@frontmcp/utils 1.10.16 → 1.11.0-rc.2

package/browser/uri/uri-template.mjs

@@ -0,0 +1,86 @@
+// libs/utils/src/uri/uri-template.ts
+function parseUriTemplate(template) {
+  if (template.length > 1e3) {
+    throw new Error("URI template too long (max 1000 characters)");
+  }
+  const paramCount = (template.match(/\{[^{}]+\}/g) || []).length;
+  if (paramCount > 50) {
+    throw new Error("URI template has too many parameters (max 50)");
+  }
+  const paramNames = [];
+  const placeholder = /\{([^{}]+)\}/g;
+  let regexStr = "";
+  let lastIndex = 0;
+  for (let m = placeholder.exec(template); m !== null; m = placeholder.exec(template)) {
+    regexStr += escapeRegex(template.slice(lastIndex, m.index));
+    const raw = m[1];
+    const reserved = raw.startsWith("+");
+    paramNames.push(reserved ? raw.slice(1) : raw);
+    regexStr += reserved ? "(.+?)" : "([^/]+)";
+    lastIndex = m.index + m[0].length;
+  }
+  regexStr += escapeRegex(template.slice(lastIndex));
+  return {
+    pattern: new RegExp(`^${regexStr}$`),
+    paramNames
+  };
+}
+function escapeRegex(literal) {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, (c) => `\\${c}`);
+}
+function matchUriTemplate(template, uri) {
+  const { pattern, paramNames } = parseUriTemplate(template);
+  const match = uri.match(pattern);
+  if (!match) return null;
+  const params = {};
+  paramNames.forEach((name, index) => {
+    params[name] = decodeURIComponent(match[index + 1]);
+  });
+  return params;
+}
+function expandUriTemplate(template, params) {
+  return template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    const reserved = raw.startsWith("+");
+    const paramName = reserved ? raw.slice(1) : raw;
+    const value = params[paramName];
+    if (value === void 0) {
+      throw new Error(`Missing parameter '${paramName}' for URI template '${template}'`);
+    }
+    return reserved ? encodeReserved(value) : encodeURIComponent(value);
+  });
+}
+function encodeReserved(value) {
+  const decoded = safeDecode(value);
+  return decoded.replace(/[^A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/g, (c) => encodeURIComponent(c));
+}
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value.replace(/%[0-9A-Fa-f]{2}/g, (triplet) => {
+      try {
+        return decodeURIComponent(triplet);
+      } catch {
+        return triplet;
+      }
+    });
+  }
+}
+function extractTemplateParams(template) {
+  const params = [];
+  template.replace(/\{([^{}]+)\}/g, (_, raw) => {
+    params.push(raw.startsWith("+") ? raw.slice(1) : raw);
+    return "";
+  });
+  return params;
+}
+function isUriTemplate(uri) {
+  return /\{[^{}]+\}/.test(uri);
+}
+export {
+  expandUriTemplate,
+  extractTemplateParams,
+  isUriTemplate,
+  matchUriTemplate,
+  parseUriTemplate
+};

package/browser/uri/uri-validation.mjs

@@ -0,0 +1,18 @@
+// libs/utils/src/uri/uri-validation.ts
+var RFC_3986_SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+var SCHEME_EXTRACT_PATTERN = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+function isValidMcpUri(uri) {
+  return RFC_3986_SCHEME_PATTERN.test(uri);
+}
+function extractUriScheme(uri) {
+  const match = uri.match(SCHEME_EXTRACT_PATTERN);
+  return match ? match[1].toLowerCase() : null;
+}
+function isValidMcpUriTemplate(uriTemplate) {
+  return RFC_3986_SCHEME_PATTERN.test(uriTemplate);
+}
+export {
+  extractUriScheme,
+  isValidMcpUri,
+  isValidMcpUriTemplate
+};

package/crypto/browser.d.ts

@@ -17,16 +17,4 @@ export declare function rsaVerifySync(): boolean;
 export declare function pemToPublicJwk(): JsonWebKey;
 export declare function generateRsaKeyPair(): never;
 export { isRsaPssAlg, jwtAlgToWebCryptoAlg } from './jwt-alg';
-/**
- * Verify an RSA signature using WebCrypto.
- *
- * Supports RS256/RS384/RS512 (RSASSA-PKCS1-v1_5) and PS256/PS384/PS512 (RSA-PSS).
- * Works in both browsers and Node.js environments that provide `crypto.subtle`.
- *
- * @param jwtAlg - JWT algorithm identifier (e.g. 'RS256', 'PS256')
- * @param data - The signed data (e.g. `headerB64.payloadB64`)
- * @param publicJwk - Public key in JWK format
- * @param signature - The signature bytes
- * @returns true if the signature is valid
- */
-export declare function rsaVerifyBrowser(jwtAlg: string, data: Uint8Array, publicJwk: JsonWebKey, signature: Uint8Array): Promise<boolean>;
+export { rsaVerifyBrowser } from './web-rsa';

