@zuplo/cli 6.73.27 → 6.73.29

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -475,7 +475,6 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
     increments: AIGatewayMeterIncrements,
     context: ZuploContext
   ): Promise<void>;
-  private static incrementMetersInternal;
   private checkWarnings;
   private checkQuotaWarning;
   private createHierarchicalQuotaExceededResponse;
@@ -492,6 +491,131 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+/**
+ * Meters AI Gateway v2 usage and enforces options-driven usage limits.
+ *
+ * The authentication policy must run before this policy so the app
+ * configuration id is available for meter storage and analytics.
+ *
+ * @title AI Gateway Metering (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request, or a 429 response when a limit is exceeded
+ */
+export declare class AIGatewayMeteringV2InboundPolicy extends InboundPolicy<AIGatewayMeteringV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-metering-v2";
+  constructor(
+    options: AIGatewayMeteringV2InboundPolicyOptions,
+    policyName: string
+  );
+  /** Set the meter increments accumulated for this request. */
+  static setIncrements(
+    context: ZuploContext,
+    increments: AIGatewayMeterIncrements
+  ): void;
+  /** Read the meter increments accumulated for this request. */
+  static getIncrements(context: ZuploContext): AIGatewayMeterIncrements;
+  /** Set the quota-fallback marker for this request. */
+  static setQuotaFallback(
+    context: ZuploContext,
+    quotaFallback: QuotaFallbackModels
+  ): void;
+  /** Read the quota-fallback marker for this request. */
+  static getQuotaFallback(
+    context: ZuploContext
+  ): QuotaFallbackModels | undefined;
+  /**
+   * Compose request-scoped limit overrides with any limits already set.
+   *
+   * Limits intentionally merge at each meter, period, and setting leaf because
+   * independent policies may tighten one path without restating sibling limits.
+   * Defined values from the newest call win; undefined values never erase an
+   * earlier value.
+   *
+   * @param context - The current request context
+   * @param limits - Limits or partial leaf overrides to compose
+   */
+  static setLimits(
+    context: ZuploContext,
+    limits: AIGatewayMeteringV2LimitOverrides
+  ): void;
+  /** Read request-scoped limit overrides. */
+  static getLimits(
+    context: ZuploContext
+  ): AIGatewayMeteringV2LimitOverrides | undefined;
+  /** Increment meters directly, for example after a streaming response. */
+  static incrementMeters(
+    configurationId: string,
+    increments: AIGatewayMeterIncrements,
+    context: ZuploContext
+  ): Promise<void>;
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+  private resolveConfiguration;
+  private fetchCurrentMeters;
+  private checkWarnings;
+  private hasWarning;
+  private findViolation;
+  private requestCapability;
+  private createQuotaExceededResponse;
+}
+
+/**
+ * Options for metering AI Gateway v2 usage and enforcing request-time limits.
+ * @public
+ */
+export declare interface AIGatewayMeteringV2InboundPolicyOptions {
+  /**
+   * Throw when the metering service is unavailable instead of failing open.
+   */
+  throwOnFailure?: boolean;
+  /**
+   * Usage limits grouped by meter.
+   */
+  limits?: {
+    costs?: QuotaLimit;
+    tokens?: QuotaLimit;
+    requests?: QuotaLimit;
+  };
+}
+
+/**
+ * Request-scoped usage-limit overrides accepted by
+ * `AIGatewayMeteringV2InboundPolicy.setLimits`.
+ */
+export declare interface AIGatewayMeteringV2LimitOverrides {
+  costs?: AIGatewayMeteringV2MeterLimitOverrides;
+  tokens?: AIGatewayMeteringV2MeterLimitOverrides;
+  requests?: AIGatewayMeteringV2MeterLimitOverrides;
+}
+
+/** Daily and monthly overrides for one usage meter. */
+declare interface AIGatewayMeteringV2MeterLimitOverrides {
+  daily?: AIGatewayMeteringV2PeriodLimitOverride;
+  monthly?: AIGatewayMeteringV2PeriodLimitOverride;
+}
+
+/** Settings that a policy can override for one usage-limit period. */
+declare interface AIGatewayMeteringV2PeriodLimitOverride {
+  enabled?: boolean;
+  limit?: number;
+  warning?: AIGatewayMeteringV2WarningLimitOverride;
+}
+
+/** Warning settings that a policy can override for one usage-limit period. */
+declare interface AIGatewayMeteringV2WarningLimitOverride {
+  enabled?: boolean;
+  threshold?: number;
+}
+
 /**
  * Matches AI Gateway requests against curated allow lists or open block lists,
  * then stores the winning model reference for the route handler.
@@ -12178,6 +12302,17 @@ export declare interface QuotaInboundPolicyOptions {
   };
 }
 
