@zuplo/cli 6.74.2 → 6.74.6

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -10,23 +10,19 @@ import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
 class IndividualRecipient {
     #parent;
-    unprotectedHeader;
-    keyManagementParameters;
-    key;
-    options;
-    constructor(enc, key, options) {
+    state;
+    constructor(enc, key, crit) {
         this.#parent = enc;
-        this.key = key;
-        this.options = options;
+        this.state = [undefined, undefined, key, crit];
     }
     setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
-        this.unprotectedHeader = unprotectedHeader;
+        assertNotSet(this.state[0], 'setUnprotectedHeader');
+        this.state[0] = unprotectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        assertNotSet(this.keyManagementParameters, 'setKeyManagementParameters');
-        this.keyManagementParameters = parameters;
+        assertNotSet(this.state[1], 'setKeyManagementParameters');
+        this.state[1] = parameters;
         return this;
     }
     addRecipient(...args) {
@@ -39,6 +35,17 @@ class IndividualRecipient {
         return this.#parent;
     }
 }
+function copyOptionalMembers(flattened, jwe, recipient) {
+    const { aad, protected: protectedHeader, unprotected, header } = flattened;
+    if (aad)
+        jwe.aad = aad;
+    if (protectedHeader)
+        jwe.protected = protectedHeader;
+    if (unprotected)
+        jwe.unprotected = unprotected;
+    if (header)
+        recipient.header = header;
+}
 export class GeneralEncrypt {
     #plaintext;
     #recipients = [];
@@ -49,7 +56,7 @@ export class GeneralEncrypt {
         this.#plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, { crit: options?.crit });
+        const recipient = new IndividualRecipient(this, key, options?.crit);
         this.#recipients.push(recipient);
         return recipient;
     }
@@ -76,29 +83,23 @@ export class GeneralEncrypt {
         }
         if (this.#recipients.length === 1) {
             const [recipient] = this.#recipients;
+            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
             const flattened = await new FlattenedEncrypt(this.#plaintext)
                 .setAdditionalAuthenticatedData(this.#aad)
                 .setProtectedHeader(this.#protectedHeader)
                 .setSharedUnprotectedHeader(this.#unprotectedHeader)
-                .setUnprotectedHeader(recipient.unprotectedHeader)
-                .setKeyManagementParameters(recipient.keyManagementParameters)
-                .encrypt(recipient.key, { ...recipient.options });
+                .setUnprotectedHeader(unprotectedHeader)
+                .setKeyManagementParameters(keyManagementParameters)
+                .encrypt(key, { crit });
             const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
                 tag: flattened.tag,
             };
-            if (flattened.aad)
-                jwe.aad = flattened.aad;
-            if (flattened.protected)
-                jwe.protected = flattened.protected;
-            if (flattened.unprotected)
-                jwe.unprotected = flattened.unprotected;
             if (flattened.encrypted_key)
                 jwe.recipients[0].encrypted_key = flattened.encrypted_key;
-            if (flattened.header)
-                jwe.recipients[0].header = flattened.header;
+            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
             return jwe;
         }
         validateCritDuplicates(JWEInvalid, this.#protectedHeader);
@@ -107,60 +108,58 @@ export class GeneralEncrypt {
         const checked = [];
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
-            const input = {
-                plaintext: this.#plaintext,
-                protectedHeader: this.#protectedHeader,
-                unprotectedHeader: recipient.unprotectedHeader,
-                sharedUnprotectedHeader: this.#unprotectedHeader,
-                aad: this.#aad,
-                keyManagementParameters: recipient.keyManagementParameters,
-                crit: recipient.options.crit,
-                unprotectedParameters: true,
-            };
+            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
+            const input = [
+                this.#plaintext,
+                this.#protectedHeader,
+                unprotectedHeader,
+                this.#unprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                true,
+            ];
             const headers = checkEncryptHeaders(input);
             inputs.push(input);
             checked.push(headers);
-            if (headers.alg === 'dir' || headers.alg === 'ECDH-ES') {
+            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
                 throw new JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');
             }
             if (!enc) {
-                enc = headers.enc;
+                enc = headers[2];
             }
-            else if (enc !== headers.enc) {
+            else if (enc !== headers[2]) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
         }
-        const cek = generateCek(checked[0].encEntry);
+        const cek = generateCek(checked[0][3]);
         const jwe = {
             ciphertext: '',
             recipients: [],
         };
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
+            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
             const target = {};
             jwe.recipients.push(target);
             if (i === 0) {
-                const flattened = await encryptJWE({ ...inputs[0], cek }, checked[0], recipient.key);
