@zuplo/cli 6.73.26 → 6.73.28

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key.js

@@ -0,0 +1,170 @@
+import { withAlg as invalidKeyInput } from './invalid_key_input.js';
+import { isKeyLike, isCryptoKey } from './is_key_like.js';
+import * as jwk from './type_checks.js';
+import { decode } from '../util/base64url.js';
+import { jwkToKey } from './jwk_to_key.js';
+const tag = (key) => key[Symbol.toStringTag];
+const jwkMatchesOp = (entry, key, usage) => {
+    const { alg } = entry;
+    if (key.use !== undefined) {
+        let expected;
+        switch (usage) {
+            case 'sign':
+            case 'verify':
+                expected = 'sig';
+                break;
+            case 'encrypt':
+            case 'decrypt':
+                expected = 'enc';
+                break;
+        }
+        if (key.use !== expected) {
+            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+        }
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+    }
+    if (Array.isArray(key.key_ops)) {
+        const expectedKeyOp = usage === 'encrypt' || usage === 'decrypt' ? entry.keyOps?.[usage] : usage;
+        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
+            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+        }
+    }
+    return true;
+};
+const symmetricTypeCheck = (entry, key, usage) => {
+    const { alg } = entry;
+    if (key instanceof Uint8Array)
+        return { kind: BYTES, key };
+    if (jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(entry, key, usage))
+            return { kind: JWK, key };
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));
+    }
+    if (key.type !== 'secret') {
+        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    }
+    return isCryptoKey(key) ? { kind: CRYPTO, key } : { kind: KEYOBJECT, key };
+};
+const asymmetricTypeCheck = (entry, key, usage) => {
+    const { alg } = entry;
+    if (jwk.isJWK(key)) {
+        switch (usage) {
+            case 'decrypt':
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(entry, key, usage))
+                    return { kind: JWK, key };
+                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
+            case 'encrypt':
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(entry, key, usage))
+                    return { kind: JWK, key };
+                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+        }
+    }
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+    }
+    if (key.type === 'secret') {
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+    }
+    if (key.type === 'public') {
+        switch (usage) {
+            case 'sign':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+            case 'decrypt':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+        }
+    }
+    if (key.type === 'private') {
+        switch (usage) {
+            case 'verify':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+            case 'encrypt':
+                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+        }
+    }
+    return isCryptoKey(key) ? { kind: CRYPTO, key } : { kind: KEYOBJECT, key };
+};
+const BYTES = Symbol();
+const CRYPTO = Symbol();
+const KEYOBJECT = Symbol();
+const JWK = Symbol();
+export function checkKeyType(entry, key, usage) {
+    return entry.symmetric
+        ? symmetricTypeCheck(entry, key, usage)
+        : asymmetricTypeCheck(entry, key, usage);
+}
+let cache;
+const nist = {
+    __proto__: null,
+    prime256v1: 'P-256',
+    secp384r1: 'P-384',
+    secp521r1: 'P-521',
+};
+function cached(key, alg) {
+    cache ||= new WeakMap();
+    return cache.get(key)?.[alg];
+}
+function store(key, alg, cryptoKey) {
+    const entry = cache.get(key);
+    if (entry) {
+        entry[alg] = cryptoKey;
+    }
+    else {
+        cache.set(key, { [alg]: cryptoKey });
+    }
+    return cryptoKey;
+}
+const handleJWK = async (key, jwk, entry) => {
+    const hit = cached(key, entry.alg);
+    if (hit)
+        return hit;
+    const cryptoKey = await jwkToKey(entry, { ...jwk, alg: entry.alg });
+    return store(key, entry.alg, cryptoKey);
+};
+const handleKeyObject = (keyObject, entry) => {
+    const hit = cached(keyObject, entry.alg);
+    if (hit)
+        return hit;
+    const isPublic = keyObject.type === 'public';
