@zuplo/cli 6.73.26 → 6.73.28

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as l}from"../chunk-7WS4HIGR.js";import{Z as n}from"../chunk-VCMIY3WJ.js";import{a as o}from"../chunk-2WLR6ZDZ.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
+import{b as l}from"../chunk-SH74D236.js";import{Z as n}from"../chunk-YIT72S45.js";import{a as o}from"../chunk-TYV53J3B.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{h as a,i as l,j as c,k as o,n as p,o as y,p as m}from"../../chunk-V4X24KCQ.js";import"../../chunk-TRBIM47E.js";import"../../chunk-VCMIY3WJ.js";import{a as i}from"../../chunk-2WLR6ZDZ.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{h as a,i as l,j as c,k as o,n as p,o as y,p as m}from"../../chunk-QVZD2XRK.js";import"../../chunk-UKQQD2JN.js";import"../../chunk-YIT72S45.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -1,6 +1,6 @@
 import { Attributes } from "@opentelemetry/api";
-import { CallToolRequest } from "@zuplo/mcp/types";
-import { CallToolResult } from "@zuplo/mcp/types";
+import type { CallToolRequest } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { InboundPolicyHandler as InboundPolicyHandler_2 } from "../../policies.js";
 import { KeyLike } from "jose";
 import { RequestGeneric as RequestGeneric_2 } from "../../request.js";
@@ -10543,6 +10543,12 @@ declare interface NotFoundOptions {
   routesMatchedByPathOnly: RouteConfiguration[];
 }
 
+/**
+ * Where the client credentials are sent on the token request. `body` sends `client_id` and `client_secret` as form parameters. `header` sends them with HTTP Basic authentication as described in RFC 6749 section 2.3.1.
+ * @public
+ */
+declare type OAuthClientCredentialsLocation = "body" | "header";
+
 /* Excluded from this release type: OAuthProtectedResourceBasePlugin */
 
 /* Excluded from this release type: OAuthProtectedResourceMetadataOptions */
@@ -15210,6 +15216,83 @@ export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
   enableSuspiciousHeaderWarning?: boolean;
 }
 
+/**
+ * Fetches an access token from any OAuth 2.0 token endpoint using the client
+ * credentials grant and adds it to a header (`Authorization` by default) on
+ * the upstream request. Tokens are cached until shortly before they expire.
+ *
+ * @title Upstream OAuth 2.0 Client Credentials Auth
+ * @product api-gateway
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class UpstreamOAuthClientCredentialsInboundPolicy extends InboundPolicy<UpstreamOAuthClientCredentialsInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "upstream-oauth-client-credentials";
+  constructor(
+    options: UpstreamOAuthClientCredentialsInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface UpstreamOAuthClientCredentialsInboundPolicyOptions {
+  /**
+   * The URL of the OAuth 2.0 token endpoint that issues the access token.
+   */
+  tokenUrl: string;
+  /**
+   * The client ID used to authenticate with the token endpoint.
+   */
+  clientId: string;
+  /**
+   * The client secret used to authenticate with the token endpoint.
+   */
+  clientSecret: string;
+  /**
+   * Space-delimited list of scopes to request. When not set, the `scope` parameter is omitted from the token request.
+   */
+  scope?: string;
+  /**
+   * The value of the `audience` form parameter sent to the token endpoint. Required by some identity providers such as Auth0. When not set, the parameter is omitted from the token request.
+   */
+  audience?: string;
+  credentialsIn?: OAuthClientCredentialsLocation;
+  /**
+   * Additional form parameters to include in the token request, for example `resource` for identity providers that require it.
+   */
+  additionalParameters?: {
+    [k: string]: string;
+  };
+  /**
+   * The name of the header on the upstream request that the access token is set on.
+   */
+  headerName?: string;
+  /**
+   * The scheme that prefixes the access token in the header. When the token response includes a `token_type`, that value is used instead.
+   */
+  headerScheme?: string;
+  /**
+   * The number of times to retry fetching the token in the event of a failure.
+   */
+  tokenRetries?: number;
+  /**
+   * The number of seconds less than the token expiration to cache the token.
+   */
+  expirationOffsetSeconds?: number;
+}
+
 /**
  * Generates a Zuplo JWT token and attaches it to the outgoing request. This
  * policy creates a self-signed JWT using the Zuplo JWT plugin and adds it
@@ -16084,7 +16167,7 @@ export declare class ZuploMcpSdk {
    * Retrieves the MCP request object from the context.
    * Use this to access metadata like `_meta` from the incoming tool call.
    *
-   * @returns The "@zuplo/mcp" MCP call tool request object or null if not found
+   * @returns The MCP call tool request object or null if not found
    */
   getRawCallToolRequest(): CallToolRequest | null;
   /**

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.73.26",
+  "version": "6.73.28",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.73.26",
+  "version": "6.73.28",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.220.0",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.73.26",
+    "@zuplo/core": "6.73.28",
     "@zuplo/editor": "1.0.29844086763",
-    "@zuplo/openapi-tools": "6.73.26",
-    "@zuplo/runtime": "6.73.26",
+    "@zuplo/openapi-tools": "6.73.28",
+    "@zuplo/runtime": "6.73.28",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.73.26",
-    "@zuplo/otel": "6.73.26"
+    "@zuplo/graphql": "6.73.28",
+    "@zuplo/otel": "6.73.28"
   },
   "bundleDependencies": [
     "@inquirer/prompts",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/aesgcmkw.js

@@ -1,15 +0,0 @@
-import { encrypt, decrypt } from './content_encryption.js';
-import { encode as b64u } from '../util/base64url.js';
-export async function wrap(alg, key, cek, iv) {
-    const jweAlgorithm = alg.slice(0, 7);
-    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array());
-    return {
-        encryptedKey: wrapped.ciphertext,
-        iv: b64u(wrapped.iv),
-        tag: b64u(wrapped.tag),
-    };
-}
-export async function unwrap(alg, key, encryptedKey, iv, tag) {
-    const jweAlgorithm = alg.slice(0, 7);
-    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array());
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/aeskw.js

@@ -1,25 +0,0 @@
-import { checkEncCryptoKey } from './crypto_key.js';
-function checkKeySize(key, alg) {
-    if (key.algorithm.length !== parseInt(alg.slice(1, 4), 10)) {
-        throw new TypeError(`Invalid key size for alg: ${alg}`);
-    }
-}
-function getCryptoKey(key, alg, usage) {
-    if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'AES-KW', true, [usage]);
-    }
-    checkEncCryptoKey(key, alg, usage);
-    return key;
-}
-export async function wrap(alg, key, cek) {
-    const cryptoKey = await getCryptoKey(key, alg, 'wrapKey');
-    checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
-    return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, cryptoKey, 'AES-KW'));
-}
-export async function unwrap(alg, key, encryptedKey) {
-    const cryptoKey = await getCryptoKey(key, alg, 'unwrapKey');
-    checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
-    return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/check_key_type.js

