@zuplo/cli 7.1.9 → 7.2.0

package/node_modules/@hono/node-server/dist/index.cjs

@@ -13,6 +13,157 @@ var RequestError = class extends Error {
 	}
 };
 
+//#endregion
+//#region src/headers.ts
+const nonJoinedHeaders = new Set([
+	"age",
+	"authorization",
+	"content-length",
+	"content-type",
+	"etag",
+	"expires",
+	"from",
+	"host",
+	"if-modified-since",
+	"if-unmodified-since",
+	"last-modified",
+	"location",
+	"max-forwards",
+	"proxy-authorization",
+	"referer",
+	"retry-after",
+	"server",
+	"user-agent"
+]);
+const validHeaderName = /^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/;
+const isHttpWhitespace = (code) => code === 9 || code === 10 || code === 13 || code === 32;
+const normalizeHeaderValue = (value) => {
+	if (!isHttpWhitespace(value.charCodeAt(0)) && !isHttpWhitespace(value.charCodeAt(value.length - 1))) return value;
+	let start = 0;
+	let end = value.length;
+	while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+	while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+	return value.slice(start, end);
+};
+const forbiddenHeaderValue = /[\0\r\n]/;
+const GlobalHeaders = globalThis.Headers;
+const materializeHeaders = (rawHeaders, HeadersCtor = GlobalHeaders) => {
+	const headers = new HeadersCtor();
+	for (let i = 0; i < rawHeaders.length; i += 2) {
+		const name = rawHeaders[i];
+		if (!name.startsWith(":")) headers.append(name, rawHeaders[i + 1]);
+	}
+	return headers;
+};
+var RequestHeaders = class {
+	#incoming;
+	#rawHeaders;
+	#headers;
+	#invalidValue;
+	constructor(incoming) {
+		this.#incoming = incoming;
+		if (incoming instanceof node_http2.Http2ServerRequest) this.#rawHeaders = incoming.rawHeaders.slice();
+	}
+	get #lazyRawHeaders() {
+		return this.#rawHeaders ??= this.#incoming.rawHeaders.slice();
+	}
+	get #native() {
+		if (!this.#headers) {
+			this.#headers = materializeHeaders(this.#lazyRawHeaders);
+			this.#rawHeaders = void 0;
+		}
+		return this.#headers;
+	}
+	#normalizedName(name) {
+		if (typeof name !== "string") return;
+		if (!validHeaderName.test(name)) throw new TypeError(`Invalid header name: ${name}`);
+		return name.toLowerCase();
+	}
+	#lookupHttp1(lowerName) {
+		const headers = this.#incoming instanceof node_http2.Http2ServerRequest ? void 0 : this.#incoming.headers;
+		if (!headers || nonJoinedHeaders.has(lowerName) || lowerName === "set-cookie" || lowerName === "__proto__") return;
+		if (!Object.hasOwn(headers, lowerName)) return null;
+		const rawValue = headers[lowerName];
+		if (typeof rawValue === "string") {
+			const value = normalizeHeaderValue(rawValue);
+			return forbiddenHeaderValue.test(value) ? void 0 : value;
+		}
+	}
+	#lookup(rawHeaders, lowerName) {
+		const separator = lowerName === "cookie" ? "; " : ", ";
+		let value = null;
+		for (let i = 0; i < rawHeaders.length; i += 2) {
+			const rawName = rawHeaders[i];
+			if (rawName.length === lowerName.length && rawName.toLowerCase() === lowerName) {
+				const rawValue = normalizeHeaderValue(rawHeaders[i + 1]);
+				if (forbiddenHeaderValue.test(rawValue)) {
+					this.#invalidValue = true;
+					return;
+				}
+				value = value === null ? rawValue : value + separator + rawValue;
+			}
+		}
+		return value;
+	}
+	append(name, value) {
+		this.#native.append(name, value);
+	}
+	delete(name) {
+		this.#native.delete(name);
+	}
+	get(name) {
+		const lowerName = this.#normalizedName(name);
+		if (lowerName && !this.#headers && !this.#invalidValue) {
+			const http1Value = this.#lookupHttp1(lowerName);
+			if (http1Value !== void 0) return http1Value;
+			const value = this.#lookup(this.#lazyRawHeaders, lowerName);
+			if (value !== void 0) return value;
+		}
+		return this.#native.get(name);
+	}
+	has(name) {
+		const lowerName = this.#normalizedName(name);
+		if (lowerName && !this.#headers && !this.#invalidValue) {
+			const http1Value = this.#lookupHttp1(lowerName);
+			if (http1Value !== void 0) return http1Value !== null;
+			const value = this.#lookup(this.#lazyRawHeaders, lowerName);
+			if (value !== void 0) return value !== null;
+		}
+		return this.#native.has(name);
+	}
+	set(name, value) {
+		this.#native.set(name, value);
+	}
+	getSetCookie() {
+		return this.#native.getSetCookie();
+	}
+	keys() {
+		return this.#native.keys();
+	}
+	values() {
+		return this.#native.values();
+	}
+	entries() {
+		return this.#native.entries();
+	}
+	forEach(callback, thisArg) {
+		this.#native.forEach((value, key) => {
+			callback.call(thisArg, value, key, this);
+		});
+	}
+	[Symbol.iterator]() {
+		return this.entries();
+	}
+};
+Object.defineProperty(RequestHeaders.prototype, Symbol.for("nodejs.util.inspect.custom"), { value: function(depth, options, inspectFn) {
+	return `Headers (lightweight) ${inspectFn(Object.fromEntries(this), {
+		...options,
+		depth: depth == null ? null : depth - 1
+	})}`;
+} });
+Object.setPrototypeOf(RequestHeaders.prototype, GlobalHeaders.prototype);
+const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeaders ? new RequestHeaders(incoming) : materializeHeaders(incoming.rawHeaders, globalThis.Headers);
+
 //#endregion
 //#region src/url.ts
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
@@ -50,15 +201,6 @@ var Request$1 = class extends GlobalRequest {
 		super(input, options);
 	}
 };
-const newHeadersFromIncoming = (incoming) => {
-	const headerRecord = [];
-	const rawHeaders = incoming.rawHeaders;
-	for (let i = 0, len = rawHeaders.length; i < len; i += 2) {
-		const key = rawHeaders[i];
-		if (key.charCodeAt(0) !== 58) headerRecord.push([key, rawHeaders[i + 1]]);
-	}
-	return new Headers(headerRecord);
-};
 const wrapBodyStream = Symbol("wrapBodyStream");
 const byteExactEncodings = new Set([
 	"latin1",

