@frontmcp/utils 1.0.3 → 1.1.0-beta.1

package/crypto/key-persistence/schemas.d.ts

@@ -3,12 +3,11 @@
  *
  * @module @frontmcp/utils/key-persistence
  */
-import { z } from 'zod';
-import type { AnyKeyData, SecretKeyData, AsymmetricKeyData } from './types';
+import type { AnyKeyData, AsymmetricKeyData, SecretKeyData } from './types';
 /**
  * Supported asymmetric algorithms.
  */
-export declare const asymmetricAlgSchema: z.ZodEnum<{
+export declare const asymmetricAlgSchema: import("@frontmcp/lazy-zod").ZodEnum<{
     RS256: "RS256";
     RS384: "RS384";
     RS512: "RS512";
@@ -19,23 +18,23 @@ export declare const asymmetricAlgSchema: z.ZodEnum<{
 /**
  * Zod schema for SecretKeyData.
  */
-export declare const secretKeyDataSchema: z.ZodObject<{
-    kid: z.ZodString;
-    createdAt: z.ZodNumber;
-    version: z.ZodNumber;
-    type: z.ZodLiteral<"secret">;
-    secret: z.ZodString;
-    bytes: z.ZodNumber;
-}, z.core.$strip>;
+export declare const secretKeyDataSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    kid: import("@frontmcp/lazy-zod").ZodString;
+    createdAt: import("@frontmcp/lazy-zod").ZodNumber;
+    version: import("@frontmcp/lazy-zod").ZodNumber;
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"secret">;
+    secret: import("@frontmcp/lazy-zod").ZodString;
+    bytes: import("@frontmcp/lazy-zod").ZodNumber;
+}, import("zod/v4/core").$strip>;
 /**
  * Zod schema for AsymmetricKeyData.
  */
-export declare const asymmetricKeyDataSchema: z.ZodObject<{
-    kid: z.ZodString;
-    createdAt: z.ZodNumber;
-    version: z.ZodNumber;
-    type: z.ZodLiteral<"asymmetric">;
-    alg: z.ZodEnum<{
+export declare const asymmetricKeyDataSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    kid: import("@frontmcp/lazy-zod").ZodString;
+    createdAt: import("@frontmcp/lazy-zod").ZodNumber;
+    version: import("@frontmcp/lazy-zod").ZodNumber;
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"asymmetric">;
+    alg: import("@frontmcp/lazy-zod").ZodEnum<{
         RS256: "RS256";
         RS384: "RS384";
         RS512: "RS512";
@@ -43,59 +42,59 @@ export declare const asymmetricKeyDataSchema: z.ZodObject<{
         ES384: "ES384";
         ES512: "ES512";
     }>;
-    privateKey: z.ZodObject<{
-        kty: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        alg: z.ZodOptional<z.ZodString>;
-        kid: z.ZodOptional<z.ZodString>;
-        n: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>;
-    publicJwk: z.ZodObject<{
-        keys: z.ZodArray<z.ZodObject<{
-            kty: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            alg: z.ZodOptional<z.ZodString>;
-            kid: z.ZodOptional<z.ZodString>;
-            n: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
+    privateKey: import("@frontmcp/lazy-zod").ZodObject<{
+        kty: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        use: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        alg: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        kid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        n: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        e: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        d: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        p: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        q: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        dp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        dq: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        qi: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        x: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        y: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        crv: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$loose>;
+    publicJwk: import("@frontmcp/lazy-zod").ZodObject<{
+        keys: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+            kty: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            use: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            alg: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            kid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            n: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            e: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            d: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            p: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            q: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            dp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            dq: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            qi: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            x: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            y: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            crv: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$loose>>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
 /**
  * Zod schema for AnyKeyData (discriminated union).
  */
-export declare const anyKeyDataSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kid: z.ZodString;
-    createdAt: z.ZodNumber;
-    version: z.ZodNumber;
-    type: z.ZodLiteral<"secret">;
-    secret: z.ZodString;
-    bytes: z.ZodNumber;
-}, z.core.$strip>, z.ZodObject<{
-    kid: z.ZodString;
-    createdAt: z.ZodNumber;
-    version: z.ZodNumber;
-    type: z.ZodLiteral<"asymmetric">;
-    alg: z.ZodEnum<{
+export declare const anyKeyDataSchema: import("@frontmcp/lazy-zod").ZodDiscriminatedUnion<[import("@frontmcp/lazy-zod").ZodObject<{
+    kid: import("@frontmcp/lazy-zod").ZodString;
+    createdAt: import("@frontmcp/lazy-zod").ZodNumber;
+    version: import("@frontmcp/lazy-zod").ZodNumber;
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"secret">;
+    secret: import("@frontmcp/lazy-zod").ZodString;
+    bytes: import("@frontmcp/lazy-zod").ZodNumber;
+}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
+    kid: import("@frontmcp/lazy-zod").ZodString;
+    createdAt: import("@frontmcp/lazy-zod").ZodNumber;
+    version: import("@frontmcp/lazy-zod").ZodNumber;
+    type: import("@frontmcp/lazy-zod").ZodLiteral<"asymmetric">;
+    alg: import("@frontmcp/lazy-zod").ZodEnum<{
         RS256: "RS256";
         RS384: "RS384";
         RS512: "RS512";
@@ -103,43 +102,43 @@ export declare const anyKeyDataSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         ES384: "ES384";
         ES512: "ES512";
     }>;
-    privateKey: z.ZodObject<{
-        kty: z.ZodOptional<z.ZodString>;
-        use: z.ZodOptional<z.ZodString>;
-        alg: z.ZodOptional<z.ZodString>;
-        kid: z.ZodOptional<z.ZodString>;
-        n: z.ZodOptional<z.ZodString>;
-        e: z.ZodOptional<z.ZodString>;
-        d: z.ZodOptional<z.ZodString>;
-        p: z.ZodOptional<z.ZodString>;
-        q: z.ZodOptional<z.ZodString>;
-        dp: z.ZodOptional<z.ZodString>;
-        dq: z.ZodOptional<z.ZodString>;
-        qi: z.ZodOptional<z.ZodString>;
-        x: z.ZodOptional<z.ZodString>;
-        y: z.ZodOptional<z.ZodString>;
-        crv: z.ZodOptional<z.ZodString>;
-    }, z.core.$loose>;
-    publicJwk: z.ZodObject<{
-        keys: z.ZodArray<z.ZodObject<{
-            kty: z.ZodOptional<z.ZodString>;
-            use: z.ZodOptional<z.ZodString>;
-            alg: z.ZodOptional<z.ZodString>;
-            kid: z.ZodOptional<z.ZodString>;
-            n: z.ZodOptional<z.ZodString>;
-            e: z.ZodOptional<z.ZodString>;
-            d: z.ZodOptional<z.ZodString>;
-            p: z.ZodOptional<z.ZodString>;
-            q: z.ZodOptional<z.ZodString>;
-            dp: z.ZodOptional<z.ZodString>;
-            dq: z.ZodOptional<z.ZodString>;
-            qi: z.ZodOptional<z.ZodString>;
-            x: z.ZodOptional<z.ZodString>;
-            y: z.ZodOptional<z.ZodString>;
-            crv: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-    }, z.core.$strip>;
-}, z.core.$strip>], "type">;
+    privateKey: import("@frontmcp/lazy-zod").ZodObject<{
+        kty: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        use: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        alg: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        kid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        n: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        e: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        d: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        p: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        q: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        dp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        dq: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        qi: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        x: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        y: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        crv: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+    }, import("zod/v4/core").$loose>;
+    publicJwk: import("@frontmcp/lazy-zod").ZodObject<{
+        keys: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
+            kty: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            use: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            alg: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            kid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            n: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            e: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            d: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            p: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            q: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            dp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            dq: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            qi: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            x: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            y: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+            crv: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
+        }, import("zod/v4/core").$loose>>;
+    }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>], "type">;
 /**
  * Result of validating key data.
  */

