@frontmcp/utils 1.9.2 → 1.9.4

package/index.js

@@ -119,6 +119,9 @@ async function fileExists(p) {
     return false;
   }
 }
+function fileExistsSync(p) {
+  return getFs().existsSync(p);
+}
 async function readJSON(jsonPath) {
   try {
     const fsp = getFsp();
@@ -2541,180 +2544,19 @@ var init_key_persistence2 = __esm({
   }
 });
 
-// libs/utils/src/crypto/node.ts
-var node_exports = {};
-__export(node_exports, {
-  createSignedJwt: () => createSignedJwt,
-  cryptoProvider: () => nodeCrypto,
-  generateRsaKeyPair: () => generateRsaKeyPair,
-  isRsaPssAlg: () => isRsaPssAlg,
-  jwtAlgToNodeAlg: () => jwtAlgToNodeAlg,
-  nodeCrypto: () => nodeCrypto,
-  pemToPublicJwk: () => pemToPublicJwk,
-  rsaSign: () => rsaSign,
-  rsaSignBase64Url: () => rsaSignBase64Url,
-  rsaVerify: () => rsaVerify,
-  rsaVerifySync: () => rsaVerifySync
-});
-function toUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function toBuffer(data) {
-  if (typeof data === "string") {
-    return Buffer.from(data, "utf8");
-  }
-  return Buffer.from(data);
-}
-function generateRsaKeyPair(modulusLength = 2048, alg = "RS256") {
-  const kid = `rsa-key-${Date.now()}-${import_node_crypto.default.randomBytes(8).toString("hex")}`;
-  const { privateKey, publicKey } = import_node_crypto.default.generateKeyPairSync("rsa", {
-    modulusLength
-  });
-  const exported = publicKey.export({ format: "jwk" });
-  const publicJwk = {
-    ...exported,
-    kid,
-    alg,
-    use: "sig",
-    kty: "RSA"
-  };
-  return { privateKey, publicKey, publicJwk };
-}
-function rsaSign(algorithm, data, privateKey, options) {
-  const signingKey = options ? { key: privateKey, ...options } : privateKey;
-  return import_node_crypto.default.sign(algorithm, data, signingKey);
-}
-function rsaVerify(jwtAlg, data, publicJwk, signature) {
-  const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const verifyKey = isRsaPssAlg(jwtAlg) ? {
-    key: publicKey,
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  } : publicKey;
-  return import_node_crypto.default.verify(nodeAlgorithm, data, verifyKey, signature);
-}
-function rsaSignBase64Url(jwtAlg, data, privateJwk) {
-  const privateKey = import_node_crypto.default.createPrivateKey({ key: privateJwk, format: "jwk" });
-  const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-  const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-  const sig = isRsaPssAlg(jwtAlg) ? rsaSign(nodeAlgorithm, buf, privateKey, {
-    padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-  }) : rsaSign(nodeAlgorithm, buf, privateKey);
-  return sig.toString("base64url");
-}
-function rsaVerifySync(jwtAlg, data, publicJwk, signature) {
-  try {
-    const publicKey = import_node_crypto.default.createPublicKey({ key: publicJwk, format: "jwk" });
-    const dataBuf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-    const sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
-    if (jwtAlg === "EdDSA") {
-      return import_node_crypto.default.verify(null, dataBuf, publicKey, sigBuf);
-    }
-    const nodeAlgorithm = jwtAlgToNodeAlg(jwtAlg);
-    const verifyKey = isRsaPssAlg(jwtAlg) ? {
-      key: publicKey,
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : publicKey;
-    return import_node_crypto.default.verify(nodeAlgorithm, dataBuf, verifyKey, sigBuf);
-  } catch {
-    return false;
-  }
-}
-function pemToPublicJwk(pem) {
-  const key = import_node_crypto.default.createPublicKey({ key: pem, format: "pem" });
-  return key.export({ format: "jwk" });
-}
-function createSignedJwt(payload, privateKey, kid, alg = "RS256") {
-  const header = { alg, typ: "JWT", kid };
-  const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
-  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signatureInput = `${headerB64}.${payloadB64}`;
-  const nodeAlgorithm = jwtAlgToNodeAlg(alg);
-  const signature = rsaSign(
-    nodeAlgorithm,
-    Buffer.from(signatureInput),
-    privateKey,
-    isRsaPssAlg(alg) ? {
