@zuplo/cli 7.4.4 → 7.4.6

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -12,13 +12,22 @@ const multipliers = {
 };
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 const checkFailed = 'check_failed';
+function invalidDuration() {
+    throw new TypeError('Invalid time period format');
+}
 export function secs(str) {
+    if (typeof str !== 'string') {
+        invalidDuration();
+    }
     const matched = REGEX.exec(str);
     if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
+        invalidDuration();
     }
     const value = parseFloat(matched[2]);
     const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate)) {
+        invalidDuration();
+    }
     if (matched[1] === '-' || matched[4] === 'ago') {
         return -numericDate;
     }
@@ -30,6 +39,17 @@ function validateInput(label, input) {
     }
     return input;
 }
+function validateStringClaim(claim, value) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`"${claim}" claim must be a string`);
+    }
+}
+function validateAudienceClaim(value) {
+    if (typeof value !== 'string' &&
+        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
+        throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+}
 function numericDate(value, label) {
     if (typeof value === 'number')
         return validateInput(label, value);
@@ -38,10 +58,8 @@ function numericDate(value, label) {
     return epoch(new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    if (value.includes('/')) {
-        return value.toLowerCase();
-    }
-    return `application/${value.toLowerCase()}`;
+    const normalized = value.toLowerCase();
+    return value.includes('/') ? normalized : `application/${normalized}`;
 };
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
@@ -75,7 +93,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
     const { typ } = options;
-    if (typ &&
+    if (typ !== undefined &&
         (typeof protectedHeader.typ !== 'string' ||
             normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
         throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
@@ -119,7 +137,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
+    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
     const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
     const nbf = validateNumericDate(payload, 'nbf');
     if (nbf !== undefined) {
@@ -135,63 +153,80 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     if (maxTokenAge !== undefined) {
         const age = now - iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
         }
-        if (age < 0 - tolerance) {
+        if (age < -tolerance) {
             throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
         }
     }
     return payload;
 }
+let producerPayloads;
+function producerPayload(producer) {
+    return producerPayloads.get(producer);
+}
+export function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ['iat', 'nbf', 'exp']) {
+        const value = payload[claim];
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new TypeError(`"${claim}" claim must be a finite number`);
+        }
+    }
+    return encoder.encode(JSON.stringify(payload));
+}
+export function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+}
 export class JWTClaimsBuilder {
-    #payload;
-    constructor(payload) {
+    constructor(payload = {}) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    set nbf(value) {
-        this.#payload.nbf = numericDate(value, 'setNotBefore');
-    }
-    set exp(value) {
-        this.#payload.exp = numericDate(value, 'setExpirationTime');
-    }
-    set iat(value) {
+        ;
+        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
+    }
+    setIssuer(value) {
+        validateStringClaim('iss', value);
+        producerPayload(this).iss = value;
+        return this;
+    }
+    setSubject(value) {
+        validateStringClaim('sub', value);
+        producerPayload(this).sub = value;
+        return this;
+    }
+    setAudience(value) {
+        validateAudienceClaim(value);
+        producerPayload(this).aud = value;
+        return this;
+    }
+    setJti(value) {
+        validateStringClaim('jti', value);
+        producerPayload(this).jti = value;
+        return this;
+    }
+    setNotBefore(value) {
+        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
+        return this;
+    }
+    setExpirationTime(value) {
+        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
+        return this;
+    }
+    setIssuedAt(value) {
+        const payload = producerPayload(this);
         if (value === undefined) {
-            this.#payload.iat = epoch(new Date());
+            payload.iat = epoch(new Date());
         }
         else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this.#payload.iat = numericDate(value, 'setIssuedAt');
+            payload.iat = numericDate(value, 'setIssuedAt');
         }
+        return this;
     }
 }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/key.js