package/crypto/secret-persistence/schema.d.ts

@@ -3,16 +3,15 @@
  *
  * @module @frontmcp/utils/secret-persistence
  */
-import { z } from 'zod';
 import type { SecretData, SecretValidationResult } from './types';
 /**
  * Zod schema for SecretData.
  */
-export declare const secretDataSchema: z.ZodObject<{
-    secret: z.ZodString;
-    createdAt: z.ZodNumber;
-    version: z.ZodNumber;
-}, z.core.$strict>;
+export declare const secretDataSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    secret: import("@frontmcp/lazy-zod").ZodString;
+    createdAt: import("@frontmcp/lazy-zod").ZodNumber;
+    version: import("@frontmcp/lazy-zod").ZodNumber;
+}, import("zod/v4/core").$strict>;
 /**
  * Validate secret data structure.
  *

package/env/browser-runtime-context.d.ts

@@ -4,7 +4,6 @@
  * Returns safe defaults for browser environments.
  * The isEntryAvailable matcher works identically to the Node version.
  */
-import { z } from 'zod';
 export interface RuntimeContext {
     platform: string;
     runtime: string;
@@ -17,12 +16,12 @@ export interface EntryAvailability {
     deployment?: string[];
     env?: string[];
 }
-export declare const entryAvailabilitySchema: z.ZodObject<{
-    platform: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    runtime: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deployment: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    env: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
+export declare const entryAvailabilitySchema: import("@frontmcp/lazy-zod").ZodObject<{
+    platform: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    runtime: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    deployment: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    env: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+}, import("zod/v4/core").$strict>;
 export declare function isEntryAvailable(availability: EntryAvailability | undefined, ctx: RuntimeContext): boolean;
 export declare function detectRuntimeContext(): RuntimeContext;
 export declare function getRuntimeContext(): RuntimeContext;

package/env/runtime-context.d.ts

@@ -7,7 +7,6 @@
  * - `getRuntimeContext()` — lazy singleton returning the detected context
  * - `isEntryAvailable()` — pure matcher: does the constraint match the context?
  */
-import { z } from 'zod';
 /**
  * Snapshot of the current runtime environment.
  * Detected once and cached for the lifetime of the process.
@@ -17,7 +16,7 @@ export interface RuntimeContext {
     platform: string;
     /** JavaScript runtime: 'node', 'bun', 'deno', 'edge', 'browser' */
     runtime: string;
-    /** Deployment mode: 'serverless' or 'standalone' */
+    /** Deployment mode: 'distributed', 'serverless', 'standalone', or 'browser' */
     deployment: string;
     /** NODE_ENV value: 'production', 'development', 'test', etc. */
     env: string;
@@ -47,7 +46,7 @@ export interface EntryAvailability {
     platform?: string[];
     /** Runtime constraint: 'node', 'browser', 'edge', 'bun', 'deno' */
     runtime?: string[];
-    /** Deployment constraint: 'serverless', 'standalone' */
+    /** Deployment constraint: 'distributed', 'serverless', 'standalone', 'browser' */
     deployment?: string[];
     /** Environment constraint: 'production', 'development', 'test', etc. */
     env?: string[];
@@ -55,12 +54,12 @@ export interface EntryAvailability {
 /**
  * Zod schema for validating EntryAvailability in metadata.
  */
-export declare const entryAvailabilitySchema: z.ZodObject<{
-    platform: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    runtime: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deployment: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    env: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
+export declare const entryAvailabilitySchema: import("@frontmcp/lazy-zod").ZodObject<{
+    platform: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    runtime: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    deployment: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+    env: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
+}, import("zod/v4/core").$strict>;
 /**
  * Check if an entry is available in the given runtime context.
  *

package/esm/index.mjs

@@ -403,7 +403,7 @@ var init_pkce2 = __esm({
 });
 
 // libs/utils/src/crypto/secret-persistence/schema.ts
-import { z } from "zod";
+import { z } from "@frontmcp/lazy-zod";
 function validateSecretData(data) {
   const result = secretDataSchema.safeParse(data);
   if (!result.success) {
@@ -690,7 +690,7 @@ var init_hmac_signing = __esm({
 });
 
