.buf.length ? Buffer.concat([this.buf, chunk]) : chunk;
+        const out = [];
+        for (;;) {
+            const r = this.parse(0);
+            if (!r)
+                break;
+            out.push(r.value);
+            this.buf = this.buf.subarray(r.end);
+        }
+        return out;
+    }
+    line(from) {
+        const i = this.buf.indexOf('\r\n', from);
+        if (i < 0)
+            return undefined;
+        return { text: this.buf.toString('utf8', from, i), end: i + 2 };
+    }
+    parse(at) {
+        if (at >= this.buf.length)
+            return undefined;
+        const type = String.fromCharCode(this.buf[at]);
+        const l = this.line(at + 1);
+        if (!l)
+            return undefined;
+        switch (type) {
+            case '+':
+                return { value: l.text, end: l.end };
+            case '-':
+                return { value: new RespError(l.text), end: l.end };
+            case ':':
+                return { value: Number(l.text), end: l.end };
+            case '$': {
+                const len = Number(l.text);
+                if (len < 0)
+                    return { value: null, end: l.end };
+                if (this.buf.length < l.end + len + 2)
+                    return undefined;
+                return { value: this.buf.toString('utf8', l.end, l.end + len), end: l.end + len + 2 };
+            }
+            case '*': {
+                const n = Number(l.text);
+                if (n < 0)
+                    return { value: null, end: l.end };
+                const items = [];
+                let end = l.end;
+                for (let i = 0; i < n; i++) {
+                    const r = this.parse(end);
+                    if (!r)
+                        return undefined;
+                    items.push(r.value);
+                    end = r.end;
+                }
+                return { value: items, end };
+            }
+            default:
+                throw new Error(`RESP protocol error: unexpected type byte "${type}"`);
+        }
+    }
+}
+export function encodeCommand(args) {
+    const parts = [`*${args.length}\r\n`];
+    for (const a of args) {
+        const s = String(a);
+        parts.push(`$${Buffer.byteLength(s)}\r\n${s}\r\n`);
+    }
+    return Buffer.from(parts.join(''));
+}
+/** Minimal pipelining Redis client. */
+export class RedisClient {
+    options;
+    socket;
+    connecting;
+    queue = [];
+    parser = new RespParser();
+    closed = false;
+    url;
+    constructor(options) {
+        this.options = options;
+        this.url = new URL(options.url);
+        if (this.url.protocol !== 'redis:' && this.url.protocol !== 'rediss:') {
+            throw new Error(`state.redis.url must start with redis:// or rediss:// (got ${this.url.protocol})`);
+        }
+    }
+    failAll(err) {
+        const q = this.queue;
+        this.queue = [];
+        for (const p of q)
+            p.reject(err);
+    }
+    open() {
+        if (this.socket && !this.socket.destroyed)
+            return Promise.resolve(this.socket);
+        if (this.connecting)
+            return this.connecting;
+        this.connecting = new Promise((resolve, reject) => {
+            const port = Number(this.url.port || 6379);
+            const host = this.url.hostname.replace(/^\[|\]$/g, '');
+            const socket = this.url.protocol === 'rediss:' ? tlsConnect({ host, port, servername: host }) : netConnect({ host, port });
+            const timer = setTimeout(() => socket.destroy(new Error('Redis connect timeout')), this.options.connectTimeoutMs ?? 5_000);
+            timer.unref();
+            this.parser = new RespParser();
+            socket.on('data', (chunk) => {
+                let values;
+                try {
+                    values = this.parser.push(chunk);
+                }
+                catch (err) {
+                    socket.destroy(err);
+                    return;
+                }
+                for (const v of values) {
+                    const p = this.queue.shift();
+                    if (!p)
+                        continue;
+                    if (v instanceof RespError)
+                        p.reject(v);
+                    else
+                        p.resolve(v);
+                }
+            });
+            socket.on('error', (err) => {
+                logger.debug(`Redis connection error: ${err.message}`);
+            });
+            socket.on('close', () => {
+                if (this.socket === socket)
+                    this.socket = undefined;
+                this.failAll(new Error('Redis connection closed'));
+            });
