@frontmcp/utils 1.9.2 → 1.9.4

package/esm/index.mjs

@@ -117,6 +117,9 @@ async function fileExists(p) {
     return false;
   }
 }
+function fileExistsSync(p) {
+  return getFs().existsSync(p);
+}
 async function readJSON(jsonPath) {
   try {
     const fsp = getFsp();
@@ -2539,186 +2542,25 @@ var init_key_persistence2 = __esm({
   }
 });
 
-// libs/utils/src/crypto/node.ts
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-import crypto2 from "node:crypto";
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${crypto2.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = crypto2.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return crypto2.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return crypto2.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = crypto2.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = crypto2.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return crypto2.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return crypto2.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = crypto2.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: crypto2.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: crypto2.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return crypto2.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(crypto2.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = crypto2.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return crypto2.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = crypto2.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = crypto2.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = crypto2.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = crypto2.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = crypto2.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return crypto2.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
-
 // libs/utils/src/crypto/browser.ts
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
-import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
-import { hmac } from "@noble/hashes/hmac.js";
+import { gcm } from "@noble/ciphers/aes.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 as sha256Hash } from "@noble/hashes/sha2.js";
 import { randomBytes as nobleRandomBytes } from "@noble/hashes/utils.js";
-import { gcm } from "@noble/ciphers/aes.js";
 function toBytes(data) {
   if (typeof data === "string") {
     return new TextEncoder().encode(data);
@@ -2746,6 +2588,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2825,40 +2685,40 @@ var init_browser = __esm({
 });
 
 // libs/utils/src/crypto/index.ts
-import { cryptoProvider as cryptoProvider2 } from "#crypto-provider";
+import * as platformCrypto from "#crypto-provider";
 function getCrypto() {
-  return cryptoProvider2;
+  return platformCrypto.cryptoProvider;
 }
-function rsaVerify2(jwtAlg, data, publicJwk, signature) {
+function rsaVerify3(jwtAlg, data, publicJwk, signature) {
   if (isNode()) {
-    return Promise.resolve((init_node(), __toCommonJS(node_exports)).rsaVerify(jwtAlg, data, publicJwk, signature));
+    return Promise.resolve(platformCrypto.rsaVerify(jwtAlg, data, publicJwk, signature));
   }
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
-function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
   if (!isNode()) {
     throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+  return platformCrypto.rsaSignBase64Url(jwtAlg, data, privateJwk);
 }
-function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
   if (!isNode()) {
     throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+  return platformCrypto.rsaVerifySync(jwtAlg, data, publicJwk, signature);
 }
-function pemToPublicJwk2(pem) {
+function pemToPublicJwk3(pem) {
   if (!isNode()) {
     throw new Error("pemToPublicJwk is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+  return platformCrypto.pemToPublicJwk(pem);
 }
-function generateRsaKeyPair2(modulusLength, alg) {
+function generateRsaKeyPair3(modulusLength, alg) {
   if (!isNode()) {
     throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+  return platformCrypto.generateRsaKeyPair(modulusLength, alg);
 }
 function randomUUID() {
   return getCrypto().randomUUID();
@@ -3023,37 +2883,55 @@ function decodeOrRaw(encoded) {
     return encoded;
   }
 }
-function mergeRedisUrlFields(rawUrl, fields) {
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
   let url;
   try {
     url = new URL(rawUrl);
   } catch {
     return void 0;
   }
-  const urlHost = url.hostname.replace(/^\[(.*)\]$/, "$1");
-  const urlPort = url.port ? Number(url.port) : void 0;
-  const urlPassword = url.password ? decodeOrRaw(url.password) : void 0;
-  const urlDbText = url.pathname.replace(/^\/+/, "") || url.searchParams.get("db") || void 0;
-  const urlDb = urlDbText === void 0 ? void 0 : Number(urlDbText);
-  const urlUsesTls = url.protocol === "rediss:";
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
   const fillIns = {};
   const conflicts = [];
-  if (fields.host !== void 0 && fields.host !== urlHost) conflicts.push("host");
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
   if (fields.port !== void 0) {
-    if (urlPort === void 0) fillIns.port = fields.port;
-    else if (fields.port !== urlPort) conflicts.push("port");
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
   }
   if (fields.password !== void 0) {
-    if (urlPassword === void 0) fillIns.password = fields.password;
-    else if (fields.password !== urlPassword) conflicts.push("password");
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
   }
   if (fields.db !== void 0) {
-    if (urlDb === void 0) fillIns.db = fields.db;
-    else if (fields.db !== urlDb) conflicts.push("db");
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
   }
-  if (fields.tls === true && !urlUsesTls) fillIns.tls = true;
-  if (fields.tls === false && urlUsesTls) conflicts.push("tls");
-  return { fillIns, conflicts };
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
 }
 function describeRedisUrlConflicts(conflicts) {
   return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
@@ -3103,28 +2981,49 @@ function getRedisClass() {
     });
   }
 }
-function resolveUrlFillIns(connectionUrl, options) {
+function resolveUrlOptions(connectionUrl, options) {
   const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
   if (options.url && configUrl && configUrl !== options.url) {
     throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
   }
-  const merge = mergeRedisUrlFields(connectionUrl, siblingFields);
-  if (merge && merge.conflicts.length > 0) {
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
     throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
   }
-  return merge?.fillIns ?? {};
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
 }
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -3149,7 +3048,8 @@ var init_redis = __esm({
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
       connectionUrl;
-      urlFillIns;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -3173,7 +3073,7 @@ var init_redis = __esm({
         this.keyPrefix = options.keyPrefix ?? "";
         const configUrl = options.config?.url;
         this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
-        this.urlFillIns = this.connectionUrl ? resolveUrlFillIns(this.connectionUrl, options) : {};
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -3195,12 +3095,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.connectionUrl) {
-              client = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3434,15 +3329,7 @@ var init_redis = __esm({
        */
       buildRedisOptions() {
         if (this.connectionUrl) {
-          const { port, password, db, tls } = this.urlFillIns;
-          return {
-            ...port !== void 0 ? { port } : {},
-            ...password !== void 0 ? { password } : {},
-            ...db !== void 0 ? { db } : {},
-            ...tls ? { tls: {} } : {},
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
         if (!config || typeof config.url === "string" || config.host === void 0) {
@@ -3458,16 +3345,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.connectionUrl) {
-          subscriber = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -4992,6 +4886,30 @@ function safeJsonForScript(value) {
   }
 }
 