 // libs/utils/src/crypto/key-persistence/schemas.ts
-import { z as z2 } from "zod";
+import { z as z2 } from "@frontmcp/lazy-zod";
 function validateKeyData(data) {
   const result = anyKeyDataSchema.safeParse(data);
   if (!result.success) {
@@ -4199,6 +4199,85 @@ function validateBaseUrl(url) {
   }
 }
 
+// libs/utils/src/http/cookie.ts
+init_runtime();
+var LOCALHOST_PATTERNS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+function isLocalhost(host) {
+  if (!host) return false;
+  if (host.startsWith("[")) {
+    const closeBracket = host.indexOf("]");
+    if (closeBracket > 0) {
+      return LOCALHOST_PATTERNS.has(host.slice(1, closeBracket));
+    }
+  }
+  if (LOCALHOST_PATTERNS.has(host)) return true;
+  const lastColon = host.lastIndexOf(":");
+  if (lastColon > 0) {
+    const hostname = host.slice(0, lastColon);
+    return LOCALHOST_PATTERNS.has(hostname);
+  }
+  return false;
+}
+function isSecureRequest(req) {
+  if (!req) return false;
+  if (req.protocol === "https") return true;
+  const forwarded = req.headers?.["x-forwarded-proto"];
+  const forwardedStr = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim()?.toLowerCase();
+  if (forwardedStr === "https") return true;
+  if (req.socket?.encrypted) return true;
+  return false;
+}
+function buildSetCookie(options, req) {
+  if (!isNode()) return null;
+  const { name, value, path = "/", maxAge = 86400, httpOnly = true, sameSite = "Strict", domain } = options;
+  let secure;
+  if (options.secure !== void 0) {
+    secure = options.secure;
+  } else {
+    const host = req?.headers?.["host"];
+    const hostStr = Array.isArray(host) ? host[0] : host;
+    if (isLocalhost(hostStr)) {
+      secure = false;
+    } else if (req) {
+      secure = isSecureRequest(req);
+    } else {
+      secure = process.env["NODE_ENV"] === "production";
+    }
+  }
+  if (sameSite === "None" && !secure) {
+    secure = true;
+  }
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${path}`);
+  parts.push(`Max-Age=${maxAge}`);
+  if (httpOnly) parts.push("HttpOnly");
+  if (secure) parts.push("Secure");
+  parts.push(`SameSite=${sameSite}`);
+  if (domain) parts.push(`Domain=${domain}`);
+  return parts.join("; ");
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) continue;
+    try {
+      const name = decodeURIComponent(pair.slice(0, eqIdx).trim());
+      const value = decodeURIComponent(pair.slice(eqIdx + 1).trim());
+      if (name) cookies[name] = value;
+    } catch {
+      continue;
+    }
+  }
+  return cookies;
+}
+function getCookie(cookieHeader, name) {
+  if (!cookieHeader) return void 0;
+  return parseCookies(cookieHeader)[name];
+}
+
 // libs/utils/src/index.ts
 init_fs2();
 
@@ -4283,7 +4362,7 @@ import {
 } from "#env";
 
 // libs/utils/src/env/runtime-context.ts
-import { z as z3 } from "zod";
+import { z as z3 } from "@frontmcp/lazy-zod";
 import { isEdgeRuntime, isServerless } from "#env";
 var entryAvailabilitySchema = z3.object({
   platform: z3.array(z3.string().min(1)).optional(),
@@ -4308,11 +4387,20 @@ function detectRuntime() {
   if (isEdgeRuntime()) return "edge";
   return "node";
 }
+function detectDeployment(runtime) {
+  const explicit = process.env["FRONTMCP_DEPLOYMENT_MODE"];
+  if (explicit === "distributed") return "distributed";
+  if (explicit === "serverless") return "serverless";
+  if (runtime === "browser") return "browser";
+  if (isServerless()) return "serverless";
+  return "standalone";
+}
 function detectRuntimeContext() {
+  const runtime = detectRuntime();
   return {
     platform: process.platform,
-    runtime: detectRuntime(),
-    deployment: isServerless() ? "serverless" : "standalone",
+    runtime,
+    deployment: detectDeployment(runtime),
     env: process.env["NODE_ENV"] || "development"
   };
 }
@@ -5139,6 +5227,87 @@ async function processVercel(info, callTool) {
   const args = info.args != null && typeof info.args === "object" && !Array.isArray(info.args) ? info.args : void 0;
   return callTool(info.toolName, args);
 }
+
+// libs/utils/src/machine-id/machine-id.ts
+init_crypto();
+init_runtime();
+function getEnvDirect(key) {
+  return typeof process !== "undefined" ? process.env[key] : void 0;
+}
+function isProductionDirect() {
+  return getEnvDirect("NODE_ENV") === "production";
+}
+var DEFAULT_MACHINE_ID_PATH = ".frontmcp/machine-id";
+function isDevPersistenceEnabled() {
+  if (isBrowser()) return false;
+  return !isProductionDirect();
+}
+function resolveMachineIdPath() {
+  if (isBrowser()) return DEFAULT_MACHINE_ID_PATH;
+  const path = __require("path");
+  const machineIdPath = getEnvDirect("MACHINE_ID_PATH") ?? DEFAULT_MACHINE_ID_PATH;
+  const cwd = typeof process !== "undefined" ? process.cwd() : ".";
+  return path.isAbsolute(machineIdPath) ? machineIdPath : path.resolve(cwd, machineIdPath);
+}
+function loadMachineIdSync() {
+  if (!isDevPersistenceEnabled()) return null;
+  const machineIdPath = resolveMachineIdPath();
+  try {
+    const fs = __require("fs");
+    const content = fs.readFileSync(machineIdPath, "utf8").trim();
+    if (/^[0-9a-f-]{32,36}$/i.test(content)) return content;
+    console.warn(`[MachineId] Invalid format at ${machineIdPath}, will regenerate`);
+    return null;
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      console.warn(`[MachineId] Failed to load from ${machineIdPath}: ${error.message}`);
+    }
+    return null;
+  }
+}
+function saveMachineIdAsync(machineId2) {
+  if (!isDevPersistenceEnabled()) return;
+  const machineIdPath = resolveMachineIdPath();
+  const path = __require("path");
+  const dir = path.dirname(machineIdPath);
+  (async () => {
+    try {
+      const fsp = __require("fs").promises;
+      await fsp.mkdir(dir, { recursive: true, mode: 448 });
+      await fsp.writeFile(machineIdPath, machineId2, { mode: 384 });
+    } catch (error) {
+      console.warn(`[MachineId] Failed to save to ${machineIdPath}: ${error.message}`);
+    }
+  })();
+}
+var machineId = (() => {
+  const envMachineId = getEnvDirect("MACHINE_ID");
+  if (envMachineId) return envMachineId;
+  const deploymentMode = getEnvDirect("FRONTMCP_DEPLOYMENT_MODE");
+  if (deploymentMode === "distributed") {
+    const hostname = getEnvDirect("HOSTNAME");
+    if (hostname) return hostname;
+    if (isNode()) {
+      const os = __require("os");
+      return os.hostname();
+    }
+  }
+  if (deploymentMode === "serverless") {
+    return randomUUID();
+  }
+  const loadedId = loadMachineIdSync();
+  if (loadedId) return loadedId;
+  const newId = randomUUID();
+  saveMachineIdAsync(newId);
+  return newId;
+})();
+var machineIdOverride;
+function getMachineId() {
+  return machineIdOverride ?? machineId;
+}
+function setMachineIdOverride(id) {
+  machineIdOverride = id;
+}
 export {
   AsyncLocalStorage,
   BaseStorageAdapter,
@@ -5182,6 +5351,7 @@ export {
   base64urlEncode,
   basename,
   buildPrefix,
+  buildSetCookie,
   bytesToHex,
   clearCachedSecret,
   collapseChar,
@@ -5226,11 +5396,13 @@ export {
   generateCodeVerifier,
   generatePkcePair,
   generateSecret,
+  getCookie,
   getCrypto,
   getCwd2 as getCwd,
   getDetectedStorageType,
   getEnv2 as getEnv,
   getEnvFlag,
+  getMachineId,
   getOrCreateSecret,
   getRuntimeContext,
   globToRegex,
@@ -5248,6 +5420,7 @@ export {
   isEntryAvailable,
   isExpired,
   isInputLengthSafe,
+  isLocalhost,
   isNode,
   isPatternSafe,
   isProduction,
@@ -5255,6 +5428,7 @@ export {
   isSecretCached,
   isSecretKeyData,
   isSecretPersistenceEnabled,
+  isSecureRequest,
   isServerless2 as isServerless,
   isSignedData,
   isUriTemplate,
@@ -5271,6 +5445,7 @@ export {
   mkdir,
   mkdtemp,
   normalizeTTL,
+  parseCookies,
   parseKeyData,
   parseSecretData,
   parseUriTemplate,
@@ -5303,6 +5478,7 @@ export {
   sepFor,
   serializeBlob,
   setEnv,
+  setMachineIdOverride,
   sha256,
   sha256Base64url,
   sha256Hex,