-      padding: import_node_crypto.default.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: import_node_crypto.default.constants.RSA_PSS_SALTLEN_DIGEST
-    } : void 0
-  );
-  const signatureB64 = signature.toString("base64url");
-  return `${headerB64}.${payloadB64}.${signatureB64}`;
-}
-var import_node_crypto, nodeCrypto;
-var init_node = __esm({
-  "libs/utils/src/crypto/node.ts"() {
-    "use strict";
-    import_node_crypto = __toESM(require("node:crypto"));
-    init_jwt_alg();
-    init_jwt_alg();
-    nodeCrypto = {
-      randomUUID() {
-        return import_node_crypto.default.randomUUID();
-      },
-      randomBytes(length) {
-        return toUint8Array(import_node_crypto.default.randomBytes(length));
-      },
-      sha256(data) {
-        const hash = import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest();
-        return toUint8Array(hash);
-      },
-      sha256Hex(data) {
-        return import_node_crypto.default.createHash("sha256").update(toBuffer(data)).digest("hex");
-      },
-      hmacSha256(key, data) {
-        const hmac2 = import_node_crypto.default.createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest();
-        return toUint8Array(hmac2);
-      },
-      hkdfSha256(ikm, salt, info, length) {
-        const ikmBuf = Buffer.from(ikm);
-        const saltBuf = salt.length > 0 ? Buffer.from(salt) : Buffer.alloc(32);
-        const prk = import_node_crypto.default.createHmac("sha256", saltBuf).update(ikmBuf).digest();
-        const hashLen = 32;
-        const n = Math.ceil(length / hashLen);
-        const chunks = [];
-        let prev = Buffer.alloc(0);
-        for (let i = 1; i <= n; i++) {
-          prev = import_node_crypto.default.createHmac("sha256", prk).update(Buffer.concat([prev, Buffer.from(info), Buffer.from([i])])).digest();
-          chunks.push(prev);
-        }
-        return toUint8Array(Buffer.concat(chunks).subarray(0, length));
-      },
-      encryptAesGcm(key, plaintext, iv) {
-        const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        const encrypted = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return {
-          ciphertext: toUint8Array(encrypted),
-          tag: toUint8Array(tag)
-        };
-      },
-      decryptAesGcm(key, ciphertext, iv, tag) {
-        const decipher = import_node_crypto.default.createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
-        decipher.setAuthTag(Buffer.from(tag));
-        const decrypted = Buffer.concat([decipher.update(Buffer.from(ciphertext)), decipher.final()]);
-        return toUint8Array(decrypted);
-      },
-      timingSafeEqual(a, b) {
-        if (a.length !== b.length) return false;
-        return import_node_crypto.default.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-      }
-    };
-  }
-});
-
 // libs/utils/src/crypto/browser.ts
 var browser_exports = {};
 __export(browser_exports, {
   browserCrypto: () => browserCrypto,
   cryptoProvider: () => browserCrypto,
+  generateRsaKeyPair: () => generateRsaKeyPair,
   isRsaPssAlg: () => isRsaPssAlg,
   jwtAlgToWebCryptoAlg: () => jwtAlgToWebCryptoAlg,
-  rsaVerifyBrowser: () => rsaVerifyBrowser
+  pemToPublicJwk: () => pemToPublicJwk,
+  rsaSignBase64Url: () => rsaSignBase64Url,
+  rsaVerify: () => rsaVerify,
+  rsaVerifyBrowser: () => rsaVerifyBrowser,
+  rsaVerifySync: () => rsaVerifySync
 });
 function toBytes(data) {
   if (typeof data === "string") {
@@ -2743,6 +2585,24 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function nodeOnly(name) {
+  throw new Error(`${name} is only available in Node.js runtimes`);
+}
+function rsaVerify() {
+  return nodeOnly("rsaVerify");
+}
+function rsaSignBase64Url() {
+  return nodeOnly("rsaSignBase64Url");
+}
+function rsaVerifySync() {
+  return nodeOnly("rsaVerifySync");
+}
+function pemToPublicJwk() {
+  return nodeOnly("pemToPublicJwk");
+}
+function generateRsaKeyPair() {
+  return nodeOnly("generateRsaKeyPair");
+}
 async function rsaVerifyBrowser(jwtAlg, data, publicJwk, signature) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     throw new Error("WebCrypto API (crypto.subtle) is not available in this environment");