+                inputs[0][5] = cek;
+                const flattened = await encryptJWE(inputs[0], checked[0], key);
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;
                 jwe.tag = flattened.tag;
-                if (flattened.aad)
-                    jwe.aad = flattened.aad;
-                if (flattened.protected)
-                    jwe.protected = flattened.protected;
-                if (flattened.unprotected)
-                    jwe.unprotected = flattened.unprotected;
                 target.encrypted_key = flattened.encrypted_key;
-                if (flattened.header)
-                    target.header = flattened.header;
+                copyOptionalMembers(flattened, jwe, target);
                 continue;
             }
-            const { alg } = checked[i];
-            const k = await prepareKey(jweAlgorithm(alg), recipient.key, 'encrypt');
-            const { encryptedKey, parameters } = await encryptKeyManagement(alg, checked[i].encEntry, k, cek, recipient.keyManagementParameters);
+            const [, alg, , encEntry] = checked[i];
+            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
+            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
-            if (recipient.unprotectedHeader || parameters)
-                target.header = { ...recipient.unprotectedHeader, ...parameters };
+            if (unprotectedHeader || parameters)
+                target.header = { ...unprotectedHeader, ...parameters };
         }
         return jwe;
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/local.js

@@ -4,7 +4,7 @@ import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingK
 import { isObject } from '../lib/type_checks.js';
 function signatureAlgorithm(alg) {
     const entry = typeof alg === 'string' ? maybeJWSAlgorithm(alg) : undefined;
-    if (!entry || entry.symmetric) {
+    if (!entry || entry.secret) {
         throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
     }
     return entry;
@@ -14,10 +14,7 @@ function isJWKSLike(jwks) {
         return false;
     }
     const { keys } = jwks;
-    return Array.isArray(keys) && keys.every(isJWKLike);
-}
-function isJWKLike(key) {
-    return isObject(key);
+    return Array.isArray(keys) && keys.every((isObject));
 }
 class LocalJWKSetImpl {
     #jwks;
@@ -34,25 +31,12 @@ class LocalJWKSetImpl {
     async getKey(protectedHeader, token) {
         const { alg, kid } = { ...protectedHeader, ...token?.header };
         const entry = signatureAlgorithm(alg);
-        const candidates = this.#jwks.keys.filter((jwk) => {
-            let candidate = entry.kty.includes(jwk.kty);
-            if (candidate && typeof kid === 'string') {
-                candidate = kid === jwk.kid;
-            }
-            if (candidate && (typeof jwk.alg === 'string' || jwk.kty === 'AKP')) {
-                candidate = alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && entry.crv) {
-                candidate = jwk.crv === entry.crv;
-            }
-            return candidate;
-        });
+        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
+            (typeof kid !== 'string' || kid === jwk.kid) &&
+            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
+            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
+            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
+            (!entry.crv || jwk.crv === entry.crv));
         const { 0: jwk, length } = candidates;
         if (length === 0) {
             throw new JWKSNoMatchingKey();
@@ -87,13 +71,8 @@ async function importWithAlgCache(cache, jwk, entry) {
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSetImpl(jwks);
     const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(localJWKSet, {
-        jwks: {
-            value: () => structuredClone(set.jwks()),
-            enumerable: false,
-            configurable: false,
-            writable: false,
-        },
+    Object.defineProperty(localJWKSet, 'jwks', {
+        value: () => structuredClone(set.jwks()),
     });
     return localJWKSet;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.6';
+    const VERSION = 'v6.2.7';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -67,12 +67,12 @@ class RemoteJWKSetImpl {
             throw new TypeError('url must be an instance of URL');
         }
         this.#url = new URL(url.href);
-        this.#timeoutDuration =
-            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
+        const opts = options ?? {};
+        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
         this.#cooldownDuration =
-            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        this.#headers = new Headers(options?.headers);
+            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
+        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
+        this.#headers = new Headers(opts.headers);
         if (USER_AGENT && !this.#headers.has('User-Agent')) {
             this.#headers.set('User-Agent', USER_AGENT);
         }
@@ -80,10 +80,11 @@ class RemoteJWKSetImpl {
             this.#headers.set('accept', 'application/json');
             this.#headers.append('accept', 'application/jwk-set+json');
         }
-        this.#customFetch = options?.[customFetch];
-        if (options?.[jwksCache] !== undefined) {
-            this.#cache = options?.[jwksCache];
-            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {
+        this.#customFetch = opts[customFetch];
+        const cache = opts[jwksCache];
+        if (cache !== undefined) {