@@ -1,122 +0,0 @@
-import { withAlg as invalidKeyInput } from './invalid_key_input.js';
-import { isKeyLike } from './is_key_like.js';
-import * as jwk from './type_checks.js';
-const tag = (key) => key?.[Symbol.toStringTag];
-const jwkMatchesOp = (alg, key, usage) => {
-    if (key.use !== undefined) {
-        let expected;
-        switch (usage) {
-            case 'sign':
-            case 'verify':
-                expected = 'sig';
-                break;
-            case 'encrypt':
-            case 'decrypt':
-                expected = 'enc';
-                break;
-        }
-        if (key.use !== expected) {
-            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-        }
-    }
-    if (key.alg !== undefined && key.alg !== alg) {
-        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-    }
-    if (Array.isArray(key.key_ops)) {
-        let expectedKeyOp;
-        switch (true) {
-            case usage === 'sign' || usage === 'verify':
-            case alg === 'dir':
-            case alg.includes('CBC-HS'):
-                expectedKeyOp = usage;
-                break;
-            case alg.startsWith('PBES2'):
-                expectedKeyOp = 'deriveBits';
-                break;
-            case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
-                if (!alg.includes('GCM') && alg.endsWith('KW')) {
-                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';
-                }
-                else {
-                    expectedKeyOp = usage;
-                }
-                break;
-            case usage === 'encrypt' && alg.startsWith('RSA'):
-                expectedKeyOp = 'wrapKey';
-                break;
-            case usage === 'decrypt':
-                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';
-                break;
-        }
-        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
-            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-        }
-    }
-    return true;
-};
-const symmetricTypeCheck = (alg, key, usage) => {
-    if (key instanceof Uint8Array)
-        return;
-    if (jwk.isJWK(key)) {
-        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
-            return;
-        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-    }
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-    if (jwk.isJWK(key)) {
-        switch (usage) {
-            case 'decrypt':
-            case 'sign':
-                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
-                    return;
-                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-            case 'encrypt':
-            case 'verify':
-                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
-                    return;
-                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
-        }
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    if (key.type === 'public') {
-        switch (usage) {
-            case 'sign':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-            case 'decrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-        }
-    }
-    if (key.type === 'private') {
-        switch (usage) {
-            case 'verify':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-            case 'encrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
-        }
-    }
-};
-export function checkKeyType(alg, key, usage) {
-    switch (alg.substring(0, 2)) {
-        case 'A1':
-        case 'A2':
-        case 'di':
-        case 'HS':
-        case 'PB':
-            symmetricTypeCheck(alg, key, usage);
-            break;
-        default:
-            asymmetricTypeCheck(alg, key, usage);
-    }
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/ecdhes.js

@@ -1,52 +0,0 @@
-import { encode, concat, uint32be } from './buffer_utils.js';
-import { checkEncCryptoKey } from './crypto_key.js';
-import { digest } from './helpers.js';
-function lengthAndInput(input) {
-    return concat(uint32be(input.length), input);
-}
-async function concatKdf(Z, L, OtherInfo) {
-    const dkLen = L >> 3;
-    const hashLen = 32;
-    const reps = Math.ceil(dkLen / hashLen);
-    const dk = new Uint8Array(reps * hashLen);
-    for (let i = 1; i <= reps; i++) {
-        const hashInput = new Uint8Array(4 + Z.length + OtherInfo.length);
-        hashInput.set(uint32be(i), 0);
-        hashInput.set(Z, 4);
-        hashInput.set(OtherInfo, 4 + Z.length);
-        const hashResult = await digest('sha256', hashInput);
-        dk.set(hashResult, (i - 1) * hashLen);
-    }
-    return dk.slice(0, dkLen);
-}
-export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
-    checkEncCryptoKey(publicKey, 'ECDH');
-    checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
-    const algorithmID = lengthAndInput(encode(algorithm));
-    const partyUInfo = lengthAndInput(apu);
-    const partyVInfo = lengthAndInput(apv);
-    const suppPubInfo = uint32be(keyLength);
-    const suppPrivInfo = new Uint8Array();
-    const otherInfo = concat(algorithmID, partyUInfo, partyVInfo, suppPubInfo, suppPrivInfo);
-    const Z = new Uint8Array(await crypto.subtle.deriveBits({
-        name: publicKey.algorithm.name,
-        public: publicKey,
-    }, privateKey, getEcdhBitLength(publicKey)));
-    return concatKdf(Z, keyLength, otherInfo);
-}
-function getEcdhBitLength(publicKey) {
-    if (publicKey.algorithm.name === 'X25519') {
-        return 256;
-    }
-    return (Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3);
-}
-export function allowed(key) {
-    switch (key.algorithm.namedCurve) {
-        case 'P-256':
-        case 'P-384':
-        case 'P-521':
-            return true;
-        default:
-            return key.algorithm.name === 'X25519';
-    }
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key_to_jwk.js

@@ -1,34 +0,0 @@
-import { invalidKeyInput } from './invalid_key_input.js';
-import { encode as b64u } from '../util/base64url.js';
-import { isCryptoKey, isKeyObject } from './is_key_like.js';
-function omitUndefinedProperties(jwk) {
-    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== undefined));
-}
-export async function keyToJWK(key) {
-    if (isKeyObject(key)) {
-        if (key.type === 'secret') {
-            key = key.export();
-        }
-        else {
-            return key.export({ format: 'jwk' });
-        }
-    }
-    if (key instanceof Uint8Array) {
-        return {
-            kty: 'oct',
-            k: b64u(key),
-        };
-    }
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
-    }
-    if (!key.extractable) {
-        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
-    }
-    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey('jwk', key));
-    if (jwk.kty === 'AKP') {
-        ;
-        jwk.alg = alg;
-    }
-    return jwk;
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/normalize_key.js

@@ -1,166 +0,0 @@
-import { isJWK } from './type_checks.js';
-import { decode } from '../util/base64url.js';
-import { jwkToKey } from './jwk_to_key.js';
-import { isCryptoKey, isKeyObject } from './is_key_like.js';
-const unusableForAlg = 'given KeyObject instance cannot be used for this algorithm';
-let cache;
-const handleJWK = async (key, jwk, alg, freeze = false) => {
-    cache ||= new WeakMap();
-    let cached = cache.get(key);
-    if (cached?.[alg]) {
-        return cached[alg];
-    }
-    const cryptoKey = await jwkToKey({ ...jwk, alg });
-    if (freeze)
-        Object.freeze(key);
-    if (!cached) {
-        cache.set(key, { [alg]: cryptoKey });
-    }
-    else {
-        cached[alg] = cryptoKey;
-    }
-    return cryptoKey;
-};
-const handleKeyObject = (keyObject, alg) => {
-    cache ||= new WeakMap();
-    let cached = cache.get(keyObject);
-    if (cached?.[alg]) {
-        return cached[alg];
-    }
-    const isPublic = keyObject.type === 'public';
-    const extractable = isPublic ? true : false;
-    let cryptoKey;
-    if (keyObject.asymmetricKeyType === 'x25519') {
-        switch (alg) {
-            case 'ECDH-ES':
-            case 'ECDH-ES+A128KW':
-            case 'ECDH-ES+A192KW':
-            case 'ECDH-ES+A256KW':
-                break;
-            default:
-                throw new TypeError(unusableForAlg);
-        }
-        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);
-    }
-    if (keyObject.asymmetricKeyType === 'ed25519') {
-        if (alg !== 'EdDSA' && alg !== 'Ed25519') {
-            throw new TypeError(unusableForAlg);
-        }
-        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
-            isPublic ? 'verify' : 'sign',
-        ]);
-    }
-    switch (keyObject.asymmetricKeyType) {
-        case 'ml-dsa-44':
-        case 'ml-dsa-65':
-        case 'ml-dsa-87': {
-            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
-                throw new TypeError(unusableForAlg);
-            }
-            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
-                isPublic ? 'verify' : 'sign',
-            ]);
-        }
-    }
-    if (keyObject.asymmetricKeyType === 'rsa') {
-        let hash;
-        switch (alg) {
-            case 'RSA-OAEP':
-                hash = 'SHA-1';
-                break;
-            case 'RS256':
-            case 'PS256':
-            case 'RSA-OAEP-256':
-                hash = 'SHA-256';
-                break;
-            case 'RS384':
-            case 'PS384':
-            case 'RSA-OAEP-384':
-                hash = 'SHA-384';
-                break;
-            case 'RS512':
-            case 'PS512':
-            case 'RSA-OAEP-512':
-                hash = 'SHA-512';
-                break;
-            default:
-                throw new TypeError(unusableForAlg);
-        }
-        if (alg.startsWith('RSA-OAEP')) {
-            return keyObject.toCryptoKey({
-                name: 'RSA-OAEP',
-                hash,
-            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);
-        }
-        cryptoKey = keyObject.toCryptoKey({
-            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',
-            hash,
-        }, extractable, [isPublic ? 'verify' : 'sign']);
-    }
-    if (keyObject.asymmetricKeyType === 'ec') {
-        const nist = new Map([
-            ['prime256v1', 'P-256'],
-            ['secp384r1', 'P-384'],
-            ['secp521r1', 'P-521'],
-        ]);
-        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
-        if (!namedCurve) {
-            throw new TypeError(unusableForAlg);
-        }
-        const expectedCurve = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };
-        if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {
-            cryptoKey = keyObject.toCryptoKey({
-                name: 'ECDSA',
-                namedCurve,
-            }, extractable, [isPublic ? 'verify' : 'sign']);
-        }
-        if (alg.startsWith('ECDH-ES')) {
-            cryptoKey = keyObject.toCryptoKey({
-                name: 'ECDH',
-                namedCurve,
-            }, extractable, isPublic ? [] : ['deriveBits']);
-        }
-    }
-    if (!cryptoKey) {
-        throw new TypeError(unusableForAlg);
-    }
-    if (!cached) {
-        cache.set(keyObject, { [alg]: cryptoKey });
-    }
-    else {
-        cached[alg] = cryptoKey;
-    }
-    return cryptoKey;
-};
-export async function normalizeKey(key, alg) {
-    if (key instanceof Uint8Array) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        return key;
-    }
-    if (isKeyObject(key)) {
-        if (key.type === 'secret') {
-            return key.export();
-        }
-        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {
-            try {
-                return handleKeyObject(key, alg);
-            }
-            catch (err) {
-                if (err instanceof TypeError) {
-                    throw err;
-                }
-            }
-        }
-        let jwk = key.export({ format: 'jwk' });
-        return handleJWK(key, jwk, alg);
-    }
-    if (isJWK(key)) {
-        if (key.k) {
-            return decode(key.k);
-        }
-        return handleJWK(key, key, alg, true);
-    }
-    throw new Error('unreachable');
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/pbes2kw.js

@@ -1,42 +0,0 @@
-import { encode as b64u } from '../util/base64url.js';
-import * as aeskw from './aeskw.js';
-import { checkEncCryptoKey } from './crypto_key.js';
-import { concat, encode } from './buffer_utils.js';
-import { JWEInvalid } from '../util/errors.js';
-function getCryptoKey(key, alg) {
-    if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
-            'deriveBits',
-        ]);
-    }
-    checkEncCryptoKey(key, alg, 'deriveBits');
-    return key;
-}
-const concatSalt = (alg, p2sInput) => concat(encode(alg), Uint8Array.of(0x00), p2sInput);
-async function deriveKey(p2s, alg, p2c, key) {
-    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
-        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
-    }
-    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) {
-        throw new JWEInvalid('PBES2 Count Input must be a positive integer');
-    }
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10);
-    const subtleAlg = {
-        hash: `SHA-${alg.slice(8, 11)}`,
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const cryptoKey = await getCryptoKey(key, alg);
-    return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-}
-export async function wrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    const encryptedKey = await aeskw.wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: b64u(p2s) };
-}
-export async function unwrap(alg, key, encryptedKey, p2c, p2s) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    return aeskw.unwrap(alg.slice(-6), derived, encryptedKey);
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/rsaes.js

@@ -1,24 +0,0 @@
-import { checkEncCryptoKey } from './crypto_key.js';
-import { checkKeyLength } from './signing.js';
-import { JOSENotSupported } from '../util/errors.js';
-const subtleAlgorithm = (alg) => {
-    switch (alg) {
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            return 'RSA-OAEP';
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-};
-export async function encrypt(alg, key, cek) {
-    checkEncCryptoKey(key, alg, 'encrypt');
-    checkKeyLength(alg, key);
-    return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
-}
-export async function decrypt(alg, key, encryptedKey) {
-    checkEncCryptoKey(key, alg, 'decrypt');
-    checkKeyLength(alg, key);
-    return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
-}