@frontmcp/utils 1.1.2 → 1.2.1

package/crypto/index.d.ts

@@ -4,7 +4,10 @@
  * Provides cryptographic operations that work in both Node.js and browser environments.
  * Uses native crypto in Node.js and @noble/hashes + @noble/ciphers in browsers.
  */
+import type { RsaJwk as RsaJwkNode, RsaKeyPair as RsaKeyPairNode } from './node';
 import type { CryptoProvider, EncBlob } from './types';
+export type RsaJwk = RsaJwkNode;
+export type RsaKeyPair = RsaKeyPairNode;
 export { isRsaPssAlg, jwtAlgToNodeAlg, jwtAlgToWebCryptoAlg } from './jwt-alg';
 /**
  * Get the crypto provider for the current runtime environment.
@@ -24,6 +27,50 @@ export declare function getCrypto(): CryptoProvider;
  * @returns Promise resolving to true if the signature is valid
  */
 export declare function rsaVerify(jwtAlg: string, data: Buffer | Uint8Array, publicJwk: JsonWebKey, signature: Buffer | Uint8Array): Promise<boolean>;
+/**
+ * Sign data with an RSA private JWK and return a base64url-encoded signature.
+ *
+ * Node-only: signs synchronously using `crypto.createPrivateKey` + `crypto.sign`.
+ * Throws in non-Node runtimes since WebCrypto requires async key import and
+ * the audit signer needs a synchronous interface; production hosts that need
+ * RS256 audit signing run on Node.
+ *
+ * @param jwtAlg - JWT algorithm identifier (e.g. 'RS256', 'PS256')
+ * @param data - Bytes to sign
+ * @param privateJwk - Private key in JWK format
+ * @returns Base64url-encoded signature
+ */
+export declare function rsaSignBase64Url(jwtAlg: string, data: Buffer | Uint8Array, privateJwk: JsonWebKey): string;
+/**
+ * Synchronous companion to {@link rsaVerify}. Node-only — server-side audit
+ * verifiers and bundle signature verifiers need a sync surface so the
+ * `AuditSignatureVerifier` interface stays single-await for hot paths.
+ *
+ * Accepts RSA, RSA-PSS, and EdDSA (Ed25519) keys in JWK form. Returns
+ * `false` (never throws) on malformed keys / unsupported algs.
+ *
+ * @param jwtAlg - JWT algorithm identifier (`'RS256'`, `'PS256'`, `'EdDSA'`, ...)
+ * @param data - The signed data bytes
+ * @param publicJwk - Public key in JWK format
+ * @param signature - Raw signature bytes
+ */
+export declare function rsaVerifySync(jwtAlg: string, data: Buffer | Uint8Array, publicJwk: JsonWebKey, signature: Buffer | Uint8Array): boolean;
+/**
+ * Convert a PEM-encoded public key (SPKI) into a JWK so callers can route
+ * verification through {@link rsaVerifySync}. Node-only.
+ *
+ * Throws on malformed PEM — server-side callers should catch and translate
+ * to a structured failure reason.
+ */
+export declare function pemToPublicJwk(pem: string): JsonWebKey;
+/**
+ * Generate an RSA key pair (Node-only). Re-exported here so test code and
+ * host bootstrap don't have to reach into `node:crypto` directly.
+ *
+ * @param modulusLength - Key size in bits (default: 2048)
+ * @param alg - JWT algorithm (default: 'RS256')
+ */
+export declare function generateRsaKeyPair(modulusLength?: number, alg?: string): RsaKeyPair;
 /**
  * Generate a UUID v4 string.
  */

