@zuplo/cli 6.73.27 → 6.73.28

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,14 +1,6 @@
-import { decode as b64u } from '../../util/base64url.js';
-import { verify } from '../../lib/signing.js';
-import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
-import { decodeBase64url } from '../../lib/helpers.js';
-import { isDisjoint } from '../../lib/type_checks.js';
+import { JWSInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { checkKeyType } from '../../lib/check_key_type.js';
-import { validateCrit } from '../../lib/validate_crit.js';
-import { validateAlgorithms } from '../../lib/validate_algorithms.js';
-import { normalizeKey } from '../../lib/normalize_key.js';
+import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -28,83 +20,5 @@ export async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined && !isObject(jws.header)) {
         throw new JWSInvalid('JWS Unprotected Header incorrect type');
     }
-    let parsedProt = {};
-    if (jws.protected) {
-        try {
-            const protectedHeader = b64u(jws.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWSInvalid('JWS Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jws.header)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jws.header,
-    };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.has('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
-    if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof jws.payload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-    }
-    checkKeyType(alg, key, 'verify');
-    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'
-        ? b64
-            ? encode(jws.payload)
-            : encoder.encode(jws.payload)
-        : jws.payload);
-    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
-    const k = await normalizeKey(key, alg);
-    const verified = await verify(alg, k, signature, data);
-    if (!verified) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    let payload;
-    if (b64) {
-        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);
-    }
-    else if (typeof jws.payload === 'string') {
-        payload = encoder.encode(jws.payload);
-    }
-    else {
-        payload = jws.payload;
-    }
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key: k };
-    }
-    return result;
+    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -1,4 +1,4 @@
-import { FlattenedSign } from '../flattened/sign.js';
+import { createSignature } from '../../lib/jws_sign.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { assertNotSet } from '../../lib/helpers.js';
 class IndividualSignature {
@@ -47,16 +47,29 @@ export class GeneralSign {
         if (!this.#signatures.length) {
             throw new JWSInvalid('at least one signature must be added');
         }
+        if (!(this.#payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
         const jws = {
             signatures: [],
             payload: '',
         };
+        const encoded = {};
         for (let i = 0; i < this.#signatures.length; i++) {
             const signature = this.#signatures[i];
-            const flattened = new FlattenedSign(this.#payload);
-            flattened.setProtectedHeader(signature.protectedHeader);
-            flattened.setUnprotectedHeader(signature.unprotectedHeader);
-            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (!signature.protectedHeader && !signature.unprotectedHeader) {
+                throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
+            }
+            const { payload, ...rest } = await createSignature({
+                payload: this.#payload,
+                protectedHeader: signature.protectedHeader,
+                unprotectedHeader: signature.unprotectedHeader,
+                crit: signature.options?.crit,
+                encoded,
+            }, signature.key);
+            if (signature.unprotectedHeader) {
+                rest.header = signature.unprotectedHeader;
+            }
             if (i === 0) {
                 jws.payload = payload;
             }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -1,4 +1,4 @@
-import { flattenedVerify } from '../flattened/verify.js';
+import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
 export async function generalVerify(jws, key, options) {
@@ -8,14 +8,32 @@ export async function generalVerify(jws, key, options) {
     if (!Array.isArray(jws.signatures) || !jws.signatures.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
+    let shared;
+    try {
+        if (jws.payload === undefined)
+            throw new Error();
+        shared = prepareVerify(options);
+    }
+    catch {
+        throw new JWSSignatureVerificationFailed();
+    }
     for (const signature of jws.signatures) {
         try {
-            return await flattenedVerify({
+            if (signature.protected === undefined && signature.header === undefined)
+                throw new Error();
+            if (signature.protected !== undefined && typeof signature.protected !== 'string') {
+                throw new Error();
+            }
+            if (typeof signature.signature !== 'string')
+                throw new Error();
+            if (signature.header !== undefined && !isObject(signature.header))
+                throw new Error();
+            return verifyResult(signature, await verifySignature({
                 header: signature.header,
                 payload: jws.payload,
                 protected: signature.protected,
                 signature: signature.signature,
-            }, key, options);
+            }, shared, key));
         }
         catch {
         }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -1,10 +1,10 @@
-import { compactDecrypt } from '../jwe/compact/decrypt.js';
+import { prepareDecrypt, decryptCompact } from '../lib/jwe_decrypt.js';
 import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTClaimValidationFailed } from '../util/errors.js';
 export async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await compactDecrypt(jwt, key, options);
-    const payload = validateClaimsSet(decrypted.protectedHeader, decrypted.plaintext, options);
-    const { protectedHeader } = decrypted;
+    const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
+    const protectedHeader = decrypted.parsedProt;
+    const payload = validateClaimsSet(protectedHeader, decrypted.plaintext, options);
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
         throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/sign.js

