@frontmcp/plugin-dashboard 1.9.1 → 1.9.3

package/esm/index.mjs

@@ -106,22 +106,22 @@ var require_node = __commonJS({
       mod
     ));
     var __toCommonJS = (mod) => __copyProps2(__defProp3({}, "__esModule", { value: true }), mod);
-    var node_exports2 = {};
-    __export2(node_exports2, {
-      createSignedJwt: () => createSignedJwt2,
-      cryptoProvider: () => nodeCrypto2,
-      generateRsaKeyPair: () => generateRsaKeyPair2,
+    var node_exports = {};
+    __export2(node_exports, {
+      createSignedJwt: () => createSignedJwt,
+      cryptoProvider: () => nodeCrypto,
+      generateRsaKeyPair: () => generateRsaKeyPair3,
       isRsaPssAlg: () => isRsaPssAlg2,
-      jwtAlgToNodeAlg: () => jwtAlgToNodeAlg2,
-      nodeCrypto: () => nodeCrypto2,
-      pemToPublicJwk: () => pemToPublicJwk2,
-      rsaSign: () => rsaSign2,
-      rsaSignBase64Url: () => rsaSignBase64Url2,
-      rsaVerify: () => rsaVerify2,
-      rsaVerifySync: () => rsaVerifySync2
+      jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
+      nodeCrypto: () => nodeCrypto,
+      pemToPublicJwk: () => pemToPublicJwk3,
+      rsaSign: () => rsaSign,
+      rsaSignBase64Url: () => rsaSignBase64Url3,
+      rsaVerify: () => rsaVerify3,
+      rsaVerifySync: () => rsaVerifySync3
     });
-    module.exports = __toCommonJS(node_exports2);
-    var import_node_crypto2 = __toESM2(__require("node:crypto"));
+    module.exports = __toCommonJS(node_exports);
+    var import_node_crypto = __toESM2(__require("node:crypto"));
     var JWT_ALG_TO_NODE_DIGEST2 = {
       RS256: "RSA-SHA256",
       RS384: "RSA-SHA384",
@@ -131,7 +131,7 @@ var require_node = __commonJS({
       PS384: "RSA-SHA384",
       PS512: "RSA-SHA512"
     };
-    function jwtAlgToNodeAlg2(jwtAlg) {
+    function jwtAlgToNodeAlg(jwtAlg) {
       const nodeAlg = JWT_ALG_TO_NODE_DIGEST2[jwtAlg];
       if (!nodeAlg) {
         throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`);
@@ -141,70 +141,70 @@ var require_node = __commonJS({
     function isRsaPssAlg2(jwtAlg) {
       return jwtAlg.startsWith("PS");
     }
-    function toUint8Array2(buf) {
+    function toUint8Array(buf) {
       return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
     }
-    function toBuffer2(data) {
+    function toBuffer(data) {
       if (typeof data === "string") {
         return Buffer.from(data, "utf8");
       }
       return Buffer.from(data);
     }
-    var nodeCrypto2 = {
+    var nodeCrypto = {
       randomUUID() {
-        return import_node_crypto2.default.randomUUID();
+        return import_node_crypto.default.randomUUID();
       },
       randomBytes(length) {
-        return toUint8Array2(import_node_crypto2.default.randomBytes(length));
+        return toUint8Array(import_node_crypto.default.randomBytes(length));
       },
       sha256(data) {
-        const hash = import_node_crypto2.default.createHash("sha256").update(toBuffer2(data)).digest();
-        return toUint8Array2(hash);
+        const hash = import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest();
+        return toUint8Array(hash);
       },
       sha256Hex(data) {
-        return import_node_crypto2.default.createHash("sha256").update(toBuffer2(data)).digest("hex");
+        return import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest("hex");
       },
       hmacSha256(key, data) {
-        const hmac2 = import_node_crypto2.default.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array2(hmac2);
+        const hmac2 = import_node_crypto.default.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
+        return toUint8Array(hmac2);
       },
       hkdfSha256(ikm, salt, info, length) {
         const ikmBuf = Buffer.from(ikm);
         const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = import_node_crypto2.default.createHmac("sha256", saltBuf).update(ikmBuf).digest();
+        const prk = import_node_crypto.default.createHmac("sha256", saltBuf).update(ikmBuf).digest();
         const hashLen = 32;
         const n = Math.ceil(length / hashLen);
         const chunks = [];
         let prev = Buffer.alloc(0);
         for (let i = 1; i <= n; i++) {
-          prev = import_node_crypto2.default.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
+          prev = import_node_crypto.default.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
           chunks.push(prev);
         }
-        return toUint8Array2(Buffer.concat(chunks).subarray(0, length));
+        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
       },
       encryptAesGcm(key, plaintext, iv) {
-        const cipher = import_node_crypto2.default.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+        const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
         const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
         const tag = cipher.getAuthTag();
         return {
-          ciphertext: toUint8Array2(encrypted),
-          tag: toUint8Array2(tag)
+          ciphertext: toUint8Array(encrypted),
+          tag: toUint8Array(tag)
         };
       },
       decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = import_node_crypto2.default.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+        const decipher = import_node_crypto.default.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
         decipher.setAuthTag(Buffer.from(tag));
         const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array2(decrypted);
+        return toUint8Array(decrypted);
       },
       timingSafeEqual(a, b) {
         if (a.length !== b.length) return false;
-        return import_node_crypto2.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+        return import_node_crypto.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
       }
     };