package/crypto/node.d.ts

@@ -49,6 +49,55 @@ export declare function generateRsaKeyPair(modulusLength?: number, alg?: string)
  */
 export declare function rsaSign(algorithm: string, data: Buffer, privateKey: crypto.KeyObject, options?: Omit<crypto.SignKeyObjectInput, 'key'>): Buffer;
 export declare function rsaVerify(jwtAlg: string, data: Buffer, publicJwk: JsonWebKey, signature: Buffer): boolean;
+/**
+ * Sign data with an RSA private JWK and return a base64url-encoded signature.
+ *
+ * Mirror of {@link rsaVerify} on the signing side: takes a JWT alg name
+ * (`RS256`/`RS384`/`RS512`/`PS256`/`PS384`/`PS512`), a private key in JWK
+ * format, and the data bytes; returns the detached signature as a base64url
+ * string suitable for inline JSON envelopes (e.g. tamper-evident audit
+ * records that re-use the same key registry as bundle signing).
+ *
+ * Node-only — `crypto.createPrivateKey({ format: 'jwk' })` is not exposed in
+ * WebCrypto with the same shape, so audit signing is gated to Node runtimes.
+ *
+ * @param jwtAlg - JWT algorithm identifier (e.g. 'RS256', 'PS256')
+ * @param data - Bytes to sign
+ * @param privateJwk - Private key in JWK format
+ * @returns Base64url-encoded signature
+ */
+export declare function rsaSignBase64Url(jwtAlg: string, data: Buffer | Uint8Array, privateJwk: JsonWebKey): string;
+/**
+ * Verify an RSA / RSA-PSS / EdDSA signature synchronously.
+ *
+ * Node-only — mirrors {@link rsaSignBase64Url}'s sync, JWK-first surface so
+ * server-side callers (audit signer verifier, bundle signature verifier)
+ * have a single utility to call instead of touching `node:crypto` directly.
+ *
+ * - RS256/RS384/RS512 / PS256/PS384/PS512: pass `jwtAlg` and an RSA JWK.
+ * - EdDSA: pass `'EdDSA'` and an Ed25519 JWK (`kty: 'OKP'`, `crv: 'Ed25519'`).
+ *
+ * Returns `false` (never throws) for malformed keys / unsupported algs so
+ * callers can surface a single "verification failed" reason instead of
+ * branching on every internal crypto error.
+ *
+ * @param jwtAlg - JWT algorithm identifier (`'RS256'`, `'PS256'`, `'EdDSA'`, ...)
+ * @param data - Bytes that were signed
+ * @param publicJwk - Public key in JWK format
+ * @param signature - Signature bytes (raw, NOT base64url)
+ */
+export declare function rsaVerifySync(jwtAlg: string, data: Buffer | Uint8Array, publicJwk: JsonWebKey, signature: Buffer | Uint8Array): boolean;
+/**
+ * Convert a PEM-encoded public key (SPKI) to a JWK.
+ *
+ * Node-only. Used by host code that has historically configured trust roots
+ * as PEMs (bundle-signature trust list, audit verifier trust list) so the
+ * verifier path can normalize to JWK before calling {@link rsaVerifySync}.
+ *
+ * Throws if the PEM cannot be parsed — callers should catch and translate
+ * into a structured "malformed_public_key" reason where appropriate.
+ */
+export declare function pemToPublicJwk(pem: string): JsonWebKey;
 /**
  * Create a JWT signed with an RSA key
  *

package/crypto/node.js

@@ -36,8 +36,11 @@ __export(node_exports, {
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
   nodeCrypto: () => nodeCrypto,
+  pemToPublicJwk: () => pemToPublicJwk,
   rsaSign: () => rsaSign,
-  rsaVerify: () => rsaVerify
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifySync: () => rsaVerifySync
 });
 module.exports = __toCommonJS(node_exports);
 var import_node_crypto = __toESM(require("node:crypto"));
@@ -154,6 +157,39 @@ function rsaVerify(jwtAlg, data, publicJwk, signature) {
   } : publicKey;
   return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
 }
+function rsaSignBase64Url(jwtAlg, data, privateJwk) {
+  const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
+  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
+    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
+  }) : rsaSign(nodeAlgorithm, buf, privateKey);
+  return sig.toString("base64url");
+}
+function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
+  try {
+    const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
+    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
+    if (jwtAlg === "EdDSA") {
+      return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
+    }
+    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+    const verifyKey = isRsaPssAlg(jwtAlg) ? {
+      key: publicKey,
+      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
+    } : publicKey;
+    return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
+  } catch {
+    return false;
+  }
+}
+function pemToPublicJwk(pem) {
+  const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
+  return key.export({ format: "jwk" });
+}
 function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
   const header = { alg, typ: "JWT", kid };
   const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
@@ -180,6 +216,9 @@ function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
   isRsaPssAlg,
   jwtAlgToNodeAlg,
   nodeCrypto,
+  pemToPublicJwk,
   rsaSign,
-  rsaVerify
+  rsaSignBase64Url,
+  rsaVerify,
+  rsaVerifySync
 });

package/esm/crypto/node.mjs

@@ -113,6 +113,39 @@ function rsaVerify(jwtAlg, data, publicJwk, signature) {
   } : publicKey;
   return crypto.verify(nodeAlgorithm, data, verifyKey, signature);
 }
+function rsaSignBase64Url(jwtAlg, data, privateJwk) {
+  const privateKey = crypto.createPrivateKey({ key: privateJwk, format: "jwk" });
+  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
+  }) : rsaSign(nodeAlgorithm, buf, privateKey);
+  return sig.toString("base64url");
+}
+function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
+  try {
+    const publicKey = crypto.createPublicKey({ key: publicJwk, format: "jwk" });
+    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
+    if (jwtAlg === "EdDSA") {
+      return crypto.verify(null, dataBuf, publicKey, sigBuf);
+    }
+    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+    const verifyKey = isRsaPssAlg(jwtAlg) ? {
+      key: publicKey,
+      padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
+    } : publicKey;
+    return crypto.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
+  } catch {
+    return false;
+  }
+}
+function pemToPublicJwk(pem) {
+  const key = crypto.createPublicKey({ key: pem, format: "pem" });
+  return key.export({ format: "jwk" });
+}
 function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
   const header = { alg, typ: "JWT", kid };
   const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
@@ -138,6 +171,9 @@ export {
   isRsaPssAlg,
   jwtAlgToNodeAlg,
   nodeCrypto,
+  pemToPublicJwk,
   rsaSign,
-  rsaVerify
+  rsaSignBase64Url,
+  rsaVerify,
+  rsaVerifySync
 };