package/http/cookie.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Cookie Utilities
+ *
+ * Browser-safe cookie building, parsing, and extraction.
+ * Auto-detects Secure flag based on environment (localhost, HTTPS, browser).
+ */
+/**
+ * Options for building a Set-Cookie header value.
+ */
+export interface CookieOptions {
+    /** Cookie name */
+    name: string;
+    /** Cookie value */
+    value: string;
+    /** Cookie path (default: '/') */
+    path?: string;
+    /** Max age in seconds (default: 86400 = 24h) */
+    maxAge?: number;
+    /** HttpOnly flag — prevents JS access (default: true) */
+    httpOnly?: boolean;
+    /** SameSite policy (default: 'Strict') */
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Secure flag — if omitted, auto-detected from request context */
+    secure?: boolean;
+    /** Domain for the cookie (default: omitted = current domain) */
+    domain?: string;
+}
+/**
+ * Check if a host string is localhost.
+ * Matches: localhost, 127.0.0.1, ::1, 0.0.0.0 (with or without port).
+ */
+export declare function isLocalhost(host: string | undefined): boolean;
+/**
+ * Minimal request shape for secure detection.
+ * Works with Express, Koa, raw Node.js, and plain objects.
+ */
+export interface SecureDetectionRequest {
+    headers?: Record<string, string | string[] | undefined>;
+    protocol?: string;
+    socket?: {
+        encrypted?: boolean;
+    };
+}
+/**
+ * Detect if a request was made over HTTPS.
+ * Checks (in order): protocol field, X-Forwarded-Proto header, socket.encrypted.
+ */
+export declare function isSecureRequest(req?: SecureDetectionRequest): boolean;
+/**
+ * Build a Set-Cookie header value.
+ *
+ * Auto-detects the Secure flag based on environment:
+ * - Browser: returns `null` (server-side cookies don't apply)
+ * - localhost/127.0.0.1: omits Secure (dev mode works over HTTP)
+ * - HTTPS request: sets Secure
+ * - No request context: sets Secure in production, omits in development
+ *
+ * @param options - Cookie options
+ * @param req - Optional request for auto-detecting Secure and localhost
+ * @returns Set-Cookie header value, or `null` if cookies don't apply (browser-only environment)
+ */
+export declare function buildSetCookie(options: CookieOptions, req?: SecureDetectionRequest): string | null;
+/**
+ * Parse a Cookie header string into key-value pairs.
+ * Works in both Node.js and browser environments.
+ *
+ * @param cookieHeader - The Cookie header value (e.g., "name=value; other=123")
+ * @returns Record of cookie name to value
+ */
+export declare function parseCookies(cookieHeader: string): Record<string, string>;
+/**
+ * Extract a specific cookie value from a Cookie header string.
+ *
+ * @param cookieHeader - The Cookie header value
+ * @param name - Cookie name to find
+ * @returns The cookie value, or undefined if not found
+ */
+export declare function getCookie(cookieHeader: string | undefined, name: string): string | undefined;