+// libs/utils/src/class-brand/class-brand.ts
+var CLASS_BRAND = /* @__PURE__ */ Symbol.for("@frontmcp/class-brand");
+var ordinaryHasInstance = Function.prototype[Symbol.hasInstance];
+function ownBrandOf(klass) {
+  if (typeof klass !== "function" || !Object.prototype.hasOwnProperty.call(klass, CLASS_BRAND)) return void 0;
+  return klass[CLASS_BRAND];
+}
+function classOfPrototype(proto) {
+  return Object.getOwnPropertyDescriptor(proto, "constructor")?.value;
+}
+function brandClass(klass, brand) {
+  Object.defineProperty(klass, CLASS_BRAND, { value: brand, enumerable: false, writable: false, configurable: false });
+}
+function isBrandedInstance(klass, value) {
+  if (ordinaryHasInstance.call(klass, value)) return true;
+  if (typeof value !== "object" || value === null) return false;
+  const brand = ownBrandOf(klass);
+  if (brand === void 0) return false;
+  for (let proto = Object.getPrototypeOf(value); proto !== null; proto = Object.getPrototypeOf(proto)) {
+    if (ownBrandOf(classOfPrototype(proto)) === brand) return true;
+  }
+  return false;
+}
+
 // libs/utils/src/serialization/serialization.ts
 function safeStringify(value, space) {
   const seen = /* @__PURE__ */ new WeakSet();
@@ -6016,6 +5934,7 @@ export {
   base64urlDecode,
   base64urlEncode,
   basename,
+  brandClass,
   buildPrefix,
   buildSetCookie,
   bytesToHex,
@@ -6066,11 +5985,12 @@ export {
   extractTemplateParams,
   extractUriScheme,
   fileExists,
+  fileExistsSync,
   findNonFiniteNumber,
   generateCodeChallenge,
   generateCodeVerifier,
   generatePkcePair,
-  generateRsaKeyPair2 as generateRsaKeyPair,
+  generateRsaKeyPair3 as generateRsaKeyPair,
   generateSecret,
   getAsyncContextMode,
   getCookie,
@@ -6092,6 +6012,7 @@ export {
   inferMimeType,
   isAbsolute,
   isAsymmetricKeyData,
+  isBrandedInstance,
   isBrowser,
   isDebug,
   isDevelopment,
@@ -6135,7 +6056,7 @@ export {
   join as pathJoin,
   resolve as pathResolve,
   pathToFileURL,
-  pemToPublicJwk2 as pemToPublicJwk,
+  pemToPublicJwk3 as pemToPublicJwk,
   processPlatformToolCalls,
   randomBytes,
   randomUUID,
@@ -6150,9 +6071,9 @@ export {
   resetRuntimeContext,
   resolveSecretPath,
   rm,
-  rsaSignBase64Url2 as rsaSignBase64Url,
-  rsaVerify2 as rsaVerify,
-  rsaVerifySync2 as rsaVerifySync,
+  rsaSignBase64Url3 as rsaSignBase64Url,
+  rsaVerify3 as rsaVerify,
+  rsaVerifySync3 as rsaVerifySync,
   runCmd,
   runRequestExclusive,
   safeExec,