package/crypto/browser.js

@@ -1 +1 @@
-"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var browser_exports={};__export(browser_exports,{browserCrypto:()=>browserCrypto,cryptoProvider:()=>browserCrypto,generateRsaKeyPair:()=>generateRsaKeyPair,isRsaPssAlg:()=>isRsaPssAlg,jwtAlgToWebCryptoAlg:()=>jwtAlgToWebCryptoAlg,pemToPublicJwk:()=>pemToPublicJwk,rsaSignBase64Url:()=>rsaSignBase64Url,rsaVerify:()=>rsaVerify,rsaVerifyBrowser:()=>rsaVerifyBrowser,rsaVerifySync:()=>rsaVerifySync});module.exports=__toCommonJS(browser_exports);var import_aes=require("@noble/ciphers/aes.js");var import_hkdf=require("@noble/hashes/hkdf.js");var import_hmac=require("@noble/hashes/hmac.js");var import_sha2=require("@noble/hashes/sha2.js");var import_utils=require("@noble/hashes/utils.js");function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}var JWT_ALG_TO_WEB_CRYPTO={RS256:"SHA-256",RS384:"SHA-384",RS512:"SHA-512",PS256:"SHA-256",PS384:"SHA-384",PS512:"SHA-512"};function jwtAlgToWebCryptoAlg(jwtAlg){const webAlg=JWT_ALG_TO_WEB_CRYPTO[jwtAlg];if(!webAlg){throw new Error(`Unsupported JWT algorithm for WebCrypto: ${jwtAlg}`)}return webAlg}function toBytes(data){if(typeof data==="string"){return new TextEncoder().encode(data)}return data}function toHex(bytes){return Array.from(bytes).map(b=>b.toString(16).padStart(2,"0")).join("")}function generateUUID(){if(typeof crypto!=="undefined"&&typeof crypto.randomUUID==="function"){return crypto.randomUUID()}const bytes=(0,import_utils.randomBytes)(16);bytes[6]=bytes[6]&15|64;bytes[8]=bytes[8]&63|128;const hex=toHex(bytes);return`${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`}function constantTimeEqual(a,b){if(a.length!==b.length)return false;let result=0;for(let i=0;i<a.length;i++){result|=a[i]^b[i]}return result===0}var browserCrypto={randomUUID(){return generateUUID()},randomBytes(length){return(0,import_utils.randomBytes)(length)},sha256(data){return(0,import_sha2.sha256)(toBytes(data))},sha256Hex(data){return toHex((0,import_sha2.sha256)(toBytes(data)))},hmacSha256(key,data){return(0,import_hmac.hmac)(import_sha2.sha256,key,data)},hkdfSha256(ikm,salt,info,length){const effectiveSalt=salt.length>0?salt:new Uint8Array(32);return(0,import_hkdf.hkdf)(import_sha2.sha256,ikm,effectiveSalt,info,length)},encryptAesGcm(key,plaintext,iv){const cipher=(0,import_aes.gcm)(key,iv);const sealed=cipher.encrypt(plaintext);const ciphertext=sealed.slice(0,-16);const tag=sealed.slice(-16);return{ciphertext,tag}},decryptAesGcm(key,ciphertext,iv,tag){const cipher=(0,import_aes.gcm)(key,iv);const sealed=new Uint8Array(ciphertext.length+tag.length);sealed.set(ciphertext);sealed.set(tag,ciphertext.length);return cipher.decrypt(sealed)},timingSafeEqual(a,b){return constantTimeEqual(a,b)}};function nodeOnly(name){throw new Error(`${name} is only available in Node.js runtimes`)}function rsaVerify(){return nodeOnly("rsaVerify")}function rsaSignBase64Url(){return nodeOnly("rsaSignBase64Url")}function rsaVerifySync(){return nodeOnly("rsaVerifySync")}function pemToPublicJwk(){return nodeOnly("pemToPublicJwk")}function generateRsaKeyPair(){return nodeOnly("generateRsaKeyPair")}async function rsaVerifyBrowser(jwtAlg,data,publicJwk,signature){if(typeof globalThis.crypto?.subtle==="undefined"){throw new Error("WebCrypto API (crypto.subtle) is not available in this environment")}const webAlg=jwtAlgToWebCryptoAlg(jwtAlg);const isPss=isRsaPssAlg(jwtAlg);const algorithm={name:isPss?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:{name:webAlg}};const key=await globalThis.crypto.subtle.importKey("jwk",publicJwk,algorithm,false,["verify"]);const verifyAlgorithm=isPss?{name:"RSA-PSS",saltLength:getSaltLength(jwtAlg)}:{name:"RSASSA-PKCS1-v1_5"};const sigBuf=new Uint8Array(signature).buffer;const dataBuf=new Uint8Array(data).buffer;return globalThis.crypto.subtle.verify(verifyAlgorithm,key,sigBuf,dataBuf)}function getSaltLength(jwtAlg){switch(jwtAlg){case"PS256":return 32;case"PS384":return 48;case"PS512":return 64;default:return 32}}0&&(module.exports={browserCrypto,cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToWebCryptoAlg,pemToPublicJwk,rsaSignBase64Url,rsaVerify,rsaVerifyBrowser,rsaVerifySync});
+"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var browser_exports={};__export(browser_exports,{browserCrypto:()=>browserCrypto,cryptoProvider:()=>browserCrypto,generateRsaKeyPair:()=>generateRsaKeyPair,isRsaPssAlg:()=>isRsaPssAlg,jwtAlgToWebCryptoAlg:()=>jwtAlgToWebCryptoAlg,pemToPublicJwk:()=>pemToPublicJwk,rsaSignBase64Url:()=>rsaSignBase64Url,rsaVerify:()=>rsaVerify,rsaVerifyBrowser:()=>rsaVerifyBrowser,rsaVerifySync:()=>rsaVerifySync});module.exports=__toCommonJS(browser_exports);var import_aes=require("@noble/ciphers/aes.js");var import_hkdf=require("@noble/hashes/hkdf.js");var import_hmac=require("@noble/hashes/hmac.js");var import_sha2=require("@noble/hashes/sha2.js");var import_utils=require("@noble/hashes/utils.js");function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}var JWT_ALG_TO_WEB_CRYPTO={RS256:"SHA-256",RS384:"SHA-384",RS512:"SHA-512",PS256:"SHA-256",PS384:"SHA-384",PS512:"SHA-512"};function jwtAlgToWebCryptoAlg(jwtAlg){const webAlg=JWT_ALG_TO_WEB_CRYPTO[jwtAlg];if(!webAlg){throw new Error(`Unsupported JWT algorithm for WebCrypto: ${jwtAlg}`)}return webAlg}async function rsaVerifyBrowser(jwtAlg,data,publicJwk,signature){if(typeof globalThis.crypto?.subtle==="undefined"){throw new Error("WebCrypto API (crypto.subtle) is not available in this environment")}const webAlg=jwtAlgToWebCryptoAlg(jwtAlg);const isPss=isRsaPssAlg(jwtAlg);const algorithm={name:isPss?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:{name:webAlg}};const key=await globalThis.crypto.subtle.importKey("jwk",publicJwk,algorithm,false,["verify"]);const verifyAlgorithm=isPss?{name:"RSA-PSS",saltLength:getSaltLength(jwtAlg)}:{name:"RSASSA-PKCS1-v1_5"};const sigBuf=new Uint8Array(signature).buffer;const dataBuf=new Uint8Array(data).buffer;return globalThis.crypto.subtle.verify(verifyAlgorithm,key,sigBuf,dataBuf)}function getSaltLength(jwtAlg){switch(jwtAlg){case"PS256":return 32;case"PS384":return 48;case"PS512":return 64;default:return 32}}function toBytes(data){if(typeof data==="string"){return new TextEncoder().encode(data)}return data}function toHex(bytes){return Array.from(bytes).map(b=>b.toString(16).padStart(2,"0")).join("")}function generateUUID(){if(typeof crypto!=="undefined"&&typeof crypto.randomUUID==="function"){return crypto.randomUUID()}const bytes=(0,import_utils.randomBytes)(16);bytes[6]=bytes[6]&15|64;bytes[8]=bytes[8]&63|128;const hex=toHex(bytes);return`${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`}function constantTimeEqual(a,b){if(a.length!==b.length)return false;let result=0;for(let i=0;i<a.length;i++){result|=a[i]^b[i]}return result===0}var browserCrypto={randomUUID(){return generateUUID()},randomBytes(length){return(0,import_utils.randomBytes)(length)},sha256(data){return(0,import_sha2.sha256)(toBytes(data))},sha256Hex(data){return toHex((0,import_sha2.sha256)(toBytes(data)))},hmacSha256(key,data){return(0,import_hmac.hmac)(import_sha2.sha256,key,data)},hkdfSha256(ikm,salt,info,length){const effectiveSalt=salt.length>0?salt:new Uint8Array(32);return(0,import_hkdf.hkdf)(import_sha2.sha256,ikm,effectiveSalt,info,length)},encryptAesGcm(key,plaintext,iv){const cipher=(0,import_aes.gcm)(key,iv);const sealed=cipher.encrypt(plaintext);const ciphertext=sealed.slice(0,-16);const tag=sealed.slice(-16);return{ciphertext,tag}},decryptAesGcm(key,ciphertext,iv,tag){const cipher=(0,import_aes.gcm)(key,iv);const sealed=new Uint8Array(ciphertext.length+tag.length);sealed.set(ciphertext);sealed.set(tag,ciphertext.length);return cipher.decrypt(sealed)},timingSafeEqual(a,b){return constantTimeEqual(a,b)}};function nodeOnly(name){throw new Error(`${name} is only available in Node.js runtimes`)}function rsaVerify(){return nodeOnly("rsaVerify")}function rsaSignBase64Url(){return nodeOnly("rsaSignBase64Url")}function rsaVerifySync(){return nodeOnly("rsaVerifySync")}function pemToPublicJwk(){return nodeOnly("pemToPublicJwk")}function generateRsaKeyPair(){return nodeOnly("generateRsaKeyPair")}0&&(module.exports={browserCrypto,cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToWebCryptoAlg,pemToPublicJwk,rsaSignBase64Url,rsaVerify,rsaVerifyBrowser,rsaVerifySync});