package/http/index.d.ts

@@ -1 +1,3 @@
 export { validateBaseUrl } from './http';
+export { buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest } from './cookie';
+export type { CookieOptions, SecureDetectionRequest } from './cookie';

package/index.d.ts

@@ -11,7 +11,8 @@ export { isValidMcpUri, extractUriScheme, isValidMcpUriTemplate, parseUriTemplat
 export type { ParsedUriTemplate } from './uri';
 export { trimSlashes, joinPath, pathResolve, pathJoin, basename, dirname, extname } from './path';
 export { sanitizeToJson, inferMimeType } from './content';
-export { validateBaseUrl } from './http';
+export { validateBaseUrl, buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest } from './http';
+export type { CookieOptions, SecureDetectionRequest } from './http';
 export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, rm, mkdtemp, access, fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd, } from './fs';
 export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript } from './escape';
 export { safeStringify } from './serialization';
@@ -26,3 +27,4 @@ export { createStorage, createMemoryStorage, getDetectedStorageType, NamespacedS
 export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, VercelKvAdapterOptions, UpstashAdapterOptions, StorageType, StorageConfig, } from './storage';
 export { processPlatformToolCalls } from './llm';
 export type { CallToolFn, OpenAIToolCallItem, OpenAIToolResponse, ClaudeToolUseBlock, ClaudeToolResultBlock, VercelToolCallInfo, PlatformToolCallsInput, PlatformToolCallsOutput, SupportedPlatform, } from './llm';
+export { getMachineId, setMachineIdOverride } from './machine-id';

package/index.js

@@ -433,16 +433,16 @@ function parseSecretData(data) {
   }
   return data;
 }
-var import_zod, secretDataSchema, MAX_CLOCK_DRIFT_MS, MAX_SECRET_AGE_MS;
+var import_lazy_zod, secretDataSchema, MAX_CLOCK_DRIFT_MS, MAX_SECRET_AGE_MS;
 var init_schema = __esm({
   "libs/utils/src/crypto/secret-persistence/schema.ts"() {
     "use strict";
-    import_zod = require("zod");
-    secretDataSchema = import_zod.z.object({
-      secret: import_zod.z.string().base64url().length(43),
+    import_lazy_zod = require("@frontmcp/lazy-zod");
+    secretDataSchema = import_lazy_zod.z.object({
+      secret: import_lazy_zod.z.string().base64url().length(43),
       // base64url of 32 bytes is exactly 43 chars
-      createdAt: import_zod.z.number().positive().int(),
-      version: import_zod.z.number().positive().int()
+      createdAt: import_lazy_zod.z.number().positive().int(),
+      version: import_lazy_zod.z.number().positive().int()
     }).strict();
     MAX_CLOCK_DRIFT_MS = 6e4;
     MAX_SECRET_AGE_MS = 100 * 365 * 24 * 60 * 60 * 1e3;
@@ -726,50 +726,50 @@ function isSecretKeyData(data) {
 function isAsymmetricKeyData(data) {
   return data.type === "asymmetric";
 }
-var import_zod2, MAX_CLOCK_DRIFT_MS2, MAX_KEY_AGE_MS, asymmetricAlgSchema, baseKeyDataSchema, jsonWebKeySchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema;
+var import_lazy_zod2, MAX_CLOCK_DRIFT_MS2, MAX_KEY_AGE_MS, asymmetricAlgSchema, baseKeyDataSchema, jsonWebKeySchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema;
 var init_schemas = __esm({
   "libs/utils/src/crypto/key-persistence/schemas.ts"() {
     "use strict";
-    import_zod2 = require("zod");
+    import_lazy_zod2 = require("@frontmcp/lazy-zod");
     MAX_CLOCK_DRIFT_MS2 = 6e4;
     MAX_KEY_AGE_MS = 100 * 365 * 24 * 60 * 60 * 1e3;
-    asymmetricAlgSchema = import_zod2.z.enum(["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"]);
-    baseKeyDataSchema = import_zod2.z.object({
-      kid: import_zod2.z.string().min(1),
-      createdAt: import_zod2.z.number().positive().int(),
-      version: import_zod2.z.number().positive().int()
+    asymmetricAlgSchema = import_lazy_zod2.z.enum(["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"]);
+    baseKeyDataSchema = import_lazy_zod2.z.object({
+      kid: import_lazy_zod2.z.string().min(1),
+      createdAt: import_lazy_zod2.z.number().positive().int(),
+      version: import_lazy_zod2.z.number().positive().int()
     });
-    jsonWebKeySchema = import_zod2.z.object({
-      kty: import_zod2.z.string().optional(),
-      use: import_zod2.z.string().optional(),
-      alg: import_zod2.z.string().optional(),
-      kid: import_zod2.z.string().optional(),
-      n: import_zod2.z.string().optional(),
-      e: import_zod2.z.string().optional(),
-      d: import_zod2.z.string().optional(),
-      p: import_zod2.z.string().optional(),
-      q: import_zod2.z.string().optional(),
-      dp: import_zod2.z.string().optional(),
-      dq: import_zod2.z.string().optional(),
-      qi: import_zod2.z.string().optional(),
-      x: import_zod2.z.string().optional(),
-      y: import_zod2.z.string().optional(),
-      crv: import_zod2.z.string().optional()
+    jsonWebKeySchema = import_lazy_zod2.z.object({
+      kty: import_lazy_zod2.z.string().optional(),
+      use: import_lazy_zod2.z.string().optional(),
+      alg: import_lazy_zod2.z.string().optional(),
+      kid: import_lazy_zod2.z.string().optional(),
+      n: import_lazy_zod2.z.string().optional(),
+      e: import_lazy_zod2.z.string().optional(),
+      d: import_lazy_zod2.z.string().optional(),
+      p: import_lazy_zod2.z.string().optional(),
+      q: import_lazy_zod2.z.string().optional(),
+      dp: import_lazy_zod2.z.string().optional(),
+      dq: import_lazy_zod2.z.string().optional(),
+      qi: import_lazy_zod2.z.string().optional(),
+      x: import_lazy_zod2.z.string().optional(),
+      y: import_lazy_zod2.z.string().optional(),
+      crv: import_lazy_zod2.z.string().optional()
     }).passthrough();
     secretKeyDataSchema = baseKeyDataSchema.extend({
-      type: import_zod2.z.literal("secret"),
-      secret: import_zod2.z.string().min(1),
-      bytes: import_zod2.z.number().positive().int()
+      type: import_lazy_zod2.z.literal("secret"),
+      secret: import_lazy_zod2.z.string().min(1),
+      bytes: import_lazy_zod2.z.number().positive().int()
     });
     asymmetricKeyDataSchema = baseKeyDataSchema.extend({
-      type: import_zod2.z.literal("asymmetric"),
+      type: import_lazy_zod2.z.literal("asymmetric"),
       alg: asymmetricAlgSchema,
       privateKey: jsonWebKeySchema,
-      publicJwk: import_zod2.z.object({
-        keys: import_zod2.z.array(jsonWebKeySchema).min(1)
+      publicJwk: import_lazy_zod2.z.object({
+        keys: import_lazy_zod2.z.array(jsonWebKeySchema).min(1)
       })
     });
-    anyKeyDataSchema = import_zod2.z.discriminatedUnion("type", [secretKeyDataSchema, asymmetricKeyDataSchema]);
+    anyKeyDataSchema = import_lazy_zod2.z.discriminatedUnion("type", [secretKeyDataSchema, asymmetricKeyDataSchema]);
   }
 });
 