+            socket.once(this.url.protocol === 'rediss:' ? 'secureConnect' : 'connect', () => {
+                clearTimeout(timer);
+                this.socket = socket;
+                resolve(socket);
+            });
+            socket.once('close', () => {
+                clearTimeout(timer);
+                reject(new Error(`Could not connect to Redis at ${host}:${port}`));
+            });
+        })
+            .then(async (socket) => {
+            const user = decodeURIComponent(this.url.username);
+            const pass = decodeURIComponent(this.url.password);
+            if (pass)
+                await this.raw(socket, user ? ['AUTH', user, pass] : ['AUTH', pass]);
+            const db = this.url.pathname.replace(/^\//, '');
+            if (db && db !== '0')
+                await this.raw(socket, ['SELECT', db]);
+            return socket;
+        })
+            .finally(() => {
+            this.connecting = undefined;
+        });
+        return this.connecting;
+    }
+    raw(socket, args) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                reject(new Error(`Redis command timed out: ${String(args[0])}`));
+                socket.destroy();
+            }, this.options.commandTimeoutMs ?? 5_000);
+            timer.unref();
+            this.queue.push({
+                resolve: (v) => {
+                    clearTimeout(timer);
+                    resolve(v);
+                },
+                reject: (e) => {
+                    clearTimeout(timer);
+                    reject(e);
+                },
+            });
+            socket.write(encodeCommand(args));
+        });
+    }
+    async command(...args) {
+        if (this.closed)
+            throw new Error('Redis client is closed');
+        const socket = await this.open();
+        return this.raw(socket, args);
+    }
+    /** Run commands inside MULTI / EXEC; resolves with the EXEC reply array. */
+    async transaction(commands) {
+        if (this.closed)
+            throw new Error('Redis client is closed');
+        const socket = await this.open();
+        const replies = [this.raw(socket, ['MULTI']), ...commands.map((c) => this.raw(socket, c)), this.raw(socket, ['EXEC'])];
+        const all = await Promise.all(replies);
+        const exec = all[all.length - 1];
+        if (!Array.isArray(exec))
+            throw new Error('Redis transaction aborted');
+        for (const v of exec)
+            if (v instanceof RespError)
+                throw v;
+        return exec;
+    }
+    async close() {
+        this.closed = true;
+        const s = this.socket;
+        this.socket = undefined;
+        if (s && !s.destroyed) {
+            await new Promise((resolve) => {
+                s.once('close', () => resolve());
+                s.end(encodeCommand(['QUIT']));
+                setTimeout(() => s.destroy(), 500).unref();
+            });
+        }
+        this.failAll(new Error('Redis client is closed'));
+    }
+}
+export class RedisStateStore {
+    kind = 'redis';
+    client;
+    constructor(options) {
+        this.client = new RedisClient(options);
+    }
+    async incr(key, ttlMs, by = 1) {
+        const ttl = Math.max(1, Math.ceil(ttlMs));
+        const replies = await this.client.transaction([
+            ['SET', key, '0', 'PX', ttl, 'NX'],
+            ['INCRBY', key, by],
+        ]);
+        return Number(replies[1]);
+    }
+    async get(key) {
+        const v = await this.client.command('GET', key);
+        return v === null ? undefined : String(v);
+    }
+    async set(key, value, ttlMs) {
+        if (ttlMs && ttlMs > 0)
+            await this.client.command('SET', key, value, 'PX', Math.ceil(ttlMs));
+        else
+            await this.client.command('SET', key, value);
+    }
+    async del(key) {
+        await this.client.command('DEL', key);
+    }
+    async pttl(key) {
+        return Number(await this.client.command('PTTL', key));
+    }
+    async ping() {
+        await this.client.command('PING');
+    }
+    close() {
+        return this.client.close();
+    }
+}
+//# sourceMappingURL=redis.js.map