package/crypto/node.js

@@ -1 +1 @@
-"use strict";var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoOf=Object.getPrototypeOf;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toESM=(mod,isNodeMode,target)=>(target=mod!=null?__create(__getProtoOf(mod)):{},__copyProps(isNodeMode||!mod||!mod.__esModule?__defProp(target,"default",{value:mod,enumerable:true}):target,mod));var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var node_exports={};__export(node_exports,{createSignedJwt:()=>createSignedJwt,cryptoProvider:()=>nodeCrypto,generateRsaKeyPair:()=>generateRsaKeyPair,isRsaPssAlg:()=>isRsaPssAlg,jwtAlgToNodeAlg:()=>jwtAlgToNodeAlg,nodeCrypto:()=>nodeCrypto,pemToPublicJwk:()=>pemToPublicJwk,rsaSign:()=>rsaSign,rsaSignBase64Url:()=>rsaSignBase64Url,rsaVerify:()=>rsaVerify,rsaVerifySync:()=>rsaVerifySync});module.exports=__toCommonJS(node_exports);var import_node_crypto=__toESM(require("node:crypto"));var JWT_ALG_TO_NODE_DIGEST={RS256:"RSA-SHA256",RS384:"RSA-SHA384",RS512:"RSA-SHA512",PS256:"RSA-SHA256",PS384:"RSA-SHA384",PS512:"RSA-SHA512"};function jwtAlgToNodeAlg(jwtAlg){const nodeAlg=JWT_ALG_TO_NODE_DIGEST[jwtAlg];if(!nodeAlg){throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`)}return nodeAlg}function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}function toUint8Array(buf){return new Uint8Array(buf.buffer,buf.byteOffset,buf.byteLength)}function toBuffer(data){if(typeof data==="string"){return Buffer.from(data,"utf8")}return Buffer.from(data)}var nodeCrypto={randomUUID(){return import_node_crypto.default.randomUUID()},randomBytes(length){return toUint8Array(import_node_crypto.default.randomBytes(length))},sha256(data){const hash=import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest();return toUint8Array(hash)},sha256Hex(data){return import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest("hex")},hmacSha256(key,data){const hmac=import_node_crypto.default.createHmac("sha256",Buffer.from(key)).update(Buffer.from(data)).digest();return toUint8Array(hmac)},hkdfSha256(ikm,salt,info,length){const ikmBuf=Buffer.from(ikm);const saltBuf=salt.length>0?Buffer.from(salt):Buffer.alloc(32);const prk=import_node_crypto.default.createHmac("sha256",saltBuf).update(ikmBuf).digest();const hashLen=32;const n=Math.ceil(length/hashLen);const chunks=[];let prev=Buffer.alloc(0);for(let i=1;i<=n;i++){prev=import_node_crypto.default.createHmac("sha256",prk).update(Buffer.concat([prev,Buffer.from(info),Buffer.from([i])])).digest();chunks.push(prev)}return toUint8Array(Buffer.concat(chunks).subarray(0,length))},encryptAesGcm(key,plaintext,iv){const cipher=import_node_crypto.default.createCipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));const encrypted=Buffer.concat([cipher.update(Buffer.from(plaintext)),cipher.final()]);const tag=cipher.getAuthTag();return{ciphertext:toUint8Array(encrypted),tag:toUint8Array(tag)}},decryptAesGcm(key,ciphertext,iv,tag){const decipher=import_node_crypto.default.createDecipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));decipher.setAuthTag(Buffer.from(tag));const decrypted=Buffer.concat([decipher.update(Buffer.from(ciphertext)),decipher.final()]);return toUint8Array(decrypted)},timingSafeEqual(a,b){if(a.length!==b.length)return false;return import_node_crypto.default.timingSafeEqual(Buffer.from(a),Buffer.from(b))}};function generateRsaKeyPair(modulusLength=2048,alg="RS256"){const kid=`rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;const{privateKey,publicKey}=import_node_crypto.default.generateKeyPairSync("rsa",{modulusLength});const exported=publicKey.export({format:"jwk"});const publicJwk={...exported,kid,alg,use:"sig",kty:"RSA"};return{privateKey,publicKey,publicJwk}}function rsaSign(algorithm,data,privateKey,options){const signingKey=options?{key:privateKey,...options}:privateKey;return import_node_crypto.default.sign(algorithm,data,signingKey)}function rsaVerify(jwtAlg,data,publicJwk,signature){const publicKey=import_node_crypto.default.createPublicKey({key:publicJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return import_node_crypto.default.verify(nodeAlgorithm,data,verifyKey,signature)}function rsaSignBase64Url(jwtAlg,data,privateJwk){const privateKey=import_node_crypto.default.createPrivateKey({key:privateJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const buf=Buffer.isBuffer(data)?data:Buffer.from(data);const sig=isRsaPssAlg(jwtAlg)?rsaSign(nodeAlgorithm,buf,privateKey,{padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}):rsaSign(nodeAlgorithm,buf,privateKey);return sig.toString("base64url")}function rsaVerifySync(jwtAlg,data,publicJwk,signature){try{const publicKey=import_node_crypto.default.createPublicKey({key:publicJwk,format:"jwk"});const dataBuf=Buffer.isBuffer(data)?data:Buffer.from(data);const sigBuf=Buffer.isBuffer(signature)?signature:Buffer.from(signature);if(jwtAlg==="EdDSA"){return import_node_crypto.default.verify(null,dataBuf,publicKey,sigBuf)}const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return import_node_crypto.default.verify(nodeAlgorithm,dataBuf,verifyKey,sigBuf)}catch{return false}}function pemToPublicJwk(pem){const key=import_node_crypto.default.createPublicKey({key:pem,format:"pem"});return key.export({format:"jwk"})}function createSignedJwt(payload,privateKey,kid,alg="RS256"){const header={alg,typ:"JWT",kid};const headerB64=Buffer.from(JSON.stringify(header)).toString("base64url");const payloadB64=Buffer.from(JSON.stringify(payload)).toString("base64url");const signatureInput=`${headerB64}.${payloadB64}`;const nodeAlgorithm=jwtAlgToNodeAlg(alg);const signature=rsaSign(nodeAlgorithm,Buffer.from(signatureInput),privateKey,isRsaPssAlg(alg)?{padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:void 0);const signatureB64=signature.toString("base64url");return`${headerB64}.${payloadB64}.${signatureB64}`}0&&(module.exports={createSignedJwt,cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToNodeAlg,nodeCrypto,pemToPublicJwk,rsaSign,rsaSignBase64Url,rsaVerify,rsaVerifySync});
+"use strict";var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoOf=Object.getPrototypeOf;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toESM=(mod,isNodeMode,target)=>(target=mod!=null?__create(__getProtoOf(mod)):{},__copyProps(isNodeMode||!mod||!mod.__esModule?__defProp(target,"default",{value:mod,enumerable:true}):target,mod));var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var node_exports={};__export(node_exports,{createSignedJwt:()=>createSignedJwt,cryptoProvider:()=>nodeCrypto,generateRsaKeyPair:()=>generateRsaKeyPair,isRsaPssAlg:()=>isRsaPssAlg,jwtAlgToNodeAlg:()=>jwtAlgToNodeAlg,nodeCrypto:()=>nodeCrypto,pemToPublicJwk:()=>pemToPublicJwk,rsaSign:()=>rsaSign,rsaSignBase64Url:()=>rsaSignBase64Url,rsaVerify:()=>rsaVerify,rsaVerifySync:()=>rsaVerifySync});module.exports=__toCommonJS(node_exports);var import_node_crypto=__toESM(require("node:crypto"));var JWT_ALG_TO_NODE_DIGEST={RS256:"RSA-SHA256",RS384:"RSA-SHA384",RS512:"RSA-SHA512",PS256:"RSA-SHA256",PS384:"RSA-SHA384",PS512:"RSA-SHA512"};function jwtAlgToNodeAlg(jwtAlg){const nodeAlg=JWT_ALG_TO_NODE_DIGEST[jwtAlg];if(!nodeAlg){throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`)}return nodeAlg}function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}function toUint8Array(buf){return new Uint8Array(buf.buffer,buf.byteOffset,buf.byteLength)}var nodeCrypto={randomUUID(){return import_node_crypto.default.randomUUID()},randomBytes(length){return toUint8Array(import_node_crypto.default.randomBytes(length))},sha256(data){const hash=import_node_crypto.default.createHash("sha256").update(data).digest();return toUint8Array(hash)},sha256Hex(data){return import_node_crypto.default.createHash("sha256").update(data).digest("hex")},hmacSha256(key,data){const hmac=import_node_crypto.default.createHmac("sha256",Buffer.from(key)).update(Buffer.from(data)).digest();return toUint8Array(hmac)},hkdfSha256(ikm,salt,info,length){const ikmBuf=Buffer.from(ikm);const saltBuf=salt.length>0?Buffer.from(salt):Buffer.alloc(32);const prk=import_node_crypto.default.createHmac("sha256",saltBuf).update(ikmBuf).digest();const hashLen=32;const n=Math.ceil(length/hashLen);const chunks=[];let prev=Buffer.alloc(0);for(let i=1;i<=n;i++){prev=import_node_crypto.default.createHmac("sha256",prk).update(Buffer.concat([prev,Buffer.from(info),Buffer.from([i])])).digest();chunks.push(prev)}return toUint8Array(Buffer.concat(chunks).subarray(0,length))},encryptAesGcm(key,plaintext,iv){const cipher=import_node_crypto.default.createCipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));const encrypted=Buffer.concat([cipher.update(Buffer.from(plaintext)),cipher.final()]);const tag=cipher.getAuthTag();return{ciphertext:toUint8Array(encrypted),tag:toUint8Array(tag)}},decryptAesGcm(key,ciphertext,iv,tag){const decipher=import_node_crypto.default.createDecipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));decipher.setAuthTag(Buffer.from(tag));const decrypted=Buffer.concat([decipher.update(Buffer.from(ciphertext)),decipher.final()]);return toUint8Array(decrypted)},timingSafeEqual(a,b){if(a.length!==b.length)return false;return import_node_crypto.default.timingSafeEqual(Buffer.from(a),Buffer.from(b))}};function generateRsaKeyPair(modulusLength=2048,alg="RS256"){const kid=`rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;const{privateKey,publicKey}=import_node_crypto.default.generateKeyPairSync("rsa",{modulusLength});const exported=publicKey.export({format:"jwk"});const publicJwk={...exported,kid,alg,use:"sig",kty:"RSA"};return{privateKey,publicKey,publicJwk}}function rsaSign(algorithm,data,privateKey,options){const signingKey=options?{key:privateKey,...options}:privateKey;return import_node_crypto.default.sign(algorithm,data,signingKey)}function rsaVerify(jwtAlg,data,publicJwk,signature){const publicKey=import_node_crypto.default.createPublicKey({key:publicJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return import_node_crypto.default.verify(nodeAlgorithm,data,verifyKey,signature)}function rsaSignBase64Url(jwtAlg,data,privateJwk){const privateKey=import_node_crypto.default.createPrivateKey({key:privateJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const buf=Buffer.isBuffer(data)?data:Buffer.from(data);const sig=isRsaPssAlg(jwtAlg)?rsaSign(nodeAlgorithm,buf,privateKey,{padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}):rsaSign(nodeAlgorithm,buf,privateKey);return sig.toString("base64url")}function rsaVerifySync(jwtAlg,data,publicJwk,signature){try{const publicKey=import_node_crypto.default.createPublicKey({key:publicJwk,format:"jwk"});const dataBuf=Buffer.isBuffer(data)?data:Buffer.from(data);const sigBuf=Buffer.isBuffer(signature)?signature:Buffer.from(signature);if(jwtAlg==="EdDSA"){return import_node_crypto.default.verify(null,dataBuf,publicKey,sigBuf)}const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return import_node_crypto.default.verify(nodeAlgorithm,dataBuf,verifyKey,sigBuf)}catch{return false}}function pemToPublicJwk(pem){const key=import_node_crypto.default.createPublicKey({key:pem,format:"pem"});return key.export({format:"jwk"})}function createSignedJwt(payload,privateKey,kid,alg="RS256"){const header={alg,typ:"JWT",kid};const headerB64=Buffer.from(JSON.stringify(header)).toString("base64url");const payloadB64=Buffer.from(JSON.stringify(payload)).toString("base64url");const signatureInput=`${headerB64}.${payloadB64}`;const nodeAlgorithm=jwtAlgToNodeAlg(alg);const signature=rsaSign(nodeAlgorithm,Buffer.from(signatureInput),privateKey,isRsaPssAlg(alg)?{padding:import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,saltLength:import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST}:void 0);const signatureB64=signature.toString("base64url");return`${headerB64}.${payloadB64}.${signatureB64}`}0&&(module.exports={createSignedJwt,cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToNodeAlg,nodeCrypto,pemToPublicJwk,rsaSign,rsaSignBase64Url,rsaVerify,rsaVerifySync});