package/node_modules/@hono/node-server/dist/index.mjs

@@ -12,6 +12,157 @@ var RequestError = class extends Error {
 	}
 };
 
+//#endregion
+//#region src/headers.ts
+const nonJoinedHeaders = new Set([
+	"age",
+	"authorization",
+	"content-length",
+	"content-type",
+	"etag",
+	"expires",
+	"from",
+	"host",
+	"if-modified-since",
+	"if-unmodified-since",
+	"last-modified",
+	"location",
+	"max-forwards",
+	"proxy-authorization",
+	"referer",
+	"retry-after",
+	"server",
+	"user-agent"
+]);
+const validHeaderName = /^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/;
+const isHttpWhitespace = (code) => code === 9 || code === 10 || code === 13 || code === 32;
+const normalizeHeaderValue = (value) => {
+	if (!isHttpWhitespace(value.charCodeAt(0)) && !isHttpWhitespace(value.charCodeAt(value.length - 1))) return value;
+	let start = 0;
+	let end = value.length;
+	while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+	while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+	return value.slice(start, end);
+};
+const forbiddenHeaderValue = /[\0\r\n]/;
+const GlobalHeaders = globalThis.Headers;
+const materializeHeaders = (rawHeaders, HeadersCtor = GlobalHeaders) => {
+	const headers = new HeadersCtor();
+	for (let i = 0; i < rawHeaders.length; i += 2) {
+		const name = rawHeaders[i];
+		if (!name.startsWith(":")) headers.append(name, rawHeaders[i + 1]);
+	}
+	return headers;
+};
+var RequestHeaders = class {
+	#incoming;
+	#rawHeaders;
+	#headers;
+	#invalidValue;
+	constructor(incoming) {
+		this.#incoming = incoming;
+		if (incoming instanceof Http2ServerRequest) this.#rawHeaders = incoming.rawHeaders.slice();
+	}
+	get #lazyRawHeaders() {
+		return this.#rawHeaders ??= this.#incoming.rawHeaders.slice();
+	}
+	get #native() {
+		if (!this.#headers) {
+			this.#headers = materializeHeaders(this.#lazyRawHeaders);
+			this.#rawHeaders = void 0;
+		}
+		return this.#headers;
+	}
+	#normalizedName(name) {
+		if (typeof name !== "string") return;
+		if (!validHeaderName.test(name)) throw new TypeError(`Invalid header name: ${name}`);
+		return name.toLowerCase();
+	}
+	#lookupHttp1(lowerName) {
+		const headers = this.#incoming instanceof Http2ServerRequest ? void 0 : this.#incoming.headers;
+		if (!headers || nonJoinedHeaders.has(lowerName) || lowerName === "set-cookie" || lowerName === "__proto__") return;
+		if (!Object.hasOwn(headers, lowerName)) return null;
+		const rawValue = headers[lowerName];
+		if (typeof rawValue === "string") {
+			const value = normalizeHeaderValue(rawValue);
+			return forbiddenHeaderValue.test(value) ? void 0 : value;
+		}
+	}
+	#lookup(rawHeaders, lowerName) {
+		const separator = lowerName === "cookie" ? "; " : ", ";
+		let value = null;
+		for (let i = 0; i < rawHeaders.length; i += 2) {
+			const rawName = rawHeaders[i];