@@ -2774,15 +2634,15 @@ function getSaltLength(jwtAlg) {
       return 32;
   }
 }
-var import_sha2, import_hmac, import_hkdf, import_utils, import_aes, browserCrypto;
+var import_aes, import_hkdf, import_hmac, import_sha2, import_utils, browserCrypto;
 var init_browser = __esm({
   "libs/utils/src/crypto/browser.ts"() {
     "use strict";
-    import_sha2 = require("@noble/hashes/sha2.js");
-    import_hmac = require("@noble/hashes/hmac.js");
+    import_aes = require("@noble/ciphers/aes.js");
     import_hkdf = require("@noble/hashes/hkdf.js");
+    import_hmac = require("@noble/hashes/hmac.js");
+    import_sha2 = require("@noble/hashes/sha2.js");
     import_utils = require("@noble/hashes/utils.js");
-    import_aes = require("@noble/ciphers/aes.js");
     init_jwt_alg();
     init_jwt_alg();
     browserCrypto = {
@@ -2828,38 +2688,38 @@ var init_browser = __esm({
 
 // libs/utils/src/crypto/index.ts
 function getCrypto() {
-  return import_crypto_provider2.cryptoProvider;
+  return platformCrypto.cryptoProvider;
 }
-function rsaVerify2(jwtAlg, data, publicJwk, signature) {
+function rsaVerify3(jwtAlg, data, publicJwk, signature) {
   if (isNode()) {
-    return Promise.resolve((init_node(), __toCommonJS(node_exports)).rsaVerify(jwtAlg, data, publicJwk, signature));
+    return Promise.resolve(platformCrypto.rsaVerify(jwtAlg, data, publicJwk, signature));
   }
   const { rsaVerifyBrowser: rsaVerifyBrowser2 } = (init_browser(), __toCommonJS(browser_exports));
   return rsaVerifyBrowser2(jwtAlg, data, publicJwk, signature);
 }
-function rsaSignBase64Url2(jwtAlg, data, privateJwk) {
+function rsaSignBase64Url3(jwtAlg, data, privateJwk) {
   if (!isNode()) {
     throw new Error("rsaSignBase64Url is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaSignBase64Url(jwtAlg, data, privateJwk);
+  return platformCrypto.rsaSignBase64Url(jwtAlg, data, privateJwk);
 }
-function rsaVerifySync2(jwtAlg, data, publicJwk, signature) {
+function rsaVerifySync3(jwtAlg, data, publicJwk, signature) {
   if (!isNode()) {
     throw new Error("rsaVerifySync is only available in Node.js runtimes; use the async rsaVerify in browsers");
   }
-  return (init_node(), __toCommonJS(node_exports)).rsaVerifySync(jwtAlg, data, publicJwk, signature);
+  return platformCrypto.rsaVerifySync(jwtAlg, data, publicJwk, signature);
 }
-function pemToPublicJwk2(pem) {
+function pemToPublicJwk3(pem) {
   if (!isNode()) {
     throw new Error("pemToPublicJwk is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).pemToPublicJwk(pem);
+  return platformCrypto.pemToPublicJwk(pem);
 }
-function generateRsaKeyPair2(modulusLength, alg) {
+function generateRsaKeyPair3(modulusLength, alg) {
   if (!isNode()) {
     throw new Error("generateRsaKeyPair is only available in Node.js runtimes");
   }
-  return (init_node(), __toCommonJS(node_exports)).generateRsaKeyPair(modulusLength, alg);
+  return platformCrypto.generateRsaKeyPair(modulusLength, alg);
 }
 function randomUUID() {
   return getCrypto().randomUUID();
@@ -2965,11 +2825,11 @@ function base64Decode(data) {
 function sha256Base64url(data) {
   return base64urlEncode(sha256(data));
 }
-var import_crypto_provider2, HKDF_SHA256_MAX_LENGTH;
+var platformCrypto, HKDF_SHA256_MAX_LENGTH;
 var init_crypto = __esm({
   "libs/utils/src/crypto/index.ts"() {
     "use strict";
-    import_crypto_provider2 = require("#crypto-provider");
+    platformCrypto = __toESM(require("#crypto-provider"));
     init_runtime();
     init_jwt_alg();
     init_runtime();
@@ -3025,37 +2885,55 @@ function decodeOrRaw(encoded) {
     return encoded;
   }
 }
-function mergeRedisUrlFields(rawUrl, fields) {
+function integerOrUndefined(text) {
+  const value = Number.parseInt(text ?? "", 10);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function readRedisUrl(rawUrl) {
   let url;
   try {
     url = new URL(rawUrl);
   } catch {
     return void 0;
   }
-  const urlHost = url.hostname.replace(/^\[(.*)\]$/, "$1");