package/crypto/web-rsa.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Verify an RSA signature using WebCrypto.
+ *
+ * Supports RS256/RS384/RS512 (RSASSA-PKCS1-v1_5) and PS256/PS384/PS512 (RSA-PSS).
+ * Works in both browsers and Node.js environments that provide `crypto.subtle`.
+ *
+ * @param jwtAlg - JWT algorithm identifier (e.g. 'RS256', 'PS256')
+ * @param data - The signed data (e.g. `headerB64.payloadB64`)
+ * @param publicJwk - Public key in JWK format
+ * @param signature - The signature bytes
+ * @returns true if the signature is valid
+ */
+export declare function rsaVerifyBrowser(jwtAlg: string, data: Uint8Array, publicJwk: JsonWebKey, signature: Uint8Array): Promise<boolean>;

package/env/browser-runtime-context.js

@@ -1 +1 @@
-"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var browser_runtime_context_exports={};__export(browser_runtime_context_exports,{checkEntryAvailability:()=>checkEntryAvailability,detectRuntimeContext:()=>detectRuntimeContext,entryAvailabilitySchema:()=>entryAvailabilitySchema,getRuntimeContext:()=>getRuntimeContext,isEntryAvailable:()=>isEntryAvailable,resetRuntimeContext:()=>resetRuntimeContext});module.exports=__toCommonJS(browser_runtime_context_exports);var import_lazy_zod=require("@frontmcp/lazy-zod");var NODE_ENV_KEY="NODE_ENV";function bundlerDefinedNodeEnv(){try{return process.env["NODE_ENV"]||void 0}catch{return void 0}}function getNodeEnv(){const shim=globalThis.process;return shim?.env?.[NODE_ENV_KEY]||bundlerDefinedNodeEnv()}var entryAvailabilitySchema=import_lazy_zod.z.object({os:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),platform:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),runtime:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),deployment:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),provider:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),target:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),surface:import_lazy_zod.z.array(import_lazy_zod.z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))return false}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey]))missing.push(key)}if(availability.surface!==void 0){if(availability.surface.length===0)missing.push("surface");else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))missing.push("surface")}return{available:missing.length===0,missingAxes:missing}}function detectRuntimeContext(){return{os:"browser",platform:"browser",runtime:"browser",deployment:"standalone",provider:"bare",target:"browser",env:getNodeEnv()||"development"}}var cached;function getRuntimeContext(){if(!cached){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached=detected}return cached}function resetRuntimeContext(){cached=void 0}0&&(module.exports={checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext});
+"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var browser_runtime_context_exports={};__export(browser_runtime_context_exports,{checkEntryAvailability:()=>checkEntryAvailability,detectRuntimeContext:()=>detectRuntimeContext,entryAvailabilitySchema:()=>entryAvailabilitySchema,getRuntimeContext:()=>getRuntimeContext,isEntryAvailable:()=>isEntryAvailable,resetRuntimeContext:()=>resetRuntimeContext});module.exports=__toCommonJS(browser_runtime_context_exports);var import_lazy_zod=require("@frontmcp/lazy-zod");var NODE_ENV_KEY="NODE_ENV";function bundlerDefinedNodeEnv(){try{return process.env["NODE_ENV"]||void 0}catch{return void 0}}function getNodeEnv(){const shim=globalThis.process;return shim?.env?.[NODE_ENV_KEY]||bundlerDefinedNodeEnv()}var entryAvailabilitySchema=import_lazy_zod.internalZ.object({os:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),platform:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),runtime:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),deployment:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),provider:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),target:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),surface:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))return false}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey]))missing.push(key)}if(availability.surface!==void 0){if(availability.surface.length===0)missing.push("surface");else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))missing.push("surface")}return{available:missing.length===0,missingAxes:missing}}function detectRuntimeContext(){return{os:"browser",platform:"browser",runtime:"browser",deployment:"standalone",provider:"bare",target:"browser",env:getNodeEnv()||"development"}}var cached;function getRuntimeContext(){if(!cached){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached=detected}return cached}function resetRuntimeContext(){cached=void 0}0&&(module.exports={checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext});

package/env/runtime-context.js

@@ -1 +1 @@
-"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var runtime_context_exports={};__export(runtime_context_exports,{checkEntryAvailability:()=>checkEntryAvailability,detectRuntimeContext:()=>detectRuntimeContext,entryAvailabilitySchema:()=>entryAvailabilitySchema,getRuntimeContext:()=>getRuntimeContext,isEntryAvailable:()=>isEntryAvailable,resetRuntimeContext:()=>resetRuntimeContext});module.exports=__toCommonJS(runtime_context_exports);var import_lazy_zod=require("@frontmcp/lazy-zod");var import_env=require("#env");var cached;function getBuildTarget(){if(cached)return cached;cached=resolveBuildTarget();return cached}function resolveBuildTarget(){const globalAny=globalThis;const fromGlobal=globalAny.FRONTMCP_BUILD_TARGET;if(typeof fromGlobal==="string"&&isKnownTarget(fromGlobal))return fromGlobal;const fromEnv=typeof process!=="undefined"?process.env?.["FRONTMCP_BUILD_TARGET"]:void 0;if(typeof fromEnv==="string"&&isKnownTarget(fromEnv))return fromEnv;return"unknown"}function isKnownTarget(value){return value==="unknown"||value==="node"||value==="distributed"||value==="cli"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="browser"||value==="sdk"||value==="mcpb"}var cached2;function detectProvider(){if(cached2)return cached2;cached2=detectProviderUncached();return cached2}function detectProviderUncached(){const explicit=process.env["FRONTMCP_PROVIDER"];if(explicit&&isKnownProvider(explicit))return explicit;if(process.env["VERCEL"])return"vercel";if(process.env["AWS_LAMBDA_FUNCTION_NAME"])return"lambda";if(process.env["CF_PAGES"])return"cloudflare";if(process.env["NETLIFY"])return"netlify";if(process.env["AZURE_FUNCTIONS_ENVIRONMENT"])return"azure";if(process.env["K_SERVICE"])return"gcp";if(process.env["FLY_APP_NAME"])return"fly";if(process.env["RENDER"])return"render";if(process.env["RAILWAY_ENVIRONMENT"])return"railway";try{const nodeFs=require("node:fs");if(nodeFs.existsSync("/.dockerenv"))return"docker"}catch{}return"bare"}function isKnownProvider(value){return value==="bare"||value==="docker"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="netlify"||value==="azure"||value==="gcp"||value==="fly"||value==="render"||value==="railway"}var entryAvailabilitySchema=import_lazy_zod.z.object({os:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),platform:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),runtime:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),deployment:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),provider:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),target:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional(),surface:import_lazy_zod.z.array(import_lazy_zod.z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:import_lazy_zod.z.array(import_lazy_zod.z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){return false}}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey])){missing.push(key)}}if(availability.surface!==void 0){if(availability.surface.length===0){missing.push("surface")}else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){missing.push("surface")}}return{available:missing.length===0,missingAxes:missing}}function detectRuntime(){if(typeof globalThis!=="undefined"&&"Bun"in globalThis)return"bun";if(typeof globalThis!=="undefined"&&"Deno"in globalThis)return"deno";if((0,import_env.isEdgeRuntime)())return"edge";return"node"}function detectDeployment(runtime){const explicit=process.env["FRONTMCP_DEPLOYMENT_MODE"];if(explicit==="distributed")return"distributed";if(explicit==="serverless")return"serverless";if(runtime==="browser")return"browser";if((0,import_env.isServerless)())return"serverless";return"standalone"}function detectRuntimeContext(){const runtime=detectRuntime();const os=process.platform;return{os,platform:os,runtime,deployment:detectDeployment(runtime),provider:detectProvider(),target:getBuildTarget(),env:(0,import_env.getNodeEnv)()||"development"}}var cached3;function getRuntimeContext(){if(!cached3){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>(0,import_env.getNodeEnv)()||"development",enumerable:true,configurable:true});cached3=detected}return cached3}function resetRuntimeContext(){cached3=void 0}0&&(module.exports={checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext});
+"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:true})};var __copyProps=(to,from,except,desc)=>{if(from&&typeof from==="object"||typeof from==="function"){for(let key of __getOwnPropNames(from))if(!__hasOwnProp.call(to,key)&&key!==except)__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable})}return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:true}),mod);var runtime_context_exports={};__export(runtime_context_exports,{checkEntryAvailability:()=>checkEntryAvailability,detectRuntimeContext:()=>detectRuntimeContext,entryAvailabilitySchema:()=>entryAvailabilitySchema,getRuntimeContext:()=>getRuntimeContext,isEntryAvailable:()=>isEntryAvailable,resetRuntimeContext:()=>resetRuntimeContext});module.exports=__toCommonJS(runtime_context_exports);var import_lazy_zod=require("@frontmcp/lazy-zod");var import_env=require("#env");var cached;function getBuildTarget(){if(cached)return cached;cached=resolveBuildTarget();return cached}function resolveBuildTarget(){const globalAny=globalThis;const fromGlobal=globalAny.FRONTMCP_BUILD_TARGET;if(typeof fromGlobal==="string"&&isKnownTarget(fromGlobal))return fromGlobal;const fromEnv=typeof process!=="undefined"?process.env?.["FRONTMCP_BUILD_TARGET"]:void 0;if(typeof fromEnv==="string"&&isKnownTarget(fromEnv))return fromEnv;return"unknown"}function isKnownTarget(value){return value==="unknown"||value==="node"||value==="distributed"||value==="cli"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="browser"||value==="sdk"||value==="mcpb"}var cached2;function detectProvider(){if(cached2)return cached2;cached2=detectProviderUncached();return cached2}function detectProviderUncached(){const explicit=process.env["FRONTMCP_PROVIDER"];if(explicit&&isKnownProvider(explicit))return explicit;if(process.env["VERCEL"])return"vercel";if(process.env["AWS_LAMBDA_FUNCTION_NAME"])return"lambda";if(process.env["CF_PAGES"])return"cloudflare";if(process.env["NETLIFY"])return"netlify";if(process.env["AZURE_FUNCTIONS_ENVIRONMENT"])return"azure";if(process.env["K_SERVICE"])return"gcp";if(process.env["FLY_APP_NAME"])return"fly";if(process.env["RENDER"])return"render";if(process.env["RAILWAY_ENVIRONMENT"])return"railway";try{const nodeFs=require("node:fs");if(nodeFs.existsSync("/.dockerenv"))return"docker"}catch{}return"bare"}function isKnownProvider(value){return value==="bare"||value==="docker"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="netlify"||value==="azure"||value==="gcp"||value==="fly"||value==="render"||value==="railway"}var entryAvailabilitySchema=import_lazy_zod.internalZ.object({os:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),platform:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),runtime:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),deployment:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),provider:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),target:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional(),surface:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:import_lazy_zod.internalZ.array(import_lazy_zod.internalZ.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){return false}}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey])){missing.push(key)}}if(availability.surface!==void 0){if(availability.surface.length===0){missing.push("surface")}else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){missing.push("surface")}}return{available:missing.length===0,missingAxes:missing}}function detectRuntime(){if(typeof globalThis!=="undefined"&&"Bun"in globalThis)return"bun";if(typeof globalThis!=="undefined"&&"Deno"in globalThis)return"deno";if((0,import_env.isEdgeRuntime)())return"edge";return"node"}function detectDeployment(runtime){const explicit=process.env["FRONTMCP_DEPLOYMENT_MODE"];if(explicit==="distributed")return"distributed";if(explicit==="serverless")return"serverless";if(runtime==="browser")return"browser";if((0,import_env.isServerless)())return"serverless";return"standalone"}function detectRuntimeContext(){const runtime=detectRuntime();const os=process.platform;return{os,platform:os,runtime,deployment:detectDeployment(runtime),provider:detectProvider(),target:getBuildTarget(),env:(0,import_env.getNodeEnv)()||"development"}}var cached3;function getRuntimeContext(){if(!cached3){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>(0,import_env.getNodeEnv)()||"development",enumerable:true,configurable:true});cached3=detected}return cached3}function resetRuntimeContext(){cached3=void 0}0&&(module.exports={checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext});

package/esm/crypto/browser.mjs

@@ -1 +1 @@
-import{gcm}from"@noble/ciphers/aes.js";import{hkdf}from"@noble/hashes/hkdf.js";import{hmac}from"@noble/hashes/hmac.js";import{sha256 as sha256Hash}from"@noble/hashes/sha2.js";import{randomBytes as nobleRandomBytes}from"@noble/hashes/utils.js";function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}var JWT_ALG_TO_WEB_CRYPTO={RS256:"SHA-256",RS384:"SHA-384",RS512:"SHA-512",PS256:"SHA-256",PS384:"SHA-384",PS512:"SHA-512"};function jwtAlgToWebCryptoAlg(jwtAlg){const webAlg=JWT_ALG_TO_WEB_CRYPTO[jwtAlg];if(!webAlg){throw new Error(`Unsupported JWT algorithm for WebCrypto: ${jwtAlg}`)}return webAlg}function toBytes(data){if(typeof data==="string"){return new TextEncoder().encode(data)}return data}function toHex(bytes){return Array.from(bytes).map(b=>b.toString(16).padStart(2,"0")).join("")}function generateUUID(){if(typeof crypto!=="undefined"&&typeof crypto.randomUUID==="function"){return crypto.randomUUID()}const bytes=nobleRandomBytes(16);bytes[6]=bytes[6]&15|64;bytes[8]=bytes[8]&63|128;const hex=toHex(bytes);return`${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`}function constantTimeEqual(a,b){if(a.length!==b.length)return false;let result=0;for(let i=0;i<a.length;i++){result|=a[i]^b[i]}return result===0}var browserCrypto={randomUUID(){return generateUUID()},randomBytes(length){return nobleRandomBytes(length)},sha256(data){return sha256Hash(toBytes(data))},sha256Hex(data){return toHex(sha256Hash(toBytes(data)))},hmacSha256(key,data){return hmac(sha256Hash,key,data)},hkdfSha256(ikm,salt,info,length){const effectiveSalt=salt.length>0?salt:new Uint8Array(32);return hkdf(sha256Hash,ikm,effectiveSalt,info,length)},encryptAesGcm(key,plaintext,iv){const cipher=gcm(key,iv);const sealed=cipher.encrypt(plaintext);const ciphertext=sealed.slice(0,-16);const tag=sealed.slice(-16);return{ciphertext,tag}},decryptAesGcm(key,ciphertext,iv,tag){const cipher=gcm(key,iv);const sealed=new Uint8Array(ciphertext.length+tag.length);sealed.set(ciphertext);sealed.set(tag,ciphertext.length);return cipher.decrypt(sealed)},timingSafeEqual(a,b){return constantTimeEqual(a,b)}};function nodeOnly(name){throw new Error(`${name} is only available in Node.js runtimes`)}function rsaVerify(){return nodeOnly("rsaVerify")}function rsaSignBase64Url(){return nodeOnly("rsaSignBase64Url")}function rsaVerifySync(){return nodeOnly("rsaVerifySync")}function pemToPublicJwk(){return nodeOnly("pemToPublicJwk")}function generateRsaKeyPair(){return nodeOnly("generateRsaKeyPair")}async function rsaVerifyBrowser(jwtAlg,data,publicJwk,signature){if(typeof globalThis.crypto?.subtle==="undefined"){throw new Error("WebCrypto API (crypto.subtle) is not available in this environment")}const webAlg=jwtAlgToWebCryptoAlg(jwtAlg);const isPss=isRsaPssAlg(jwtAlg);const algorithm={name:isPss?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:{name:webAlg}};const key=await globalThis.crypto.subtle.importKey("jwk",publicJwk,algorithm,false,["verify"]);const verifyAlgorithm=isPss?{name:"RSA-PSS",saltLength:getSaltLength(jwtAlg)}:{name:"RSASSA-PKCS1-v1_5"};const sigBuf=new Uint8Array(signature).buffer;const dataBuf=new Uint8Array(data).buffer;return globalThis.crypto.subtle.verify(verifyAlgorithm,key,sigBuf,dataBuf)}function getSaltLength(jwtAlg){switch(jwtAlg){case"PS256":return 32;case"PS384":return 48;case"PS512":return 64;default:return 32}}export{browserCrypto,browserCrypto as cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToWebCryptoAlg,pemToPublicJwk,rsaSignBase64Url,rsaVerify,rsaVerifyBrowser,rsaVerifySync};
+import{gcm}from"@noble/ciphers/aes.js";import{hkdf}from"@noble/hashes/hkdf.js";import{hmac}from"@noble/hashes/hmac.js";import{sha256 as sha256Hash}from"@noble/hashes/sha2.js";import{randomBytes as nobleRandomBytes}from"@noble/hashes/utils.js";function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}var JWT_ALG_TO_WEB_CRYPTO={RS256:"SHA-256",RS384:"SHA-384",RS512:"SHA-512",PS256:"SHA-256",PS384:"SHA-384",PS512:"SHA-512"};function jwtAlgToWebCryptoAlg(jwtAlg){const webAlg=JWT_ALG_TO_WEB_CRYPTO[jwtAlg];if(!webAlg){throw new Error(`Unsupported JWT algorithm for WebCrypto: ${jwtAlg}`)}return webAlg}async function rsaVerifyBrowser(jwtAlg,data,publicJwk,signature){if(typeof globalThis.crypto?.subtle==="undefined"){throw new Error("WebCrypto API (crypto.subtle) is not available in this environment")}const webAlg=jwtAlgToWebCryptoAlg(jwtAlg);const isPss=isRsaPssAlg(jwtAlg);const algorithm={name:isPss?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:{name:webAlg}};const key=await globalThis.crypto.subtle.importKey("jwk",publicJwk,algorithm,false,["verify"]);const verifyAlgorithm=isPss?{name:"RSA-PSS",saltLength:getSaltLength(jwtAlg)}:{name:"RSASSA-PKCS1-v1_5"};const sigBuf=new Uint8Array(signature).buffer;const dataBuf=new Uint8Array(data).buffer;return globalThis.crypto.subtle.verify(verifyAlgorithm,key,sigBuf,dataBuf)}function getSaltLength(jwtAlg){switch(jwtAlg){case"PS256":return 32;case"PS384":return 48;case"PS512":return 64;default:return 32}}function toBytes(data){if(typeof data==="string"){return new TextEncoder().encode(data)}return data}function toHex(bytes){return Array.from(bytes).map(b=>b.toString(16).padStart(2,"0")).join("")}function generateUUID(){if(typeof crypto!=="undefined"&&typeof crypto.randomUUID==="function"){return crypto.randomUUID()}const bytes=nobleRandomBytes(16);bytes[6]=bytes[6]&15|64;bytes[8]=bytes[8]&63|128;const hex=toHex(bytes);return`${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`}function constantTimeEqual(a,b){if(a.length!==b.length)return false;let result=0;for(let i=0;i<a.length;i++){result|=a[i]^b[i]}return result===0}var browserCrypto={randomUUID(){return generateUUID()},randomBytes(length){return nobleRandomBytes(length)},sha256(data){return sha256Hash(toBytes(data))},sha256Hex(data){return toHex(sha256Hash(toBytes(data)))},hmacSha256(key,data){return hmac(sha256Hash,key,data)},hkdfSha256(ikm,salt,info,length){const effectiveSalt=salt.length>0?salt:new Uint8Array(32);return hkdf(sha256Hash,ikm,effectiveSalt,info,length)},encryptAesGcm(key,plaintext,iv){const cipher=gcm(key,iv);const sealed=cipher.encrypt(plaintext);const ciphertext=sealed.slice(0,-16);const tag=sealed.slice(-16);return{ciphertext,tag}},decryptAesGcm(key,ciphertext,iv,tag){const cipher=gcm(key,iv);const sealed=new Uint8Array(ciphertext.length+tag.length);sealed.set(ciphertext);sealed.set(tag,ciphertext.length);return cipher.decrypt(sealed)},timingSafeEqual(a,b){return constantTimeEqual(a,b)}};function nodeOnly(name){throw new Error(`${name} is only available in Node.js runtimes`)}function rsaVerify(){return nodeOnly("rsaVerify")}function rsaSignBase64Url(){return nodeOnly("rsaSignBase64Url")}function rsaVerifySync(){return nodeOnly("rsaVerifySync")}function pemToPublicJwk(){return nodeOnly("pemToPublicJwk")}function generateRsaKeyPair(){return nodeOnly("generateRsaKeyPair")}export{browserCrypto,browserCrypto as cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToWebCryptoAlg,pemToPublicJwk,rsaSignBase64Url,rsaVerify,rsaVerifyBrowser,rsaVerifySync};

package/esm/crypto/node.mjs

@@ -1 +1 @@
-import crypto from"node:crypto";var JWT_ALG_TO_NODE_DIGEST={RS256:"RSA-SHA256",RS384:"RSA-SHA384",RS512:"RSA-SHA512",PS256:"RSA-SHA256",PS384:"RSA-SHA384",PS512:"RSA-SHA512"};function jwtAlgToNodeAlg(jwtAlg){const nodeAlg=JWT_ALG_TO_NODE_DIGEST[jwtAlg];if(!nodeAlg){throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`)}return nodeAlg}function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}function toUint8Array(buf){return new Uint8Array(buf.buffer,buf.byteOffset,buf.byteLength)}function toBuffer(data){if(typeof data==="string"){return Buffer.from(data,"utf8")}return Buffer.from(data)}var nodeCrypto={randomUUID(){return crypto.randomUUID()},randomBytes(length){return toUint8Array(crypto.randomBytes(length))},sha256(data){const hash=crypto.createHash("sha256").update(toBuffer(data)).digest();return toUint8Array(hash)},sha256Hex(data){return crypto.createHash("sha256").update(toBuffer(data)).digest("hex")},hmacSha256(key,data){const hmac=crypto.createHmac("sha256",Buffer.from(key)).update(Buffer.from(data)).digest();return toUint8Array(hmac)},hkdfSha256(ikm,salt,info,length){const ikmBuf=Buffer.from(ikm);const saltBuf=salt.length>0?Buffer.from(salt):Buffer.alloc(32);const prk=crypto.createHmac("sha256",saltBuf).update(ikmBuf).digest();const hashLen=32;const n=Math.ceil(length/hashLen);const chunks=[];let prev=Buffer.alloc(0);for(let i=1;i<=n;i++){prev=crypto.createHmac("sha256",prk).update(Buffer.concat([prev,Buffer.from(info),Buffer.from([i])])).digest();chunks.push(prev)}return toUint8Array(Buffer.concat(chunks).subarray(0,length))},encryptAesGcm(key,plaintext,iv){const cipher=crypto.createCipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));const encrypted=Buffer.concat([cipher.update(Buffer.from(plaintext)),cipher.final()]);const tag=cipher.getAuthTag();return{ciphertext:toUint8Array(encrypted),tag:toUint8Array(tag)}},decryptAesGcm(key,ciphertext,iv,tag){const decipher=crypto.createDecipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));decipher.setAuthTag(Buffer.from(tag));const decrypted=Buffer.concat([decipher.update(Buffer.from(ciphertext)),decipher.final()]);return toUint8Array(decrypted)},timingSafeEqual(a,b){if(a.length!==b.length)return false;return crypto.timingSafeEqual(Buffer.from(a),Buffer.from(b))}};function generateRsaKeyPair(modulusLength=2048,alg="RS256"){const kid=`rsa-key-${Date.now()}-${crypto.randomBytes(8).toString("hex")}`;const{privateKey,publicKey}=crypto.generateKeyPairSync("rsa",{modulusLength});const exported=publicKey.export({format:"jwk"});const publicJwk={...exported,kid,alg,use:"sig",kty:"RSA"};return{privateKey,publicKey,publicJwk}}function rsaSign(algorithm,data,privateKey,options){const signingKey=options?{key:privateKey,...options}:privateKey;return crypto.sign(algorithm,data,signingKey)}function rsaVerify(jwtAlg,data,publicJwk,signature){const publicKey=crypto.createPublicKey({key:publicJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return crypto.verify(nodeAlgorithm,data,verifyKey,signature)}function rsaSignBase64Url(jwtAlg,data,privateJwk){const privateKey=crypto.createPrivateKey({key:privateJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const buf=Buffer.isBuffer(data)?data:Buffer.from(data);const sig=isRsaPssAlg(jwtAlg)?rsaSign(nodeAlgorithm,buf,privateKey,{padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}):rsaSign(nodeAlgorithm,buf,privateKey);return sig.toString("base64url")}function rsaVerifySync(jwtAlg,data,publicJwk,signature){try{const publicKey=crypto.createPublicKey({key:publicJwk,format:"jwk"});const dataBuf=Buffer.isBuffer(data)?data:Buffer.from(data);const sigBuf=Buffer.isBuffer(signature)?signature:Buffer.from(signature);if(jwtAlg==="EdDSA"){return crypto.verify(null,dataBuf,publicKey,sigBuf)}const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return crypto.verify(nodeAlgorithm,dataBuf,verifyKey,sigBuf)}catch{return false}}function pemToPublicJwk(pem){const key=crypto.createPublicKey({key:pem,format:"pem"});return key.export({format:"jwk"})}function createSignedJwt(payload,privateKey,kid,alg="RS256"){const header={alg,typ:"JWT",kid};const headerB64=Buffer.from(JSON.stringify(header)).toString("base64url");const payloadB64=Buffer.from(JSON.stringify(payload)).toString("base64url");const signatureInput=`${headerB64}.${payloadB64}`;const nodeAlgorithm=jwtAlgToNodeAlg(alg);const signature=rsaSign(nodeAlgorithm,Buffer.from(signatureInput),privateKey,isRsaPssAlg(alg)?{padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:void 0);const signatureB64=signature.toString("base64url");return`${headerB64}.${payloadB64}.${signatureB64}`}export{createSignedJwt,nodeCrypto as cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToNodeAlg,nodeCrypto,pemToPublicJwk,rsaSign,rsaSignBase64Url,rsaVerify,rsaVerifySync};
+import crypto from"node:crypto";var JWT_ALG_TO_NODE_DIGEST={RS256:"RSA-SHA256",RS384:"RSA-SHA384",RS512:"RSA-SHA512",PS256:"RSA-SHA256",PS384:"RSA-SHA384",PS512:"RSA-SHA512"};function jwtAlgToNodeAlg(jwtAlg){const nodeAlg=JWT_ALG_TO_NODE_DIGEST[jwtAlg];if(!nodeAlg){throw new Error(`Unsupported JWT algorithm: ${jwtAlg}`)}return nodeAlg}function isRsaPssAlg(jwtAlg){return jwtAlg.startsWith("PS")}function toUint8Array(buf){return new Uint8Array(buf.buffer,buf.byteOffset,buf.byteLength)}var nodeCrypto={randomUUID(){return crypto.randomUUID()},randomBytes(length){return toUint8Array(crypto.randomBytes(length))},sha256(data){const hash=crypto.createHash("sha256").update(data).digest();return toUint8Array(hash)},sha256Hex(data){return crypto.createHash("sha256").update(data).digest("hex")},hmacSha256(key,data){const hmac=crypto.createHmac("sha256",Buffer.from(key)).update(Buffer.from(data)).digest();return toUint8Array(hmac)},hkdfSha256(ikm,salt,info,length){const ikmBuf=Buffer.from(ikm);const saltBuf=salt.length>0?Buffer.from(salt):Buffer.alloc(32);const prk=crypto.createHmac("sha256",saltBuf).update(ikmBuf).digest();const hashLen=32;const n=Math.ceil(length/hashLen);const chunks=[];let prev=Buffer.alloc(0);for(let i=1;i<=n;i++){prev=crypto.createHmac("sha256",prk).update(Buffer.concat([prev,Buffer.from(info),Buffer.from([i])])).digest();chunks.push(prev)}return toUint8Array(Buffer.concat(chunks).subarray(0,length))},encryptAesGcm(key,plaintext,iv){const cipher=crypto.createCipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));const encrypted=Buffer.concat([cipher.update(Buffer.from(plaintext)),cipher.final()]);const tag=cipher.getAuthTag();return{ciphertext:toUint8Array(encrypted),tag:toUint8Array(tag)}},decryptAesGcm(key,ciphertext,iv,tag){const decipher=crypto.createDecipheriv("aes-256-gcm",Buffer.from(key),Buffer.from(iv));decipher.setAuthTag(Buffer.from(tag));const decrypted=Buffer.concat([decipher.update(Buffer.from(ciphertext)),decipher.final()]);return toUint8Array(decrypted)},timingSafeEqual(a,b){if(a.length!==b.length)return false;return crypto.timingSafeEqual(Buffer.from(a),Buffer.from(b))}};function generateRsaKeyPair(modulusLength=2048,alg="RS256"){const kid=`rsa-key-${Date.now()}-${crypto.randomBytes(8).toString("hex")}`;const{privateKey,publicKey}=crypto.generateKeyPairSync("rsa",{modulusLength});const exported=publicKey.export({format:"jwk"});const publicJwk={...exported,kid,alg,use:"sig",kty:"RSA"};return{privateKey,publicKey,publicJwk}}function rsaSign(algorithm,data,privateKey,options){const signingKey=options?{key:privateKey,...options}:privateKey;return crypto.sign(algorithm,data,signingKey)}function rsaVerify(jwtAlg,data,publicJwk,signature){const publicKey=crypto.createPublicKey({key:publicJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return crypto.verify(nodeAlgorithm,data,verifyKey,signature)}function rsaSignBase64Url(jwtAlg,data,privateJwk){const privateKey=crypto.createPrivateKey({key:privateJwk,format:"jwk"});const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const buf=Buffer.isBuffer(data)?data:Buffer.from(data);const sig=isRsaPssAlg(jwtAlg)?rsaSign(nodeAlgorithm,buf,privateKey,{padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}):rsaSign(nodeAlgorithm,buf,privateKey);return sig.toString("base64url")}function rsaVerifySync(jwtAlg,data,publicJwk,signature){try{const publicKey=crypto.createPublicKey({key:publicJwk,format:"jwk"});const dataBuf=Buffer.isBuffer(data)?data:Buffer.from(data);const sigBuf=Buffer.isBuffer(signature)?signature:Buffer.from(signature);if(jwtAlg==="EdDSA"){return crypto.verify(null,dataBuf,publicKey,sigBuf)}const nodeAlgorithm=jwtAlgToNodeAlg(jwtAlg);const verifyKey=isRsaPssAlg(jwtAlg)?{key:publicKey,padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:publicKey;return crypto.verify(nodeAlgorithm,dataBuf,verifyKey,sigBuf)}catch{return false}}function pemToPublicJwk(pem){const key=crypto.createPublicKey({key:pem,format:"pem"});return key.export({format:"jwk"})}function createSignedJwt(payload,privateKey,kid,alg="RS256"){const header={alg,typ:"JWT",kid};const headerB64=Buffer.from(JSON.stringify(header)).toString("base64url");const payloadB64=Buffer.from(JSON.stringify(payload)).toString("base64url");const signatureInput=`${headerB64}.${payloadB64}`;const nodeAlgorithm=jwtAlgToNodeAlg(alg);const signature=rsaSign(nodeAlgorithm,Buffer.from(signatureInput),privateKey,isRsaPssAlg(alg)?{padding:crypto.constants.RSA_PKCS1_PSS_PADDING,saltLength:crypto.constants.RSA_PSS_SALTLEN_DIGEST}:void 0);const signatureB64=signature.toString("base64url");return`${headerB64}.${payloadB64}.${signatureB64}`}export{createSignedJwt,nodeCrypto as cryptoProvider,generateRsaKeyPair,isRsaPssAlg,jwtAlgToNodeAlg,nodeCrypto,pemToPublicJwk,rsaSign,rsaSignBase64Url,rsaVerify,rsaVerifySync};

package/esm/env/browser-runtime-context.mjs

@@ -1 +1 @@
-import{z}from"@frontmcp/lazy-zod";var NODE_ENV_KEY="NODE_ENV";function bundlerDefinedNodeEnv(){try{return process.env["NODE_ENV"]||void 0}catch{return void 0}}function getNodeEnv(){const shim=globalThis.process;return shim?.env?.[NODE_ENV_KEY]||bundlerDefinedNodeEnv()}var entryAvailabilitySchema=z.object({os:z.array(z.string().min(1)).optional(),platform:z.array(z.string().min(1)).optional(),runtime:z.array(z.string().min(1)).optional(),deployment:z.array(z.string().min(1)).optional(),provider:z.array(z.string().min(1)).optional(),target:z.array(z.string().min(1)).optional(),surface:z.array(z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:z.array(z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))return false}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey]))missing.push(key)}if(availability.surface!==void 0){if(availability.surface.length===0)missing.push("surface");else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))missing.push("surface")}return{available:missing.length===0,missingAxes:missing}}function detectRuntimeContext(){return{os:"browser",platform:"browser",runtime:"browser",deployment:"standalone",provider:"bare",target:"browser",env:getNodeEnv()||"development"}}var cached;function getRuntimeContext(){if(!cached){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached=detected}return cached}function resetRuntimeContext(){cached=void 0}export{checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext};
+import{internalZ as z}from"@frontmcp/lazy-zod";var NODE_ENV_KEY="NODE_ENV";function bundlerDefinedNodeEnv(){try{return process.env["NODE_ENV"]||void 0}catch{return void 0}}function getNodeEnv(){const shim=globalThis.process;return shim?.env?.[NODE_ENV_KEY]||bundlerDefinedNodeEnv()}var entryAvailabilitySchema=z.object({os:z.array(z.string().min(1)).optional(),platform:z.array(z.string().min(1)).optional(),runtime:z.array(z.string().min(1)).optional(),deployment:z.array(z.string().min(1)).optional(),provider:z.array(z.string().min(1)).optional(),target:z.array(z.string().min(1)).optional(),surface:z.array(z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:z.array(z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))return false}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey]))missing.push(key)}if(availability.surface!==void 0){if(availability.surface.length===0)missing.push("surface");else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface))missing.push("surface")}return{available:missing.length===0,missingAxes:missing}}function detectRuntimeContext(){return{os:"browser",platform:"browser",runtime:"browser",deployment:"standalone",provider:"bare",target:"browser",env:getNodeEnv()||"development"}}var cached;function getRuntimeContext(){if(!cached){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached=detected}return cached}function resetRuntimeContext(){cached=void 0}export{checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext};

package/esm/env/runtime-context.mjs

@@ -1,4 +1,4 @@
 var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
 const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
 // __frontmcpCreateRequire
-var __require=(x=>typeof require!=="undefined"?require:typeof Proxy!=="undefined"?new Proxy(x,{get:(a,b)=>(typeof require!=="undefined"?require:a)[b]}):x)(function(x){if(typeof require!=="undefined")return require.apply(this,arguments);throw Error('Dynamic require of "'+x+'" is not supported')});import{z}from"@frontmcp/lazy-zod";import{getNodeEnv,isEdgeRuntime,isServerless}from"#env";var cached;function getBuildTarget(){if(cached)return cached;cached=resolveBuildTarget();return cached}function resolveBuildTarget(){const globalAny=globalThis;const fromGlobal=globalAny.FRONTMCP_BUILD_TARGET;if(typeof fromGlobal==="string"&&isKnownTarget(fromGlobal))return fromGlobal;const fromEnv=typeof process!=="undefined"?process.env?.["FRONTMCP_BUILD_TARGET"]:void 0;if(typeof fromEnv==="string"&&isKnownTarget(fromEnv))return fromEnv;return"unknown"}function isKnownTarget(value){return value==="unknown"||value==="node"||value==="distributed"||value==="cli"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="browser"||value==="sdk"||value==="mcpb"}var cached2;function detectProvider(){if(cached2)return cached2;cached2=detectProviderUncached();return cached2}function detectProviderUncached(){const explicit=process.env["FRONTMCP_PROVIDER"];if(explicit&&isKnownProvider(explicit))return explicit;if(process.env["VERCEL"])return"vercel";if(process.env["AWS_LAMBDA_FUNCTION_NAME"])return"lambda";if(process.env["CF_PAGES"])return"cloudflare";if(process.env["NETLIFY"])return"netlify";if(process.env["AZURE_FUNCTIONS_ENVIRONMENT"])return"azure";if(process.env["K_SERVICE"])return"gcp";if(process.env["FLY_APP_NAME"])return"fly";if(process.env["RENDER"])return"render";if(process.env["RAILWAY_ENVIRONMENT"])return"railway";try{const nodeFs=__require("node:fs");if(nodeFs.existsSync("/.dockerenv"))return"docker"}catch{}return"bare"}function isKnownProvider(value){return value==="bare"||value==="docker"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="netlify"||value==="azure"||value==="gcp"||value==="fly"||value==="render"||value==="railway"}var entryAvailabilitySchema=z.object({os:z.array(z.string().min(1)).optional(),platform:z.array(z.string().min(1)).optional(),runtime:z.array(z.string().min(1)).optional(),deployment:z.array(z.string().min(1)).optional(),provider:z.array(z.string().min(1)).optional(),target:z.array(z.string().min(1)).optional(),surface:z.array(z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:z.array(z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){return false}}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey])){missing.push(key)}}if(availability.surface!==void 0){if(availability.surface.length===0){missing.push("surface")}else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){missing.push("surface")}}return{available:missing.length===0,missingAxes:missing}}function detectRuntime(){if(typeof globalThis!=="undefined"&&"Bun"in globalThis)return"bun";if(typeof globalThis!=="undefined"&&"Deno"in globalThis)return"deno";if(isEdgeRuntime())return"edge";return"node"}function detectDeployment(runtime){const explicit=process.env["FRONTMCP_DEPLOYMENT_MODE"];if(explicit==="distributed")return"distributed";if(explicit==="serverless")return"serverless";if(runtime==="browser")return"browser";if(isServerless())return"serverless";return"standalone"}function detectRuntimeContext(){const runtime=detectRuntime();const os=process.platform;return{os,platform:os,runtime,deployment:detectDeployment(runtime),provider:detectProvider(),target:getBuildTarget(),env:getNodeEnv()||"development"}}var cached3;function getRuntimeContext(){if(!cached3){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached3=detected}return cached3}function resetRuntimeContext(){cached3=void 0}export{checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext};
+var __require=(x=>typeof require!=="undefined"?require:typeof Proxy!=="undefined"?new Proxy(x,{get:(a,b)=>(typeof require!=="undefined"?require:a)[b]}):x)(function(x){if(typeof require!=="undefined")return require.apply(this,arguments);throw Error('Dynamic require of "'+x+'" is not supported')});import{internalZ as z}from"@frontmcp/lazy-zod";import{getNodeEnv,isEdgeRuntime,isServerless}from"#env";var cached;function getBuildTarget(){if(cached)return cached;cached=resolveBuildTarget();return cached}function resolveBuildTarget(){const globalAny=globalThis;const fromGlobal=globalAny.FRONTMCP_BUILD_TARGET;if(typeof fromGlobal==="string"&&isKnownTarget(fromGlobal))return fromGlobal;const fromEnv=typeof process!=="undefined"?process.env?.["FRONTMCP_BUILD_TARGET"]:void 0;if(typeof fromEnv==="string"&&isKnownTarget(fromEnv))return fromEnv;return"unknown"}function isKnownTarget(value){return value==="unknown"||value==="node"||value==="distributed"||value==="cli"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="browser"||value==="sdk"||value==="mcpb"}var cached2;function detectProvider(){if(cached2)return cached2;cached2=detectProviderUncached();return cached2}function detectProviderUncached(){const explicit=process.env["FRONTMCP_PROVIDER"];if(explicit&&isKnownProvider(explicit))return explicit;if(process.env["VERCEL"])return"vercel";if(process.env["AWS_LAMBDA_FUNCTION_NAME"])return"lambda";if(process.env["CF_PAGES"])return"cloudflare";if(process.env["NETLIFY"])return"netlify";if(process.env["AZURE_FUNCTIONS_ENVIRONMENT"])return"azure";if(process.env["K_SERVICE"])return"gcp";if(process.env["FLY_APP_NAME"])return"fly";if(process.env["RENDER"])return"render";if(process.env["RAILWAY_ENVIRONMENT"])return"railway";try{const nodeFs=__require("node:fs");if(nodeFs.existsSync("/.dockerenv"))return"docker"}catch{}return"bare"}function isKnownProvider(value){return value==="bare"||value==="docker"||value==="vercel"||value==="lambda"||value==="cloudflare"||value==="netlify"||value==="azure"||value==="gcp"||value==="fly"||value==="render"||value==="railway"}var entryAvailabilitySchema=z.object({os:z.array(z.string().min(1)).optional(),platform:z.array(z.string().min(1)).optional(),runtime:z.array(z.string().min(1)).optional(),deployment:z.array(z.string().min(1)).optional(),provider:z.array(z.string().min(1)).optional(),target:z.array(z.string().min(1)).optional(),surface:z.array(z.enum(["mcp","cli","http-trigger","job","agent","webmcp"])).optional(),env:z.array(z.string().min(1)).optional()}).strict();var PROCESS_AXES=[{key:"os",ctxKey:"os"},{key:"platform",ctxKey:"platform"},{key:"runtime",ctxKey:"runtime"},{key:"deployment",ctxKey:"deployment"},{key:"provider",ctxKey:"provider"},{key:"target",ctxKey:"target"},{key:"env",ctxKey:"env"}];function isEntryAvailable(availability,ctx,callCtx){if(!availability)return true;for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0)return false;if(!allowed.includes(ctx[ctxKey]))return false}if(availability.surface!==void 0){if(availability.surface.length===0)return false;if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){return false}}return true}function checkEntryAvailability(availability,ctx,callCtx){if(!availability)return{available:true,missingAxes:[]};const missing=[];for(const{key,ctxKey}of PROCESS_AXES){const allowed=availability[key];if(allowed===void 0)continue;if(allowed.length===0||!allowed.includes(ctx[ctxKey])){missing.push(key)}}if(availability.surface!==void 0){if(availability.surface.length===0){missing.push("surface")}else if(callCtx?.surface!==void 0&&!availability.surface.includes(callCtx.surface)){missing.push("surface")}}return{available:missing.length===0,missingAxes:missing}}function detectRuntime(){if(typeof globalThis!=="undefined"&&"Bun"in globalThis)return"bun";if(typeof globalThis!=="undefined"&&"Deno"in globalThis)return"deno";if(isEdgeRuntime())return"edge";return"node"}function detectDeployment(runtime){const explicit=process.env["FRONTMCP_DEPLOYMENT_MODE"];if(explicit==="distributed")return"distributed";if(explicit==="serverless")return"serverless";if(runtime==="browser")return"browser";if(isServerless())return"serverless";return"standalone"}function detectRuntimeContext(){const runtime=detectRuntime();const os=process.platform;return{os,platform:os,runtime,deployment:detectDeployment(runtime),provider:detectProvider(),target:getBuildTarget(),env:getNodeEnv()||"development"}}var cached3;function getRuntimeContext(){if(!cached3){const detected=detectRuntimeContext();Object.defineProperty(detected,"env",{get:()=>getNodeEnv()||"development",enumerable:true,configurable:true});cached3=detected}return cached3}function resetRuntimeContext(){cached3=void 0}export{checkEntryAvailability,detectRuntimeContext,entryAvailabilitySchema,getRuntimeContext,isEntryAvailable,resetRuntimeContext};