@winstonsayno/mcp-gateway 1.3.0 → 1.5.0

package/dist/state/redis.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Redis-backed `StateStore` with a small built-in RESP2 client (no extra
+ * dependency). Supports `redis://` and `rediss://` (TLS) URLs with optional
+ * `user:password@` credentials and a `/db` number. Commands are pipelined on
+ * one connection; the connection is re-established lazily after an error.
+ *
+ * @module state/redis
+ */
+import type { StateStore } from './store.js';
+export type RespValue = string | number | null | RespValue[] | RespError;
+export declare class RespError extends Error {
+}
+/** Incremental RESP2 parser. Returns parsed values and leaves partial data buffered. */
+export declare class RespParser {
+    private buf;
+    push(chunk: Buffer): RespValue[];
+    private line;
+    private parse;
+}
+export declare function encodeCommand(args: Array<string | number>): Buffer;
+export interface RedisOptions {
+    url: string;
+    connectTimeoutMs?: number;
+    commandTimeoutMs?: number;
+}
+/** Minimal pipelining Redis client. */
+export declare class RedisClient {
+    private readonly options;
+    private socket?;
+    private connecting?;
+    private queue;
+    private parser;
+    private closed;
+    private readonly url;
+    constructor(options: RedisOptions);
+    private failAll;
+    private open;
+    private raw;
+    command(...args: Array<string | number>): Promise<RespValue>;
+    /** Run commands inside MULTI / EXEC; resolves with the EXEC reply array. */
+    transaction(commands: Array<Array<string | number>>): Promise<RespValue[]>;
+    close(): Promise<void>;
+}
+export declare class RedisStateStore implements StateStore {
+    readonly kind = "redis";
+    readonly client: RedisClient;
+    constructor(options: RedisOptions);
+    incr(key: string, ttlMs: number, by?: number): Promise<number>;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    pttl(key: string): Promise<number>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=redis.d.ts.map

package/dist/state/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/state/redis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC;AAEzE,qBAAa,SAAU,SAAQ,KAAK;CAAG;AAOvC,wFAAwF;AACxF,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAA2B;IAEtC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE;IAYhC,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,KAAK;CAmCd;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAOlE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uCAAuC;AACvC,qBAAa,WAAW;IAQV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,UAAU,CAAC,CAAkB;IACrC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;gBAEG,OAAO,EAAE,YAAY;IAOlD,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,IAAI;IAyDZ,OAAO,CAAC,GAAG;IAqBL,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAMlE,4EAA4E;IACtE,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAW1E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B;AAED,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;gBAEjB,OAAO,EAAE,YAAY;IAI3B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IASzD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvB"}

package/dist/state/redis.js

@@ -0,0 +1,263 @@
+/**
+ * Redis-backed `StateStore` with a small built-in RESP2 client (no extra
+ * dependency). Supports `redis://` and `rediss://` (TLS) URLs with optional
+ * `user:password@` credentials and a `/db` number. Commands are pipelined on
+ * one connection; the connection is re-established lazily after an error.
+ *
+ * @module state/redis
+ */
+import { connect as netConnect } from 'net';
+import { connect as tlsConnect } from 'tls';
+import { logger } from '../utils/logger.js';
+export class RespError extends Error {
+}
+/** Incremental RESP2 parser. Returns parsed values and leaves partial data buffered. */
+export class RespParser {
+    buf = Buffer.alloc(0);
+    push(chunk) {
+        this.buf = this.buf.length ? Buffer.concat([this.buf, chunk]) : chunk;
+        const out = [];
+        for (;;) {
+            const r = this.parse(0);
+            if (!r)
+                break;
+            out.push(r.value);
+            this.buf = this.buf.subarray(r.end);
+        }
+        return out;
+    }
+    line(from) {
+        const i = this.buf.indexOf('\r\n', from);
+        if (i < 0)
+            return undefined;
+        return { text: this.buf.toString('utf8', from, i), end: i + 2 };
+    }
+    parse(at) {
+        if (at >= this.buf.length)
+            return undefined;
+        const type = String.fromCharCode(this.buf[at]);
+        const l = this.line(at + 1);
+        if (!l)
+            return undefined;
+        switch (type) {
+            case '+':
+                return { value: l.text, end: l.end };
+            case '-':
+                return { value: new RespError(l.text), end: l.end };
+            case ':':
+                return { value: Number(l.text), end: l.end };
+            case '$': {
+                const len = Number(l.text);
+                if (len < 0)
+                    return { value: null, end: l.end };
+                if (this.buf.length < l.end + len + 2)
+                    return undefined;
+                return { value: this.buf.toString('utf8', l.end, l.end + len), end: l.end + len + 2 };
+            }
+            case '*': {