+declare interface QuotaLimit {
+  daily?: QuotaSettings;
+  monthly?: QuotaSettings;
+}
+
+declare interface QuotaSettings {
+  enabled: boolean;
+  limit?: number;
+  warning?: WarningSettings;
+}
+
 /**
  * The identifying element of the request that enforces distinct rate limits. For example, you can limit by `user`, `ip`, `function` or `all` - function allows you to specify a simple function to create a string identifier to create a rate-limit group.
  * @public
@@ -15720,6 +15855,14 @@ declare interface WaitUntilFunc {
   (promise: Promise<any>): void;
 }
 
+declare interface WarningSettings {
+  enabled: boolean;
+  /**
+   * Percentage of the limit at which to emit a warning event.
+   */
+  threshold?: number;
+}
+
 /**
  * Authenticate bots using web-bot-auth HTTP Message Signatures.
  *

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.73.27",
+  "version": "6.73.29",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.73.27",
+  "version": "6.73.29",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.220.0",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.73.27",
+    "@zuplo/core": "6.73.29",
     "@zuplo/editor": "1.0.29844086763",
-    "@zuplo/openapi-tools": "6.73.27",
-    "@zuplo/runtime": "6.73.27",
+    "@zuplo/openapi-tools": "6.73.29",
+    "@zuplo/runtime": "6.73.29",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.73.27",
-    "@zuplo/otel": "6.73.27"
+    "@zuplo/graphql": "6.73.29",
+    "@zuplo/otel": "6.73.29"
   },
   "bundleDependencies": [
     "@inquirer/prompts",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/aesgcmkw.js

@@ -1,15 +0,0 @@
-import { encrypt, decrypt } from './content_encryption.js';
-import { encode as b64u } from '../util/base64url.js';
-export async function wrap(alg, key, cek, iv) {
-    const jweAlgorithm = alg.slice(0, 7);
-    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array());
-    return {
-        encryptedKey: wrapped.ciphertext,
-        iv: b64u(wrapped.iv),
-        tag: b64u(wrapped.tag),
-    };
-}
-export async function unwrap(alg, key, encryptedKey, iv, tag) {
-    const jweAlgorithm = alg.slice(0, 7);
-    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array());
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/aeskw.js

@@ -1,25 +0,0 @@
-import { checkEncCryptoKey } from './crypto_key.js';
-function checkKeySize(key, alg) {
-    if (key.algorithm.length !== parseInt(alg.slice(1, 4), 10)) {
-        throw new TypeError(`Invalid key size for alg: ${alg}`);
-    }
-}
-function getCryptoKey(key, alg, usage) {
-    if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'AES-KW', true, [usage]);
-    }
-    checkEncCryptoKey(key, alg, usage);
-    return key;
-}
-export async function wrap(alg, key, cek) {
-    const cryptoKey = await getCryptoKey(key, alg, 'wrapKey');
-    checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
-    return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, cryptoKey, 'AES-KW'));
-}
-export async function unwrap(alg, key, encryptedKey) {
-    const cryptoKey = await getCryptoKey(key, alg, 'unwrapKey');
-    checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
-    return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/check_key_type.js