@@ -3764,6 +3764,7 @@ __export(index_exports, {
   base64urlEncode: () => base64urlEncode,
   basename: () => import_path.basename,
   buildPrefix: () => buildPrefix,
+  buildSetCookie: () => buildSetCookie,
   bytesToHex: () => bytesToHex,
   clearCachedSecret: () => clearCachedSecret,
   collapseChar: () => collapseChar,
@@ -3808,11 +3809,13 @@ __export(index_exports, {
   generateCodeVerifier: () => generateCodeVerifier,
   generatePkcePair: () => generatePkcePair,
   generateSecret: () => generateSecret,
+  getCookie: () => getCookie,
   getCrypto: () => getCrypto,
   getCwd: () => import_env3.getCwd,
   getDetectedStorageType: () => getDetectedStorageType,
   getEnv: () => import_env3.getEnv,
   getEnvFlag: () => import_env3.getEnvFlag,
+  getMachineId: () => getMachineId,
   getOrCreateSecret: () => getOrCreateSecret,
   getRuntimeContext: () => getRuntimeContext,
   globToRegex: () => globToRegex,
@@ -3830,6 +3833,7 @@ __export(index_exports, {
   isEntryAvailable: () => isEntryAvailable,
   isExpired: () => isExpired,
   isInputLengthSafe: () => isInputLengthSafe,
+  isLocalhost: () => isLocalhost,
   isNode: () => isNode,
   isPatternSafe: () => isPatternSafe,
   isProduction: () => import_env3.isProduction,
@@ -3837,6 +3841,7 @@ __export(index_exports, {
   isSecretCached: () => isSecretCached,
   isSecretKeyData: () => isSecretKeyData,
   isSecretPersistenceEnabled: () => isSecretPersistenceEnabled,
+  isSecureRequest: () => isSecureRequest,
   isServerless: () => import_env3.isServerless,
   isSignedData: () => isSignedData,
   isUriTemplate: () => isUriTemplate,
@@ -3853,6 +3858,7 @@ __export(index_exports, {
   mkdir: () => mkdir,
   mkdtemp: () => mkdtemp,
   normalizeTTL: () => normalizeTTL,
+  parseCookies: () => parseCookies,
   parseKeyData: () => parseKeyData,
   parseSecretData: () => parseSecretData,
   parseUriTemplate: () => parseUriTemplate,
@@ -3885,6 +3891,7 @@ __export(index_exports, {
   sepFor: () => sepFor,
   serializeBlob: () => serializeBlob,
   setEnv: () => import_env3.setEnv,
+  setMachineIdOverride: () => setMachineIdOverride,
   sha256: () => sha256,
   sha256Base64url: () => sha256Base64url,
   sha256Hex: () => sha256Hex,
@@ -4404,6 +4411,85 @@ function validateBaseUrl(url) {
   }
 }
 
+// libs/utils/src/http/cookie.ts
+init_runtime();
+var LOCALHOST_PATTERNS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+function isLocalhost(host) {
+  if (!host) return false;
+  if (host.startsWith("[")) {
+    const closeBracket = host.indexOf("]");
+    if (closeBracket > 0) {
+      return LOCALHOST_PATTERNS.has(host.slice(1, closeBracket));
+    }
+  }
+  if (LOCALHOST_PATTERNS.has(host)) return true;
+  const lastColon = host.lastIndexOf(":");
+  if (lastColon > 0) {
+    const hostname = host.slice(0, lastColon);
+    return LOCALHOST_PATTERNS.has(hostname);
+  }
+  return false;
+}
+function isSecureRequest(req) {
+  if (!req) return false;
+  if (req.protocol === "https") return true;
+  const forwarded = req.headers?.["x-forwarded-proto"];
+  const forwardedStr = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim()?.toLowerCase();
+  if (forwardedStr === "https") return true;
+  if (req.socket?.encrypted) return true;
+  return false;
+}
+function buildSetCookie(options, req) {
+  if (!isNode()) return null;
+  const { name, value, path = "/", maxAge = 86400, httpOnly = true, sameSite = "Strict", domain } = options;
+  let secure;
+  if (options.secure !== void 0) {
+    secure = options.secure;
+  } else {
+    const host = req?.headers?.["host"];
+    const hostStr = Array.isArray(host) ? host[0] : host;
+    if (isLocalhost(hostStr)) {
+      secure = false;
+    } else if (req) {
+      secure = isSecureRequest(req);
+    } else {
+      secure = process.env["NODE_ENV"] === "production";
+    }
+  }
+  if (sameSite === "None" && !secure) {
+    secure = true;
+  }
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${path}`);
+  parts.push(`Max-Age=${maxAge}`);
+  if (httpOnly) parts.push("HttpOnly");
+  if (secure) parts.push("Secure");
+  parts.push(`SameSite=${sameSite}`);
+  if (domain) parts.push(`Domain=${domain}`);
+  return parts.join("; ");
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  const pairs = cookieHeader.split(";");
+  for (const pair of pairs) {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) continue;
+    try {
+      const name = decodeURIComponent(pair.slice(0, eqIdx).trim());
+      const value = decodeURIComponent(pair.slice(eqIdx + 1).trim());
+      if (name) cookies[name] = value;
+    } catch {
+      continue;
+    }
+  }
+  return cookies;
+}
+function getCookie(cookieHeader, name) {
+  if (!cookieHeader) return void 0;
+  return parseCookies(cookieHeader)[name];
+}
+
 // libs/utils/src/index.ts
 init_fs2();
 