+                const n = Number(l.text);
+                if (n < 0)
+                    return { value: null, end: l.end };
+                const items = [];
+                let end = l.end;
+                for (let i = 0; i < n; i++) {
+                    const r = this.parse(end);
+                    if (!r)
+                        return undefined;
+                    items.push(r.value);
+                    end = r.end;
+                }
+                return { value: items, end };
+            }
+            default:
+                throw new Error(`RESP protocol error: unexpected type byte "${type}"`);
+        }
+    }
+}
+export function encodeCommand(args) {
+    const parts = [`*${args.length}\r\n`];
+    for (const a of args) {
+        const s = String(a);
+        parts.push(`$${Buffer.byteLength(s)}\r\n${s}\r\n`);
+    }
+    return Buffer.from(parts.join(''));
+}
+/** Minimal pipelining Redis client. */
+export class RedisClient {
+    options;
+    socket;
+    connecting;
+    queue = [];
+    parser = new RespParser();
+    closed = false;
+    url;
+    constructor(options) {
+        this.options = options;
+        this.url = new URL(options.url);
+        if (this.url.protocol !== 'redis:' && this.url.protocol !== 'rediss:') {
+            throw new Error(`state.redis.url must start with redis:// or rediss:// (got ${this.url.protocol})`);
+        }
+    }
+    failAll(err) {
+        const q = this.queue;
+        this.queue = [];
+        for (const p of q)
+            p.reject(err);
+    }
+    open() {
+        if (this.socket && !this.socket.destroyed)
+            return Promise.resolve(this.socket);
+        if (this.connecting)
+            return this.connecting;
+        this.connecting = new Promise((resolve, reject) => {
+            const port = Number(this.url.port || 6379);
+            const host = this.url.hostname.replace(/^\[|\]$/g, '');
+            const socket = this.url.protocol === 'rediss:' ? tlsConnect({ host, port, servername: host }) : netConnect({ host, port });
+            const timer = setTimeout(() => socket.destroy(new Error('Redis connect timeout')), this.options.connectTimeoutMs ?? 5_000);
+            timer.unref();
+            this.parser = new RespParser();
+            socket.on('data', (chunk) => {
+                let values;
+                try {
+                    values = this.parser.push(chunk);
+                }
+                catch (err) {
+                    socket.destroy(err);
+                    return;
+                }
+                for (const v of values) {
+                    const p = this.queue.shift();
+                    if (!p)
+                        continue;
+                    if (v instanceof RespError)
+                        p.reject(v);
+                    else
+                        p.resolve(v);
+                }
+            });
+            socket.on('error', (err) => {
+                logger.debug(`Redis connection error: ${err.message}`);
+            });
+            socket.on('close', () => {
+                if (this.socket === socket)
+                    this.socket = undefined;
+                this.failAll(new Error('Redis connection closed'));
+            });
+            socket.once(this.url.protocol === 'rediss:' ? 'secureConnect' : 'connect', () => {
+                clearTimeout(timer);
+                this.socket = socket;
+                resolve(socket);
+            });
+            socket.once('close', () => {
+                clearTimeout(timer);
+                reject(new Error(`Could not connect to Redis at ${host}:${port}`));
+            });
+        })
+            .then(async (socket) => {
+            const user = decodeURIComponent(this.url.username);
+            const pass = decodeURIComponent(this.url.password);
+            if (pass)
+                await this.raw(socket, user ? ['AUTH', user, pass] : ['AUTH', pass]);
+            const db = this.url.pathname.replace(/^\//, '');
+            if (db && db !== '0')
+                await this.raw(socket, ['SELECT', db]);
+            return socket;
+        })
+            .finally(() => {
+            this.connecting = undefined;
+        });
+        return this.connecting;
+    }
+    raw(socket, args) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                reject(new Error(`Redis command timed out: ${String(args[0])}`));
+                socket.destroy();
+            }, this.options.commandTimeoutMs ?? 5_000);
+            timer.unref();
+            this.queue.push({
+                resolve: (v) => {
+                    clearTimeout(timer);
+                    resolve(v);
+                },
+                reject: (e) => {
+                    clearTimeout(timer);
+                    reject(e);
+                },
+            });
+            socket.write(encodeCommand(args));
+        });
+    }
+    async command(...args) {
+        if (this.closed)
+            throw new Error('Redis client is closed');
+        const socket = await this.open();
+        return this.raw(socket, args);
+    }
+    /** Run commands inside MULTI / EXEC; resolves with the EXEC reply array. */
+    async transaction(commands) {
+        if (this.closed)
+            throw new Error('Redis client is closed');
+        const socket = await this.open();
