@frontmcp/utils 1.9.1 → 1.9.3

package/index.js

@@ -2541,180 +2541,19 @@ var init_key_persistence2 = __esm({
   }
 });
 
-// libs/utils/src/crypto/node.ts
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = import_node_crypto.default.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return import_node_crypto.default.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var import_node_crypto, nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    import_node_crypto = __toESM(require("node:crypto"));
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return import_node_crypto.default.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(import_node_crypto.default.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = import_node_crypto.default.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = import_node_crypto.default.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = import_node_crypto.default.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = import_node_crypto.default.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return import_node_crypto.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
-
 // libs/utils/src/crypto/browser.ts
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
 function toBytes(data) {
   if (typeof data === "string") {
@@ -2743,6 +2582,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2774,15 +2631,15 @@ function getSaltLength(jwtAlg) {
       return 32;
   }
 }
-var import_sha2, import_hmac, import_hkdf, import_utils, import_aes, browserCrypto;
+var import_aes, import_hkdf, import_hmac, import_sha2, import_utils, browserCrypto;
 var init_browser = __esm({
   "libs/utils/src/crypto/browser.ts"() {
     "use strict";
-    import_sha2 = require("@noble/hashes/sha2.js");
-    import_hmac = require("@noble/hashes/hmac.js");
+    import_aes = require("@noble/ciphers/aes.js");
     import_hkdf = require("@noble/hashes/hkdf.js");
+    import_hmac = require("@noble/hashes/hmac.js");
+    import_sha2 = require("@noble/hashes/sha2.js");
     import_utils = require("@noble/hashes/utils.js");
-    import_aes = require("@noble/ciphers/aes.js");
     init_jwt_alg();
     init_jwt_alg();
     browserCrypto = {
@@ -2828,38 +2685,38 @@ var init_browser = __esm({
 
 // libs/utils/src/crypto/index.ts
 function getCrypto() {
-  return import_crypto_provider2.cryptoProvider;
+  return platformCrypto.cryptoProvider;
 }
-function rsaVerify2(jwtAlg, data, publicJwk, signature) {
+function rsaVerify3(jwtAlg, data, publicJwk, signature) {
   if (isNode()) {
-    return Promise.resolve((init_node(), __toCommonJS(node_exports)).rsaVerify(jwtAlg, data, publicJwk, signature));
+    return Promise.resolve(platformCrypto.rsaVerify(jwtAlg, data, publicJwk, signature));
   }
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
-function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
   if (!isNode()) {
     throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+  return platformCrypto.rsaSignBase64Url(jwtAlg, data, privateJwk);
 }
-function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
   if (!isNode()) {
     throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+  return platformCrypto.rsaVerifySync(jwtAlg, data, publicJwk, signature);
 }
-function pemToPublicJwk2(pem) {
+function pemToPublicJwk3(pem) {
   if (!isNode()) {
     throw new Error("pemToPublicJwk is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+  return platformCrypto.pemToPublicJwk(pem);
 }
-function generateRsaKeyPair2(modulusLength, alg) {
+function generateRsaKeyPair3(modulusLength, alg) {
   if (!isNode()) {
     throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+  return platformCrypto.generateRsaKeyPair(modulusLength, alg);
 }
 function randomUUID() {
   return getCrypto().randomUUID();
@@ -2965,11 +2822,11 @@ function base64Decode(data) {
 function sha256Base64url(data) {
   return base64urlEncode(sha256(data));
 }
-var import_crypto_provider2, HKDF_SHA256_MAX_LENGTH;
+var platformCrypto, HKDF_SHA256_MAX_LENGTH;
 var init_crypto = __esm({
   "libs/utils/src/crypto/index.ts"() {
     "use strict";
-    import_crypto_provider2 = require("#crypto-provider");
+    platformCrypto = __toESM(require("#crypto-provider"));
     init_runtime();
     init_jwt_alg();
     init_runtime();
@@ -3017,6 +2874,73 @@ var init_redis_error_listener = __esm({
   }
 });
 
