@zuplo/cli 6.73.27 → 6.73.28

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -0,0 +1,109 @@
+import { encode as b64u } from '../util/base64url.js';
+import { encrypt } from './content_encryption.js';
+import { encryptKeyManagement } from './key_management.js';
+import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
+import { isDisjoint } from './type_checks.js';
+import { concat, encode } from './buffer_utils.js';
+import { validateCrit, JWE_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
+import { compress } from './deflate.js';
+export function checkEncryptHeaders(input) {
+    const { protectedHeader, unprotectedHeader, sharedUnprotectedHeader } = input;
+    if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
+        throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+    }
+    const joseHeader = {
+        ...protectedHeader,
+        ...unprotectedHeader,
+        ...sharedUnprotectedHeader,
+    };
+    validateCrit(JWEInvalid, JWE_RECOGNIZED, input.crit, protectedHeader, joseHeader);
+    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+    }
+    if (joseHeader.zip !== undefined && !protectedHeader?.zip) {
+        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+    }
+    const { alg, enc } = joseHeader;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    if (typeof enc !== 'string' || !enc) {
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+    }
+    return { joseHeader, alg, enc, encEntry: jweEncryption(enc) };
+}
+export async function encryptJWE(input, checked, key) {
+    const { joseHeader, alg, encEntry } = checked;
+    let { protectedHeader, unprotectedHeader } = input;
+    const { sharedUnprotectedHeader } = input;
+    if (input.cek && (alg === 'dir' || alg === 'ECDH-ES')) {
+        throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    }
+    const algEntry = jweAlgorithm(alg);
+    const k = await prepareKey(alg === 'dir' ? encEntry : algEntry, key, 'encrypt');
+    const { cek, encryptedKey, parameters } = await encryptKeyManagement(alg, encEntry, k, input.cek, input.keyManagementParameters);
+    if (parameters) {
+        if (input.unprotectedParameters) {
+            unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters;
+        }
+        else {
+            protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
+        }
+    }
+    let protectedHeaderS;
+    let protectedHeaderB;
+    if (protectedHeader) {
+        protectedHeaderS = b64u(JSON.stringify(protectedHeader));
+        protectedHeaderB = encode(protectedHeaderS);
+    }
+    else {
+        protectedHeaderS = '';
+        protectedHeaderB = new Uint8Array();
+    }
+    let additionalData;
+    let aadMember;
+    if (input.aad?.byteLength) {
+        aadMember = b64u(input.aad);
+        additionalData = concat(protectedHeaderB, encode('.'), encode(aadMember));
+    }
+    else {
+        additionalData = protectedHeaderB;
+    }
+    let plaintext = input.plaintext;
+    if (joseHeader.zip === 'DEF') {
+        plaintext = await compress(plaintext).catch((cause) => {
+            throw new JWEInvalid('Failed to compress plaintext', { cause });
+        });
+    }
+    const { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, input.iv, additionalData);
+    const jwe = {
+        ciphertext: b64u(ciphertext),
+    };
+    if (iv) {
+        jwe.iv = b64u(iv);
+    }
+    if (tag) {
+        jwe.tag = b64u(tag);
+    }
+    if (encryptedKey) {
+        jwe.encrypted_key = b64u(encryptedKey);
+    }
+    if (aadMember) {
+        jwe.aad = aadMember;
+    }
+    if (protectedHeader) {
+        jwe.protected = protectedHeaderS;
+    }
+    if (sharedUnprotectedHeader) {
+        jwe.unprotected = sharedUnprotectedHeader;
+    }
+    if (unprotectedHeader) {
+        jwe.header = unprotectedHeader;
+    }
+    return jwe;
+}
+export async function createJWE(input, key) {
+    return encryptJWE(input, checkEncryptHeaders(input), key);
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwk_to_key.js

@@ -1,107 +1,22 @@
 import { JOSENotSupported } from '../util/errors.js';
 const unsupportedAlg = 'Invalid or unsupported JWK "alg" (Algorithm) Parameter value';
-function subtleMapping(jwk) {
-    let algorithm;
-    let keyUsages;
-    switch (jwk.kty) {
-        case 'AKP': {
-            switch (jwk.alg) {
-                case 'ML-DSA-44':
-                case 'ML-DSA-65':
-                case 'ML-DSA-87':
-                    algorithm = { name: jwk.alg };
-                    keyUsages = jwk.priv ? ['sign'] : ['verify'];
-                    break;
-                default:
-                    throw new JOSENotSupported(unsupportedAlg);
-            }
-            break;
-        }
-        case 'RSA': {
-            switch (jwk.alg) {
-                case 'PS256':
-                case 'PS384':
-                case 'PS512':
-                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
-                case 'RS256':
-                case 'RS384':
-                case 'RS512':
-                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
-                case 'RSA-OAEP':
-                case 'RSA-OAEP-256':
-                case 'RSA-OAEP-384':
-                case 'RSA-OAEP-512':
-                    algorithm = {
-                        name: 'RSA-OAEP',
-                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,
-                    };
-                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
-                    break;
-                default:
-                    throw new JOSENotSupported(unsupportedAlg);
-            }
-            break;
-        }
-        case 'EC': {
-            switch (jwk.alg) {
-                case 'ES256':
-                case 'ES384':
-                case 'ES512':
-                    algorithm = {
-                        name: 'ECDSA',
-                        namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],
-                    };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
-                case 'ECDH-ES':
-                case 'ECDH-ES+A128KW':
-                case 'ECDH-ES+A192KW':
-                case 'ECDH-ES+A256KW':
-                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };
-                    keyUsages = jwk.d ? ['deriveBits'] : [];
-                    break;
-                default:
-                    throw new JOSENotSupported(unsupportedAlg);
-            }
-            break;
-        }
-        case 'OKP': {
-            switch (jwk.alg) {
-                case 'Ed25519':
-                case 'EdDSA':
-                    algorithm = { name: 'Ed25519' };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
-                case 'ECDH-ES':
-                case 'ECDH-ES+A128KW':
-                case 'ECDH-ES+A192KW':
-                case 'ECDH-ES+A256KW':
-                    algorithm = { name: jwk.crv };
-                    keyUsages = jwk.d ? ['deriveBits'] : [];
-                    break;
-                default:
-                    throw new JOSENotSupported(unsupportedAlg);
-            }
-            break;
-        }
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+function subtleParams(entry, jwk) {
+    if (!entry.kty.includes(jwk.kty)) {
+        throw new JOSENotSupported(unsupportedAlg);
     }
-    return { algorithm, keyUsages };
+    return entry.subtleFor?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
 }
-export async function jwkToKey(jwk) {
-    if (!jwk.alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+export async function jwkToKey(entry, jwk) {
+    if (jwk.kty === 'RSA' && 'oth' in jwk && jwk.oth !== undefined) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     }
-    const { algorithm, keyUsages } = subtleMapping(jwk);
+    const algorithm = subtleParams(entry, jwk);
+    const isPrivate = !!(jwk.d || jwk.priv);
+    const keyUsages = isPrivate ? entry.usages.private : entry.usages.public;
     const keyData = { ...jwk };
     if (keyData.kty !== 'AKP') {
         delete keyData.alg;
     }
     delete keyData.use;
-    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (isPrivate ? false : true), jwk.key_ops ?? keyUsages);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jws_algorithms.js

@@ -0,0 +1,74 @@
+import { JOSENotSupported } from '../util/errors.js';
+import { table } from './key_descriptor.js';
+const sig = { public: ['verify'], private: ['sign'] };
+function hmac(bits) {
+    const subtle = { name: 'HMAC', hash: `SHA-${bits}` };
+    return { kty: ['oct'], symmetric: true, subtle, operation: subtle, usages: sig };
+}
+function rsa(name, bits, saltLength) {
+    const subtle = { name, hash: `SHA-${bits}` };
+    return {
+        kty: ['RSA'],
+        subtle,
+        operation: saltLength ? { ...subtle, saltLength } : subtle,
+        usages: sig,
+        minModulusLength: 2048,
+    };
+}
+function ecdsa(crv, bits) {
+    return {
+        kty: ['EC'],
+        crv,
+        subtle: { name: 'ECDSA', namedCurve: crv },
+        operation: { name: 'ECDSA', hash: `SHA-${bits}` },
+        usages: sig,
+    };
+}
+function eddsa() {
+    const subtle = { name: 'Ed25519' };
+    return {
+        kty: ['OKP'],
+        crv: 'Ed25519',