@@ -1,122 +0,0 @@
-import { withAlg as invalidKeyInput } from './invalid_key_input.js';
-import { isKeyLike } from './is_key_like.js';
-import * as jwk from './type_checks.js';
-const tag = (key) => key?.[Symbol.toStringTag];
-const jwkMatchesOp = (alg, key, usage) => {
-    if (key.use !== undefined) {
-        let expected;
-        switch (usage) {
-            case 'sign':
-            case 'verify':
-                expected = 'sig';
-                break;
-            case 'encrypt':
-            case 'decrypt':
-                expected = 'enc';
-                break;
-        }
-        if (key.use !== expected) {
-            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-        }
-    }
-    if (key.alg !== undefined && key.alg !== alg) {
-        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-    }
-    if (Array.isArray(key.key_ops)) {
-        let expectedKeyOp;
-        switch (true) {
-            case usage === 'sign' || usage === 'verify':
-            case alg === 'dir':
-            case alg.includes('CBC-HS'):
-                expectedKeyOp = usage;
-                break;
-            case alg.startsWith('PBES2'):
-                expectedKeyOp = 'deriveBits';
-                break;
-            case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
-                if (!alg.includes('GCM') && alg.endsWith('KW')) {
-                    expectedKeyOp = usage === 'encrypt' ? 'wrapKey' : 'unwrapKey';
-                }
-                else {
-                    expectedKeyOp = usage;
-                }
-                break;
-            case usage === 'encrypt' && alg.startsWith('RSA'):
-                expectedKeyOp = 'wrapKey';
-                break;
-            case usage === 'decrypt':
-                expectedKeyOp = alg.startsWith('RSA') ? 'unwrapKey' : 'deriveBits';
-                break;
-        }
-        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
-            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-        }
-    }
-    return true;
-};
-const symmetricTypeCheck = (alg, key, usage) => {
-    if (key instanceof Uint8Array)
-        return;
-    if (jwk.isJWK(key)) {
-        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
-            return;
-        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-    }
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-    if (jwk.isJWK(key)) {
-        switch (usage) {
-            case 'decrypt':
-            case 'sign':
-                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
-                    return;
-                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-            case 'encrypt':
-            case 'verify':
-                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
-                    return;
-                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
-        }
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    if (key.type === 'public') {
-        switch (usage) {
-            case 'sign':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-            case 'decrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-        }
-    }
-    if (key.type === 'private') {
-        switch (usage) {
-            case 'verify':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-            case 'encrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
-        }
-    }
-};
-export function checkKeyType(alg, key, usage) {
-    switch (alg.substring(0, 2)) {
-        case 'A1':
-        case 'A2':
-        case 'di':
-        case 'HS':
-        case 'PB':
-            symmetricTypeCheck(alg, key, usage);
-            break;
-        default:
-            asymmetricTypeCheck(alg, key, usage);
-    }
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/ecdhes.js

@@ -1,52 +0,0 @@
-import { encode, concat, uint32be } from './buffer_utils.js';
-import { checkEncCryptoKey } from './crypto_key.js';
-import { digest } from './helpers.js';
-function lengthAndInput(input) {
-    return concat(uint32be(input.length), input);
-}
-async function concatKdf(Z, L, OtherInfo) {
-    const dkLen = L >> 3;
-    const hashLen = 32;
-    const reps = Math.ceil(dkLen / hashLen);
-    const dk = new Uint8Array(reps * hashLen);
-    for (let i = 1; i <= reps; i++) {
-        const hashInput = new Uint8Array(4 + Z.length + OtherInfo.length);
-        hashInput.set(uint32be(i), 0);
-        hashInput.set(Z, 4);
-        hashInput.set(OtherInfo, 4 + Z.length);
-        const hashResult = await digest('sha256', hashInput);
-        dk.set(hashResult, (i - 1) * hashLen);
-    }
-    return dk.slice(0, dkLen);
-}
-export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
-    checkEncCryptoKey(publicKey, 'ECDH');
-    checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
-    const algorithmID = lengthAndInput(encode(algorithm));
-    const partyUInfo = lengthAndInput(apu);
-    const partyVInfo = lengthAndInput(apv);
-    const suppPubInfo = uint32be(keyLength);
-    const suppPrivInfo = new Uint8Array();
-    const otherInfo = concat(algorithmID, partyUInfo, partyVInfo, suppPubInfo, suppPrivInfo);
-    const Z = new Uint8Array(await crypto.subtle.deriveBits({
-        name: publicKey.algorithm.name,
-        public: publicKey,
-    }, privateKey, getEcdhBitLength(publicKey)));
-    return concatKdf(Z, keyLength, otherInfo);
-}
-function getEcdhBitLength(publicKey) {
-    if (publicKey.algorithm.name === 'X25519') {
-        return 256;
-    }
-    return (Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3);
-}
-export function allowed(key) {
-    switch (key.algorithm.namedCurve) {
-        case 'P-256':
-        case 'P-384':
-        case 'P-521':
-            return true;
-        default:
-            return key.algorithm.name === 'X25519';
-    }
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/key_to_jwk.js