@@ -1,4 +1,5 @@
 import { CompactSign } from '../jws/compact/sign.js';
+import { unencodedPayload } from '../lib/jws_sign.js';
 import { JWTInvalid } from '../util/errors.js';
 import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class SignJWT {
@@ -42,9 +43,7 @@ export class SignJWT {
     async sign(key, options) {
         const sig = new CompactSign(this.#jwt.data());
         sig.setProtectedHeader(this.#protectedHeader);
-        if (Array.isArray(this.#protectedHeader?.crit) &&
-            this.#protectedHeader.crit.includes('b64') &&
-            this.#protectedHeader.b64 === false) {
+        if (unencodedPayload(this.#protectedHeader)) {
             throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
         }
         return sig.sign(key, options);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/unsecured.js

@@ -1,5 +1,6 @@
 import * as b64u from '../util/base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
+import { strictDecoder } from '../lib/buffer_utils.js';
+import { decodeBase64url } from '../lib/helpers.js';
 import { JWTInvalid } from '../util/errors.js';
 import { validateClaimsSet, JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class UnsecuredJWT {
@@ -50,14 +51,14 @@ export class UnsecuredJWT {
         }
         let header;
         try {
-            header = JSON.parse(decoder.decode(b64u.decode(encodedHeader)));
+            header = JSON.parse(strictDecoder.decode(b64u.decode(encodedHeader)));
             if (header.alg !== 'none')
                 throw new Error();
         }
         catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = validateClaimsSet(header, b64u.decode(encodedPayload), options);
+        const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, 'payload', JWTInvalid), options);
         return { payload, header };
     }
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/verify.js

@@ -1,13 +1,13 @@
-import { compactVerify } from '../jws/compact/verify.js';
+import { prepareVerify, verifyCompact } from '../lib/jws_verify.js';
 import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTInvalid } from '../util/errors.js';
 export async function jwtVerify(jwt, key, options) {
-    const verified = await compactVerify(jwt, key, options);
-    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
+    const verified = await verifyCompact(jwt, prepareVerify(options), key);
+    if (!verified.b64) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
-    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
+    const payload = validateClaimsSet(verified.parsedProt, verified.payload, options);
+    const result = { payload, protectedHeader: verified.parsedProt };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/key/export.js