@@ -1,8 +1,9 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike, isCryptoKey } from './is_key_like.js';
-import * as jwk from './type_checks.js';
+import { isObject } from './type_checks.js';
 import { decode } from '../util/base64url.js';
 import { jwkToKey } from './jwk_to_key.js';
+import { normalizeJwk } from './jwk_metadata.js';
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
     const { alg } = entry;
@@ -27,14 +28,27 @@ export function checkKeyType(entry, key, usage) {
     const privateKey = usage === 'decrypt' || usage === 'sign';
     if (secret && key instanceof Uint8Array)
         return [BYTES, key];
-    if (jwk.isJWK(key)) {
-        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+    if (isObject(key)) {
+        const normalized = normalizeJwk(key);
+        if (typeof normalized.kty !== 'string') {
+            throw new TypeError(secret
+                ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+                : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
+        const valid = secret
+            ? normalized.kty === 'oct' && typeof normalized.k === 'string'
+            : normalized.kty !== 'oct' &&
+                (privateKey
+                    ? (normalized.kty === 'AKP' && typeof normalized.priv === 'string') ||
+                        typeof normalized.d === 'string'
+                    : normalized.d === undefined && normalized.priv === undefined);
+        if (!valid) {
             throw new TypeError(secret
                 ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
                 : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
         }
-        jwkMatchesOp(entry, key, usage);
-        return [JWK, key];
+        jwkMatchesOp(entry, normalized, usage);
+        return [JWK, key, normalized];
     }
     if (!isKeyLike(key)) {
         throw new TypeError(secret
@@ -81,7 +95,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { __proto__: null, [alg]: value });
+            cache.set(key, { [alg]: value });
         }
     }
     return value ?? entry?.[alg];
@@ -107,8 +121,9 @@ export async function prepareKey(entry, key, usage) {
             return tagged[1];
         case JWK: {
             const key = tagged[1];
-            if (key.k) {
-                return decode(key.k);
+            const normalized = tagged[2];
+            if (normalized.kty === 'oct') {
+                return decode(normalized.k);
             }
             if (!Object.isFrozen(key)) {
                 const { key_ops } = key;
@@ -116,7 +131,7 @@ export async function prepareKey(entry, key, usage) {
                     Object.freeze(key_ops);
                 Object.freeze(key);
             }
-            return handleJWK(key, key, entry);
+            return handleJWK(key, normalized, entry);
         }
         case KEYOBJECT: {
             const keyObject = tagged[1];

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/key_management.js

@@ -5,7 +5,7 @@ import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { decodeBase64url, digest } from './helpers.js';
 import { generateCek, encrypt, decrypt } from './content_encryption.js';
-import { isObject } from './type_checks.js';
+import { assertUint8Array, isObject } from './type_checks.js';
 import { checkCryptoKey, checkModulusLength, checkUsage } from './crypto_key.js';
 import { concat, encode, uint32be } from './buffer_utils.js';
 import { assertCryptoKey } from './is_key_like.js';
@@ -110,7 +110,7 @@ function assertNoEncryptedKey(encryptedKey) {
     if (encryptedKey !== undefined)
         throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
 }
-export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
     const entry = jweAlgorithm(alg);
     if (alg === 'dir') {
         assertNoEncryptedKey(encryptedKey);
@@ -152,7 +152,7 @@ export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHead
             assertEncryptedKey(encryptedKey);
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = options?.maxPBES2Count || 10_000;
+            const p2cLimit = maxPBES2Count || 10_000;
             if (joseHeader.p2c > p2cLimit)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -190,8 +190,14 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'ECDH': {
             assertEcdhKey(key);
             const { apu, apv } = providedParameters;
+            if (apu !== undefined) {
+                assertUint8Array(apu, '"apu"');
+            }
+            if (apv !== undefined) {
+                assertUint8Array(apv, '"apv"');
+            }
             let ephemeralKey;
-            if (providedParameters.epk) {
+            if (providedParameters.epk !== undefined) {
                 ephemeralKey = (await prepareKey(entry, providedParameters.epk, 'decrypt'));
             }
             else {

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/key_options.js

@@ -0,0 +1,6 @@
+export function validateExtractableOption(extractable) {
+    if (extractable !== undefined && typeof extractable !== 'boolean') {
+        throw new TypeError('"extractable" option must be a boolean');
+    }
+    return extractable;
+}