-  const urlPort = url.port ? Number(url.port) : void 0;
-  const urlPassword = url.password ? decodeOrRaw(url.password) : void 0;
-  const urlDbText = url.pathname.replace(/^\/+/, "") || url.searchParams.get("db") || void 0;
-  const urlDb = urlDbText === void 0 ? void 0 : Number(urlDbText);
-  const urlUsesTls = url.protocol === "rediss:";
+  if (url.protocol !== "redis:" && url.protocol !== "rediss:") return void 0;
+  const query = Object.fromEntries(url.searchParams);
+  const { host, port, username, password, db, ...otherOptions } = query;
+  const queryOptions = {};
+  for (const [name, value = ""] of Object.entries(otherOptions)) {
+    queryOptions[name] = name === "family" ? integerOrUndefined(value) ?? value : value;
+  }
+  return {
+    host: url.hostname.replace(/^\[(.*)\]$/, "$1") || host,
+    port: integerOrUndefined(url.port || port),
+    username: decodeOrRaw(url.username) || username || void 0,
+    password: decodeOrRaw(url.password) || password || void 0,
+    db: integerOrUndefined(url.pathname.replace(/^\/+/, "") || db),
+    tls: url.protocol === "rediss:",
+    queryOptions
+  };
+}
+function mergeRedisUrlFields(rawUrl, fields) {
+  const connection = readRedisUrl(rawUrl);
+  if (!connection) return void 0;
   const fillIns = {};
   const conflicts = [];
-  if (fields.host !== void 0 && fields.host !== urlHost) conflicts.push("host");
+  if (fields.host !== void 0 && fields.host !== connection.host) conflicts.push("host");
   if (fields.port !== void 0) {
-    if (urlPort === void 0) fillIns.port = fields.port;
-    else if (fields.port !== urlPort) conflicts.push("port");
+    if (connection.port === void 0) fillIns.port = fields.port;
+    else if (fields.port !== connection.port) conflicts.push("port");
   }
   if (fields.password !== void 0) {
-    if (urlPassword === void 0) fillIns.password = fields.password;
-    else if (fields.password !== urlPassword) conflicts.push("password");
+    if (connection.password === void 0) fillIns.password = fields.password;
+    else if (fields.password !== connection.password) conflicts.push("password");
   }
   if (fields.db !== void 0) {
-    if (urlDb === void 0) fillIns.db = fields.db;
-    else if (fields.db !== urlDb) conflicts.push("db");
+    if (connection.db === void 0) fillIns.db = fields.db;
+    else if (fields.db !== connection.db) conflicts.push("db");
   }
-  if (fields.tls === true && !urlUsesTls) fillIns.tls = true;
-  if (fields.tls === false && urlUsesTls) conflicts.push("tls");
-  return { fillIns, conflicts };
+  if (fields.tls === true && !connection.tls) fillIns.tls = true;
+  if (fields.tls === false && connection.tls) conflicts.push("tls");
+  return { connection, fillIns, conflicts };
 }
 function describeRedisUrlConflicts(conflicts) {
   return `redis ${conflicts.join(", ")} contradict${conflicts.length === 1 ? "s" : ""} redis.url. Fields beside a url only fill in what the URL leaves out (port, password, db, tls); put the value in the URL or drop the field.`;
@@ -3105,28 +2983,49 @@ function getRedisClass() {
     });
   }
 }
-function resolveUrlFillIns(connectionUrl, options) {
+function resolveUrlOptions(connectionUrl, options) {
   const { url: configUrl, ...siblingFields } = { url: void 0, ...options.config };
   if (options.url && configUrl && configUrl !== options.url) {
     throw new StorageConfigError("redis", "redis.url and redis.config.url name different servers; set one of them.");
   }
-  const merge = mergeRedisUrlFields(connectionUrl, siblingFields);
-  if (merge && merge.conflicts.length > 0) {
+  return urlConnectionOptions(connectionUrl, siblingFields);
+}
+function urlConnectionOptions(url, fields) {
+  const merge = mergeRedisUrlFields(url, fields);
+  if (!merge) return void 0;
+  if (merge.conflicts.length > 0) {
     throw new StorageConfigError("redis", describeRedisUrlConflicts(merge.conflicts));
   }
-  return merge?.fillIns ?? {};
+  const { queryOptions, tls, ...stated } = merge.connection;
+  return { ...queryOptions, ...stated, ...toFillInOptions(merge.fillIns), ...tls ? { tls: {} } : {} };