package/fs/fs.d.ts

@@ -137,6 +137,21 @@ export declare function unlink(p: string): Promise<void>;
  * await fileExists('/path/to/file.txt') // true or false
  */
 export declare function fileExists(p: string): Promise<boolean>;
+/**
+ * Check whether a file or directory exists, synchronously.
+ *
+ * **Node.js only** - throws an error if called in browser.
+ *
+ * Use this only where async is not possible (e.g. resolving a command line
+ * before a synchronous `spawn`). Prefer {@link fileExists} otherwise.
+ *
+ * @param p - Path to check
+ * @returns true if the path exists, false otherwise
+ *
+ * @example
+ * fileExistsSync('/path/to/file.txt') // true or false
+ */
+export declare function fileExistsSync(p: string): boolean;
 /**
  * Read and parse a JSON file.
  *
@@ -343,6 +358,11 @@ export declare function access(p: string, mode?: number): Promise<void>;
 export declare function runCmd(cmd: string, args: string[], opts?: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
+    /**
+     * Pass `args` to the child unquoted (Windows only). Set it when the arguments
+     * are already quoted for `cmd.exe /d /s /c`; ignored on other platforms.
+     */
+    windowsVerbatimArguments?: boolean;
 }): Promise<void>;
 /**
  * Handle returned by {@link watchFile}. `close()` stops the watch and is safe

package/fs/index.d.ts

@@ -1,2 +1,2 @@
-export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, readdirSync, realpath, rm, mkdtemp, symlink, access, fileExists, readJSON, writeJSON, ensureDir, ensureDirSync, isDirEmpty, runCmd, watchFile, getSpawnFn, } from './fs';
+export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, readdirSync, realpath, rm, mkdtemp, symlink, access, fileExists, fileExistsSync, readJSON, writeJSON, ensureDir, ensureDirSync, isDirEmpty, runCmd, watchFile, getSpawnFn, } from './fs';
 export type { FileWatcherHandle, SymlinkType } from './fs';