-    function generateRsaKeyPair2(modulusLength = 2048, alg = "RS256") {
-      const kid = `rsa-key-${Date.now()}-${import_node_crypto2.default.randomBytes(8).toString("hex")}`;
-      const { privateKey, publicKey } = import_node_crypto2.default.generateKeyPairSync("rsa", {
+    function generateRsaKeyPair3(modulusLength = 2048, alg = "RS256") {
+      const kid = `rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;
+      const { privateKey, publicKey } = import_node_crypto.default.generateKeyPairSync("rsa", {
         modulusLength
       });
       const exported = publicKey.export({ format: "jwk" });
@@ -217,66 +217,66 @@ var require_node = __commonJS({
       };
       return { privateKey, publicKey, publicJwk };
     }
-    function rsaSign2(algorithm, data, privateKey, options) {
+    function rsaSign(algorithm, data, privateKey, options) {
       const signingKey = options ? { key: privateKey, ...options } : privateKey;
-      return import_node_crypto2.default.sign(algorithm, data, signingKey);
+      return import_node_crypto.default.sign(algorithm, data, signingKey);
     }
-    function rsaVerify2(jwtAlg, data, publicJwk, signature) {
-      const publicKey = import_node_crypto2.default.createPublicKey({ key: publicJwk, format: "jwk" });
-      const nodeAlgorithm = jwtAlgToNodeAlg2(jwtAlg);
+    function rsaVerify3(jwtAlg, data, publicJwk, signature) {
+      const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
+      const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
       const verifyKey = isRsaPssAlg2(jwtAlg) ? {
         key: publicKey,
-        padding: import_node_crypto2.default.constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: import_node_crypto2.default.constants.RSA_PSS_SALTLEN_DIGEST
+        padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
       } : publicKey;
-      return import_node_crypto2.default.verify(nodeAlgorithm, data, verifyKey, signature);
+      return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
     }
-    function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
-      const privateKey = import_node_crypto2.default.createPrivateKey({ key: privateJwk, format: "jwk" });
-      const nodeAlgorithm = jwtAlgToNodeAlg2(jwtAlg);
+    function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
+      const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
+      const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
       const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-      const sig = isRsaPssAlg2(jwtAlg) ? rsaSign2(nodeAlgorithm, buf, privateKey, {
-        padding: import_node_crypto2.default.constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: import_node_crypto2.default.constants.RSA_PSS_SALTLEN_DIGEST
-      }) : rsaSign2(nodeAlgorithm, buf, privateKey);
+      const sig = isRsaPssAlg2(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
+        padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
+      }) : rsaSign(nodeAlgorithm, buf, privateKey);
       return sig.toString("base64url");
     }
-    function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+    function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
       try {
-        const publicKey = import_node_crypto2.default.createPublicKey({ key: publicJwk, format: "jwk" });
+        const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
         const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
         const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
         if (jwtAlg === "EdDSA") {
-          return import_node_crypto2.default.verify(null, dataBuf, publicKey, sigBuf);
+          return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
         }
-        const nodeAlgorithm = jwtAlgToNodeAlg2(jwtAlg);
+        const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
         const verifyKey = isRsaPssAlg2(jwtAlg) ? {
           key: publicKey,
-          padding: import_node_crypto2.default.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: import_node_crypto2.default.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
         } : publicKey;
-        return import_node_crypto2.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
+        return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
       } catch {
         return false;
       }
     }
-    function pemToPublicJwk2(pem) {
-      const key = import_node_crypto2.default.createPublicKey({ key: pem, format: "pem" });
+    function pemToPublicJwk3(pem) {
+      const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
       return key.export({ format: "jwk" });
     }
-    function createSignedJwt2(payload, privateKey, kid, alg = "RS256") {
+    function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
       const header = { alg, typ: "JWT", kid };
       const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
       const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
       const signatureInput = `${headerB64}.${payloadB64}`;
-      const nodeAlgorithm = jwtAlgToNodeAlg2(alg);
-      const signature = rsaSign2(
+      const nodeAlgorithm = jwtAlgToNodeAlg(alg);
+      const signature = rsaSign(
         nodeAlgorithm,
         Buffer.from(signatureInput),
         privateKey,
         isRsaPssAlg2(alg) ? {
-          padding: import_node_crypto2.default.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: import_node_crypto2.default.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
         } : void 0
       );
       const signatureB64 = signature.toString("base64url");
@@ -438,13 +438,12 @@ import { MCP_ERROR_CODES, PublicMcpError } from "@frontmcp/sdk";
 import { z as z2 } from "@frontmcp/lazy-zod";
 var import_event_emitter = __toESM(require_node_event_emitter(), 1);
 import { z as z22 } from "@frontmcp/lazy-zod";