+    const usages = isPublic ? entry.usages.public : entry.usages.private;
+    const { asymmetricKeyType } = keyObject;
+    const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
+    const params = entry.subtleFor?.({ crv, asymmetricKeyType }) ?? entry.subtle;
+    return store(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+};
+export async function prepareKey(entry, key, usage) {
+    const tagged = checkKeyType(entry, key, usage);
+    switch (tagged.kind) {
+        case BYTES:
+        case CRYPTO:
+            return tagged.key;
+        case JWK: {
+            if (tagged.key.k) {
+                return decode(tagged.key.k);
+            }
+            if (!Object.isFrozen(tagged.key)) {
+                const { key_ops } = tagged.key;
+                if (Array.isArray(key_ops))
+                    Object.freeze(key_ops);
+                Object.freeze(tagged.key);
+            }
+            return handleJWK(tagged.key, tagged.key, entry);
+        }
+        case KEYOBJECT: {
+            const keyObject = tagged.key;
+            if (keyObject.type === 'secret') {
+                return keyObject.export();
+            }
+            if ('toCryptoKey' in keyObject && typeof keyObject.toCryptoKey === 'function') {
+                return handleKeyObject(keyObject, entry);
+            }
+            return handleJWK(keyObject, keyObject.export({ format: 'jwk' }), entry);
+        }
+    }
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key_algorithm.js

@@ -0,0 +1,16 @@
+import { JOSENotSupported } from '../util/errors.js';
+import { maybeJWSAlgorithm } from './jws_algorithms.js';
+import { maybeJWEAlgorithm } from './jwe_algorithms.js';
+function unsupportedAlgorithm() {
+    return new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+}
+export function keyAlgorithm(alg) {
+    if (typeof alg !== 'string') {
+        throw unsupportedAlgorithm();
+    }
+    const entry = maybeJWSAlgorithm(alg) ?? maybeJWEAlgorithm(alg);
+    if (!entry) {
+        throw unsupportedAlgorithm();
+    }
+    return entry;
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key_descriptor.js

@@ -0,0 +1,7 @@
+export function table(entries) {
+    const out = { __proto__: null };
+    for (const alg of Object.keys(entries)) {
+        out[alg] = { ...entries[alg], alg };
+    }
+    return out;
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key_management.js

@@ -1,23 +1,173 @@
-import * as aeskw from './aeskw.js';
-import * as ecdhes from './ecdhes.js';
-import * as pbes2kw from './pbes2kw.js';
-import * as rsaes from './rsaes.js';
 import { encode as b64u } from '../util/base64url.js';
-import { normalizeKey } from './normalize_key.js';
+import { prepareKey } from './key.js';
+import { jwkToKey } from './jwk_to_key.js';
+import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { decodeBase64url } from './helpers.js';
-import { generateCek, cekLength } from './content_encryption.js';
-import { importJWK } from '../key/import.js';
-import { exportJWK } from '../key/export.js';
+import { decodeBase64url, digest } from './helpers.js';
+import { generateCek, encrypt, decrypt } from './content_encryption.js';
 import { isObject } from './type_checks.js';
-import { wrap as aesGcmKwWrap, unwrap as aesGcmKwUnwrap } from './aesgcmkw.js';
+import { checkCryptoKey, checkUsage } from './crypto_key.js';
+import { checkModulusLength } from './signing.js';
+import { concat, encode, uint32be } from './buffer_utils.js';
 import { assertCryptoKey } from './is_key_like.js';
+function checkEcdhCryptoKey(key, usage) {
+    switch (key.algorithm.name) {
+        case 'ECDH':
+        case 'X25519':
+            break;
+        default:
+            throw new TypeError('CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519');
+    }
+    checkUsage(key, usage);
+}
+function checkKeySize(key, alg) {
+    if (key.algorithm.length !== parseInt(alg.slice(1, 4), 10)) {
+        throw new TypeError(`Invalid key size for alg: ${alg}`);
+    }
+}
+function aeskwCryptoKey(key, alg, usage) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'AES-KW', true, [usage]);
+    }
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, usage);
+    return key;
+}
+async function aeskwWrap(alg, key, cek) {
+    const cryptoKey = await aeskwCryptoKey(key, alg, 'wrapKey');
+    checkKeySize(cryptoKey, alg);