+        const replies = [this.raw(socket, ['MULTI']), ...commands.map((c) => this.raw(socket, c)), this.raw(socket, ['EXEC'])];
+        const all = await Promise.all(replies);
+        const exec = all[all.length - 1];
+        if (!Array.isArray(exec))
+            throw new Error('Redis transaction aborted');
+        for (const v of exec)
+            if (v instanceof RespError)
+                throw v;
+        return exec;
+    }
+    async close() {
+        this.closed = true;
+        const s = this.socket;
+        this.socket = undefined;
+        if (s && !s.destroyed) {
+            await new Promise((resolve) => {
+                s.once('close', () => resolve());
+                s.end(encodeCommand(['QUIT']));
+                setTimeout(() => s.destroy(), 500).unref();
+            });
+        }
+        this.failAll(new Error('Redis client is closed'));
+    }
+}
+export class RedisStateStore {
+    kind = 'redis';
+    client;
+    constructor(options) {
+        this.client = new RedisClient(options);
+    }
+    async incr(key, ttlMs, by = 1) {
+        const ttl = Math.max(1, Math.ceil(ttlMs));
+        const replies = await this.client.transaction([
+            ['SET', key, '0', 'PX', ttl, 'NX'],
+            ['INCRBY', key, by],
+        ]);
+        return Number(replies[1]);
+    }
+    async get(key) {
+        const v = await this.client.command('GET', key);
+        return v === null ? undefined : String(v);
+    }
+    async set(key, value, ttlMs) {
+        if (ttlMs && ttlMs > 0)
+            await this.client.command('SET', key, value, 'PX', Math.ceil(ttlMs));
+        else
+            await this.client.command('SET', key, value);
+    }
+    async del(key) {
+        await this.client.command('DEL', key);
+    }
+    async pttl(key) {
+        return Number(await this.client.command('PTTL', key));
+    }
+    async ping() {
+        await this.client.command('PING');
+    }
+    close() {
+        return this.client.close();
+    }
+}
+//# sourceMappingURL=redis.js.map

package/dist/state/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/state/redis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,KAAK,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,KAAK,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,OAAO,SAAU,SAAQ,KAAK;CAAG;AAOvC,wFAAwF;AACxF,MAAM,OAAO,UAAU;IACb,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtE,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC;gBAAE,MAAM;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACvC,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YACtD,KAAK,GAAG;gBACN,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/C,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,GAAG,GAAG,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;YACxF,CAAC;YACD,KAAK,GAAG,CAAC,CAAC,CAAC;gBACT,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAgB,EAAE,CAAC;gBAC9B,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;gBAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,CAAC;wBAAE,OAAO,SAAS,CAAC;oBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;gBACd,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC/B,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,GAAG,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAA4B;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAQD,uCAAuC;AACvC,MAAM,OAAO,WAAW;IAQO;IAPrB,MAAM,CAAU;IAChB,UAAU,CAAmB;IAC7B,KAAK,GAAc,EAAE,CAAC;IACtB,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAC1B,MAAM,GAAG,KAAK,CAAC;IACN,GAAG,CAAM;IAE1B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,8DAA8D,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,GAAU;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,GACV,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;YAC3H,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,MAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,CAAC,GAAY,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC7B,IAAI,CAAC,CAAC;wBAAE,SAAS;oBACjB,IAAI,CAAC,YAAY,SAAS;wBAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;wBACnC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACpD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC9E,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;aACC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,IAA4B;QACtD,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;YAC3C,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;oBACb,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,CAAC,CAAC,CAAC;gBACb,CAAC;gBACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;oBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,CAAC,CAAC,CAAC;gBACZ,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAG,IAA4B;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,WAAW,CAAC,QAAuC;QACvD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,YAAY,SAAS;gBAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,OAAO,CAAC;IACf,MAAM,CAAc;IAE7B,YAAY,OAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,GAAG,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC;YAClC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,KAAc;QAClD,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;YACxF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/state/shared.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Rate limiting and brute-force lockout on top of a shared `StateStore`
+ * (used when `state.store` is not `memory`).
