@zuplo/cli 7.6.9 → 7.6.10

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/base64url.d.ts

@@ -1,16 +1,16 @@
 /**
- * Decodes a base64url-encoded input.
+ * Decodes base64url text or its UTF-8 bytes.
  *
- * @param input Base64URL encoded input, as a string or its UTF-8 bytes.
+ * @param input Base64url-encoded string or its UTF-8 bytes.
  * @returns The decoded bytes.
- * @throws {!TypeError} When the input is not correctly Base64URL encoded. Standard Base64 input
- *   (i.e. containing `+` or `/`) is rejected.
+ * @throws {TypeError} If the input is not valid base64url. Standard Base64 `+` and `/` are
+ *   rejected.
  */
 export declare function decode(input: Uint8Array | string): Uint8Array;
 /**
- * Encodes input using unpadded base64url.
+ * Encodes unpadded base64url; strings are first encoded as UTF-8.
  *
- * @param input Input to encode, as a string or as bytes. Strings are encoded as UTF-8 first.
- * @returns The Base64URL encoded, unpadded, representation of the input.
+ * @param input Bytes or a string to encode. Strings are first encoded as UTF-8.
+ * @returns The unpadded base64url representation of the input.
  */
 export declare function encode(input: Uint8Array | string): string;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/decode_jwt.d.ts

@@ -1,3 +1,8 @@
 import type * as t from '../types.d.ts';
-/** Decodes the Claims Set of a JWS-formatted JSON Web Token without verifying the signature. */
+/**
+ * Decodes the Claims Set of a JWT in Compact JWS serialization without checking its signature or
+ * validating claim types and values.
+ *
+ * @returns The parsed JWT Claims Set.
+ */
 export declare function decodeJwt<PayloadType = t.JWTPayload>(jwt: string): PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/decode_protected_header.d.ts

@@ -1,9 +1,10 @@
 import type * as t from '../types.d.ts';
-/** JWE and JWS Header Parameters. */
+/** JWE and JWS Header Parameters returned by {@link decodeProtectedHeader}. */
 export type ProtectedHeaderParameters = t.JWSHeaderParameters & t.JWEHeaderParameters;
 /**
- * Decodes the Protected Header of a JWE, JWS, or JWT in any JOSE serialization.
+ * Decodes the Protected Header of a JWE, JWS, or JWT without authenticating the token.
  *
- * @param token JWE/JWS/JWT token in any JOSE serialization.
+ * @param token Compact token or JSON serialization object with a `protected` member.
+ * @returns The parsed Protected Header.
  */
 export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/errors.d.ts