@@ -1,34 +0,0 @@
-import { invalidKeyInput } from './invalid_key_input.js';
-import { encode as b64u } from '../util/base64url.js';
-import { isCryptoKey, isKeyObject } from './is_key_like.js';
-function omitUndefinedProperties(jwk) {
-    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== undefined));
-}
-export async function keyToJWK(key) {
-    if (isKeyObject(key)) {
-        if (key.type === 'secret') {
-            key = key.export();
-        }
-        else {
-            return key.export({ format: 'jwk' });
-        }
-    }
-    if (key instanceof Uint8Array) {
-        return {
-            kty: 'oct',
-            k: b64u(key),
-        };
-    }
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
-    }
-    if (!key.extractable) {
-        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
-    }
-    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey('jwk', key));
-    if (jwk.kty === 'AKP') {
-        ;
-        jwk.alg = alg;
-    }
-    return jwk;
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/normalize_key.js

@@ -1,166 +0,0 @@
-import { isJWK } from './type_checks.js';
-import { decode } from '../util/base64url.js';
-import { jwkToKey } from './jwk_to_key.js';
-import { isCryptoKey, isKeyObject } from './is_key_like.js';
-const unusableForAlg = 'given KeyObject instance cannot be used for this algorithm';
-let cache;
-const handleJWK = async (key, jwk, alg, freeze = false) => {
-    cache ||= new WeakMap();
-    let cached = cache.get(key);
-    if (cached?.[alg]) {
-        return cached[alg];
-    }
-    const cryptoKey = await jwkToKey({ ...jwk, alg });
-    if (freeze)
-        Object.freeze(key);
-    if (!cached) {
-        cache.set(key, { [alg]: cryptoKey });
-    }
-    else {
-        cached[alg] = cryptoKey;
-    }
-    return cryptoKey;
-};
-const handleKeyObject = (keyObject, alg) => {
-    cache ||= new WeakMap();
-    let cached = cache.get(keyObject);
-    if (cached?.[alg]) {
-        return cached[alg];
-    }
-    const isPublic = keyObject.type === 'public';
-    const extractable = isPublic ? true : false;
-    let cryptoKey;
-    if (keyObject.asymmetricKeyType === 'x25519') {
-        switch (alg) {
-            case 'ECDH-ES':
-            case 'ECDH-ES+A128KW':
-            case 'ECDH-ES+A192KW':
-            case 'ECDH-ES+A256KW':
-                break;
-            default:
-                throw new TypeError(unusableForAlg);
-        }
-        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);
-    }
-    if (keyObject.asymmetricKeyType === 'ed25519') {
-        if (alg !== 'EdDSA' && alg !== 'Ed25519') {
-            throw new TypeError(unusableForAlg);
-        }
-        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
-            isPublic ? 'verify' : 'sign',
-        ]);
-    }
-    switch (keyObject.asymmetricKeyType) {
-        case 'ml-dsa-44':
-        case 'ml-dsa-65':
-        case 'ml-dsa-87': {
-            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
-                throw new TypeError(unusableForAlg);
-            }
-            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
-                isPublic ? 'verify' : 'sign',
-            ]);
-        }
-    }
-    if (keyObject.asymmetricKeyType === 'rsa') {
-        let hash;
-        switch (alg) {
-            case 'RSA-OAEP':
-                hash = 'SHA-1';
-                break;
-            case 'RS256':
-            case 'PS256':
-            case 'RSA-OAEP-256':
-                hash = 'SHA-256';
-                break;
-            case 'RS384':
-            case 'PS384':
-            case 'RSA-OAEP-384':
-                hash = 'SHA-384';
-                break;
-            case 'RS512':
-            case 'PS512':
-            case 'RSA-OAEP-512':
-                hash = 'SHA-512';
-                break;
-            default:
-                throw new TypeError(unusableForAlg);
-        }
-        if (alg.startsWith('RSA-OAEP')) {
-            return keyObject.toCryptoKey({