+            this.#cache = cache;
+            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
                 this.#jwksTimestamp = this.#cache.uat;
                 this.#local = createLocalJWKSet(this.#cache.jwks);
             }
@@ -92,15 +93,14 @@ class RemoteJWKSetImpl {
     pendingFetch() {
         return !!this.#pendingFetch;
     }
+    #validFor(duration) {
+        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    }
     coolingDown() {
-        return typeof this.#jwksTimestamp === 'number'
-            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration
-            : false;
+        return this.#validFor(this.#cooldownDuration);
     }
     fresh() {
-        return typeof this.#jwksTimestamp === 'number'
-            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge
-            : false;
+        return this.#validFor(this.#cacheMaxAge);
     }
     jwks() {
         return this.#local?.jwks();
@@ -134,11 +134,9 @@ class RemoteJWKSetImpl {
                 this.#cache.jwks = json;
             }
             this.#jwksTimestamp = Date.now();
-            this.#pendingFetch = undefined;
         })
-            .catch((err) => {
+            .finally(() => {
             this.#pendingFetch = undefined;
-            throw err;
         });
         await this.#pendingFetch;
     }
@@ -150,29 +148,22 @@ export function createRemoteJWKSet(url, options) {
         coolingDown: {
             get: () => set.coolingDown(),
             enumerable: true,
-            configurable: false,
         },
         fresh: {
             get: () => set.fresh(),
             enumerable: true,
-            configurable: false,
         },
         reload: {
             value: () => set.reload(),
             enumerable: true,
-            configurable: false,
-            writable: false,
         },
         reloading: {
             get: () => set.pendingFetch(),
             enumerable: true,
-            configurable: false,
         },
         jwks: {
             value: () => set.jwks(),
             enumerable: true,
-            configurable: false,
-            writable: false,
         },
     });
     return remoteJWKSet;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -1,9 +1,9 @@
 import { prepareVerify, verifyCompact } from '../../lib/jws_verify.js';
 export async function compactVerify(jws, key, options) {
     const verified = await verifyCompact(jws, prepareVerify(options), key);
-    const result = { payload: verified.payload, protectedHeader: verified.parsedProt };
+    const result = { payload: verified[0], protectedHeader: verified[1] };
     if (typeof key === 'function') {
-        return { ...result, key: verified.key };
+        return { ...result, key: verified[3] };
     }
     return result;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -1,4 +1,3 @@
-import { JWSInvalid } from '../../util/errors.js';
 import { createSignature } from '../../lib/jws_sign.js';
 import { assertNotSet } from '../../lib/helpers.js';
 export class FlattenedSign {
@@ -22,18 +21,11 @@ export class FlattenedSign {
         return this;
     }
     async sign(key, options) {
-        if (!this.#protectedHeader && !this.#unprotectedHeader) {
-            throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
-        }
-        const jws = await createSignature({
+        return createSignature({
             payload: this.#payload,
             protectedHeader: this.#protectedHeader,
             unprotectedHeader: this.#unprotectedHeader,
             crit: options?.crit,
         }, key);
-        if (this.#unprotectedHeader) {
-            jws.header = this.#unprotectedHeader;
-        }
-        return jws;
     }
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -3,23 +3,19 @@ import { JWSInvalid } from '../../util/errors.js';
 import { assertNotSet } from '../../lib/helpers.js';
 class IndividualSignature {
     #parent;
-    protectedHeader;
-    unprotectedHeader;
-    options;
-    key;
+    state;
     constructor(sig, key, options) {
         this.#parent = sig;
-        this.key = key;
-        this.options = options;
+        this.state = [undefined, undefined, key, options?.crit];
     }
     setProtectedHeader(protectedHeader) {
-        assertNotSet(this.protectedHeader, 'setProtectedHeader');
-        this.protectedHeader = protectedHeader;
+        assertNotSet(this.state[0], 'setProtectedHeader');
+        this.state[0] = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
-        this.unprotectedHeader = unprotectedHeader;
+        assertNotSet(this.state[1], 'setUnprotectedHeader');
+        this.state[1] = unprotectedHeader;
         return this;
     }
     addSignature(...args) {
@@ -54,22 +50,17 @@ export class GeneralSign {
             signatures: [],
             payload: '',
         };
-        const encoded = {};
+        const encoded = [];
         for (let i = 0; i < this.#signatures.length; i++) {
             const signature = this.#signatures[i];
-            if (!signature.protectedHeader && !signature.unprotectedHeader) {
-                throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
-            }
+            const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
             const { payload, ...rest } = await createSignature({
                 payload: this.#payload,
-                protectedHeader: signature.protectedHeader,
-                unprotectedHeader: signature.unprotectedHeader,
-                crit: signature.options?.crit,
+                protectedHeader,
+                unprotectedHeader,
+                crit,