+        subtle,
+        operation: subtle,
+        usages: sig,
+    };
+}
+function mldsa(name) {
+    const subtle = { name };
+    return {
+        kty: ['AKP'],
+        subtle,
+        operation: subtle,
+        usages: sig,
+    };
+}
+const JWS = table({
+    HS256: hmac(256),
+    HS384: hmac(384),
+    HS512: hmac(512),
+    RS256: rsa('RSASSA-PKCS1-v1_5', 256),
+    RS384: rsa('RSASSA-PKCS1-v1_5', 384),
+    RS512: rsa('RSASSA-PKCS1-v1_5', 512),
+    PS256: rsa('RSA-PSS', 256, 32),
+    PS384: rsa('RSA-PSS', 384, 48),
+    PS512: rsa('RSA-PSS', 512, 64),
+    ES256: ecdsa('P-256', 256),
+    ES384: ecdsa('P-384', 384),
+    ES512: ecdsa('P-521', 512),
+    EdDSA: eddsa(),
+    Ed25519: eddsa(),
+    'ML-DSA-44': mldsa('ML-DSA-44'),
+    'ML-DSA-65': mldsa('ML-DSA-65'),
+    'ML-DSA-87': mldsa('ML-DSA-87'),
+});
+export function jwsAlgorithm(alg) {
+    const entry = JWS[alg];
+    if (!entry) {
+        throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+    return entry;
+}
+export function maybeJWSAlgorithm(alg) {
+    return JWS[alg];
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jws_sign.js

@@ -0,0 +1,68 @@
+import { encode as b64u } from '../util/base64url.js';
+import { sign } from './signing.js';
+import { jwsAlgorithm } from './jws_algorithms.js';
+import { isDisjoint } from './type_checks.js';
+import { JWSInvalid } from '../util/errors.js';
+import { concat, encode } from './buffer_utils.js';
+import { validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+export function unencodedPayload(protectedHeader) {
+    return (protectedHeader?.b64 === false &&
+        Array.isArray(protectedHeader.crit) &&
+        protectedHeader.crit.includes('b64'));
+}
+export async function createSignature(input, key) {
+    const { protectedHeader, unprotectedHeader } = input;
+    if (!isDisjoint(protectedHeader, unprotectedHeader)) {
+        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
+    }
+    const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
+    let b64 = true;
+    if (extensions.has('b64')) {
+        b64 = protectedHeader.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+    }
+    const { alg } = joseHeader;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    const entry = jwsAlgorithm(alg);
+    let payloadS;
+    let payloadB;
+    if (b64) {
+        const encoded = (input.encoded ??= {});
+        encoded.b64 ??= b64u(input.payload);
+        encoded.raw ??= encode(encoded.b64);
+        payloadS = encoded.b64;
+        payloadB = encoded.raw;
+    }
+    else {
+        payloadB = input.payload;
+        payloadS = '';
+    }
+    let protectedHeaderString;
+    let protectedHeaderBytes;
+    if (protectedHeader) {
+        protectedHeaderString = b64u(JSON.stringify(protectedHeader));
+        protectedHeaderBytes = encode(protectedHeaderString);
+    }
+    else {
+        protectedHeaderString = '';
+        protectedHeaderBytes = new Uint8Array();
+    }
+    const data = concat(protectedHeaderBytes, encode('.'), payloadB);
+    const k = await prepareKey(entry, key, 'sign');
+    const signature = await sign(entry, k, data);
+    const jws = {
+        signature: b64u(signature),
+        payload: payloadS,
+    };
+    if (protectedHeader) {
+        jws.protected = protectedHeaderString;
+    }
+    return jws;
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -0,0 +1,108 @@
+import { verify } from './signing.js';
+import { jwsAlgorithm } from './jws_algorithms.js';
+import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../util/errors.js';
+import { concat, decoder, encoder, encode } from './buffer_utils.js';
+import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
+import { isDisjoint } from './type_checks.js';
+import { validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+export function verifyResult(jws, verified) {
+    const result = { payload: verified.payload };
+    if (jws.protected !== undefined) {
+        result.protectedHeader = verified.parsedProt;
+    }
+    if (jws.header !== undefined) {
+        result.unprotectedHeader = jws.header;
+    }
+    if (verified.resolvedKey) {
+        return { ...result, key: verified.key };
+    }
+    return result;
+}
+export function prepareVerify(options) {
+    return {
+        algorithms: options && validateAlgorithms('algorithms', options.algorithms),
+        crit: options?.crit,
+    };
+}
+export async function verifySignature(jws, shared, key) {
+    let parsedProt = {};
+    if (jws.protected) {
+        parsedProt = parseJoseHeader(jws.protected, JWSInvalid, 'JWS Protected Header is invalid');