-                name: 'RSA-OAEP',
-                hash,
-            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);
-        }
-        cryptoKey = keyObject.toCryptoKey({
-            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',
-            hash,
-        }, extractable, [isPublic ? 'verify' : 'sign']);
-    }
-    if (keyObject.asymmetricKeyType === 'ec') {
-        const nist = new Map([
-            ['prime256v1', 'P-256'],
-            ['secp384r1', 'P-384'],
-            ['secp521r1', 'P-521'],
-        ]);
-        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
-        if (!namedCurve) {
-            throw new TypeError(unusableForAlg);
-        }
-        const expectedCurve = { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' };
-        if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) {
-            cryptoKey = keyObject.toCryptoKey({
-                name: 'ECDSA',
-                namedCurve,
-            }, extractable, [isPublic ? 'verify' : 'sign']);
-        }
-        if (alg.startsWith('ECDH-ES')) {
-            cryptoKey = keyObject.toCryptoKey({
-                name: 'ECDH',
-                namedCurve,
-            }, extractable, isPublic ? [] : ['deriveBits']);
-        }
-    }
-    if (!cryptoKey) {
-        throw new TypeError(unusableForAlg);
-    }
-    if (!cached) {
-        cache.set(keyObject, { [alg]: cryptoKey });
-    }
-    else {
-        cached[alg] = cryptoKey;
-    }
-    return cryptoKey;
-};
-export async function normalizeKey(key, alg) {
-    if (key instanceof Uint8Array) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        return key;
-    }
-    if (isKeyObject(key)) {
-        if (key.type === 'secret') {
-            return key.export();
-        }
-        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {
-            try {
-                return handleKeyObject(key, alg);
-            }
-            catch (err) {
-                if (err instanceof TypeError) {
-                    throw err;
-                }
-            }
-        }
-        let jwk = key.export({ format: 'jwk' });
-        return handleJWK(key, jwk, alg);
-    }
-    if (isJWK(key)) {
-        if (key.k) {
-            return decode(key.k);
-        }
-        return handleJWK(key, key, alg, true);
-    }
-    throw new Error('unreachable');
-}

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/pbes2kw.js

@@ -1,42 +0,0 @@
-import { encode as b64u } from '../util/base64url.js';
-import * as aeskw from './aeskw.js';
-import { checkEncCryptoKey } from './crypto_key.js';
-import { concat, encode } from './buffer_utils.js';
-import { JWEInvalid } from '../util/errors.js';
-function getCryptoKey(key, alg) {
-    if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
-            'deriveBits',
-        ]);
-    }
-    checkEncCryptoKey(key, alg, 'deriveBits');
-    return key;
-}
-const concatSalt = (alg, p2sInput) => concat(encode(alg), Uint8Array.of(0x00), p2sInput);
-async function deriveKey(p2s, alg, p2c, key) {
-    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
-        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
-    }
-    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) {
-        throw new JWEInvalid('PBES2 Count Input must be a positive integer');
-    }
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10);
-    const subtleAlg = {
-        hash: `SHA-${alg.slice(8, 11)}`,
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const cryptoKey = await getCryptoKey(key, alg);
-    return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-}
-export async function wrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    const encryptedKey = await aeskw.wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: b64u(p2s) };
-}
-export async function unwrap(alg, key, encryptedKey, p2c, p2s) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    return aeskw.unwrap(alg.slice(-6), derived, encryptedKey);
-}