package/esm/index.mjs

@@ -123,6 +123,14 @@ async function stat(p) {
   const fsp = getFsp();
   return fsp.stat(p);
 }
+async function symlink(target, linkPath) {
+  const fsp = getFsp();
+  await fsp.symlink(target, linkPath);
+}
+async function realpath(p) {
+  const fsp = getFsp();
+  return fsp.realpath(p);
+}
 async function copyFile(src, dest) {
   const fsp = getFsp();
   await fsp.copyFile(src, dest);
@@ -2481,8 +2489,11 @@ __export(node_exports, {
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
   nodeCrypto: () => nodeCrypto,
+  pemToPublicJwk: () => pemToPublicJwk,
   rsaSign: () => rsaSign,
-  rsaVerify: () => rsaVerify
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifySync: () => rsaVerifySync
 });
 import crypto2 from "node:crypto";
 function toUint8Array(buf) {
@@ -2523,6 +2534,39 @@ function rsaVerify(jwtAlg, data, publicJwk, signature) {
   } : publicKey;
   return crypto2.verify(nodeAlgorithm, data, verifyKey, signature);
 }
+function rsaSignBase64Url(jwtAlg, data, privateJwk) {
+  const privateKey = crypto2.createPrivateKey({ key: privateJwk, format: "jwk" });
+  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
+    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
+  }) : rsaSign(nodeAlgorithm, buf, privateKey);
+  return sig.toString("base64url");
+}
+function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
+  try {
+    const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
+    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
+    if (jwtAlg === "EdDSA") {
+      return crypto2.verify(null, dataBuf, publicKey, sigBuf);
+    }
+    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+    const verifyKey = isRsaPssAlg(jwtAlg) ? {
+      key: publicKey,
+      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
+    } : publicKey;
+    return crypto2.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
+  } catch {
+    return false;
+  }
+}
+function pemToPublicJwk(pem) {
+  const key = crypto2.createPublicKey({ key: pem, format: "pem" });
+  return key.export({ format: "jwk" });
+}
 function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
   const header = { alg, typ: "JWT", kid };
   const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
@@ -2733,6 +2777,30 @@ function rsaVerify2(jwtAlg, data, publicJwk, signature) {
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
+function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+  if (!isNode()) {
+    throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+}
+function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+  if (!isNode()) {
+    throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
+  }
+  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+}
+function pemToPublicJwk2(pem) {
+  if (!isNode()) {
+    throw new Error("pemToPublicJwk is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+}
+function generateRsaKeyPair2(modulusLength, alg) {
+  if (!isNode()) {
+    throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+}
 function randomUUID() {
   return getCrypto().randomUUID();
 }
@@ -4036,19 +4104,26 @@ function parseUriTemplate(template) {
     throw new Error("URI template has too many parameters (max 50)");
   }
   const paramNames = [];
-  let regexStr = template.replace(/[.*+?^${}()|[\]\\]/g, (match) => {
-    if (match === "{" || match === "}") return match;
-    return "\\" + match;
-  });
-  regexStr = regexStr.replace(/\{([^{}]+)\}/g, (_, paramName) => {
-    paramNames.push(paramName);
-    return "([^/]+)";
-  });
+  const placeholder = /\{([^{}]+)\}/g;
+  let regexStr = "";
+  let lastIndex = 0;
+  for (let m = placeholder.exec(template); m !== null; m = placeholder.exec(template)) {
+    regexStr += escapeRegex(template.slice(lastIndex, m.index));
+    const raw = m[1];
+    const reserved = raw.startsWith("+");
+    paramNames.push(reserved ? raw.slice(1) : raw);
+    regexStr += reserved ? "(.+?)" : "([^/]+)";
+    lastIndex = m.index + m[0].length;
+  }
+  regexStr += escapeRegex(template.slice(lastIndex));
   return {
     pattern: new RegExp(`^${regexStr}$`),
     paramNames
   };
 }
+function escapeRegex(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
+}
 function matchUriTemplate(template, uri) {
   const { pattern, paramNames } = parseUriTemplate(template);
   const match = uri.match(pattern);
@@ -4060,18 +4135,37 @@ function matchUriTemplate(template, uri) {
   return params;
 }
 function expandUriTemplate(template, params) {
-  return template.replace(/\{([^{}]+)\}/g, (_, paramName) => {
+  return template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    const reserved = raw.startsWith("+");
+    const paramName = reserved ? raw.slice(1) : raw;
     const value = params[paramName];
     if (value === void 0) {
       throw new Error(`Missing parameter '${paramName}' for URI template '${template}'`);
     }
-    return encodeURIComponent(value);
+    return reserved ? encodeReserved(value) : encodeURIComponent(value);
   });
 }
+function encodeReserved(value) {
+  const decoded = safeDecode(value);
+  return decoded.replace(/[^A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/g, (c) => encodeURIComponent(c));
+}
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value.replace(/%[0-9A-Fa-f]{2}/g, (triplet) => {
+      try {
+        return decodeURIComponent(triplet);
+      } catch {
+        return triplet;
+      }
+    });
+  }
+}
 function extractTemplateParams(template) {
   const params = [];
-  template.replace(/\{([^{}]+)\}/g, (_, paramName) => {
-    params.push(paramName);
+  template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    params.push(raw.startsWith("+") ? raw.slice(1) : raw);
     return "";
   });
   return params;
@@ -4090,7 +4184,7 @@ function joinPath(...parts) {
 }
 