package/index.d.ts

@@ -15,9 +15,10 @@ export { validateBaseUrl, buildSetCookie, parseCookies, getCookie, isLocalhost,
 export type { CookieOptions, SecureDetectionRequest } from './http';
 export { classifyIpAddress, expandIpv6, extractEmbeddedIpv4, parseIpv4, isRedirectResponse } from './net';
 export type { IpAddressClassification, IpAddressRange, SpecialPurposeIpRange, RedirectCandidate } from './net';
-export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, readdirSync, realpath, rm, mkdtemp, symlink, access, fileExists, readJSON, writeJSON, ensureDir, ensureDirSync, isDirEmpty, runCmd, watchFile, getSpawnFn, } from './fs';
+export { readFile, readFileSync, readFileBuffer, writeFile, mkdir, rename, unlink, stat, copyFile, cp, readdir, readdirSync, realpath, rm, mkdtemp, symlink, access, fileExists, fileExistsSync, readJSON, writeJSON, ensureDir, ensureDirSync, isDirEmpty, runCmd, watchFile, getSpawnFn, } from './fs';
 export type { FileWatcherHandle } from './fs';
 export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript } from './escape';
+export { brandClass, isBrandedInstance } from './class-brand';
 export { safeStringify } from './serialization';
 export { getCrypto, rsaVerify, rsaVerifySync, pemToPublicJwk, generateRsaKeyPair, rsaSignBase64Url, type RsaJwk, type RsaKeyPair, jwtAlgToNodeAlg, isRsaPssAlg, randomUUID, randomBytes, sha256, sha256Hex, sha256Base64url, hmacSha256, hkdfSha256, encryptAesGcm, decryptAesGcm, timingSafeEqual, bytesToHex, base64urlEncode, base64urlDecode, base64Encode, base64Decode, isNode, isBrowser, assertNode, EncryptedBlobError, encryptValue, decryptValue, tryDecryptValue, serializeBlob, deserializeBlob, tryDeserializeBlob, isValidEncryptedBlob, encryptAndSerialize, deserializeAndDecrypt, tryDeserializeAndDecrypt, generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkcePair, isValidCodeVerifier, isValidCodeChallenge, MIN_CODE_VERIFIER_LENGTH, MAX_CODE_VERIFIER_LENGTH, DEFAULT_CODE_VERIFIER_LENGTH, PkceError, type PkcePair, type SecretData, type SecretPersistenceOptions, type SecretValidationResult, secretDataSchema, validateSecretData, parseSecretData, isSecretPersistenceEnabled, resolveSecretPath, loadSecret, saveSecret, deleteSecret, generateSecret, createSecretData, getOrCreateSecret, clearCachedSecret, isSecretCached, type SignedData, type HmacSigningConfig, signData, verifyData, isSignedData, verifyOrParseData, type BaseKeyData, type SecretKeyData, type AsymmetricKeyData, type AnyKeyData, type KeyPersistenceOptions, type CreateKeyPersistenceOptions, type CreateSecretOptions, type CreateAsymmetricOptions, type KeyValidationResult, asymmetricAlgSchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema, validateKeyData, parseKeyData, isSecretKeyData, isAsymmetricKeyData, KeyPersistence, createKeyPersistence, createKeyPersistenceWithStorage, } from './crypto';
 export type { CryptoProvider, EncBlob, EncryptedBlob } from './crypto';
@@ -27,7 +28,7 @@ export { getEnv, getNodeEnv, getCwd, isProduction, isDevelopment, getEnvFlag, is
 export type { RuntimeContext, EntryAvailability } from './env';
 export { analyzePattern, isPatternSafe, createSafeRegExp, safeTest, safeMatch, safeReplace, safeExec, isInputLengthSafe, DEFAULT_MAX_INPUT_LENGTH, REDOS_THRESHOLDS, trimLeading, trimTrailing, trimBoth, trimChars, extractBracedParams, expandTemplate, hasTemplatePlaceholders, collapseChar, collapseWhitespace, type SafeRegexOptions, type PatternAnalysisResult, } from './regex';
 export { createStorage, createMemoryStorage, getDetectedStorageType, NamespacedStorageImpl, createRootStorage, createNamespacedStorage, buildPrefix, NAMESPACE_SEPARATOR, StorageError, StorageConnectionError, StorageOperationError, StorageNotSupportedError, StorageConfigError, StorageTTLError, StoragePatternError, StorageNotConnectedError, EncryptedStorageError, BaseStorageAdapter, MemoryStorageAdapter, RedisStorageAdapter, createRedisClient, VercelKvStorageAdapter, createVercelKvClient, type VercelKvConnection, UpstashStorageAdapter, FileSystemStorageAdapter, type FileSystemAdapterOptions, TypedStorage, type TypedStorageOptions, type TypedSetOptions, type TypedSetEntry, EncryptedTypedStorage, type EncryptedTypedStorageOptions, type EncryptedSetOptions, type EncryptedSetEntry, type EncryptionKey, type StoredEncryptedBlob, type ClientKeyBinding, globToRegex, matchesPattern, validatePattern, escapeGlob, MAX_TTL_SECONDS, validateTTL, validateOptionalTTL, ttlToExpiresAt, expiresAtToTTL, isExpired, normalizeTTL, attachRedisErrorListener, DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS, mergeRedisUrlFields, describeRedisUrlConflicts, } from './storage';
-export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, RedisHostConnectionConfig, RedisUrlConnectionConfig, RedisUrlFillInConfig, VercelKvAdapterOptions, UpstashAdapterOptions, StorageType, StorageConfig, RedisErrorListenerOptions, RedisUrlMerge, RedisUrlSiblingFields, CreateRedisClientOptions, ErrorEmitterClient, } from './storage';
+export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, RedisHostConnectionConfig, RedisUrlConnectionConfig, RedisUrlFillInConfig, VercelKvAdapterOptions, UpstashAdapterOptions, StorageType, StorageConfig, RedisErrorListenerOptions, RedisUrlConnection, RedisUrlMerge, RedisUrlSiblingFields, CreateRedisClientOptions, ErrorEmitterClient, } from './storage';
 export { processPlatformToolCalls } from './llm';
 export type { CallToolFn, OpenAIToolCallItem, OpenAIToolResponse, ClaudeToolUseBlock, ClaudeToolResultBlock, VercelToolCallInfo, PlatformToolCallsInput, PlatformToolCallsOutput, SupportedPlatform, } from './llm';
 export { getMachineId, setMachineIdOverride } from './machine-id';