+			if (rawName.length === lowerName.length && rawName.toLowerCase() === lowerName) {
+				const rawValue = normalizeHeaderValue(rawHeaders[i + 1]);
+				if (forbiddenHeaderValue.test(rawValue)) {
+					this.#invalidValue = true;
+					return;
+				}
+				value = value === null ? rawValue : value + separator + rawValue;
+			}
+		}
+		return value;
+	}
+	append(name, value) {
+		this.#native.append(name, value);
+	}
+	delete(name) {
+		this.#native.delete(name);
+	}
+	get(name) {
+		const lowerName = this.#normalizedName(name);
+		if (lowerName && !this.#headers && !this.#invalidValue) {
+			const http1Value = this.#lookupHttp1(lowerName);
+			if (http1Value !== void 0) return http1Value;
+			const value = this.#lookup(this.#lazyRawHeaders, lowerName);
+			if (value !== void 0) return value;
+		}
+		return this.#native.get(name);
+	}
+	has(name) {
+		const lowerName = this.#normalizedName(name);
+		if (lowerName && !this.#headers && !this.#invalidValue) {
+			const http1Value = this.#lookupHttp1(lowerName);
+			if (http1Value !== void 0) return http1Value !== null;
+			const value = this.#lookup(this.#lazyRawHeaders, lowerName);
+			if (value !== void 0) return value !== null;
+		}
+		return this.#native.has(name);
+	}
+	set(name, value) {
+		this.#native.set(name, value);
+	}
+	getSetCookie() {
+		return this.#native.getSetCookie();
+	}
+	keys() {
+		return this.#native.keys();
+	}
+	values() {
+		return this.#native.values();
+	}
+	entries() {
+		return this.#native.entries();
+	}
+	forEach(callback, thisArg) {
+		this.#native.forEach((value, key) => {
+			callback.call(thisArg, value, key, this);
+		});
+	}
+	[Symbol.iterator]() {
+		return this.entries();
+	}
+};
+Object.defineProperty(RequestHeaders.prototype, Symbol.for("nodejs.util.inspect.custom"), { value: function(depth, options, inspectFn) {
+	return `Headers (lightweight) ${inspectFn(Object.fromEntries(this), {
+		...options,
+		depth: depth == null ? null : depth - 1
+	})}`;
+} });
+Object.setPrototypeOf(RequestHeaders.prototype, GlobalHeaders.prototype);
+const newHeadersFromIncoming = (incoming) => globalThis.Headers === GlobalHeaders ? new RequestHeaders(incoming) : materializeHeaders(incoming.rawHeaders, globalThis.Headers);
+
 //#endregion
 //#region src/url.ts
 const reValidRequestUrl = /^\/[!#$&-;=?-\[\]_a-z~]*$/;
@@ -49,15 +200,6 @@ var Request$1 = class extends GlobalRequest {
 		super(input, options);
 	}
 };
-const newHeadersFromIncoming = (incoming) => {
-	const headerRecord = [];
-	const rawHeaders = incoming.rawHeaders;
-	for (let i = 0, len = rawHeaders.length; i < len; i += 2) {
-		const key = rawHeaders[i];
-		if (key.charCodeAt(0) !== 58) headerRecord.push([key, rawHeaders[i + 1]]);
-	}
-	return new Headers(headerRecord);
-};
 const wrapBodyStream = Symbol("wrapBodyStream");
 const byteExactEncodings = new Set([
 	"latin1",