 // libs/utils/src/path/node-path.ts
-import { resolve, join, basename, dirname, extname } from "path";
+import { resolve, join, basename, dirname, extname, isAbsolute } from "path";
 
 // libs/utils/src/content/content.ts
 function sanitizeToJson(value) {
@@ -5421,6 +5515,7 @@ export {
   generateCodeChallenge,
   generateCodeVerifier,
   generatePkcePair,
+  generateRsaKeyPair2 as generateRsaKeyPair,
   generateSecret,
   getCookie,
   getCrypto,
@@ -5437,6 +5532,7 @@ export {
   hmacSha256,
   idFromString,
   inferMimeType,
+  isAbsolute,
   isAsymmetricKeyData,
   isBrowser,
   isDebug,
@@ -5477,6 +5573,7 @@ export {
   parseUriTemplate,
   join as pathJoin,
   resolve as pathResolve,
+  pemToPublicJwk2 as pemToPublicJwk,
   processPlatformToolCalls,
   randomBytes,
   randomUUID,
@@ -5485,11 +5582,14 @@ export {
   readFileSync,
   readJSON,
   readdir,
+  realpath,
   rename,
   resetRuntimeContext,
   resolveSecretPath,
   rm,
+  rsaSignBase64Url2 as rsaSignBase64Url,
   rsaVerify2 as rsaVerify,
+  rsaVerifySync2 as rsaVerifySync,
   runCmd,
   safeExec,
   safeJsonForScript,
@@ -5513,6 +5613,7 @@ export {
   splitWords,
   stat,
   supportsAnsi,
+  symlink,
   timingSafeEqual,
   toCase,
   trimBoth,

package/fs/fs.d.ts

@@ -160,6 +160,35 @@ export declare function ensureDir(p: string): Promise<void>;
  * if (stats.isDirectory()) { ... }
  */
 export declare function stat(p: string): Promise<import('fs').Stats>;
+/**
+ * Create a symbolic link at `linkPath` pointing to `target`.
+ *
+ * **Node.js only** - throws an error if called in browser.
+ *
+ * @param target - Path the symlink should point to
+ * @param linkPath - Where to create the symlink
+ *
+ * @example
+ * await symlink('/etc/hosts', '/tmp/hosts-link');
+ */
+export declare function symlink(target: string, linkPath: string): Promise<void>;
+/**
+ * Resolve a path, following symbolic links to their final target.
+ *
+ * **Node.js only** - throws an error if called in browser.
+ *
+ * Unlike `pathResolve`, this returns the canonical path with symlinks
+ * resolved, which is what callers need when validating that a path stays
+ * inside a trusted root (`startsWith` checks on `pathResolve` are
+ * symlink-bypassable).
+ *
+ * @param p - Path to resolve
+ * @returns Canonical absolute path with symlinks resolved
+ *
+ * @example
+ * const real = await realpath('/var/log/app.log');
+ */
+export declare function realpath(p: string): Promise<string>;
 /**
  * Copy a file.
  *

package/fs/index.d.ts

@@ -1 +1 @@
-export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, rm, mkdtemp, access, fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd, } from './fs';
+export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, realpath, rm, mkdtemp, symlink, access, fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd, } from './fs';

package/index.d.ts

@@ -9,14 +9,14 @@ export { splitWords, toCase, sepFor, shortHash, ensureMaxLen, idFromString } fro
 export type { NameCase } from './naming';
 export { isValidMcpUri, extractUriScheme, isValidMcpUriTemplate, parseUriTemplate, matchUriTemplate, expandUriTemplate, extractTemplateParams, isUriTemplate, } from './uri';
 export type { ParsedUriTemplate } from './uri';
-export { trimSlashes, joinPath, pathResolve, pathJoin, basename, dirname, extname } from './path';
+export { trimSlashes, joinPath, pathResolve, pathJoin, basename, dirname, extname, isAbsolute } from './path';
 export { sanitizeToJson, inferMimeType, findNonFiniteNumber } from './content';
 export { validateBaseUrl, buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest } from './http';
 export type { CookieOptions, SecureDetectionRequest } from './http';
-export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, rm, mkdtemp, access, fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd, } from './fs';
+export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, realpath, rm, mkdtemp, symlink, access, fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd, } from './fs';
 export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript } from './escape';
 export { safeStringify } from './serialization';
-export { getCrypto, rsaVerify, jwtAlgToNodeAlg, isRsaPssAlg, randomUUID, randomBytes, sha256, sha256Hex, sha256Base64url, hmacSha256, hkdfSha256, encryptAesGcm, decryptAesGcm, timingSafeEqual, bytesToHex, base64urlEncode, base64urlDecode, base64Encode, base64Decode, isNode, isBrowser, assertNode, EncryptedBlobError, encryptValue, decryptValue, tryDecryptValue, serializeBlob, deserializeBlob, tryDeserializeBlob, isValidEncryptedBlob, encryptAndSerialize, deserializeAndDecrypt, tryDeserializeAndDecrypt, generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkcePair, isValidCodeVerifier, isValidCodeChallenge, MIN_CODE_VERIFIER_LENGTH, MAX_CODE_VERIFIER_LENGTH, DEFAULT_CODE_VERIFIER_LENGTH, PkceError, type PkcePair, type SecretData, type SecretPersistenceOptions, type SecretValidationResult, secretDataSchema, validateSecretData, parseSecretData, isSecretPersistenceEnabled, resolveSecretPath, loadSecret, saveSecret, deleteSecret, generateSecret, createSecretData, getOrCreateSecret, clearCachedSecret, isSecretCached, type SignedData, type HmacSigningConfig, signData, verifyData, isSignedData, verifyOrParseData, type BaseKeyData, type SecretKeyData, type AsymmetricKeyData, type AnyKeyData, type KeyPersistenceOptions, type CreateKeyPersistenceOptions, type CreateSecretOptions, type CreateAsymmetricOptions, type KeyValidationResult, asymmetricAlgSchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema, validateKeyData, parseKeyData, isSecretKeyData, isAsymmetricKeyData, KeyPersistence, createKeyPersistence, createKeyPersistenceWithStorage, } from './crypto';
+export { getCrypto, rsaVerify, rsaVerifySync, pemToPublicJwk, generateRsaKeyPair, rsaSignBase64Url, type RsaJwk, type RsaKeyPair, jwtAlgToNodeAlg, isRsaPssAlg, randomUUID, randomBytes, sha256, sha256Hex, sha256Base64url, hmacSha256, hkdfSha256, encryptAesGcm, decryptAesGcm, timingSafeEqual, bytesToHex, base64urlEncode, base64urlDecode, base64Encode, base64Decode, isNode, isBrowser, assertNode, EncryptedBlobError, encryptValue, decryptValue, tryDecryptValue, serializeBlob, deserializeBlob, tryDeserializeBlob, isValidEncryptedBlob, encryptAndSerialize, deserializeAndDecrypt, tryDeserializeAndDecrypt, generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkcePair, isValidCodeVerifier, isValidCodeChallenge, MIN_CODE_VERIFIER_LENGTH, MAX_CODE_VERIFIER_LENGTH, DEFAULT_CODE_VERIFIER_LENGTH, PkceError, type PkcePair, type SecretData, type SecretPersistenceOptions, type SecretValidationResult, secretDataSchema, validateSecretData, parseSecretData, isSecretPersistenceEnabled, resolveSecretPath, loadSecret, saveSecret, deleteSecret, generateSecret, createSecretData, getOrCreateSecret, clearCachedSecret, isSecretCached, type SignedData, type HmacSigningConfig, signData, verifyData, isSignedData, verifyOrParseData, type BaseKeyData, type SecretKeyData, type AsymmetricKeyData, type AnyKeyData, type KeyPersistenceOptions, type CreateKeyPersistenceOptions, type CreateSecretOptions, type CreateAsymmetricOptions, type KeyValidationResult, asymmetricAlgSchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema, validateKeyData, parseKeyData, isSecretKeyData, isAsymmetricKeyData, KeyPersistence, createKeyPersistence, createKeyPersistenceWithStorage, } from './crypto';
 export type { CryptoProvider, EncBlob, EncryptedBlob } from './crypto';
 export { AsyncLocalStorage } from './async-context';
 export { EventEmitter } from './event-emitter';

package/index.js

@@ -128,6 +128,14 @@ async function stat(p) {
   const fsp = getFsp();
   return fsp.stat(p);
 }
+async function symlink(target, linkPath) {
+  const fsp = getFsp();
+  await fsp.symlink(target, linkPath);
+}
+async function realpath(p) {
+  const fsp = getFsp();
+  return fsp.realpath(p);
+}
 async function copyFile(src, dest) {
   const fsp = getFsp();
   await fsp.copyFile(src, dest);
@@ -2486,8 +2494,11 @@ __export(node_exports, {
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
   nodeCrypto: () => nodeCrypto,
+  pemToPublicJwk: () => pemToPublicJwk,
   rsaSign: () => rsaSign,
-  rsaVerify: () => rsaVerify
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifySync: () => rsaVerifySync
 });
 function toUint8Array(buf) {
   return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
@@ -2527,6 +2538,39 @@ function rsaVerify(jwtAlg, data, publicJwk, signature) {
   } : publicKey;
   return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
 }
+function rsaSignBase64Url(jwtAlg, data, privateJwk) {
+  const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
+  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
+    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
+  }) : rsaSign(nodeAlgorithm, buf, privateKey);
+  return sig.toString("base64url");
+}
+function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
+  try {
+    const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
+    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
+    if (jwtAlg === "EdDSA") {
+      return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
+    }
+    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
+    const verifyKey = isRsaPssAlg(jwtAlg) ? {
+      key: publicKey,
+      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
+    } : publicKey;
+    return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
+  } catch {
+    return false;
+  }
+}
+function pemToPublicJwk(pem) {
+  const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
+  return key.export({ format: "jwk" });
+}
 function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
   const header = { alg, typ: "JWT", kid };
   const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
@@ -2737,6 +2781,30 @@ function rsaVerify2(jwtAlg, data, publicJwk, signature) {
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
+function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+  if (!isNode()) {
+    throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+}
+function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+  if (!isNode()) {
+    throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
+  }
+  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+}
+function pemToPublicJwk2(pem) {
+  if (!isNode()) {
+    throw new Error("pemToPublicJwk is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+}
+function generateRsaKeyPair2(modulusLength, alg) {
+  if (!isNode()) {
+    throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
+  }
+  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+}
 function randomUUID() {
   return getCrypto().randomUUID();
 }
@@ -2845,8 +2913,8 @@ var import_crypto_provider2, HKDF_SHA256_MAX_LENGTH;
 var init_crypto = __esm({
   "libs/utils/src/crypto/index.ts"() {
     "use strict";
-    init_runtime();
     import_crypto_provider2 = require("#crypto-provider");
+    init_runtime();
     init_jwt_alg();
     init_runtime();
     init_encrypted_blob();
@@ -3809,6 +3877,7 @@ __export(index_exports, {
   generateCodeChallenge: () => generateCodeChallenge,
   generateCodeVerifier: () => generateCodeVerifier,
   generatePkcePair: () => generatePkcePair,
+  generateRsaKeyPair: () => generateRsaKeyPair2,
   generateSecret: () => generateSecret,
   getCookie: () => getCookie,
   getCrypto: () => getCrypto,
@@ -3825,6 +3894,7 @@ __export(index_exports, {
   hmacSha256: () => hmacSha256,
   idFromString: () => idFromString,
   inferMimeType: () => inferMimeType,
+  isAbsolute: () => import_path.isAbsolute,
   isAsymmetricKeyData: () => isAsymmetricKeyData,
   isBrowser: () => isBrowser,
   isDebug: () => import_env3.isDebug,
@@ -3865,6 +3935,7 @@ __export(index_exports, {
   parseUriTemplate: () => parseUriTemplate,
   pathJoin: () => import_path.join,
   pathResolve: () => import_path.resolve,
+  pemToPublicJwk: () => pemToPublicJwk2,
   processPlatformToolCalls: () => processPlatformToolCalls,
   randomBytes: () => randomBytes,
   randomUUID: () => randomUUID,
@@ -3873,11 +3944,14 @@ __export(index_exports, {
   readFileSync: () => readFileSync,
   readJSON: () => readJSON,
   readdir: () => readdir,
+  realpath: () => realpath,
   rename: () => rename,
   resetRuntimeContext: () => resetRuntimeContext,
   resolveSecretPath: () => resolveSecretPath,
   rm: () => rm,
+  rsaSignBase64Url: () => rsaSignBase64Url2,
   rsaVerify: () => rsaVerify2,
+  rsaVerifySync: () => rsaVerifySync2,
   runCmd: () => runCmd,
   safeExec: () => safeExec,
   safeJsonForScript: () => safeJsonForScript,
@@ -3901,6 +3975,7 @@ __export(index_exports, {
   splitWords: () => splitWords,
   stat: () => stat,
   supportsAnsi: () => import_env3.supportsAnsi,
+  symlink: () => symlink,
   timingSafeEqual: () => timingSafeEqual,
   toCase: () => toCase,
   trimBoth: () => trimBoth,
@@ -4249,19 +4324,26 @@ function parseUriTemplate(template) {
     throw new Error("URI template has too many parameters (max 50)");
   }
   const paramNames = [];
-  let regexStr = template.replace(/[.*+?^${}()|[\]\\]/g, (match) => {
-    if (match === "{" || match === "}") return match;
-    return "\\" + match;
-  });
-  regexStr = regexStr.replace(/\{([^{}]+)\}/g, (_, paramName) => {
-    paramNames.push(paramName);
-    return "([^/]+)";
-  });
+  const placeholder = /\{([^{}]+)\}/g;
+  let regexStr = "";
+  let lastIndex = 0;
+  for (let m = placeholder.exec(template); m !== null; m = placeholder.exec(template)) {
+    regexStr += escapeRegex(template.slice(lastIndex, m.index));
+    const raw = m[1];
+    const reserved = raw.startsWith("+");
+    paramNames.push(reserved ? raw.slice(1) : raw);
+    regexStr += reserved ? "(.+?)" : "([^/]+)";
+    lastIndex = m.index + m[0].length;
+  }
+  regexStr += escapeRegex(template.slice(lastIndex));
   return {
     pattern: new RegExp(`^${regexStr}$`),
     paramNames
   };
 }
+function escapeRegex(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
+}
 function matchUriTemplate(template, uri) {
   const { pattern, paramNames } = parseUriTemplate(template);
   const match = uri.match(pattern);
@@ -4273,18 +4355,37 @@ function matchUriTemplate(template, uri) {
   return params;
 }
 function expandUriTemplate(template, params) {
-  return template.replace(/\{([^{}]+)\}/g, (_, paramName) => {
+  return template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    const reserved = raw.startsWith("+");
+    const paramName = reserved ? raw.slice(1) : raw;
     const value = params[paramName];
     if (value === void 0) {
       throw new Error(`Missing parameter '${paramName}' for URI template '${template}'`);
     }
-    return encodeURIComponent(value);
+    return reserved ? encodeReserved(value) : encodeURIComponent(value);
   });
 }
+function encodeReserved(value) {
+  const decoded = safeDecode(value);
+  return decoded.replace(/[^A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/g, (c) => encodeURIComponent(c));
+}
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value.replace(/%[0-9A-Fa-f]{2}/g, (triplet) => {
+      try {
+        return decodeURIComponent(triplet);
+      } catch {
+        return triplet;
+      }
+    });
+  }
+}
 function extractTemplateParams(template) {
   const params = [];
-  template.replace(/\{([^{}]+)\}/g, (_, paramName) => {
-    params.push(paramName);
+  template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    params.push(raw.startsWith("+") ? raw.slice(1) : raw);
     return "";
   });
   return params;
@@ -5624,6 +5725,7 @@ function setMachineIdOverride(id) {
   generateCodeChallenge,
   generateCodeVerifier,
   generatePkcePair,
+  generateRsaKeyPair,
   generateSecret,
   getCookie,
   getCrypto,
@@ -5640,6 +5742,7 @@ function setMachineIdOverride(id) {
   hmacSha256,
   idFromString,
   inferMimeType,
+  isAbsolute,
   isAsymmetricKeyData,
   isBrowser,
   isDebug,
@@ -5680,6 +5783,7 @@ function setMachineIdOverride(id) {
   parseUriTemplate,
   pathJoin,
   pathResolve,
+  pemToPublicJwk,
   processPlatformToolCalls,
   randomBytes,
   randomUUID,
@@ -5688,11 +5792,14 @@ function setMachineIdOverride(id) {
   readFileSync,
   readJSON,
   readdir,
+  realpath,
   rename,
   resetRuntimeContext,
   resolveSecretPath,
   rm,
+  rsaSignBase64Url,
   rsaVerify,
+  rsaVerifySync,
   runCmd,
   safeExec,
   safeJsonForScript,
@@ -5716,6 +5823,7 @@ function setMachineIdOverride(id) {
   splitWords,
   stat,
   supportsAnsi,
+  symlink,
   timingSafeEqual,
   toCase,
   trimBoth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/utils",
-  "version": "1.1.2",
+  "version": "1.2.1",
   "description": "Shared utility functions for FrontMCP - string manipulation, URI handling, path utilities, and more",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -34,7 +34,7 @@
   "peerDependencies": {
     "@vercel/kv": "^2.0.0 || ^3.0.0",
     "ioredis": "^5.0.0",
-    "@frontmcp/lazy-zod": "1.1.2"
+    "@frontmcp/lazy-zod": "1.2.1"
   },
   "peerDependenciesMeta": {
     "@vercel/kv": {