+    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
+    return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, cryptoKey, 'AES-KW'));
+}
+async function aeskwUnwrap(alg, key, encryptedKey) {
+    const cryptoKey = await aeskwCryptoKey(key, alg, 'unwrapKey');
+    checkKeySize(cryptoKey, alg);
+    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
+    return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
+}
+async function aesGcmKwWrap(gcm, key, cek, iv) {
+    const wrapped = await encrypt(gcm, cek, key, iv, new Uint8Array());
+    return {
+        encryptedKey: wrapped.ciphertext,
+        iv: b64u(wrapped.iv),
+        tag: b64u(wrapped.tag),
+    };
+}
+async function aesGcmKwUnwrap(gcm, key, encryptedKey, iv, tag) {
+    return decrypt(gcm, key, encryptedKey, iv, tag, new Uint8Array());
+}
+const subtleAlgorithm = (alg) => {
+    switch (alg) {
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            return 'RSA-OAEP';
+        default:
+            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+};
+async function rsaesEncrypt(alg, key, cek) {
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, 'encrypt');
+    checkModulusLength(alg, key);
+    return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
+}
+async function rsaesDecrypt(alg, key, encryptedKey) {
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, 'decrypt');
+    checkModulusLength(alg, key);
+    return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
+}
+function pbes2CryptoKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
+            'deriveBits',
+        ]);
+    }
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, 'deriveBits');
+    return key;
+}
+const concatSalt = (alg, p2sInput) => concat(encode(alg), Uint8Array.of(0x00), p2sInput);
+async function deriveKey(p2s, alg, p2c, key) {
+    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
+        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
+    }
+    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) {
+        throw new JWEInvalid('PBES2 Count Input must be a positive integer');
+    }
+    const salt = concatSalt(alg, p2s);
+    const keylen = parseInt(alg.slice(13, 16), 10);
+    const subtleAlg = {
+        hash: `SHA-${alg.slice(8, 11)}`,
+        iterations: p2c,
+        name: 'PBKDF2',
+        salt,
+    };
+    const cryptoKey = await pbes2CryptoKey(key, alg);
+    return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+async function pbes2kwWrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    const encryptedKey = await aeskwWrap(alg.slice(-6), derived, cek);
+    return { encryptedKey, p2c, p2s: b64u(p2s) };
+}
+async function pbes2kwUnwrap(alg, key, encryptedKey, p2c, p2s) {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    return aeskwUnwrap(alg.slice(-6), derived, encryptedKey);
+}
+function lengthAndInput(input) {
+    return concat(uint32be(input.length), input);
+}
+async function concatKdf(Z, L, OtherInfo) {
+    const dkLen = L >> 3;
+    const hashLen = 32;
+    const reps = Math.ceil(dkLen / hashLen);
+    const dk = new Uint8Array(reps * hashLen);
+    for (let i = 1; i <= reps; i++) {
+        const hashInput = new Uint8Array(4 + Z.length + OtherInfo.length);
+        hashInput.set(uint32be(i), 0);
+        hashInput.set(Z, 4);
+        hashInput.set(OtherInfo, 4 + Z.length);
+        const hashResult = await digest('sha256', hashInput);
+        dk.set(hashResult, (i - 1) * hashLen);
+    }
+    return dk.slice(0, dkLen);
+}
+async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
+    checkEcdhCryptoKey(publicKey);
+    checkEcdhCryptoKey(privateKey, 'deriveBits');
+    const algorithmID = lengthAndInput(encode(algorithm));
+    const partyUInfo = lengthAndInput(apu);
+    const partyVInfo = lengthAndInput(apv);
+    const suppPubInfo = uint32be(keyLength);
+    const suppPrivInfo = new Uint8Array();
+    const otherInfo = concat(algorithmID, partyUInfo, partyVInfo, suppPubInfo, suppPrivInfo);
+    const Z = new Uint8Array(await crypto.subtle.deriveBits({
+        name: publicKey.algorithm.name,
+        public: publicKey,
+    }, privateKey, getEcdhBitLength(publicKey)));
+    return concatKdf(Z, keyLength, otherInfo);
+}
+function getEcdhBitLength(publicKey) {
+    if (publicKey.algorithm.name === 'X25519') {
+        return 256;