+ *
+ * Both fail open by default when the store is unreachable (a Redis outage
+ * must not take every tool call down); set `state.failureMode: closed` to
+ * reject requests instead.
+ *
+ * @module state/shared
+ */
+import type { AuthLockoutConfig, RateLimitConfig } from '../utils/types.js';
+import { type RateLimiter } from '../auth/ratelimit.js';
+import { type LockoutTracker } from '../security/lockout.js';
+import type { StateStore } from './store.js';
+export type FailureMode = 'open' | 'closed';
+/**
+ * Sliding-window rate limiter whose counters live in the store, so the limit
+ * holds across every gateway instance sharing it.
+ */
+export declare function createStoreRateLimiter(config: RateLimitConfig, store: StateStore, options?: {
+    failureMode?: FailureMode;
+    now?: () => number;
+    namespace?: string;
+}): RateLimiter;
+/** Brute-force lockout with failure counters and locks kept in the store. */
+export declare class StoreAuthLockout implements LockoutTracker {
+    private readonly store;
+    private readonly failureMode;
+    readonly config: Required<AuthLockoutConfig>;
+    private total;
+    private readonly recent;
+    constructor(config: AuthLockoutConfig, store: StateStore, failureMode?: FailureMode);
+    lockedFor(ip: string): Promise<number>;
+    fail(ip: string): Promise<boolean>;
+    success(ip: string): Promise<void>;
+    /** Lockouts triggered by this instance (the store holds the cluster-wide state). */
+    status(): {
+        lockedClients: number;
+        trackedClients: number;
+        lockoutsTotal: number;
+        shared: boolean;
+    };
+    close(): void;
+}
+//# sourceMappingURL=shared.d.ts.map

package/dist/state/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/state/shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;AAW5C;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,WAAW,CAiDb;AAED,6EAA6E;AAC7E,qBAAa,gBAAiB,YAAW,cAAc;IAOnD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAP9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAGlD,MAAM,EAAE,iBAAiB,EACR,KAAK,EAAE,UAAU,EACjB,WAAW,GAAE,WAAoB;IAK9C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUtC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,oFAAoF;IACpF,MAAM;;;;;;IAMN,KAAK,IAAI,IAAI;CAGd"}

package/dist/state/shared.js

@@ -0,0 +1,130 @@
+/**
+ * Rate limiting and brute-force lockout on top of a shared `StateStore`
+ * (used when `state.store` is not `memory`).
+ *
+ * Both fail open by default when the store is unreachable (a Redis outage
+ * must not take every tool call down); set `state.failureMode: closed` to
+ * reject requests instead.
+ *
+ * @module state/shared
+ */
+import { setRateLimitHeaders } from '../auth/ratelimit.js';
+import { DEFAULT_LOCKOUT } from '../security/lockout.js';
+import { logger } from '../utils/logger.js';
+let lastStoreWarning = 0;
+function storeFailed(what, err) {
+    const t = Date.now();
+    if (t - lastStoreWarning > 10_000) {
+        lastStoreWarning = t;
+        logger.warn(`State store unavailable (${what}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Sliding-window rate limiter whose counters live in the store, so the limit
+ * holds across every gateway instance sharing it.
+ */
+export function createStoreRateLimiter(config, store, options = {}) {
+    const { limit, windowSeconds, perKey = true } = config;
+    const windowMs = windowSeconds * 1000;
+    const now = options.now ?? Date.now;
+    const ns = options.namespace ?? 'rl';
+    const take = async (req) => {
+        const clientId = perKey ? (req.clientId ?? req.ip ?? 'anonymous') : 'global';
+        const t = now();
+        const index = Math.floor(t / windowMs);
+        const windowStart = index * windowMs;
+        const resetAt = windowStart + windowMs;
+        const key = (i) => `${ns}:${windowSeconds}:${clientId}:${i}`;
+        try {
+            const [current, previousRaw] = await Promise.all([store.incr(key(index), 2 * windowMs), store.get(key(index - 1))]);
+            const previous = Number(previousRaw ?? 0) || 0;
+            const overlap = 1 - (t - windowStart) / windowMs;
+            const estimated = current - 1 + previous * overlap;
+            if (estimated >= limit) {
+                // Denied requests do not count towards the limit.