@@ -1,5 +1,38 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
-import { keyToJWK } from '../lib/key_to_jwk.js';
+import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { encode as b64u } from '../util/base64url.js';
+import { isCryptoKey, isKeyObject } from '../lib/is_key_like.js';
+function omitUndefinedProperties(jwk) {
+    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== undefined));
+}
+async function keyToJWK(key) {
+    if (isKeyObject(key)) {
+        if (key.type === 'secret') {
+            key = key.export();
+        }
+        else {
+            return key.export({ format: 'jwk' });
+        }
+    }
+    if (key instanceof Uint8Array) {
+        return {
+            kty: 'oct',
+            k: b64u(key),
+        };
+    }
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
+    }
+    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey('jwk', key));
+    if (jwk.kty === 'AKP') {
+        ;
+        jwk.alg = alg;
+    }
+    return jwk;
+}
 export async function exportSPKI(key) {
     return exportPublic(key);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import { keyAlgorithm } from '../lib/key_algorithm.js';
 function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
@@ -7,91 +8,40 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
+    const entry = keyAlgorithm(alg);
+    if (entry.symmetric) {
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
     let algorithm;
-    let keyUsages;
-    switch (alg) {
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            algorithm = {
-                name: 'RSA-PSS',
-                hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            algorithm = {
-                name: 'RSASSA-PKCS1-v1_5',
-                hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            algorithm = {
-                name: 'RSA-OAEP',
-                hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                modulusLength: getModulusLengthOption(options),
-            };
-            keyUsages = ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey'];
-            break;
-        case 'ES256':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'ES384':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'ES512':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'Ed25519':
-        case 'EdDSA': {
-            keyUsages = ['sign', 'verify'];
-            algorithm = { name: 'Ed25519' };
-            break;
+    if (entry.subtleFor) {
+        switch (options?.crv ?? 'P-256') {
+            case 'P-256':
+            case 'P-384':
+            case 'P-521':
+                algorithm = { name: 'ECDH', namedCurve: options?.crv ?? 'P-256' };
+                break;
+            case 'X25519':
+                algorithm = { name: 'X25519' };
+                break;
+            default:
+                throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
         }
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87': {
-            keyUsages = ['sign', 'verify'];
-            algorithm = { name: alg };
-            break;
+    }
+    else {
+        if (entry.crv !== undefined && options?.crv !== undefined && options.crv !== entry.crv) {
+            throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
         }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            keyUsages = ['deriveBits'];
-            const crv = options?.crv ?? 'P-256';
-            switch (crv) {
-                case 'P-256':
-                case 'P-384':
-                case 'P-521': {
-                    algorithm = { name: 'ECDH', namedCurve: crv };
-                    break;
+        algorithm =
+            entry.kty[0] === 'RSA'
+                ? {
+                    ...entry.subtle,
+                    publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
+                    modulusLength: getModulusLengthOption(options),
                 }
-                case 'X25519':
-                    algorithm = { name: 'X25519' };
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
-            }
-            break;
-        }
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+                : entry.subtle;
     }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
+        ...entry.usages.private,
+        ...entry.usages.public,
+    ]);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/key/import.js

@@ -1,6 +1,7 @@
 import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import { jwkToKey } from '../lib/jwk_to_key.js';
+import { keyAlgorithm } from '../lib/key_algorithm.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isObject } from '../lib/type_checks.js';
 export async function importSPKI(spki, alg, options) {
@@ -25,9 +26,11 @@ export async function importJWK(jwk, alg, options) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    let ext;
     alg ??= jwk.alg;
-    ext ??= options?.extractable ?? jwk.ext;
+    const ext = options?.extractable ?? jwk.ext;
+    if (jwk.kty !== 'oct' && !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
@@ -35,10 +38,7 @@ export async function importJWK(jwk, alg, options) {
             }
             return decodeBase64URL(jwk.k);
         case 'RSA':
-            if ('oth' in jwk && jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-            return jwkToKey({ ...jwk, alg, ext });
+            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
         case 'AKP': {
             if (typeof jwk.alg !== 'string' || !jwk.alg) {
                 throw new TypeError('missing "alg" (Algorithm) Parameter value');
@@ -46,11 +46,11 @@ export async function importJWK(jwk, alg, options) {
             if (alg !== undefined && alg !== jwk.alg) {
                 throw new TypeError('JWK alg and alg option value mismatch');
             }
-            return jwkToKey({ ...jwk, ext });
+            return jwkToKey(keyAlgorithm(jwk.alg), { ...jwk, ext });
         }
         case 'EC':
         case 'OKP':
-            return jwkToKey({ ...jwk, alg, ext });
+            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
         default:
             throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/asn1.js