package/dist/state/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/state/redis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,KAAK,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,KAAK,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,OAAO,SAAU,SAAQ,KAAK;CAAG;AAOvC,wFAAwF;AACxF,MAAM,OAAO,UAAU;IACb,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtE,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC;gBAAE,MAAM;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACvC,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtD,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,GAAG,GAAG,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;YACxF,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAgB,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;gBAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,CAAC;wBAAE,OAAO,SAAS,CAAC;oBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;gBACd,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC/B,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAA4B;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAQD,uCAAuC;AACvC,MAAM,OAAO,WAAW;IAQO;IAPrB,MAAM,CAAU;IAChB,UAAU,CAAmB;IAC7B,KAAK,GAAc,EAAE,CAAC;IACtB,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAC1B,MAAM,GAAG,KAAK,CAAC;IACN,GAAG,CAAM;IAE1B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAU;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,GACV,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;YAC3H,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,MAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,CAAC,GAAY,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC7B,IAAI,CAAC,CAAC;wBAAE,SAAS;oBACjB,IAAI,CAAC,YAAY,SAAS;wBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;wBACnC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACpD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,IAA4B;QACtD,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;oBACb,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,CAAC,CAAC,CAAC;gBACb,CAAC;gBACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,CAAC,CAAC,CAAC;gBACZ,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAG,IAA4B;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,WAAW,CAAC,QAAuC;QACvD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,YAAY,SAAS;gBAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,OAAO,CAAC;IACf,MAAM,CAAc;IAE7B,YAAY,OAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,GAAG,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC;YAClC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,KAAc;QAClD,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;YACxF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/state/shared.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Rate limiting and brute-force lockout on top of a shared `StateStore`
+ * (used when `state.store` is not `memory`).
+ *
+ * Both fail open by default when the store is unreachable (a Redis outage
+ * must not take every tool call down); set `state.failureMode: closed` to
+ * reject requests instead.
+ *
+ * @module state/shared
+ */
+import type { AuthLockoutConfig, RateLimitConfig } from '../utils/types.js';
+import { type RateLimiter } from '../auth/ratelimit.js';
+import { type LockoutTracker } from '../security/lockout.js';
+import type { StateStore } from './store.js';
+export type FailureMode = 'open' | 'closed';
+/**
+ * Sliding-window rate limiter whose counters live in the store, so the limit
+ * holds across every gateway instance sharing it.
+ */
+export declare function createStoreRateLimiter(config: RateLimitConfig, store: StateStore, options?: {
+    failureMode?: FailureMode;
+    now?: () => number;
+    namespace?: string;
+}): RateLimiter;
+/** Brute-force lockout with failure counters and locks kept in the store. */
+export declare class StoreAuthLockout implements LockoutTracker {
+    private readonly store;
+    private readonly failureMode;
+    readonly config: Required<AuthLockoutConfig>;
+    private total;
+    private readonly recent;
+    constructor(config: AuthLockoutConfig, store: StateStore, failureMode?: FailureMode);
+    lockedFor(ip: string): Promise<number>;
+    fail(ip: string): Promise<boolean>;
+    success(ip: string): Promise<void>;
+    /** Lockouts triggered by this instance (the store holds the cluster-wide state). */
+    status(): {
+        lockedClients: number;
+        trackedClients: number;
+        lockoutsTotal: number;
+        shared: boolean;
+    };
+    close(): void;
+}
+//# sourceMappingURL=shared.d.ts.map

package/dist/state/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/state/shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;AAW5C;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,WAAW,CAiDb;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,YAAW,cAAc;IAOnD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAP9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAGlD,MAAM,EAAE,iBAAiB,EACR,KAAK,EAAE,UAAU,EACjB,WAAW,GAAE,WAAoB;IAK9C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUtC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,oFAAoF;IACpF,MAAM;;;;;;IAMN,KAAK,IAAI,IAAI;CAGd"}