+    }
+    let joseHeader;
+    if (jws.header !== undefined) {
+        if (!isDisjoint(parsedProt, jws.header)) {
+            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
+        }
+        joseHeader = { ...parsedProt, ...jws.header };
+    }
+    else {
+        joseHeader = parsedProt;
+    }
+    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared.crit, parsedProt, joseHeader);
+    let b64 = true;
+    if (extensions.has('b64')) {
+        b64 = parsedProt.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+    }
+    const { alg } = joseHeader;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    if (shared.algorithms && !shared.algorithms.has(alg)) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    if (b64) {
+        if (typeof jws.payload !== 'string') {
+            throw new JWSInvalid('JWS Payload must be a string');
+        }
+    }
+    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
+        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
+    }
+    let resolvedKey = false;
+    if (typeof key === 'function') {
+        key = await key(parsedProt, jws);
+        resolvedKey = true;
+    }
+    const entry = jwsAlgorithm(alg);
+    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'
+        ? b64
+            ?
+                (shared.b64p ??= encodeBase64url(jws.payload, 'payload', JWSInvalid))
+            : encoder.encode(jws.payload)
+        : jws.payload);
+    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
+    const k = await prepareKey(entry, key, 'verify');
+    const verified = await verify(entry, k, signature, data);
+    if (!verified) {
+        throw new JWSSignatureVerificationFailed();
+    }
+    let payload;
+    if (b64) {
+        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);
+    }
+    else if (typeof jws.payload === 'string') {
+        payload = encoder.encode(jws.payload);
+    }
+    else {
+        payload = jws.payload;
+    }
+    return { payload, parsedProt, b64, key: k, resolvedKey };
+}
+export async function verifyCompact(jws, shared, key) {
+    if (jws instanceof Uint8Array) {
+        jws = decoder.decode(jws);
+    }
+    if (typeof jws !== 'string') {
+        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
+    }
+    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
+    if (length !== 3) {
+        throw new JWSInvalid('Invalid Compact JWS');
+    }
+    return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -1,5 +1,5 @@
 import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
-import { encoder, decoder } from './buffer_utils.js';
+import { encoder, strictDecoder } from './buffer_utils.js';
 import { isObject } from './type_checks.js';
 const epoch = (date) => Math.floor(date.getTime() / 1000);
 const minute = 60;
@@ -81,7 +81,7 @@ const checkAudiencePresence = (audPayload, audOption) => {
 export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     let payload;
     try {
-        payload = JSON.parse(decoder.decode(encodedPayload));
+        payload = JSON.parse(strictDecoder.decode(encodedPayload));
     }
     catch {
     }
@@ -109,14 +109,14 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
             throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
-    if (issuer &&
+    if (issuer !== undefined &&
         !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
         throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
-    if (subject && payload.sub !== subject) {
+    if (subject !== undefined && payload.sub !== subject) {
         throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
-    if (audience &&
+    if (audience !== undefined &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
         throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
@@ -134,9 +134,10 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
         default:
             throw new TypeError('Invalid clockTolerance option type');
     }
+    validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
-    const now = epoch(currentDate || new Date());
-    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
+    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
+    if ((payload.iat !== undefined || maxTokenAge !== undefined) && typeof payload.iat !== 'number') {
         throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
@@ -155,7 +156,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
             throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
-    if (maxTokenAge) {
+    if (maxTokenAge !== undefined) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {