@frontmcp/utils 1.9.2 → 1.9.3

package/crypto/browser.d.ts

@@ -11,6 +11,11 @@ import type { CryptoProvider } from './types';
 export declare const browserCrypto: CryptoProvider;
 /** Alias for conditional import resolution via `#crypto-provider`. */
 export { browserCrypto as cryptoProvider };
+export declare function rsaVerify(): boolean;
+export declare function rsaSignBase64Url(): string;
+export declare function rsaVerifySync(): boolean;
+export declare function pemToPublicJwk(): JsonWebKey;
+export declare function generateRsaKeyPair(): never;
 export { isRsaPssAlg, jwtAlgToWebCryptoAlg } from './jwt-alg';
 /**
  * Verify an RSA signature using WebCrypto.

package/crypto/browser.js

@@ -22,16 +22,21 @@ var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
 module.exports = __toCommonJS(browser_exports);
-var import_sha2 = require("@noble/hashes/sha2.js");
-var import_hmac = require("@noble/hashes/hmac.js");
+var import_aes = require("@noble/ciphers/aes.js");
 var import_hkdf = require("@noble/hashes/hkdf.js");
+var import_hmac = require("@noble/hashes/hmac.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
 var import_utils = require("@noble/hashes/utils.js");
-var import_aes = require("@noble/ciphers/aes.js");
 
 // libs/utils/src/crypto/jwt-alg.ts
 function isRsaPssAlg(jwtAlg) {
@@ -119,6 +124,24 @@ var browserCrypto = {
     return constantTimeEqual(a, b);
   }
 };
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -154,7 +177,12 @@ function getSaltLength(jwtAlg) {
 0 && (module.exports = {
   browserCrypto,
   cryptoProvider,
+  generateRsaKeyPair,
   isRsaPssAlg,
   jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser
+  pemToPublicJwk,
+  rsaSignBase64Url,
+  rsaVerify,
+  rsaVerifyBrowser,
+  rsaVerifySync
 });

package/crypto/node.d.ts

@@ -48,7 +48,7 @@ export declare function generateRsaKeyPair(modulusLength?: number, alg?: string)
  * For RSA-PSS (PS256/PS384/PS512), callers must pass appropriate padding/saltLength options.
  */
 export declare function rsaSign(algorithm: string, data: Buffer, privateKey: crypto.KeyObject, options?: Omit<crypto.SignKeyObjectInput, 'key'>): Buffer;
-export declare function rsaVerify(jwtAlg: string, data: Buffer, publicJwk: JsonWebKey, signature: Buffer): boolean;
+export declare function rsaVerify(jwtAlg: string, data: Buffer | Uint8Array, publicJwk: JsonWebKey, signature: Buffer | Uint8Array): boolean;
 /**
  * Sign data with an RSA private JWK and return a base64url-encoded signature.
  *

package/esm/crypto/browser.mjs

@@ -2,11 +2,11 @@ var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuilt
 const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
 // __frontmcpCreateRequire
 // libs/utils/src/crypto/browser.ts
-import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
-import { hmac } from "@noble/hashes/hmac.js";
+import { gcm } from "@noble/ciphers/aes.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
 import { randomBytes as nobleRandomBytes } from "@noble/hashes/utils.js";
-import { gcm } from "@noble/ciphers/aes.js";
 
 // libs/utils/src/crypto/jwt-alg.ts
 function isRsaPssAlg(jwtAlg) {
@@ -94,6 +94,24 @@ var browserCrypto = {
     return constantTimeEqual(a, b);
   }
 };
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -128,7 +146,12 @@ function getSaltLength(jwtAlg) {
 export {
   browserCrypto,
   browserCrypto as cryptoProvider,
+  generateRsaKeyPair,
   isRsaPssAlg,
   jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser
+  pemToPublicJwk,
+  rsaSignBase64Url,
+  rsaVerify,
+  rsaVerifyBrowser,
+  rsaVerifySync
 };

package/esm/index.mjs

@@ -2539,186 +2539,25 @@ var init_key_persistence2 = __esm({
   }
 });
 