+    }
+    return (Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3);
+}
+function ecdhesAllowed(key) {
+    switch (key.algorithm.namedCurve) {
+        case 'P-256':
+        case 'P-384':
+        case 'P-521':
+            return true;
+        default:
+            return key.algorithm.name === 'X25519';
+    }
+}
 const unsupportedAlgHeader = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
 function assertEncryptedKey(encryptedKey) {
     if (encryptedKey === undefined)
         throw new JWEInvalid('JWE Encrypted Key missing');
 }
-export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
     switch (alg) {
         case 'dir': {
             if (encryptedKey !== undefined)
@@ -33,10 +183,9 @@ export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, o
             if (!isObject(joseHeader.epk))
                 throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
             assertCryptoKey(key);
-            if (!ecdhes.allowed(key))
+            if (!ecdhesAllowed(key))
                 throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
-            const epk = await importJWK(joseHeader.epk, alg);
-            assertCryptoKey(epk);
+            const epk = await jwkToKey(jweAlgorithm(alg), joseHeader.epk);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined) {
@@ -49,11 +198,11 @@ export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, o
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = decodeBase64url(joseHeader.apv, 'apv', JWEInvalid);
             }
-            const sharedSecret = await ecdhes.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+            const sharedSecret = await ecdhesDeriveKey(epk, key, alg === 'ECDH-ES' ? enc.alg : alg, alg === 'ECDH-ES' ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             assertEncryptedKey(encryptedKey);
-            return aeskw.unwrap(alg.slice(-6), sharedSecret, encryptedKey);
+            return aeskwUnwrap(alg.slice(-6), sharedSecret, encryptedKey);
         }
         case 'RSA-OAEP':
         case 'RSA-OAEP-256':
@@ -61,7 +210,7 @@ export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, o
         case 'RSA-OAEP-512': {
             assertEncryptedKey(encryptedKey);
             assertCryptoKey(key);
-            return rsaes.decrypt(alg, key, encryptedKey);
+            return rsaesDecrypt(alg, key, encryptedKey);
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
@@ -76,13 +225,13 @@ export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, o
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             let p2s;
             p2s = decodeBase64url(joseHeader.p2s, 'p2s', JWEInvalid);
-            return pbes2kw.unwrap(alg, key, encryptedKey, joseHeader.p2c, p2s);
+            return pbes2kwUnwrap(alg, key, encryptedKey, joseHeader.p2c, p2s);
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
             assertEncryptedKey(encryptedKey);
-            return aeskw.unwrap(alg, key, encryptedKey);
+            return aeskwUnwrap(alg, key, encryptedKey);
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
@@ -96,7 +245,7 @@ export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, o
             iv = decodeBase64url(joseHeader.iv, 'iv', JWEInvalid);
             let tag;
             tag = decodeBase64url(joseHeader.tag, 'tag', JWEInvalid);
-            return aesGcmKwUnwrap(alg, key, encryptedKey, iv, tag);
+            return aesGcmKwUnwrap(jweEncryption(jweAlgorithm(alg).gcmkw), key, encryptedKey, iv, tag);
         }
         default: {
             throw new JOSENotSupported(unsupportedAlgHeader);
@@ -117,19 +266,27 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
             assertCryptoKey(key);
-            if (!ecdhes.allowed(key)) {
+            if (!ecdhesAllowed(key)) {
                 throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
             }
             const { apu, apv } = providedParameters;
             let ephemeralKey;
             if (providedParameters.epk) {
-                ephemeralKey = (await normalizeKey(providedParameters.epk, alg));
+                ephemeralKey = (await prepareKey(jweAlgorithm(alg), providedParameters.epk, 'decrypt'));
             }
             else {
                 ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ['deriveBits'])).privateKey;
             }
-            const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ecdhes.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
+            const subtle = crypto.subtle;
+            let exportableEpk = ephemeralKey;
+            if (!exportableEpk.extractable) {
+                if (typeof subtle.getPublicKey !== 'function') {
+                    throw new TypeError('CryptoKey for "epk" must be extractable');
+                }
+                exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+            }
+            const { x, y, crv, kty } = (await subtle.exportKey('jwk', exportableEpk));
+            const sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc.alg : alg, alg === 'ECDH-ES' ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv);
             parameters = { epk: { x, crv, kty } };
             if (kty === 'EC')
                 parameters.epk.y = y;
@@ -143,7 +300,7 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
             }
             cek = providedCek || generateCek(enc);
             const kwAlg = alg.slice(-6);
-            encryptedKey = await aeskw.wrap(kwAlg, sharedSecret, cek);
+            encryptedKey = await aeskwWrap(kwAlg, sharedSecret, cek);
             break;
         }
         case 'RSA-OAEP':
@@ -152,7 +309,7 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'RSA-OAEP-512': {
             cek = providedCek || generateCek(enc);
             assertCryptoKey(key);
-            encryptedKey = await rsaes.encrypt(alg, key, cek);
+            encryptedKey = await rsaesEncrypt(alg, key, cek);
             break;
         }
         case 'PBES2-HS256+A128KW':
@@ -160,14 +317,14 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'PBES2-HS512+A256KW': {
             cek = providedCek || generateCek(enc);
             const { p2c, p2s } = providedParameters;
-            ({ encryptedKey, ...parameters } = await pbes2kw.wrap(alg, key, cek, p2c, p2s));
+            ({ encryptedKey, ...parameters } = await pbes2kwWrap(alg, key, cek, p2c, p2s));
             break;
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
             cek = providedCek || generateCek(enc);
-            encryptedKey = await aeskw.wrap(alg, key, cek);
+            encryptedKey = await aeskwWrap(alg, key, cek);
             break;
         }
         case 'A128GCMKW':
@@ -175,7 +332,7 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'A256GCMKW': {
             cek = providedCek || generateCek(enc);
             const { iv } = providedParameters;
-            ({ encryptedKey, ...parameters } = await aesGcmKwWrap(alg, key, cek, iv));
+            ({ encryptedKey, ...parameters } = await aesGcmKwWrap(jweEncryption(jweAlgorithm(alg).gcmkw), key, cek, iv));
             break;
         }
         default: {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/{validate_crit.js → options.js}

@@ -1,4 +1,22 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+export const JWS_RECOGNIZED = new Map([['b64', true]]);
+export const JWE_RECOGNIZED = new Map();
+export function validateAlgorithms(option, algorithms) {
+    if (algorithms !== undefined &&
+        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {
+        throw new TypeError(`"${option}" option must be an array of strings`);
+    }
+    if (!algorithms) {
+        return undefined;
+    }
+    return new Set(algorithms);
+}
+export function validateCritDuplicates(Err, protectedHeader) {
+    const { crit } = protectedHeader ?? {};
+    if (Array.isArray(crit) && new Set(crit).size !== crit.length) {
+        throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+    }
+}
 export function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
     if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
         throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/signing.js

@@ -1,66 +1,34 @@
-import { JOSENotSupported } from '../util/errors.js';
-import { checkSigCryptoKey } from './crypto_key.js';
-import { invalidKeyInput } from './invalid_key_input.js';
-export function checkKeyLength(alg, key) {
-    if (alg.startsWith('RS') || alg.startsWith('PS')) {
-        const { modulusLength } = key.algorithm;
-        if (typeof modulusLength !== 'number' || modulusLength < 2048) {
-            throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-        }