-var import_crypto_provider = __toESM(require_node(), 1);
-import crypto2 from "node:crypto";
-import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
-import { hmac } from "@noble/hashes/hmac.js";
+var platformCrypto = __toESM(require_node(), 1);
+import { gcm } from "@noble/ciphers/aes.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
 import { randomBytes as nobleRandomBytes } from "@noble/hashes/utils.js";
-import { gcm } from "@noble/ciphers/aes.js";
 import { analyzeForReDoS, REDOS_THRESHOLDS } from "@enclave-vm/ast";
 var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : void 0;
 var require2 = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || "file:///") : void 0;
@@ -550,13 +549,6 @@ var init_fs2 = __esm({
     init_fs();
   }
 });
-function jwtAlgToNodeAlg(jwtAlg) {
-  const nodeAlg = JWT_ALG_TO_NODE_DIGEST[jwtAlg];
-  if (!nodeAlg) {
-    throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`);
-  }
-  return nodeAlg;
-}
 function isRsaPssAlg(jwtAlg) {
   return jwtAlg.startsWith("PS");
 }
@@ -2343,176 +2335,18 @@ var init_key_persistence2 = __esm({
     init_factory();
   }
 });
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${crypto2.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = crypto2.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return crypto2.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return crypto2.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = crypto2.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return crypto2.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return crypto2.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = crypto2.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return crypto2.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(crypto2.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = crypto2.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return crypto2.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = crypto2.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = crypto2.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = crypto2.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = crypto2.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = crypto2.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return crypto2.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair2,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk2,
+  rsaSignBase64Url: () => rsaSignBase64Url2,
+  rsaVerify: () => rsaVerify2,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync2
 });
 function toBytes(data) {
   if (typeof data === "string") {
@@ -2541,6 +2375,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify2() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url2() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync2() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk2() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair2() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2619,7 +2471,7 @@ var init_browser = __esm({
   }
 });
 function getCrypto() {
-  return import_crypto_provider.cryptoProvider;
+  return platformCrypto.cryptoProvider;
 }
 function randomBytes(length) {
   if (!Number.isInteger(length) || length <= 0) {
@@ -2739,6 +2591,71 @@ var init_redis_error_listener = __esm({
     DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS = 3e4;
   }
 });
+function decodeOrRaw(encoded) {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    return encoded;
+  }
+}
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
+  const fillIns = {};
+  const conflicts = [];
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
+  if (fields.port !== void 0) {
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
+  }
+  if (fields.password !== void 0) {
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
+  }
+  if (fields.db !== void 0) {
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
+  }
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
+}
+function describeRedisUrlConflicts(conflicts) {
+  return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
+}
+var init_redis_url = __esm({
+  "libs/utils/src/storage/redis-url.ts"() {
+    "use strict";
+  }
+});
 var init_utils = __esm({
   "libs/utils/src/storage/utils/index.ts"() {
     "use strict";
@@ -2773,17 +2690,49 @@ function getRedisClass() {
     });
   }
 }
+function resolveUrlOptions(connectionUrl, options) {
+  const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
+  if (options.url && configUrl && configUrl !== options.url) {
+    throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
+  }
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
+    throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
+  }
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
+}
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -2793,6 +2742,7 @@ var init_redis = __esm({
     "use strict";
     init_errors();
     init_redis_error_listener();
+    init_redis_url();
     init_utils();
     init_compare_and_delete();
     init_base();
@@ -2806,6 +2756,9 @@ var init_redis = __esm({
       connecting;
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
+      connectionUrl;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -2827,6 +2780,9 @@ var init_redis = __esm({
         this.options = options;
         this.ownsClient = !hasClient;
         this.keyPrefix = options.keyPrefix ?? "";
+        const configUrl = options.config?.url;
+        this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -2848,12 +2804,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.options.url) {
-              client = new RedisClass(this.options.url, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3086,14 +3037,11 @@ var init_redis = __esm({
        * Build Redis options from config.