-// libs/utils/src/crypto/node.ts
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-import crypto2 from "node:crypto";
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${crypto2.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = crypto2.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return crypto2.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return crypto2.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = crypto2.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return crypto2.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return crypto2.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = crypto2.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return crypto2.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(crypto2.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = crypto2.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return crypto2.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = crypto2.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = crypto2.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = crypto2.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = crypto2.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = crypto2.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return crypto2.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
-
 // libs/utils/src/crypto/browser.ts
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
-import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
-import { hmac } from "@noble/hashes/hmac.js";
+import { gcm } from "@noble/ciphers/aes.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
 import { randomBytes as nobleRandomBytes } from "@noble/hashes/utils.js";
-import { gcm } from "@noble/ciphers/aes.js";
 function toBytes(data) {
   if (typeof data === "string") {
     return new TextEncoder().encode(data);
@@ -2746,6 +2585,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2825,40 +2682,40 @@ var init_browser = __esm({
 });
 
 // libs/utils/src/crypto/index.ts
-import { cryptoProvider as cryptoProvider2 } from "#crypto-provider";
+import * as platformCrypto from "#crypto-provider";
 function getCrypto() {
-  return cryptoProvider2;
+  return platformCrypto.cryptoProvider;
 }
-function rsaVerify2(jwtAlg, data, publicJwk, signature) {
+function rsaVerify3(jwtAlg, data, publicJwk, signature) {
   if (isNode()) {
-    return Promise.resolve((init_node(), __toCommonJS(node_exports)).rsaVerify(jwtAlg, data, publicJwk, signature));
+    return Promise.resolve(platformCrypto.rsaVerify(jwtAlg, data, publicJwk, signature));
   }
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
-function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
   if (!isNode()) {
     throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+  return platformCrypto.rsaSignBase64Url(jwtAlg, data, privateJwk);
 }
-function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
   if (!isNode()) {
     throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+  return platformCrypto.rsaVerifySync(jwtAlg, data, publicJwk, signature);
 }
-function pemToPublicJwk2(pem) {
+function pemToPublicJwk3(pem) {
   if (!isNode()) {
     throw new Error("pemToPublicJwk is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+  return platformCrypto.pemToPublicJwk(pem);
 }
-function generateRsaKeyPair2(modulusLength, alg) {
+function generateRsaKeyPair3(modulusLength, alg) {
   if (!isNode()) {
     throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+  return platformCrypto.generateRsaKeyPair(modulusLength, alg);
 }
 function randomUUID() {
   return getCrypto().randomUUID();
@@ -3023,37 +2880,55 @@ function decodeOrRaw(encoded) {
     return encoded;
   }
 }
-function mergeRedisUrlFields(rawUrl, fields) {
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
   let url;
   try {
     url = new URL(rawUrl);
   } catch {
     return void 0;
   }
-  const urlHost = url.hostname.replace(/^\[(.*)\]$/, "$1");
-  const urlPort = url.port ? Number(url.port) : void 0;
-  const urlPassword = url.password ? decodeOrRaw(url.password) : void 0;
-  const urlDbText = url.pathname.replace(/^\/+/, "") || url.searchParams.get("db") || void 0;
-  const urlDb = urlDbText === void 0 ? void 0 : Number(urlDbText);
-  const urlUsesTls = url.protocol === "rediss:";
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
   const fillIns = {};
   const conflicts = [];
-  if (fields.host !== void 0 && fields.host !== urlHost) conflicts.push("host");
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
   if (fields.port !== void 0) {
-    if (urlPort === void 0) fillIns.port = fields.port;
-    else if (fields.port !== urlPort) conflicts.push("port");
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
   }
   if (fields.password !== void 0) {
-    if (urlPassword === void 0) fillIns.password = fields.password;
-    else if (fields.password !== urlPassword) conflicts.push("password");
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
   }
   if (fields.db !== void 0) {
-    if (urlDb === void 0) fillIns.db = fields.db;
-    else if (fields.db !== urlDb) conflicts.push("db");
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
   }
-  if (fields.tls === true && !urlUsesTls) fillIns.tls = true;
-  if (fields.tls === false && urlUsesTls) conflicts.push("tls");
-  return { fillIns, conflicts };
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
 }
 function describeRedisUrlConflicts(conflicts) {
   return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
@@ -3103,28 +2978,49 @@ function getRedisClass() {
     });
   }
 }
-function resolveUrlFillIns(connectionUrl, options) {
+function resolveUrlOptions(connectionUrl, options) {
   const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
   if (options.url && configUrl && configUrl !== options.url) {
     throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
   }
-  const merge = mergeRedisUrlFields(connectionUrl, siblingFields);
-  if (merge && merge.conflicts.length > 0) {
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
     throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
   }
-  return merge?.fillIns ?? {};
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
 }
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -3149,7 +3045,8 @@ var init_redis = __esm({
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
       connectionUrl;
-      urlFillIns;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -3173,7 +3070,7 @@ var init_redis = __esm({
         this.keyPrefix = options.keyPrefix ?? "";
         const configUrl = options.config?.url;
         this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
-        this.urlFillIns = this.connectionUrl ? resolveUrlFillIns(this.connectionUrl, options) : {};
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -3195,12 +3092,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.connectionUrl) {
-              client = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3434,15 +3326,7 @@ var init_redis = __esm({
        */
       buildRedisOptions() {
         if (this.connectionUrl) {
-          const { port, password, db, tls } = this.urlFillIns;
-          return {
-            ...port !== void 0 ? { port } : {},
-            ...password !== void 0 ? { password } : {},
-            ...db !== void 0 ? { db } : {},
-            ...tls ? { tls: {} } : {},
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
         if (!config || typeof config.url === "string" || config.host === void 0) {
@@ -3458,16 +3342,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.connectionUrl) {
-          subscriber = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -6070,7 +5961,7 @@ export {
   generateCodeChallenge,
   generateCodeVerifier,
   generatePkcePair,
-  generateRsaKeyPair2 as generateRsaKeyPair,
+  generateRsaKeyPair3 as generateRsaKeyPair,
   generateSecret,
   getAsyncContextMode,
   getCookie,
@@ -6135,7 +6026,7 @@ export {
   join as pathJoin,
   resolve as pathResolve,
   pathToFileURL,
-  pemToPublicJwk2 as pemToPublicJwk,
+  pemToPublicJwk3 as pemToPublicJwk,
   processPlatformToolCalls,
   randomBytes,
   randomUUID,
@@ -6150,9 +6041,9 @@ export {
   resetRuntimeContext,
   resolveSecretPath,
   rm,
-  rsaSignBase64Url2 as rsaSignBase64Url,
-  rsaVerify2 as rsaVerify,
-  rsaVerifySync2 as rsaVerifySync,
+  rsaSignBase64Url3 as rsaSignBase64Url,
+  rsaVerify3 as rsaVerify,
+  rsaVerifySync3 as rsaVerifySync,
   runCmd,
   runRequestExclusive,
   safeExec,

package/index.d.ts

@@ -27,7 +27,7 @@ export { getEnv, getNodeEnv, getCwd, isProduction, isDevelopment, getEnvFlag, is
 export type { RuntimeContext, EntryAvailability } from './env';
 export { analyzePattern, isPatternSafe, createSafeRegExp, safeTest, safeMatch, safeReplace, safeExec, isInputLengthSafe, DEFAULT_MAX_INPUT_LENGTH, REDOS_THRESHOLDS, trimLeading, trimTrailing, trimBoth, trimChars, extractBracedParams, expandTemplate, hasTemplatePlaceholders, collapseChar, collapseWhitespace, type SafeRegexOptions, type PatternAnalysisResult, } from './regex';
 export { createStorage, createMemoryStorage, getDetectedStorageType, NamespacedStorageImpl, createRootStorage, createNamespacedStorage, buildPrefix, NAMESPACE_SEPARATOR, StorageError, StorageConnectionError, StorageOperationError, StorageNotSupportedError, StorageConfigError, StorageTTLError, StoragePatternError, StorageNotConnectedError, EncryptedStorageError, BaseStorageAdapter, MemoryStorageAdapter, RedisStorageAdapter, createRedisClient, VercelKvStorageAdapter, createVercelKvClient, type VercelKvConnection, UpstashStorageAdapter, FileSystemStorageAdapter, type FileSystemAdapterOptions, TypedStorage, type TypedStorageOptions, type TypedSetOptions, type TypedSetEntry, EncryptedTypedStorage, type EncryptedTypedStorageOptions, type EncryptedSetOptions, type EncryptedSetEntry, type EncryptionKey, type StoredEncryptedBlob, type ClientKeyBinding, globToRegex, matchesPattern, validatePattern, escapeGlob, MAX_TTL_SECONDS, validateTTL, validateOptionalTTL, ttlToExpiresAt, expiresAtToTTL, isExpired, normalizeTTL, attachRedisErrorListener, DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS, mergeRedisUrlFields, describeRedisUrlConflicts, } from './storage';
-export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, RedisHostConnectionConfig, RedisUrlConnectionConfig, RedisUrlFillInConfig, VercelKvAdapterOptions, UpstashAdapterOptions, StorageType, StorageConfig, RedisErrorListenerOptions, RedisUrlMerge, RedisUrlSiblingFields, CreateRedisClientOptions, ErrorEmitterClient, } from './storage';
+export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, RedisHostConnectionConfig, RedisUrlConnectionConfig, RedisUrlFillInConfig, VercelKvAdapterOptions, UpstashAdapterOptions, StorageType, StorageConfig, RedisErrorListenerOptions, RedisUrlConnection, RedisUrlMerge, RedisUrlSiblingFields, CreateRedisClientOptions, ErrorEmitterClient, } from './storage';
 export { processPlatformToolCalls } from './llm';
 export type { CallToolFn, OpenAIToolCallItem, OpenAIToolResponse, ClaudeToolUseBlock, ClaudeToolResultBlock, VercelToolCallInfo, PlatformToolCallsInput, PlatformToolCallsOutput, SupportedPlatform, } from './llm';
 export { getMachineId, setMachineIdOverride } from './machine-id';

package/index.js

@@ -2541,180 +2541,19 @@ var init_key_persistence2 = __esm({
   }
 });
 
-// libs/utils/src/crypto/node.ts
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = import_node_crypto.default.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return import_node_crypto.default.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var import_node_crypto, nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    import_node_crypto = __toESM(require("node:crypto"));
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return import_node_crypto.default.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(import_node_crypto.default.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = import_node_crypto.default.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = import_node_crypto.default.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = import_node_crypto.default.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = import_node_crypto.default.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return import_node_crypto.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
-
 // libs/utils/src/crypto/browser.ts
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
 function toBytes(data) {
   if (typeof data === "string") {
@@ -2743,6 +2582,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2774,15 +2631,15 @@ function getSaltLength(jwtAlg) {
       return 32;
   }
 }
-var import_sha2, import_hmac, import_hkdf, import_utils, import_aes, browserCrypto;
+var import_aes, import_hkdf, import_hmac, import_sha2, import_utils, browserCrypto;
 var init_browser = __esm({
   "libs/utils/src/crypto/browser.ts"() {
     "use strict";
-    import_sha2 = require("@noble/hashes/sha2.js");
-    import_hmac = require("@noble/hashes/hmac.js");
+    import_aes = require("@noble/ciphers/aes.js");
     import_hkdf = require("@noble/hashes/hkdf.js");
+    import_hmac = require("@noble/hashes/hmac.js");
+    import_sha2 = require("@noble/hashes/sha2.js");
     import_utils = require("@noble/hashes/utils.js");
-    import_aes = require("@noble/ciphers/aes.js");
     init_jwt_alg();
     init_jwt_alg();
     browserCrypto = {
@@ -2828,38 +2685,38 @@ var init_browser = __esm({
 
 // libs/utils/src/crypto/index.ts
 function getCrypto() {
-  return import_crypto_provider2.cryptoProvider;
+  return platformCrypto.cryptoProvider;
 }
-function rsaVerify2(jwtAlg, data, publicJwk, signature) {
+function rsaVerify3(jwtAlg, data, publicJwk, signature) {
   if (isNode()) {
-    return Promise.resolve((init_node(), __toCommonJS(node_exports)).rsaVerify(jwtAlg, data, publicJwk, signature));
+    return Promise.resolve(platformCrypto.rsaVerify(jwtAlg, data, publicJwk, signature));
   }
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
-function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
   if (!isNode()) {
     throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+  return platformCrypto.rsaSignBase64Url(jwtAlg, data, privateJwk);
 }
-function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
   if (!isNode()) {
     throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+  return platformCrypto.rsaVerifySync(jwtAlg, data, publicJwk, signature);
 }
-function pemToPublicJwk2(pem) {
+function pemToPublicJwk3(pem) {
   if (!isNode()) {
     throw new Error("pemToPublicJwk is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+  return platformCrypto.pemToPublicJwk(pem);
 }
-function generateRsaKeyPair2(modulusLength, alg) {
+function generateRsaKeyPair3(modulusLength, alg) {
   if (!isNode()) {
     throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+  return platformCrypto.generateRsaKeyPair(modulusLength, alg);
 }
 function randomUUID() {
   return getCrypto().randomUUID();
@@ -2965,11 +2822,11 @@ function base64Decode(data) {
 function sha256Base64url(data) {
   return base64urlEncode(sha256(data));
 }
-var import_crypto_provider2, HKDF_SHA256_MAX_LENGTH;
+var platformCrypto, HKDF_SHA256_MAX_LENGTH;
 var init_crypto = __esm({
   "libs/utils/src/crypto/index.ts"() {
     "use strict";
-    import_crypto_provider2 = require("#crypto-provider");
+    platformCrypto = __toESM(require("#crypto-provider"));
     init_runtime();
     init_jwt_alg();
     init_runtime();
@@ -3025,37 +2882,55 @@ function decodeOrRaw(encoded) {
     return encoded;
   }
 }
-function mergeRedisUrlFields(rawUrl, fields) {
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
   let url;
   try {
     url = new URL(rawUrl);
   } catch {
     return void 0;
   }
-  const urlHost = url.hostname.replace(/^\[(.*)\]$/, "$1");
-  const urlPort = url.port ? Number(url.port) : void 0;
-  const urlPassword = url.password ? decodeOrRaw(url.password) : void 0;
-  const urlDbText = url.pathname.replace(/^\/+/, "") || url.searchParams.get("db") || void 0;
-  const urlDb = urlDbText === void 0 ? void 0 : Number(urlDbText);
-  const urlUsesTls = url.protocol === "rediss:";
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
   const fillIns = {};
   const conflicts = [];
-  if (fields.host !== void 0 && fields.host !== urlHost) conflicts.push("host");
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
   if (fields.port !== void 0) {
-    if (urlPort === void 0) fillIns.port = fields.port;
-    else if (fields.port !== urlPort) conflicts.push("port");
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
   }
   if (fields.password !== void 0) {
-    if (urlPassword === void 0) fillIns.password = fields.password;
-    else if (fields.password !== urlPassword) conflicts.push("password");
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
   }
   if (fields.db !== void 0) {
-    if (urlDb === void 0) fillIns.db = fields.db;
-    else if (fields.db !== urlDb) conflicts.push("db");
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
   }
-  if (fields.tls === true && !urlUsesTls) fillIns.tls = true;
-  if (fields.tls === false && urlUsesTls) conflicts.push("tls");
-  return { fillIns, conflicts };
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
 }
 function describeRedisUrlConflicts(conflicts) {
   return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
@@ -3105,28 +2980,49 @@ function getRedisClass() {
     });
   }
 }
-function resolveUrlFillIns(connectionUrl, options) {
+function resolveUrlOptions(connectionUrl, options) {
   const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
   if (options.url && configUrl && configUrl !== options.url) {
     throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
   }
-  const merge = mergeRedisUrlFields(connectionUrl, siblingFields);
-  if (merge && merge.conflicts.length > 0) {
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
     throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
   }
-  return merge?.fillIns ?? {};
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
 }
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -3151,7 +3047,8 @@ var init_redis = __esm({
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
       connectionUrl;
-      urlFillIns;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -3175,7 +3072,7 @@ var init_redis = __esm({
         this.keyPrefix = options.keyPrefix ?? "";
         const configUrl = options.config?.url;
         this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
-        this.urlFillIns = this.connectionUrl ? resolveUrlFillIns(this.connectionUrl, options) : {};
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -3197,12 +3094,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.connectionUrl) {
-              client = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3436,15 +3328,7 @@ var init_redis = __esm({
        */
       buildRedisOptions() {
         if (this.connectionUrl) {
-          const { port, password, db, tls } = this.urlFillIns;
-          return {
-            ...port !== void 0 ? { port } : {},
-            ...password !== void 0 ? { password } : {},
-            ...db !== void 0 ? { db } : {},
-            ...tls ? { tls: {} } : {},
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
         if (!config || typeof config.url === "string" || config.host === void 0) {
@@ -3460,16 +3344,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.connectionUrl) {
-          subscriber = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -4297,7 +4188,7 @@ __export(index_exports, {
   generateCodeChallenge: () => generateCodeChallenge,
   generateCodeVerifier: () => generateCodeVerifier,
   generatePkcePair: () => generatePkcePair,
-  generateRsaKeyPair: () => generateRsaKeyPair2,
+  generateRsaKeyPair: () => generateRsaKeyPair3,
   generateSecret: () => generateSecret,
   getAsyncContextMode: () => import_async_context.getAsyncContextMode,
   getCookie: () => getCookie,
@@ -4362,7 +4253,7 @@ __export(index_exports, {
   pathJoin: () => import_path2.join,
   pathResolve: () => import_path2.resolve,
   pathToFileURL: () => import_path2.pathToFileURL,
-  pemToPublicJwk: () => pemToPublicJwk2,
+  pemToPublicJwk: () => pemToPublicJwk3,
   processPlatformToolCalls: () => processPlatformToolCalls,
   randomBytes: () => randomBytes,
   randomUUID: () => randomUUID,
@@ -4377,9 +4268,9 @@ __export(index_exports, {
   resetRuntimeContext: () => import_runtime_context.resetRuntimeContext,
   resolveSecretPath: () => resolveSecretPath,
   rm: () => rm,
-  rsaSignBase64Url: () => rsaSignBase64Url2,
-  rsaVerify: () => rsaVerify2,
-  rsaVerifySync: () => rsaVerifySync2,
+  rsaSignBase64Url: () => rsaSignBase64Url3,
+  rsaVerify: () => rsaVerify3,
+  rsaVerifySync: () => rsaVerifySync3,
   runCmd: () => runCmd,
   runRequestExclusive: () => import_async_context.runRequestExclusive,
   safeExec: () => safeExec,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/utils",
-  "version": "1.9.2",
+  "version": "1.9.3",
   "description": "Shared utility functions for FrontMCP - string manipulation, URI handling, path utilities, and more",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -32,11 +32,15 @@
     "@noble/hashes": "^2.0.1"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.2",
+    "@frontmcp/lazy-zod": "1.9.3",
+    "@upstash/redis": "^1.34.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0",
     "ioredis": "^5.0.0"
   },
   "peerDependenciesMeta": {
+    "@upstash/redis": {
+      "optional": true
+    },
     "@vercel/kv": {
       "optional": true
     },

package/storage/adapters/redis.d.ts

@@ -40,7 +40,8 @@ export declare class RedisStorageAdapter extends BaseStorageAdapter {
     private readonly keyPrefix;
     private readonly subscriptionHandlers;
     private readonly connectionUrl?;
-    private readonly urlFillIns;
+    /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+    private readonly urlOptions?;
     constructor(options?: RedisAdapterOptions);
     connect(): Promise<void>;
     private openConnection;
@@ -75,6 +76,10 @@ export declare class RedisStorageAdapter extends BaseStorageAdapter {
      * Build Redis options from config.
      */
     private buildRedisOptions;
+    /**
+     * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+     */
+    private newClient;
     /**
      * Create subscriber connection.
      */
@@ -106,6 +111,9 @@ export interface CreateRedisClientOptions {
 /**
  * Create a plain ioredis client that reconnects on its own and never emits an unhandled
  * 'error' event. The caller owns the client and must `quit()`/`disconnect()` it.
+ *
+ * With a `url`, the other connection fields fill in only what the URL leaves out (port,
+ * password, db, tls), and one that contradicts it throws a `StorageConfigError`.
  */
 export declare function createRedisClient(options: CreateRedisClientOptions): Redis;
 export {};

package/storage/index.d.ts

@@ -9,7 +9,7 @@ export { createStorage, createMemoryStorage, getDetectedStorageType } from './fa
 export { attachRedisErrorListener, DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS } from './redis-error-listener';
 export type { RedisErrorListenerOptions, ErrorEmitterClient } from './redis-error-listener';
 export { mergeRedisUrlFields, describeRedisUrlConflicts } from './redis-url';
-export type { RedisUrlMerge, RedisUrlSiblingFields } from './redis-url';
+export type { RedisUrlConnection, RedisUrlMerge, RedisUrlSiblingFields } from './redis-url';
 export { NamespacedStorageImpl, createRootStorage, createNamespacedStorage, buildPrefix, NAMESPACE_SEPARATOR, } from './namespace';
 export { StorageError, StorageConnectionError, StorageOperationError, StorageNotSupportedError, StorageConfigError, StorageTTLError, StoragePatternError, StorageNotConnectedError, EncryptedStorageError, } from './errors';
 export { TypedStorage } from './typed-storage';

package/storage/redis-url.d.ts

@@ -8,20 +8,42 @@ export interface RedisUrlSiblingFields {
     db?: number;
     tls?: boolean;
 }
+/**
+ * What a `redis://` or `rediss://` URL states, read as ioredis reads it: the userinfo, port and path
+ * first, then the same names in its query. An empty username or password counts as left out.
+ */
+export interface RedisUrlConnection {
+    host?: string;
+    port?: number;
+    username?: string;
+    password?: string;
+    db?: number;
+    tls: boolean;
+    /** The query's other options, which ioredis takes as they are (`family` as a number). */
+    queryOptions: Record<string, string | number>;
+}
 /**
  * Outcome of combining a Redis URL with the fields written beside it.
  */
 export interface RedisUrlMerge {
+    /** What the URL states. */
+    connection: RedisUrlConnection;
     /** Fields the URL leaves out that the sibling fields supply. */
     fillIns: Pick<RedisUrlSiblingFields, 'port' | 'password' | 'db' | 'tls'>;
     /** Sibling fields whose value contradicts the URL. */
     conflicts: Array<keyof RedisUrlSiblingFields>;
 }
+/**
+ * Read a `redis://` or `rediss://` URL. Returns `undefined` for an unparseable URL or another
+ * scheme (such as a socket path), which only ioredis reads.
+ */
+export declare function readRedisUrl(rawUrl: string): RedisUrlConnection | undefined;
 /**
  * The URL is the base: fields beside it fill in only what it leaves out (a
- * port, a password, a database, TLS), and a field that contradicts it is a
- * conflict the caller must reject (#768). Returns `undefined` for an
- * unparseable URL, which the caller reports on its own terms.
+ * port, a password, a database, TLS), and a field that contradicts what it
+ * states, in its userinfo, path or query, is a conflict the caller must reject
+ * (#768). Returns `undefined` for a URL {@link readRedisUrl} cannot read, which
+ * the caller reports on its own terms.
  */
 export declare function mergeRedisUrlFields(rawUrl: string, fields: RedisUrlSiblingFields): RedisUrlMerge | undefined;
 /** Human-readable reason for {@link RedisUrlMerge.conflicts}. */