package/path/browser-path.d.ts

@@ -3,3 +3,4 @@ export declare function join(..._segments: string[]): string;
 export declare function basename(p: string, ext?: string): string;
 export declare function dirname(_p: string): string;
 export declare function extname(p: string): string;
+export declare function isAbsolute(p: string): boolean;

package/path/index.d.ts

@@ -1,2 +1,2 @@
 export { trimSlashes, joinPath } from './path';
-export { resolve as pathResolve, join as pathJoin, basename, dirname, extname } from '#path';
+export { resolve as pathResolve, join as pathJoin, basename, dirname, extname, isAbsolute } from '#path';

package/path/node-path.d.ts

@@ -1 +1 @@
-export { resolve, join, basename, dirname, extname } from 'path';
+export { resolve, join, basename, dirname, extname, isAbsolute } from 'path';

package/uri/uri-template.d.ts

@@ -1,9 +1,16 @@
 /**
- * RFC 6570 Level 1 URI Template utilities.
- *
- * Provides parsing, matching, and expansion of URI templates using simple
- * string substitution ({param} syntax). This implements RFC 6570 Level 1 only;
- * advanced operators like {+path}, {#fragment}, or {?query} are not supported.
+ * RFC 6570 URI Template utilities.
+ *
+ * Implements:
+ *   - Level 1 simple string expansion (`{var}`) — value is percent-encoded,
+ *     stops at `/`.
+ *   - Level 2 reserved expansion (`{+var}`) — value passes reserved characters
+ *     (including `/`) through unencoded, so a single template variable can
+ *     span multiple path segments (e.g. `skill://{+skillPath}/SKILL.md`
+ *     matches `skill://acme/billing/refunds/SKILL.md`).
+ *
+ * Other RFC 6570 operators (`{#frag}`, `{?query}`, `{&qcont}`, `{;path}`,
+ * `{.label}`, `{/path}`) are not supported.
  */
 /**
  * Parsed URI template information.
@@ -15,8 +22,8 @@ export interface ParsedUriTemplate {
     paramNames: string[];
 }
 /**
- * Parse a URI template (RFC 6570 Level 1) into a regex pattern and parameter names.
- * Supports simple string substitution: {param}
+ * Parse a URI template (RFC 6570 Level 1 + reserved expansion) into a regex
+ * pattern and parameter names.
  *
  * @param template - The URI template to parse
  * @returns Parsed template with pattern and parameter names
@@ -28,6 +35,9 @@ export interface ParsedUriTemplate {
  *
  * parseUriTemplate("users/{userId}/posts/{postId}")
  * // { pattern: /^users\/([^/]+)\/posts\/([^/]+)$/, paramNames: ["userId", "postId"] }
+ *
+ * parseUriTemplate("skill://{+skillPath}/SKILL.md")
+ * // { pattern: /^skill:\/\/(.+?)\/SKILL\.md$/, paramNames: ["skillPath"] }
  */
 export declare function parseUriTemplate(template: string): ParsedUriTemplate;
 /**
@@ -52,12 +62,19 @@ export declare function matchUriTemplate(template: string, uri: string): Record<
 /**
  * Expand a URI template with the given parameters.
  *
- * Parameter values are **percent-encoded** per RFC 6570 Level 1 using
- * `encodeURIComponent()`. Use {@link matchUriTemplate} to decode them back.
+ * Encoding depends on the operator:
+ *   - `{var}` (simple expansion): value is percent-encoded via
+ *     `encodeURIComponent()` so `/`, `:`, etc. become `%2F`, `%3A`.
+ *   - `{+var}` (reserved expansion): unreserved + reserved characters
+ *     (per RFC 3986) pass through unencoded — only characters outside
+ *     that set are percent-encoded. This lets a single variable carry
+ *     a multi-segment path.
+ *
+ * Use {@link matchUriTemplate} to decode them back.
  *
  * @param template - The URI template
  * @param params - Object with parameter values (raw, unencoded)
- * @returns Expanded URI with parameters percent-encoded and substituted
+ * @returns Expanded URI with parameters substituted (encoding depends on operator)
  * @throws Error if a required parameter is missing
  *
  * @example
@@ -67,9 +84,13 @@ export declare function matchUriTemplate(template: string, uri: string): Record<
  * expandUriTemplate("users/{userId}/posts/{postId}", { userId: "123", postId: "456" })
  * // "users/123/posts/456"
  *
- * // Special characters are percent-encoded:
+ * // Simple expansion percent-encodes reserved chars:
  * expandUriTemplate("notes://{id}", { id: "x-coredata://ABC/Note/1" })
  * // "notes://x-coredata%3A%2F%2FABC%2FNote%2F1"
+ *
+ * // Reserved expansion preserves them:
+ * expandUriTemplate("skill://{+skillPath}/SKILL.md", { skillPath: "acme/billing" })
+ * // "skill://acme/billing/SKILL.md"
  */
 export declare function expandUriTemplate(template: string, params: Record<string, string>): string;
 /**

package/CHANGELOG.md

@@ -1,12 +0,0 @@
-# Changelog
-
-## 0.0.1
-
-- Initial release
-- Extracted utilities from @frontmcp/sdk, @frontmcp/cli, and @frontmcp/adapters
-- Added naming utilities: splitWords, toCase, sepFor, shortHash, ensureMaxLen, idFromString
-- Added URI utilities: isValidMcpUri, extractUriScheme, isValidMcpUriTemplate, parseUriTemplate, matchUriTemplate, expandUriTemplate, extractTemplateParams, isUriTemplate
-- Added path utilities: trimSlashes, joinPath
-- Added content utilities: sanitizeToJson, inferMimeType
-- Added HTTP utilities: validateBaseUrl
-- Added FS utilities: fileExists, readJSON, writeJSON, ensureDir, isDirEmpty, runCmd