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/options.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+import { isObject } from './type_checks.js';
 export const JWS_RECOGNIZED = { __proto__: null, b64: true };
 export const JWE_RECOGNIZED = { __proto__: null };
 export function validateAlgorithms(option, algorithms) {
@@ -46,3 +47,28 @@ export function validateCrit(Err, recognizedDefault, recognizedOption, protected
     }
     return protectedHeader.crit;
 }
+export function validateB64(protectedHeader, extensions) {
+    if (extensions.includes('b64')) {
+        const b64 = protectedHeader.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+        return b64;
+    }
+    return true;
+}
+export function serializeJoseHeader(Err, header) {
+    let serialized;
+    let parsed;
+    try {
+        serialized = JSON.stringify(header);
+        parsed = JSON.parse(serialized);
+    }
+    catch (cause) {
+        throw new Err('JOSE Header is not valid JSON', { cause });
+    }
+    if (!isObject(parsed)) {
+        throw new Err('JOSE Header is not a JSON object');
+    }
+    return [parsed, serialized];
+}

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/lib/type_checks.js

@@ -1,3 +1,8 @@
+export function assertUint8Array(input, label) {
+    if (!(input instanceof Uint8Array)) {
+        throw new TypeError(`${label} must be an instance of Uint8Array`);
+    }
+}
 export function isObject(input) {
     if (typeof input !== 'object' ||
         input === null ||
@@ -5,14 +10,12 @@ export function isObject(input) {
         return false;
     }
     const prototype = Object.getPrototypeOf(input);
-    if (prototype === null) {
-        return true;
-    }
-    let proto = prototype;
-    while (Object.getPrototypeOf(proto) !== null) {
-        proto = Object.getPrototypeOf(proto);
-    }
-    return prototype === proto;
+    return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+export function isJwkSet(input) {
+    return (isObject(input) &&
+        Array.isArray(input.keys) &&
+        Array.from(input.keys).every(isObject));
 }
 export function isDisjoint(...headers) {
     const parameters = new Set();
@@ -28,8 +31,3 @@ export function isDisjoint(...headers) {
     }
     return true;
 }
-export const isJWK = (key) => isObject(key) && typeof key.kty === 'string';
-export const isPrivateJWK = (key) => key.kty !== 'oct' &&
-    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');
-export const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;
-export const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';

package/node_modules/@modelcontextprotocol/client/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.9",
+  "version": "6.2.10",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwks/remote.d.ts

@@ -36,17 +36,17 @@ export declare const jwksCache: unique symbol;
 export interface RemoteJWKSetOptions {
     /**
      * Timeout (in milliseconds) for the HTTP request. When reached the request will be aborted and
-     * the verification will fail. Default is 5000 (5 seconds).
+     * the verification will fail. Must be a non-negative integer. Default is 5000 (5 seconds).
      */
     timeoutDuration?: number;
     /**
      * Duration (in milliseconds) for which no more HTTP requests will be triggered after a previous
-     * successful fetch. Default is 30000 (30 seconds).
+     * successful fetch. Must not be `NaN`. Default is 30000 (30 seconds).
      */
     cooldownDuration?: number;
     /**
      * Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10
-     * minutes).
+     * minutes). Must not be `NaN`.
      */
     cacheMaxAge?: number | typeof Infinity;
     /** Headers to be sent with the HTTP request. */
@@ -60,7 +60,7 @@ export interface RemoteJWKSetOptions {
 export interface ExportedJWKSCache {
     /** Current cached JSON Web Key Set */
     jwks: types.JSONWebKeySet;
-    /** Last updated at timestamp (seconds since epoch) */
+    /** Last updated at timestamp (milliseconds since epoch) */
     uat: number;
 }
 /** See {@link jwksCache}. */

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jws/general/verify.d.ts

@@ -11,9 +11,9 @@ export interface GeneralVerifyGetKey<KeyType extends types.CryptoKey | Uint8Arra
  * > Note: The function iterates over the `signatures` array in the General JWS and returns the verification
  * > result of the first signature entry that can be successfully verified. The result only contains
  * > the payload, protected header, and unprotected header of that successfully verified signature
- * > entry. Other signature entries in the General JWS are not validated, and their headers are not
- * > included in the returned result. Recipients of a General JWS should only rely on the returned
- * > (verified) data.
+ * > entry. Other signature entries' headers may be inspected solely to reject inconsistent use of the
+ * > JWS Unencoded Payload Option, and their headers are not included in the returned result.
+ * > Recipients of a General JWS should only rely on the returned (verified) data.
  *
  * @param jws General JWS.
  * @param key Key to verify the JWS with. See