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts

@@ -35,9 +35,10 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts

@@ -9,9 +9,10 @@ export declare class FlattenedEncrypt {
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -8,9 +8,10 @@ export interface Recipient {
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -23,9 +23,10 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/types.d.ts

@@ -417,11 +417,13 @@ export interface JWEKeyManagementHeaderParameters {
    * used in ECDH's ConcatKDF.
    */
   apv?: Uint8Array
+
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
-   *   validation purposes.
+   * PBES2 "p2c" (PBES2 Count). This will be used as a JOSE Header Parameter and as the PBKDF2
+   * iteration count.
    */
   p2c?: number
+
   /**
    * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -5,7 +5,7 @@ import { generateCek } from '../../lib/content_encryption.js';
 import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
 import { validateCritDuplicates } from '../../lib/options.js';
-import { checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
 import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
 class IndividualRecipient {
@@ -158,8 +158,12 @@ export class GeneralEncrypt {
             const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (unprotectedHeader || parameters) {
+                const header = { ...unprotectedHeader, ...parameters };
+                if (parameters)
+                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+                target.header = header;
+            }
         }
         return jwe;
     }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.8';
+    const VERSION = 'v6.2.9';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -8,11 +8,14 @@ import { validateCrit, JWE_RECOGNIZED } from './options.js';
 import { prepareKey } from './key.js';
 import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { compress } from './deflate.js';
-export function checkEncryptHeaders(input) {
-    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+export function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
     if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
         throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
     }
+}
+export function checkEncryptHeaders(input) {
+    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
         ...protectedHeader,
         ...unprotectedHeader,
@@ -52,6 +55,7 @@ export async function encryptJWE(input, checked, key) {
         else {
             protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
         }
+        checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     }
     let protectedHeaderS;
     let protectedHeaderB;

package/node_modules/@modelcontextprotocol/client/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.8",
+  "version": "6.2.9",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts

@@ -35,9 +35,10 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts

@@ -9,9 +9,10 @@ export declare class FlattenedEncrypt {
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -8,9 +8,10 @@ export interface Recipient {
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -23,9 +23,10 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/types.d.ts

@@ -417,11 +417,13 @@ export interface JWEKeyManagementHeaderParameters {
    * used in ECDH's ConcatKDF.
    */
   apv?: Uint8Array
+
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
-   *   validation purposes.
+   * PBES2 "p2c" (PBES2 Count). This will be used as a JOSE Header Parameter and as the PBKDF2
+   * iteration count.
    */
   p2c?: number
+
   /**
    * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -5,7 +5,7 @@ import { generateCek } from '../../lib/content_encryption.js';
 import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
 import { validateCritDuplicates } from '../../lib/options.js';
-import { checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
 import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
 class IndividualRecipient {
@@ -158,8 +158,12 @@ export class GeneralEncrypt {
             const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (unprotectedHeader || parameters) {
+                const header = { ...unprotectedHeader, ...parameters };
+                if (parameters)
+                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+                target.header = header;
+            }
         }
         return jwe;
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.8';
+    const VERSION = 'v6.2.9';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -8,11 +8,14 @@ import { validateCrit, JWE_RECOGNIZED } from './options.js';
 import { prepareKey } from './key.js';
 import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { compress } from './deflate.js';
-export function checkEncryptHeaders(input) {
-    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+export function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
     if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
         throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
     }
+}
+export function checkEncryptHeaders(input) {
+    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
         ...protectedHeader,
         ...unprotectedHeader,
@@ -52,6 +55,7 @@ export async function encryptJWE(input, checked, key) {
         else {
             protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
         }
+        checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     }
     let protectedHeaderS;
     let protectedHeaderB;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.8",
+  "version": "6.2.9",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",