+                await store.incr(key(index), 2 * windowMs, -1).catch(() => undefined);
+                logger.warn(`Rate limit exceeded for ${clientId}`);
+                return { allowed: false, limit, remaining: 0, resetAt, retryAfter: Math.max(1, Math.ceil((resetAt - t) / 1000)) };
+            }
+            return { allowed: true, limit, remaining: Math.max(0, Math.floor(limit - estimated - 1)), resetAt };
+        }
+        catch (err) {
+            storeFailed('rate limit', err);
+            if (options.failureMode === 'closed')
+                return { allowed: false, limit, remaining: 0, resetAt, retryAfter: 1 };
+            return { allowed: true, limit, remaining: limit, resetAt };
+        }
+    };
+    const limiter = ((req, res, next) => {
+        take(req).then((d) => {
+            setRateLimitHeaders(res, d.limit, d.remaining, d.resetAt);
+            if (!d.allowed) {
+                res.status(429).set('Retry-After', String(d.retryAfter)).json({
+                    error: 'Too Many Requests',
+                    message: `Rate limit of ${limit} requests per ${windowSeconds}s exceeded`,
+                    retryAfter: d.retryAfter,
+                });
+                return;
+            }
+            next();
+        }, next);
+    });
+    limiter.take = take;
+    limiter.close = () => { };
+    return limiter;
+}
+/** Brute-force lockout with failure counters and locks kept in the store. */
+export class StoreAuthLockout {
+    store;
+    failureMode;
+    config;
+    total = 0;
+    recent = new Map();
+    constructor(config, store, failureMode = 'open') {
+        this.store = store;
+        this.failureMode = failureMode;
+        this.config = { ...DEFAULT_LOCKOUT, ...Object.fromEntries(Object.entries(config).filter(([, v]) => v !== undefined)) };
+    }
+    async lockedFor(ip) {
+        try {
+            const ttl = await this.store.pttl(`lo:l:${ip}`);
+            return ttl > 0 ? Math.ceil(ttl / 1000) : ttl === -1 ? this.config.lockoutSeconds : 0;
+        }
+        catch (err) {
+            storeFailed('auth lockout', err);
+            return this.failureMode === 'closed' ? 1 : 0;
+        }
+    }
+    async fail(ip) {
+        try {
+            const n = await this.store.incr(`lo:f:${ip}`, this.config.windowSeconds * 1000);
+            if (n >= this.config.maxFailures) {
+                await this.store.set(`lo:l:${ip}`, '1', this.config.lockoutSeconds * 1000);
+                await this.store.del(`lo:f:${ip}`);
+                this.total++;
+                this.recent.set(ip, Date.now() + this.config.lockoutSeconds * 1000);
+                logger.warn(`Locked out ${ip} for ${this.config.lockoutSeconds}s after ${n} failed authentication attempts`);
+                return true;
+            }
+        }
+        catch (err) {
+            storeFailed('auth lockout', err);
+        }
+        return false;
+    }
+    async success(ip) {
+        await this.store.del(`lo:f:${ip}`).catch((err) => storeFailed('auth lockout', err));
+    }
+    /** Lockouts triggered by this instance (the store holds the cluster-wide state). */
+    status() {
+        const t = Date.now();
+        for (const [ip, until] of this.recent)
+            if (until <= t)
+                this.recent.delete(ip);
+        return { lockedClients: this.recent.size, trackedClients: this.recent.size, lockoutsTotal: this.total, shared: true };
+    }
+    close() {
+        this.recent.clear();
+    }
+}
+//# sourceMappingURL=shared.js.map

package/dist/state/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/state/shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,mBAAmB,EAA4C,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAuB,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,IAAI,gBAAgB,GAAG,CAAC,CAAC;AACzB,SAAS,WAAW,CAAC,IAAY,EAAE,GAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;QAClC,gBAAgB,GAAG,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAiB,EACjB,UAAiF,EAAE;IAEnF,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAA8B,EAAE;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAE,GAAuC,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClH,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;QACrC,MAAM,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,aAAa,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpH,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,QAAQ,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,GAAG,QAAQ,GAAG,OAAO,CAAC;YACnD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACvB,kDAAkD;gBAClD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACtE,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;YACpH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC7G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACnE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC5D,KAAK,EAAE,mBAAmB;oBAC1B,OAAO,EAAE,iBAAiB,KAAK,iBAAiB,aAAa,YAAY;oBACzE,UAAU,EAAE,CAAC,CAAC,UAAU;iBACzB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC,CAAgB,CAAC;IAClB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,KAAK,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACzB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,gBAAgB;IAOR;IACA;IAPV,MAAM,CAA8B;IACrC,KAAK,GAAG,CAAC,CAAC;IACD,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YACE,MAAyB,EACR,KAAiB,EACjB,cAA2B,MAAM;QADjC,UAAK,GAAL,KAAK,CAAY;QACjB,gBAAW,GAAX,WAAW,CAAsB;QAElD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;IACzH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;gBAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,WAAW,CAAC,iCAAiC,CAAC,CAAC;gBAC7G,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,oFAAoF;IACpF,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/state/store.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Pluggable shared state for multi-instance deployments.