@@ -4477,13 +4563,13 @@ var import_event_emitter2 = require("#event-emitter");
 var import_env3 = require("#env");
 
 // libs/utils/src/env/runtime-context.ts
-var import_zod3 = require("zod");
+var import_lazy_zod3 = require("@frontmcp/lazy-zod");
 var import_env2 = require("#env");
-var entryAvailabilitySchema = import_zod3.z.object({
-  platform: import_zod3.z.array(import_zod3.z.string().min(1)).optional(),
-  runtime: import_zod3.z.array(import_zod3.z.string().min(1)).optional(),
-  deployment: import_zod3.z.array(import_zod3.z.string().min(1)).optional(),
-  env: import_zod3.z.array(import_zod3.z.string().min(1)).optional()
+var entryAvailabilitySchema = import_lazy_zod3.z.object({
+  platform: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1)).optional(),
+  runtime: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1)).optional(),
+  deployment: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1)).optional(),
+  env: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1)).optional()
 }).strict();
 function isEntryAvailable(availability, ctx) {
   if (!availability) return true;
@@ -4502,11 +4588,20 @@ function detectRuntime() {
   if ((0, import_env2.isEdgeRuntime)()) return "edge";
   return "node";
 }
+function detectDeployment(runtime) {
+  const explicit = process.env["FRONTMCP_DEPLOYMENT_MODE"];
+  if (explicit === "distributed") return "distributed";
+  if (explicit === "serverless") return "serverless";
+  if (runtime === "browser") return "browser";
+  if ((0, import_env2.isServerless)()) return "serverless";
+  return "standalone";
+}
 function detectRuntimeContext() {
+  const runtime = detectRuntime();
   return {
     platform: process.platform,
-    runtime: detectRuntime(),
-    deployment: (0, import_env2.isServerless)() ? "serverless" : "standalone",
+    runtime,
+    deployment: detectDeployment(runtime),
     env: process.env["NODE_ENV"] || "development"
   };
 }
@@ -5333,6 +5428,87 @@ async function processVercel(info, callTool) {
   const args = info.args != null && typeof info.args === "object" && !Array.isArray(info.args) ? info.args : void 0;
   return callTool(info.toolName, args);
 }
+
+// libs/utils/src/machine-id/machine-id.ts
+init_crypto();
+init_runtime();
+function getEnvDirect(key) {
+  return typeof process !== "undefined" ? process.env[key] : void 0;
+}
+function isProductionDirect() {
+  return getEnvDirect("NODE_ENV") === "production";
+}
+var DEFAULT_MACHINE_ID_PATH = ".frontmcp/machine-id";
+function isDevPersistenceEnabled() {
+  if (isBrowser()) return false;
+  return !isProductionDirect();
+}
+function resolveMachineIdPath() {
+  if (isBrowser()) return DEFAULT_MACHINE_ID_PATH;
+  const path = require("path");
+  const machineIdPath = getEnvDirect("MACHINE_ID_PATH") ?? DEFAULT_MACHINE_ID_PATH;
+  const cwd = typeof process !== "undefined" ? process.cwd() : ".";
+  return path.isAbsolute(machineIdPath) ? machineIdPath : path.resolve(cwd, machineIdPath);
+}
+function loadMachineIdSync() {
+  if (!isDevPersistenceEnabled()) return null;
+  const machineIdPath = resolveMachineIdPath();
+  try {
+    const fs = require("fs");
+    const content = fs.readFileSync(machineIdPath, "utf8").trim();
+    if (/^[0-9a-f-]{32,36}$/i.test(content)) return content;
+    console.warn(`[MachineId] Invalid format at ${machineIdPath}, will regenerate`);
+    return null;
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      console.warn(`[MachineId] Failed to load from ${machineIdPath}: ${error.message}`);
+    }
+    return null;
+  }
+}
+function saveMachineIdAsync(machineId2) {
+  if (!isDevPersistenceEnabled()) return;
+  const machineIdPath = resolveMachineIdPath();
+  const path = require("path");
+  const dir = path.dirname(machineIdPath);
+  (async () => {
+    try {
+      const fsp = require("fs").promises;
+      await fsp.mkdir(dir, { recursive: true, mode: 448 });
+      await fsp.writeFile(machineIdPath, machineId2, { mode: 384 });
+    } catch (error) {
+      console.warn(`[MachineId] Failed to save to ${machineIdPath}: ${error.message}`);
+    }
+  })();
+}
+var machineId = (() => {
+  const envMachineId = getEnvDirect("MACHINE_ID");
+  if (envMachineId) return envMachineId;
+  const deploymentMode = getEnvDirect("FRONTMCP_DEPLOYMENT_MODE");
+  if (deploymentMode === "distributed") {
+    const hostname = getEnvDirect("HOSTNAME");
+    if (hostname) return hostname;
+    if (isNode()) {
+      const os = require("os");
+      return os.hostname();
+    }
+  }
+  if (deploymentMode === "serverless") {
+    return randomUUID();
+  }
+  const loadedId = loadMachineIdSync();
+  if (loadedId) return loadedId;
+  const newId = randomUUID();
+  saveMachineIdAsync(newId);
+  return newId;
+})();
+var machineIdOverride;
+function getMachineId() {
+  return machineIdOverride ?? machineId;
+}
+function setMachineIdOverride(id) {
+  machineIdOverride = id;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AsyncLocalStorage,
@@ -5377,6 +5553,7 @@ async function processVercel(info, callTool) {
   base64urlEncode,
   basename,
   buildPrefix,
+  buildSetCookie,
   bytesToHex,
   clearCachedSecret,
   collapseChar,
@@ -5421,11 +5598,13 @@ async function processVercel(info, callTool) {
   generateCodeVerifier,
   generatePkcePair,
   generateSecret,
+  getCookie,
   getCrypto,
   getCwd,
   getDetectedStorageType,
   getEnv,
   getEnvFlag,
+  getMachineId,
   getOrCreateSecret,
   getRuntimeContext,
   globToRegex,
@@ -5443,6 +5622,7 @@ async function processVercel(info, callTool) {
   isEntryAvailable,
   isExpired,
   isInputLengthSafe,
+  isLocalhost,
   isNode,
   isPatternSafe,
   isProduction,
@@ -5450,6 +5630,7 @@ async function processVercel(info, callTool) {
   isSecretCached,
   isSecretKeyData,
   isSecretPersistenceEnabled,
+  isSecureRequest,
   isServerless,
   isSignedData,
   isUriTemplate,
@@ -5466,6 +5647,7 @@ async function processVercel(info, callTool) {
   mkdir,
   mkdtemp,
   normalizeTTL,
+  parseCookies,
   parseKeyData,
   parseSecretData,
   parseUriTemplate,
@@ -5498,6 +5680,7 @@ async function processVercel(info, callTool) {
   sepFor,
   serializeBlob,
   setEnv,
+  setMachineIdOverride,
   sha256,
   sha256Base64url,
   sha256Hex,