@@ -1,6 +1,7 @@
 import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
+import { keyAlgorithm } from './key_algorithm.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {
     const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
@@ -36,13 +37,20 @@ const bytesEqual = (a, b) => {
     return true;
 };
 const createASN1State = (data) => ({ data, pos: 0 });
+const readByte = (state) => {
+    const byte = state.data[state.pos++];
+    if (byte === undefined) {
+        throw new Error('Unexpected end of ASN.1 input');
+    }
+    return byte;
+};
 const parseLength = (state) => {
-    const first = state.data[state.pos++];
+    const first = readByte(state);
     if (first & 0x80) {
         const lengthOfLen = first & 0x7f;
         let length = 0;
         for (let i = 0; i < lengthOfLen; i++) {
-            length = (length << 8) | state.data[state.pos++];
+            length = (length << 8) | readByte(state);
         }
         return length;
     }
@@ -59,11 +67,14 @@ const skipElement = (state, count = 1) => {
     }
 };
 const expectTag = (state, expectedTag, errorMessage) => {
-    if (state.data[state.pos++] !== expectedTag) {
+    if (readByte(state) !== expectedTag) {
         throw new Error(errorMessage);
     }
 };
 const getSubarray = (state, length) => {
+    if (length < 0 || state.pos + length > state.data.length) {
+        throw new Error('Unexpected end of ASN.1 input');
+    }
     const result = state.data.subarray(state.pos, state.pos + length);
     state.pos += length;
     return result;
@@ -115,71 +126,24 @@ const parseECAlgorithmIdentifier = (state) => {
     throw new Error('Unsupported named curve');
 };
 const genericImport = async (keyFormat, keyData, alg, options) => {
-    let algorithm;
-    let keyUsages;
+    const entry = keyAlgorithm(alg);
+    if (entry.symmetric) {
+        throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+    }
     const isPublic = keyFormat === 'spki';
-    const getSigUsages = () => (isPublic ? ['verify'] : ['sign']);
-    const getEncUsages = () => isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];
-    switch (alg) {
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            algorithm = { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };
-            keyUsages = getSigUsages();
-            break;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };
-            keyUsages = getSigUsages();
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            algorithm = {
-                name: 'RSA-OAEP',
-                hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-            };
-            keyUsages = getEncUsages();
-            break;
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            const curveMap = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };
-            algorithm = { name: 'ECDSA', namedCurve: curveMap[alg] };
-            keyUsages = getSigUsages();
-            break;
+    let algorithm;
+    if (entry.subtleFor) {
+        try {
+            algorithm = entry.subtleFor({ crv: options.getNamedCurve(keyData) });
         }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            try {
-                const namedCurve = options.getNamedCurve(keyData);
-                algorithm = namedCurve === 'X25519' ? { name: 'X25519' } : { name: 'ECDH', namedCurve };
-            }
-            catch (cause) {
-                throw new JOSENotSupported('Invalid or unsupported key format');
-            }
-            keyUsages = isPublic ? [] : ['deriveBits'];
-            break;
+        catch (cause) {
+            throw new JOSENotSupported('Invalid or unsupported key format');
         }
-        case 'Ed25519':
-        case 'EdDSA':
-            algorithm = { name: 'Ed25519' };
-            keyUsages = getSigUsages();
-            break;
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87':
-            algorithm = { name: alg };
-            keyUsages = getSigUsages();
-            break;
-        default:
-            throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
-    }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
+    }
+    else {
+        algorithm = entry.subtle;
+    }
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), isPublic ? entry.usages.public : entry.usages.private);
 };
 const processPEMData = (pem, pattern) => {
     return decodeBase64(pem.replace(pattern, ''));

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/buffer_utils.js

@@ -1,5 +1,6 @@
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
+export const strictDecoder = new TextDecoder('utf-8', { fatal: true });
 const MAX_INT32 = 2 ** 32;
 export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);