+ *
+ * Rate-limit windows, brute-force lockouts and MCP session metadata go
+ * through a `StateStore`. The default `MemoryStateStore` keeps everything in
+ * the process (single instance, the pre-1.4 behaviour); `RedisStateStore`
+ * (see `./redis.ts`) shares it between gateway replicas behind a load
+ * balancer, so limits hold cluster-wide and an MCP session opened on one
+ * replica is accepted by the others.
+ *
+ * @module state/store
+ */
+export interface StateStore {
+    /** `memory`, `redis`, or a custom name. */
+    readonly kind: string;
+    /**
+     * Atomically add `by` (default 1) to the integer at `key` and return the new
+     * value. A missing key starts at 0 and expires after `ttlMs`; an existing
+     * key keeps its expiry.
+     */
+    incr(key: string, ttlMs: number, by?: number): Promise<number>;
+    get(key: string): Promise<string | undefined>;
+    /** Set `key` (optionally expiring after `ttlMs`). */
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    /** Remaining time to live in ms; -1 = no expiry, -2 = missing. */
+    pttl(key: string): Promise<number>;
+    /** Health check (resolves when reachable). */
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+/** In-process store (default). */
+export declare class MemoryStateStore implements StateStore {
+    private readonly now;
+    readonly kind = "memory";
+    private readonly data;
+    private readonly timer;
+    constructor(now?: () => number);
+    private live;
+    incr(key: string, ttlMs: number, by?: number): Promise<number>;
+    /** Synchronous variant (used by the in-memory fast paths). */
+    incrSync(key: string, ttlMs: number, by?: number): number;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    pttl(key: string): Promise<number>;
+    ping(): Promise<void>;
+    /** Number of live keys (tests / diagnostics). */
+    size(): number;
+    private sweep;
+    close(): Promise<void>;
+}
+/** Prefixes every key (namespacing several gateways in one Redis). */
+export declare class PrefixedStateStore implements StateStore {
+    private readonly inner;
+    private readonly prefix;
+    constructor(inner: StateStore, prefix: string);
+    get kind(): string;
+    incr(key: string, ttlMs: number, by?: number): Promise<number>;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    del(key: string): Promise<void>;
+    pttl(key: string): Promise<number>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/state/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/state/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C,qDAAqD;IACrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,kEAAkE;IAClE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,8CAA8C;IAC9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAOD,kCAAkC;AAClC,qBAAa,gBAAiB,YAAW,UAAU;IAKrC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJhC,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;gBAEV,GAAG,GAAE,MAAM,MAAiB;IAKzD,OAAO,CAAC,IAAI;IAUN,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAI/D,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAI,GAAG,MAAM;IAW9C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMlC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,iDAAiD;IACjD,IAAI,IAAI,MAAM;IAKd,OAAO,CAAC,KAAK;IAKP,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AAED,sEAAsE;AACtE,qBAAa,kBAAmB,YAAW,UAAU;IAEjD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,MAAM;IAEjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IACD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM;IAG5C,GAAG,CAAC,GAAG,EAAE,MAAM;IAGf,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;IAG9C,GAAG,CAAC,GAAG,EAAE,MAAM;IAGf,IAAI,CAAC,GAAG,EAAE,MAAM;IAGhB,IAAI;IAGJ,KAAK;CAGN"}