package/machine-id/index.d.ts

@@ -0,0 +1 @@
+export { getMachineId, setMachineIdOverride } from './machine-id';

package/machine-id/machine-id.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Machine ID Utility
+ *
+ * Single source of truth for the machine ID used across session management,
+ * transport session affinity, and HA features.
+ *
+ * Resolution depends on deployment mode (set by `frontmcp build -t {target}`):
+ *
+ * **Distributed** (`FRONTMCP_DEPLOYMENT_MODE=distributed`):
+ *   1. MACHINE_ID env var (explicit override)
+ *   2. HOSTNAME env var (K8s pod name — auto-set by Kubernetes)
+ *   3. os.hostname() (non-K8s distributed)
+ *
+ * **Serverless** (`FRONTMCP_DEPLOYMENT_MODE=serverless`):
+ *   1. MACHINE_ID env var (explicit override)
+ *   2. Random UUID (ephemeral — no file persistence)
+ *
+ * **Standalone** (default — `node` or `cli` build targets):
+ *   1. MACHINE_ID env var (explicit override)
+ *   2. File persistence at `.frontmcp/machine-id` (dev mode)
+ *   3. Random UUID (production)
+ */
+/**
+ * Get the current machine ID.
+ * Returns the override (if set via `setMachineIdOverride`) or the computed value.
+ */
+export declare function getMachineId(): string;
+/**
+ * Set a process-wide machine ID override.
+ * Pass `undefined` to clear the override and revert to the computed value.
+ */
+export declare function setMachineIdOverride(id: string | undefined): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/utils",
-  "version": "1.0.3",
+  "version": "1.1.0-beta.1",
   "description": "Shared utility functions for FrontMCP - string manipulation, URI handling, path utilities, and more",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -29,12 +29,12 @@
   "dependencies": {
     "@noble/hashes": "^2.0.1",
     "@noble/ciphers": "^2.1.1",
-    "@enclave-vm/ast": "^2.13.0",
-    "zod": "^4.0.0"
+    "@enclave-vm/ast": "^2.13.0"
   },
   "peerDependencies": {
     "@vercel/kv": "^2.0.0 || ^3.0.0",
-    "ioredis": "^5.0.0"
+    "ioredis": "^5.0.0",
+    "@frontmcp/lazy-zod": "1.1.0-beta.1"
   },
   "peerDependenciesMeta": {
     "@vercel/kv": {

package/storage/encrypted-typed-storage.types.d.ts

@@ -4,8 +4,8 @@
  * Type definitions for the EncryptedTypedStorage wrapper that provides
  * transparent encryption/decryption with key rotation support.
  */
+import type { z } from '@frontmcp/lazy-zod';
 import type { SetOptions } from './types';
-import type { z } from 'zod';
 /**
  * Encryption key with identifier for key rotation support.
  */

package/storage/typed-storage.types.d.ts

@@ -4,8 +4,8 @@
  * Type definitions for the TypedStorage wrapper that provides
  * type-safe JSON serialization on top of StorageAdapter.
  */
+import type { z } from '@frontmcp/lazy-zod';
 import type { SetOptions } from './types';
-import type { z } from 'zod';
 /**
  * Options for TypedStorage wrapper
  */

package/uri/uri-template.d.ts

@@ -52,9 +52,12 @@ export declare function matchUriTemplate(template: string, uri: string): Record<
 /**
  * Expand a URI template with the given parameters.
  *
+ * Parameter values are **percent-encoded** per RFC 6570 Level 1 using
+ * `encodeURIComponent()`. Use {@link matchUriTemplate} to decode them back.
+ *
  * @param template - The URI template
- * @param params - Object with parameter values
- * @returns Expanded URI with parameters substituted
+ * @param params - Object with parameter values (raw, unencoded)
+ * @returns Expanded URI with parameters percent-encoded and substituted
  * @throws Error if a required parameter is missing
  *
  * @example
@@ -63,6 +66,10 @@ export declare function matchUriTemplate(template: string, uri: string): Record<
  *
  * expandUriTemplate("users/{userId}/posts/{postId}", { userId: "123", postId: "456" })
  * // "users/123/posts/456"
+ *
+ * // Special characters are percent-encoded:
+ * expandUriTemplate("notes://{id}", { id: "x-coredata://ABC/Note/1" })
+ * // "notes://x-coredata%3A%2F%2FABC%2FNote%2F1"
  */
 export declare function expandUriTemplate(template: string, params: Record<string, string>): string;
 /**