+import { checkCryptoKey } from './crypto_key.js';
+export function checkModulusLength(alg, key) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
+        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }
 }
-function subtleAlgorithm(alg, algorithm) {
-    const hash = `SHA-${alg.slice(-3)}`;
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512':
-            return { hash, name: 'HMAC' };
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            return { hash, name: 'RSA-PSS', saltLength: parseInt(alg.slice(-3), 10) >> 3 };
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            return { hash, name: 'RSASSA-PKCS1-v1_5' };
-        case 'ES256':
-        case 'ES384':
-        case 'ES512':
-            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
-        case 'Ed25519':
-        case 'EdDSA':
-            return { name: 'Ed25519' };
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87':
-            return { name: alg };
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+function checkSigCryptoKey(entry, key, usage) {
+    checkCryptoKey(key, entry.subtle, usage);
+    if (entry.minModulusLength) {
+        checkModulusLength(entry.alg, key);
     }
 }
-async function getSigKey(alg, key, usage) {
+async function getSigKey(entry, key, usage) {
     if (key instanceof Uint8Array) {
-        if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-        }
-        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);
+        return crypto.subtle.importKey('raw', key, entry.subtle, false, [
+            usage,
+        ]);
     }
-    checkSigCryptoKey(key, alg, usage);
+    checkSigCryptoKey(entry, key, usage);
     return key;
 }
-export async function sign(alg, key, data) {
-    const cryptoKey = await getSigKey(alg, key, 'sign');
-    checkKeyLength(alg, cryptoKey);
-    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
+export async function sign(entry, key, data) {
+    const cryptoKey = await getSigKey(entry, key, 'sign');
+    const signature = await crypto.subtle.sign(entry.operation, cryptoKey, data);
     return new Uint8Array(signature);
 }
-export async function verify(alg, key, signature, data) {
-    const cryptoKey = await getSigKey(alg, key, 'verify');
-    checkKeyLength(alg, cryptoKey);
-    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+export async function verify(entry, key, signature, data) {
+    const cryptoKey = await getSigKey(entry, key, 'verify');
     try {
-        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+        return await crypto.subtle.verify(entry.operation, cryptoKey, signature, data);
     }
     catch {
         return false;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/util/base64url.js

@@ -2,14 +2,22 @@ import { encoder, decoder } from '../lib/buffer_utils.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 export function decode(input) {
     if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
-            alphabet: 'base64url',
-        });
+        try {
+            return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
+                alphabet: 'base64url',
+            });
+        }
+        catch (cause) {
+            throw new TypeError('The input to be decoded is not correctly encoded.', { cause });
+        }
     }
     let encoded = input;
     if (encoded instanceof Uint8Array) {
         encoded = decoder.decode(encoded);
     }
+    if (encoded.includes('+') || encoded.includes('/')) {
+        throw new TypeError('The input to be decoded is not correctly encoded.');
+    }
     encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');
     try {
         return decodeBase64(encoded);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/util/decode_jwt.js

@@ -1,5 +1,5 @@
 import { decode as b64u } from './base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
+import { strictDecoder } from '../lib/buffer_utils.js';
 import { isObject } from '../lib/type_checks.js';
 import { JWTInvalid } from './errors.js';
 export function decodeJwt(jwt) {
@@ -21,7 +21,7 @@ export function decodeJwt(jwt) {
     }
     let result;
     try {
-        result = JSON.parse(decoder.decode(decoded));
+        result = JSON.parse(strictDecoder.decode(decoded));
     }
     catch {
         throw new JWTInvalid('Failed to parse the decoded payload as JSON');