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -1,20 +1,13 @@
 import type * as types from '../types.d.ts';
+/**
+ * EncryptJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const EncryptJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens. */
-export declare class EncryptJWT implements types.ProduceJWT {
+export declare class EncryptJWT extends EncryptJWT_base {
     #private;
-    /**
-     * {@link EncryptJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWE Protected Header on the EncryptJWT object.
      *
@@ -66,3 +59,4 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<string>;
 }
+export {};

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwt/sign.d.ts

@@ -1,20 +1,13 @@
 import type * as types from '../types.d.ts';
+/**
+ * SignJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const SignJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens. */
-export declare class SignJWT implements types.ProduceJWT {
+export declare class SignJWT extends SignJWT_base {
     #private;
-    /**
-     * {@link SignJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWS Protected Header on the SignJWT object.
      *
@@ -30,3 +23,4 @@ export declare class SignJWT implements types.ProduceJWT {
      */
     sign(key: types.KeyInput, options?: types.SignOptions): Promise<string>;
 }
+export {};

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/jwt/unsecured.d.ts

@@ -6,24 +6,17 @@ export interface UnsecuredResult<PayloadType = types.JWTPayload> {
     /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
     header: types.JWSHeaderParameters;
 }
+/**
+ * UnsecuredJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const UnsecuredJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs. */
-export declare class UnsecuredJWT implements types.ProduceJWT {
-    #private;
-    /**
-     * {@link UnsecuredJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
+export declare class UnsecuredJWT extends UnsecuredJWT_base {
+    private jwt;
     /** Encodes the Unsecured JWT. */
     encode(): string;
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Decodes an unsecured JWT.
      *
@@ -32,3 +25,4 @@ export declare class UnsecuredJWT implements types.ProduceJWT {
      */
     static decode<PayloadType = types.JWTPayload>(jwt: string, options?: types.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
 }
+export {};

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/compact/encrypt.js

@@ -1,27 +1,49 @@
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { assertNotSet } from '../../lib/helpers.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
+import { createJWE } from '../../lib/jwe_encrypt.js';
 export class CompactEncrypt {
-    #flattened;
+    #plaintext;
+    #protectedHeader;
+    #cek;
+    #iv;
+    #keyManagementParameters;
     constructor(plaintext) {
-        this.#flattened = new FlattenedEncrypt(plaintext);
+        assertUint8Array(plaintext, 'plaintext');
+        this.#plaintext = plaintext;
     }
     setContentEncryptionKey(cek) {
-        this.#flattened.setContentEncryptionKey(cek);
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
+        this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        this.#flattened.setInitializationVector(iv);
+        assertNotSet(this.#iv, 'setInitializationVector');
+        this.#iv = iv;
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        this.#flattened.setProtectedHeader(protectedHeader);
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        this.#flattened.setKeyManagementParameters(parameters);
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
+        this.#keyManagementParameters = parameters;
         return this;
     }
     async encrypt(key, options) {
-        const jwe = await this.#flattened.encrypt(key, options);
+        const jwe = await createJWE([
+            this.#plaintext,
+            this.#protectedHeader,
+            undefined,
+            undefined,
+            undefined,
+            this.#cek,
+            this.#iv,
+            this.#keyManagementParameters,
+            undefined,
+            false,
+        ], key, options);
         return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
     }
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -1,11 +1,15 @@
 import { JWEInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { prepareDecrypt, decryptJWE, decryptResult, checkShared, checkRecipient, } from '../../lib/jwe_decrypt.js';
+import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
     }
-    checkShared(jwe);
-    checkRecipient(jwe);
-    return decryptResult(jwe, await decryptJWE(jwe, prepareDecrypt(options), key));
+    const shared = snapshotSharedJWE(jwe);
+    const [recipient, , error] = snapshotRecipientJWE(jwe);
+    if (!recipient)
+        throw error;
+    const snapshot = { ...shared, ...recipient };
+    checkRecipient(snapshot);
+    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
 }