        */
       buildRedisOptions() {
-        if (this.options.url) {
-          return {
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+        if (this.connectionUrl) {
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
-        if (!config) {
+        if (!config || typeof config.url === "string" || config.host === void 0) {
           throw new StorageConfigError("redis", "Redis config is required when URL is not provided");
         }
         return {
@@ -3106,16 +3054,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.options.url) {
-          subscriber = new RedisClass(this.options.url);
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -3162,7 +3117,8 @@ var init_redis = __esm({
 });
 var vercel_kv_exports = {};
 __export(vercel_kv_exports, {
-  VercelKvStorageAdapter: () => VercelKvStorageAdapter
+  VercelKvStorageAdapter: () => VercelKvStorageAdapter,
+  createVercelKvClient: () => createVercelKvClient
 });
 async function loadVercelKv() {
   try {
@@ -3174,6 +3130,15 @@ async function loadVercelKv() {
     throw new Error("@vercel/kv is required for Vercel KV storage adapter. Install it with: npm install @vercel/kv");
   }
 }
+async function createVercelKvClient(connection = {}) {
+  const url = connection.url ?? process.env["KV_REST_API_URL"];
+  const token = connection.token ?? process.env["KV_REST_API_TOKEN"];
+  if (!url || !token) {
+    throw new StorageConfigError("vercel-kv", "Pass url and token, or set KV_REST_API_URL and KV_REST_API_TOKEN.");
+  }
+  const { createClient } = await loadVercelKv();
+  return createClient({ url, token, cache: void 0, automaticDeserialization: false });
+}
 var VercelKvStorageAdapter;
 var init_vercel_kv = __esm({
   "libs/utils/src/storage/adapters/vercel-kv.ts"() {
@@ -3206,13 +3171,7 @@ var init_vercel_kv = __esm({
       async connect() {
         if (this.connected) return;
         try {
-          const { createClient } = await loadVercelKv();
-          const url = this.options.url;
-          const token = this.options.token;
-          if (!url || !token) {
-            throw new StorageConfigError("vercel-kv", "URL and token are required");
-          }
-          this.client = createClient({ url, token, cache: void 0, automaticDeserialization: false });
+          this.client = await createVercelKvClient({ url: this.options.url, token: this.options.token });
           await this.client.exists("__healthcheck__");
           this.connected = true;
         } catch (e) {
@@ -3383,9 +3342,12 @@ var upstash_exports = {};
 __export(upstash_exports, {
   UpstashStorageAdapter: () => UpstashStorageAdapter
 });
-function getUpstashRedis() {
+async function loadUpstashRedis() {
   try {
-    return __require2("@upstash/redis");
+    const mod = await import("@upstash/redis");
+    const resolved = typeof mod.Redis === "function" ? mod : mod.default;
+    if (!resolved || typeof resolved.Redis !== "function") throw new Error("Redis missing");
+    return resolved;
   } catch {
     throw new Error(
       "@upstash/redis is required for Upstash storage adapter. Install it with: npm install @upstash/redis"
@@ -3431,7 +3393,7 @@ var init_upstash = __esm({
       async connect() {
         if (this.connected) return;
         try {
-          const { Redis } = getUpstashRedis();
+          const { Redis } = await loadUpstashRedis();
           const url = this.options.url;
           const token = this.options.token;
           if (!url || !token) {
@@ -3920,6 +3882,7 @@ init_errors();
 init_errors();
 init_memory();
 init_redis_error_listener();
+init_redis_url();
 init_errors();
 init_crypto();
 init_errors();