                 encoded,
-            }, signature.key);
-            if (signature.unprotectedHeader) {
-                rest.header = signature.unprotectedHeader;
-            }
+            }, key);
             if (i === 0) {
                 jws.payload = payload;
             }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -5,34 +5,36 @@ export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');
     }
-    if (!Array.isArray(jws.signatures) || !jws.signatures.every(isObject)) {
+    const { signatures, payload } = jws;
+    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
     let shared;
     try {
-        if (jws.payload === undefined)
+        if (payload === undefined)
             throw new Error();
         shared = prepareVerify(options);
     }
     catch {
         throw new JWSSignatureVerificationFailed();
     }
-    for (const signature of jws.signatures) {
+    for (const signature of signatures) {
         try {
-            if (signature.protected === undefined && signature.header === undefined)
+            const { protected: encodedProtected, header, signature: encodedSignature } = signature;
+            if (encodedProtected === undefined && header === undefined)
                 throw new Error();
-            if (signature.protected !== undefined && typeof signature.protected !== 'string') {
+            if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
                 throw new Error();
             }
-            if (typeof signature.signature !== 'string')
+            if (typeof encodedSignature !== 'string')
                 throw new Error();
-            if (signature.header !== undefined && !isObject(signature.header))
+            if (header !== undefined && !isObject(header))
                 throw new Error();
             return verifyResult(signature, await verifySignature({
-                header: signature.header,
-                payload: jws.payload,
-                protected: signature.protected,
-                signature: signature.signature,
+                header,
+                payload,
+                protected: encodedProtected,
+                signature: encodedSignature,
             }, shared, key));
         }
         catch {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -3,8 +3,8 @@ import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTClaimValidationFailed } from '../util/errors.js';
 export async function jwtDecrypt(jwt, key, options) {
     const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
-    const protectedHeader = decrypted.parsedProt;
-    const payload = validateClaimsSet(protectedHeader, decrypted.plaintext, options);
+    const protectedHeader = decrypted[1];
+    const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
         throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
@@ -17,7 +17,7 @@ export async function jwtDecrypt(jwt, key, options) {
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {
-        return { ...result, key: decrypted.key };
+        return { ...result, key: decrypted[2] };
     }
     return result;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwt/verify.js

@@ -3,13 +3,13 @@ import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTInvalid } from '../util/errors.js';
 export async function jwtVerify(jwt, key, options) {
     const verified = await verifyCompact(jwt, prepareVerify(options), key);
-    if (!verified.b64) {
+    if (!verified[2]) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
-    const payload = validateClaimsSet(verified.parsedProt, verified.payload, options);
-    const result = { payload, protectedHeader: verified.parsedProt };
+    const payload = validateClaimsSet(verified[1], verified[0], options);
+    const result = { payload, protectedHeader: verified[1] };
     if (typeof key === 'function') {
-        return { ...result, key: verified.key };
+        return { ...result, key: verified[3] };
     }
     return result;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/key/export.js

@@ -33,12 +33,12 @@ async function keyToJWK(key) {
     }
     return jwk;
 }
-export async function exportSPKI(key) {
+export function exportSPKI(key) {
     return exportPublic(key);
 }
-export async function exportPKCS8(key) {
+export function exportPKCS8(key) {
     return exportPrivate(key);
 }
-export async function exportJWK(key) {
+export function exportJWK(key) {
     return keyToJWK(key);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -9,16 +9,17 @@ function getModulusLengthOption(options) {
 }
 export async function generateKeyPair(alg, options) {
     const entry = keyAlgorithm(alg);
-    if (entry.symmetric) {
+    if (entry.secret) {
         throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
     let algorithm;
-    if (entry.subtleFor) {
-        switch (options?.crv ?? 'P-256') {
+    if (entry.resolve) {
+        const crv = options?.crv ?? 'P-256';
+        switch (crv) {
             case 'P-256':
             case 'P-384':
             case 'P-521':
-                algorithm = { name: 'ECDH', namedCurve: options?.crv ?? 'P-256' };
+                algorithm = { name: 'ECDH', namedCurve: crv };
                 break;
             case 'X25519':
                 algorithm = { name: 'X25519' };
@@ -41,7 +42,7 @@ export async function generateKeyPair(alg, options) {
                 : entry.subtle;
     }
     return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
-        ...entry.usages.private,
-        ...entry.usages.public,
+        ...entry.usages[1],
+        ...entry.usages[0],
     ]);
 }