+// libs/utils/src/storage/redis-url.ts
+function decodeOrRaw(encoded) {
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    return encoded;
+  }
+}
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
+  const fillIns = {};
+  const conflicts = [];
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
+  if (fields.port !== void 0) {
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
+  }
+  if (fields.password !== void 0) {
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
+  }
+  if (fields.db !== void 0) {
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
+  }
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
+}
+function describeRedisUrlConflicts(conflicts) {
+  return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
+}
+var init_redis_url = __esm({
+  "libs/utils/src/storage/redis-url.ts"() {
+    "use strict";
+  }
+});
+
 // libs/utils/src/storage/utils/index.ts
 var init_utils = __esm({
   "libs/utils/src/storage/utils/index.ts"() {
@@ -3056,17 +2980,49 @@ function getRedisClass() {
     });
   }
 }
+function resolveUrlOptions(connectionUrl, options) {
+  const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
+  if (options.url && configUrl && configUrl !== options.url) {
+    throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
+  }
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
+    throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
+  }
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
+}
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -3076,6 +3032,7 @@ var init_redis = __esm({
     "use strict";
     init_errors();
     init_redis_error_listener();
+    init_redis_url();
     init_utils();
     init_compare_and_delete();
     init_base();
@@ -3089,6 +3046,9 @@ var init_redis = __esm({
       connecting;
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
+      connectionUrl;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -3110,6 +3070,9 @@ var init_redis = __esm({
         this.options = options;
         this.ownsClient = !hasClient;
         this.keyPrefix = options.keyPrefix ?? "";
+        const configUrl = options.config?.url;
+        this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -3131,12 +3094,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.options.url) {
-              client = new RedisClass(this.options.url, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3369,14 +3327,11 @@ var init_redis = __esm({
        * Build Redis options from config.
        */
       buildRedisOptions() {
-        if (this.options.url) {
-          return {
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+        if (this.connectionUrl) {
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
-        if (!config) {
+        if (!config || typeof config.url === "string" || config.host === void 0) {
           throw new StorageConfigError("redis", "Redis config is required when URL is not provided");
         }
         return {
@@ -3389,16 +3344,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.options.url) {
-          subscriber = new RedisClass(this.options.url);
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -3447,7 +3409,8 @@ var init_redis = __esm({
 // libs/utils/src/storage/adapters/vercel-kv.ts
 var vercel_kv_exports = {};
 __export(vercel_kv_exports, {
-  VercelKvStorageAdapter: () => VercelKvStorageAdapter
+  VercelKvStorageAdapter: () => VercelKvStorageAdapter,
+  createVercelKvClient: () => createVercelKvClient
 });
 async function loadVercelKv() {
   try {
@@ -3459,6 +3422,15 @@ async function loadVercelKv() {
     throw new Error("@vercel/kv is required for Vercel KV storage adapter. Install it with: npm install @vercel/kv");
   }
 }
+async function createVercelKvClient(connection = {}) {
+  const url = connection.url ?? process.env["KV_REST_API_URL"];
+  const token = connection.token ?? process.env["KV_REST_API_TOKEN"];
+  if (!url || !token) {
+    throw new StorageConfigError("vercel-kv", "Pass url and token, or set KV_REST_API_URL and KV_REST_API_TOKEN.");
+  }
+  const { createClient } = await loadVercelKv();
+  return createClient({ url, token, cache: void 0, automaticDeserialization: false });
+}
 var VercelKvStorageAdapter;
 var init_vercel_kv = __esm({
   "libs/utils/src/storage/adapters/vercel-kv.ts"() {
@@ -3491,13 +3463,7 @@ var init_vercel_kv = __esm({
       async connect() {
         if (this.connected) return;
         try {
-          const { createClient } = await loadVercelKv();
-          const url = this.options.url;
-          const token = this.options.token;
-          if (!url || !token) {
-            throw new StorageConfigError("vercel-kv", "URL and token are required");
-          }
-          this.client = createClient({ url, token, cache: void 0, automaticDeserialization: false });
+          this.client = await createVercelKvClient({ url: this.options.url, token: this.options.token });
           await this.client.exists("__healthcheck__");
           this.connected = true;
         } catch (e) {
@@ -3670,9 +3636,12 @@ var upstash_exports = {};
 __export(upstash_exports, {
   UpstashStorageAdapter: () => UpstashStorageAdapter
 });
-function getUpstashRedis() {
+async function loadUpstashRedis() {
   try {
-    return require("@upstash/redis");
+    const mod = await import("@upstash/redis");
+    const resolved = typeof mod.Redis === "function" ? mod : mod.default;
+    if (!resolved || typeof resolved.Redis !== "function") throw new Error("Redis missing");
+    return resolved;
   } catch {
     throw new Error(
       "@upstash/redis is required for Upstash storage adapter. Install it with: npm install @upstash/redis"
@@ -3717,7 +3686,7 @@ var init_upstash = __esm({
       async connect() {
         if (this.connected) return;
         try {
-          const { Redis } = getUpstashRedis();
+          const { Redis } = await loadUpstashRedis();
           const url = this.options.url;
           const token = this.options.token;
           if (!url || !token) {
@@ -4184,9 +4153,11 @@ __export(index_exports, {
   createSafeRegExp: () => createSafeRegExp,
   createSecretData: () => createSecretData,
   createStorage: () => createStorage,
+  createVercelKvClient: () => createVercelKvClient,
   decryptAesGcm: () => decryptAesGcm,
   decryptValue: () => decryptValue,
   deleteSecret: () => deleteSecret,
+  describeRedisUrlConflicts: () => describeRedisUrlConflicts,
   deserializeAndDecrypt: () => deserializeAndDecrypt,
   deserializeBlob: () => deserializeBlob,
   detectRuntimeContext: () => import_runtime_context.detectRuntimeContext,
@@ -4217,7 +4188,7 @@ __export(index_exports, {
   generateCodeChallenge: () => generateCodeChallenge,
   generateCodeVerifier: () => generateCodeVerifier,
   generatePkcePair: () => generatePkcePair,
-  generateRsaKeyPair: () => generateRsaKeyPair2,
+  generateRsaKeyPair: () => generateRsaKeyPair3,
   generateSecret: () => generateSecret,
   getAsyncContextMode: () => import_async_context.getAsyncContextMode,
   getCookie: () => getCookie,
@@ -4270,6 +4241,7 @@ __export(index_exports, {
   loadSecret: () => loadSecret,
   matchUriTemplate: () => matchUriTemplate,
   matchesPattern: () => matchesPattern,
+  mergeRedisUrlFields: () => mergeRedisUrlFields,
   mkdir: () => mkdir,
   mkdtemp: () => mkdtemp,
   normalizeTTL: () => normalizeTTL,
@@ -4281,7 +4253,7 @@ __export(index_exports, {
   pathJoin: () => import_path2.join,
   pathResolve: () => import_path2.resolve,
   pathToFileURL: () => import_path2.pathToFileURL,
-  pemToPublicJwk: () => pemToPublicJwk2,
+  pemToPublicJwk: () => pemToPublicJwk3,
   processPlatformToolCalls: () => processPlatformToolCalls,
   randomBytes: () => randomBytes,
   randomUUID: () => randomUUID,
@@ -4296,9 +4268,9 @@ __export(index_exports, {
   resetRuntimeContext: () => import_runtime_context.resetRuntimeContext,
   resolveSecretPath: () => resolveSecretPath,
   rm: () => rm,
-  rsaSignBase64Url: () => rsaSignBase64Url2,
-  rsaVerify: () => rsaVerify2,
-  rsaVerifySync: () => rsaVerifySync2,
+  rsaSignBase64Url: () => rsaSignBase64Url3,
+  rsaVerify: () => rsaVerify3,
+  rsaVerifySync: () => rsaVerifySync3,
   runCmd: () => runCmd,
   runRequestExclusive: () => import_async_context.runRequestExclusive,
   safeExec: () => safeExec,
@@ -5446,6 +5418,7 @@ function getDetectedStorageType() {
 
 // libs/utils/src/storage/index.ts
 init_redis_error_listener();
+init_redis_url();
 init_errors();
 
 // libs/utils/src/storage/typed-storage.ts
@@ -6160,9 +6133,11 @@ function setMachineIdOverride(id) {
   createSafeRegExp,
   createSecretData,
   createStorage,
+  createVercelKvClient,
   decryptAesGcm,
   decryptValue,
   deleteSecret,
+  describeRedisUrlConflicts,
   deserializeAndDecrypt,
   deserializeBlob,
   detectRuntimeContext,
@@ -6246,6 +6221,7 @@ function setMachineIdOverride(id) {
   loadSecret,
   matchUriTemplate,
   matchesPattern,
+  mergeRedisUrlFields,
   mkdir,
   mkdtemp,
   normalizeTTL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/utils",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "description": "Shared utility functions for FrontMCP - string manipulation, URI handling, path utilities, and more",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -32,11 +32,15 @@
     "@noble/hashes": "^2.0.1"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1",
+    "@frontmcp/lazy-zod": "1.9.3",
+    "@upstash/redis": "^1.34.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0",
     "ioredis": "^5.0.0"
   },
   "peerDependenciesMeta": {
+    "@upstash/redis": {
+      "optional": true
+    },
     "@vercel/kv": {
       "optional": true
     },

package/storage/adapters/index.d.ts

@@ -7,7 +7,7 @@ export { BaseStorageAdapter } from './base';
 export { MemoryStorageAdapter } from './memory';
 export { RedisStorageAdapter, createRedisClient } from './redis';
 export type { CreateRedisClientOptions } from './redis';
-export { VercelKvStorageAdapter } from './vercel-kv';
+export { VercelKvStorageAdapter, createVercelKvClient, type VercelKvConnection } from './vercel-kv';
 export { UpstashStorageAdapter } from './upstash';
 export { CloudflareKvStorageAdapter } from './cloudflare-kv';
 export { FileSystemStorageAdapter } from './filesystem';