+}
+function toFillInOptions({ port, password, db, tls }) {
+  return {
+    ...port !== void 0 ? { port } : {},
+    ...password !== void 0 ? { password } : {},
+    ...db !== void 0 ? { db } : {},
+    ...tls ? { tls: {} } : {}
+  };
 }
 function createRedisClient(options) {
+  const urlOptions = options.url ? urlConnectionOptions(options.url, options) : void 0;
   const RedisClass = getRedisClass();
   const baseOptions = { lazyConnect: false, maxRetriesPerRequest: 3 };
-  const client = options.url ? new RedisClass(options.url, baseOptions) : new RedisClass({
-    ...baseOptions,
-    host: options.host ?? "localhost",
-    port: options.port ?? 6379,
-    password: options.password,
-    db: options.db ?? 0,
-    tls: options.tls ? {} : void 0
-  });
+  let client;
+  if (urlOptions) {
+    client = new RedisClass({ ...baseOptions, ...urlOptions });
+  } else if (options.url) {
+    client = new RedisClass(options.url, baseOptions);
+  } else {
+    client = new RedisClass({
+      ...baseOptions,
+      host: options.host ?? "localhost",
+      port: options.port ?? 6379,
+      password: options.password,
+      db: options.db ?? 0,
+      tls: options.tls ? {} : void 0
+    });
+  }
   attachRedisErrorListener(client, { label: options.label ?? "redis", logger: options.logger });
   return client;
 }
@@ -3151,7 +3050,8 @@ var init_redis = __esm({
       keyPrefix;
       subscriptionHandlers = /* @__PURE__ */ new Map();
       connectionUrl;
-      urlFillIns;
+      /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+      urlOptions;
       constructor(options = {}) {
         super();
         const hasClient = options.client !== void 0;
@@ -3175,7 +3075,7 @@ var init_redis = __esm({
         this.keyPrefix = options.keyPrefix ?? "";
         const configUrl = options.config?.url;
         this.connectionUrl = options.url ?? (typeof configUrl === "string" ? configUrl : void 0);
-        this.urlFillIns = this.connectionUrl ? resolveUrlFillIns(this.connectionUrl, options) : {};
+        this.urlOptions = this.connectionUrl ? resolveUrlOptions(this.connectionUrl, options) : void 0;
       }
       // ============================================
       // Connection Lifecycle
@@ -3197,12 +3097,7 @@ var init_redis = __esm({
           if (this.options.client) {
             client = this.options.client;
           } else {
-            const RedisClass = getRedisClass();
-            if (this.connectionUrl) {
-              client = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-            } else {
-              client = new RedisClass(this.buildRedisOptions());
-            }
+            client = this.newClient();
             client.on("error", recordSocketError);
           }
           await client.ping();
@@ -3436,15 +3331,7 @@ var init_redis = __esm({
        */
       buildRedisOptions() {
         if (this.connectionUrl) {
-          const { port, password, db, tls } = this.urlFillIns;
-          return {
-            ...port !== void 0 ? { port } : {},
-            ...password !== void 0 ? { password } : {},
-            ...db !== void 0 ? { db } : {},
-            ...tls ? { tls: {} } : {},
-            lazyConnect: false,
-            maxRetriesPerRequest: 3
-          };
+          return { lazyConnect: false, maxRetriesPerRequest: 3, ...this.urlOptions };
         }
         const config = this.options.config;
         if (!config || typeof config.url === "string" || config.host === void 0) {
@@ -3460,16 +3347,23 @@ var init_redis = __esm({
           maxRetriesPerRequest: 3
         };
       }
+      /**
+       * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+       */
+      newClient() {
+        const RedisClass = getRedisClass();
+        if (this.connectionUrl && !this.urlOptions) {
+          return new RedisClass(this.connectionUrl, this.buildRedisOptions());
+        }
+        return new RedisClass(this.buildRedisOptions());
+      }
       /**
        * Create subscriber connection.
        */
       async createSubscriber() {
-        const RedisClass = getRedisClass();
         let subscriber;
-        if (this.connectionUrl) {
-          subscriber = new RedisClass(this.connectionUrl, this.buildRedisOptions());
-        } else if (this.options.config) {
-          subscriber = new RedisClass(this.buildRedisOptions());
+        if (this.connectionUrl || this.options.config) {
+          subscriber = this.newClient();
         } else if (this.options.client) {
           subscriber = this.options.client.duplicate();
         } else {
@@ -4243,6 +4137,7 @@ __export(index_exports, {
   base64urlDecode: () => base64urlDecode,
   base64urlEncode: () => base64urlEncode,
   basename: () => import_path2.basename,
+  brandClass: () => brandClass,
   buildPrefix: () => buildPrefix,
   buildSetCookie: () => buildSetCookie,
   bytesToHex: () => bytesToHex,
@@ -4293,11 +4188,12 @@ __export(index_exports, {
   extractTemplateParams: () => extractTemplateParams,
   extractUriScheme: () => extractUriScheme,
   fileExists: () => fileExists,
+  fileExistsSync: () => fileExistsSync,
   findNonFiniteNumber: () => findNonFiniteNumber,
   generateCodeChallenge: () => generateCodeChallenge,
   generateCodeVerifier: () => generateCodeVerifier,
   generatePkcePair: () => generatePkcePair,
-  generateRsaKeyPair: () => generateRsaKeyPair2,
+  generateRsaKeyPair: () => generateRsaKeyPair3,
   generateSecret: () => generateSecret,
   getAsyncContextMode: () => import_async_context.getAsyncContextMode,
   getCookie: () => getCookie,
@@ -4319,6 +4215,7 @@ __export(index_exports, {
   inferMimeType: () => inferMimeType,
   isAbsolute: () => import_path2.isAbsolute,
   isAsymmetricKeyData: () => isAsymmetricKeyData,
+  isBrandedInstance: () => isBrandedInstance,
   isBrowser: () => isBrowser,
   isDebug: () => import_env2.isDebug,
   isDevelopment: () => import_env2.isDevelopment,
@@ -4362,7 +4259,7 @@ __export(index_exports, {
   pathJoin: () => import_path2.join,
   pathResolve: () => import_path2.resolve,
   pathToFileURL: () => import_path2.pathToFileURL,
-  pemToPublicJwk: () => pemToPublicJwk2,
+  pemToPublicJwk: () => pemToPublicJwk3,
   processPlatformToolCalls: () => processPlatformToolCalls,
   randomBytes: () => randomBytes,
   randomUUID: () => randomUUID,
@@ -4377,9 +4274,9 @@ __export(index_exports, {
   resetRuntimeContext: () => import_runtime_context.resetRuntimeContext,
   resolveSecretPath: () => resolveSecretPath,
   rm: () => rm,
-  rsaSignBase64Url: () => rsaSignBase64Url2,
-  rsaVerify: () => rsaVerify2,
-  rsaVerifySync: () => rsaVerifySync2,
+  rsaSignBase64Url: () => rsaSignBase64Url3,
+  rsaVerify: () => rsaVerify3,
+  rsaVerifySync: () => rsaVerifySync3,
   runCmd: () => runCmd,
   runRequestExclusive: () => import_async_context.runRequestExclusive,
   safeExec: () => safeExec,
@@ -5223,6 +5120,30 @@ function safeJsonForScript(value) {
   }
 }
 
+// libs/utils/src/class-brand/class-brand.ts
+var CLASS_BRAND = /* @__PURE__ */ Symbol.for("@frontmcp/class-brand");
+var ordinaryHasInstance = Function.prototype[Symbol.hasInstance];
+function ownBrandOf(klass) {
+  if (typeof klass !== "function" || !Object.prototype.hasOwnProperty.call(klass, CLASS_BRAND)) return void 0;
+  return klass[CLASS_BRAND];
+}
+function classOfPrototype(proto) {
+  return Object.getOwnPropertyDescriptor(proto, "constructor")?.value;
+}
+function brandClass(klass, brand) {
+  Object.defineProperty(klass, CLASS_BRAND, { value: brand, enumerable: false, writable: false, configurable: false });
+}
+function isBrandedInstance(klass, value) {
+  if (ordinaryHasInstance.call(klass, value)) return true;
+  if (typeof value !== "object" || value === null) return false;
+  const brand = ownBrandOf(klass);
+  if (brand === void 0) return false;
+  for (let proto = Object.getPrototypeOf(value); proto !== null; proto = Object.getPrototypeOf(proto)) {
+    if (ownBrandOf(classOfPrototype(proto)) === brand) return true;
+  }
+  return false;
+}
+
 // libs/utils/src/serialization/serialization.ts
 function safeStringify(value, space) {
   const seen = /* @__PURE__ */ new WeakSet();
@@ -6223,6 +6144,7 @@ function setMachineIdOverride(id) {
   base64urlDecode,
   base64urlEncode,
   basename,
+  brandClass,
   buildPrefix,
   buildSetCookie,
   bytesToHex,
@@ -6273,6 +6195,7 @@ function setMachineIdOverride(id) {
   extractTemplateParams,
   extractUriScheme,
   fileExists,
+  fileExistsSync,
   findNonFiniteNumber,
   generateCodeChallenge,
   generateCodeVerifier,
@@ -6299,6 +6222,7 @@ function setMachineIdOverride(id) {
   inferMimeType,
   isAbsolute,
   isAsymmetricKeyData,
+  isBrandedInstance,
   isBrowser,
   isDebug,
   isDevelopment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/utils",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "Shared utility functions for FrontMCP - string manipulation, URI handling, path utilities, and more",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -32,11 +32,15 @@
     "@noble/hashes": "^2.0.1"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.2",
+    "@frontmcp/lazy-zod": "1.9.4",
+    "@upstash/redis": "^1.34.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0",
     "ioredis": "^5.0.0"
   },
   "peerDependenciesMeta": {
+    "@upstash/redis": {
+      "optional": true
+    },
     "@vercel/kv": {
       "optional": true
     },

package/storage/adapters/redis.d.ts

@@ -40,7 +40,8 @@ export declare class RedisStorageAdapter extends BaseStorageAdapter {
     private readonly keyPrefix;
     private readonly subscriptionHandlers;
     private readonly connectionUrl?;
-    private readonly urlFillIns;
+    /** The connection options of a URL this adapter reads itself; undefined for one only ioredis reads. */
+    private readonly urlOptions?;
     constructor(options?: RedisAdapterOptions);
     connect(): Promise<void>;
     private openConnection;
@@ -75,6 +76,10 @@ export declare class RedisStorageAdapter extends BaseStorageAdapter {
      * Build Redis options from config.
      */
     private buildRedisOptions;
+    /**
+     * Create a client this adapter owns. A URL only ioredis reads goes to it as is.
+     */
+    private newClient;
     /**
      * Create subscriber connection.
      */
@@ -106,6 +111,9 @@ export interface CreateRedisClientOptions {
 /**
  * Create a plain ioredis client that reconnects on its own and never emits an unhandled
  * 'error' event. The caller owns the client and must `quit()`/`disconnect()` it.
+ *
+ * With a `url`, the other connection fields fill in only what the URL leaves out (port,
+ * password, db, tls), and one that contradicts it throws a `StorageConfigError`.
  */
 export declare function createRedisClient(options: CreateRedisClientOptions): Redis;
 export {};