@@ -1,70 +1,64 @@
 import type * as t from '../types.d.ts';
 /** Stable error codes used by this module. */
 export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
-/**
- * Shared properties of JWT Claims Set validation errors.
- *
- * > Note: {@link JWTExpired} does not extend {@link JWTClaimValidationFailed}, so `instanceof
- * > JWTClaimValidationFailed` is `false` for an expired JWT. Use {@link JWTClaimValidationError} or
- * > the {@link JOSEError.code code} discriminant to handle both.
- */
+/** Shared details of JWT claim or header validation failures. */
 export interface JWTClaimValidationFailure {
-    /** The Claim for which the validation failed. */
+    /** Claim or header that failed validation. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: JWTClaimValidationReason;
-    /** The parsed JWT Claims Set (aka payload). */
+    /** The parsed JWT Claims Set; validation of other claims may be incomplete. */
     payload: t.JWTPayload;
 }
 /** Reason codes produced by JWT Claims Set validation. */
 export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
 /** Base class for JOSE errors. */
 export declare class JOSEError extends Error {
-    /** A unique error code for the particular error subclass. */
+    /** Stable code identifying the error class. */
     static code: JOSEErrorCode | (string & {});
-    /**
-     * A unique error code for {@link JOSEError}. Each subclass sets its own; see {@link AnyJOSEError}
-     * to switch over them as a discriminated union.
-     */
+    /** Stable code identifying the error class. Use {@link AnyJOSEError} to narrow subclasses by code. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/** Thrown when JWT Claims Set validation fails. */
+/**
+ * Thrown when JWT claim or header validation fails. Expiration is reported separately as
+ * {@link JWTExpired}.
+ */
 export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
     static code: JOSEErrorCode | (string & {});
     code: JOSEErrorCode | (string & {});
-    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
     cause: JWTClaimValidationFailure;
-    /** The Claim for which the validation failed. */
+    /** Claim or header that failed validation. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: JWTClaimValidationReason;
     /**
-     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
-     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
-     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
-     * Decryption processes.
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
      */
     payload: t.JWTPayload;
     constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
 }
-/** Thrown when a JWT is expired. */
+/** Thrown when a JWT has expired or exceeds the configured maximum token age. */
 export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
     static code: JOSEErrorCode | (string & {});
     code: JOSEErrorCode | (string & {});
-    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
     cause: JWTClaimValidationFailure;
-    /** The Claim for which the validation failed. */
+    /** Claim or header that failed validation. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: JWTClaimValidationReason;
     /**
-     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
-     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
-     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
-     * Decryption processes.
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
      */
     payload: t.JWTPayload;
     constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
@@ -79,7 +73,7 @@ export declare class JOSENotSupported extends JOSEError {
     static code: JOSEErrorCode | (string & {});
     code: JOSEErrorCode | (string & {});
 }
-/** Thrown when JWE ciphertext decryption fails. */
+/** Thrown when JWE ciphertext decryption or authentication fails. */
 export declare class JWEDecryptionFailed extends JOSEError {
     static code: JOSEErrorCode | (string & {});
     code: JOSEErrorCode | (string & {});
@@ -123,11 +117,10 @@ export declare class JWKSNoMatchingKey extends JOSEError {
 /** Thrown when multiple keys match in a JWKS. */
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
     /**
-     * Iterates the public keys that matched the JWS JOSE Header, so that verification can be
-     * attempted with each in turn. See the {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet}
-     * and {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Instances thrown by this
-     * module always iterate the matched keys; an instance constructed by other code iterates
-     * nothing.
+     * Yields public keys matching the JWS Header so verification can be attempted with each. See the
+     * {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} and
+     * {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Empty on manually constructed
+     * errors.
      */
     [Symbol.asyncIterator]: () => AsyncIterableIterator<t.CryptoKey>;
     static code: JOSEErrorCode | (string & {});
@@ -155,12 +148,8 @@ export declare class JWSSignatureVerificationFailed extends JOSEError {
 /** Errors thrown during JWT Claims Set validation. */
 export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
 /**
- * Discriminated union of the specific {@link JOSEError} subclasses.
- *
- * > Note: The base {@link JOSEError} is deliberately not a member — its `code` spans every value, which
- * > would defeat the discriminant. A small number of JSON Web Key Set HTTP failures are thrown as the
- * > base class itself, so `instanceof JOSEError` remains the catch-all; this union is for handling a
- * > value already known to be one of the specific errors.
+ * Discriminated union of specific {@link JOSEError} subclasses, narrowed by `code`. Excludes base
+ * {@link JOSEError} instances; use `instanceof JOSEError` to catch all module errors.
  */
 export type AnyJOSEError = (JOSEAlgNotAllowed & {
     code: 'ERR_JOSE_ALG_NOT_ALLOWED';

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/compact/decrypt.js

@@ -1,7 +1,6 @@
 import { prepareDecrypt, decryptCompact } from "../../lib/jwe_decrypt.js";
 async function compactDecrypt(jwe, key, options) {
-  const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key), result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
-  return typeof key == "function" ? { ...result, key: decrypted[2] } : result;
+  return decryptCompact(jwe, prepareDecrypt(options), key);
 }
 export {
   compactDecrypt

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/compact/encrypt.js

@@ -1,41 +1,24 @@
-import { assertNotSet } from "../../lib/helpers.js";
-import { assertUint8Array } from "../../lib/type_checks.js";
-import { createJWE } from "../../lib/jwe_encrypt.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { compactJWE, createJWE } from "../../lib/jwe_encrypt.js";
 class CompactEncrypt {
-  #plaintext;
-  #protectedHeader;
-  #cek;
-  #iv;
-  #keyManagementParameters;
+  #input;
   constructor(plaintext) {
-    assertUint8Array(plaintext, "plaintext"), this.#plaintext = plaintext;
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
   }
   setContentEncryptionKey(cek) {
-    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
   }
   setInitializationVector(iv) {
-    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
   }
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setKeyManagementParameters(parameters) {
-    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
   }
   async encrypt(key, options) {
-    const jwe = await createJWE([
-      this.#plaintext,
-      this.#protectedHeader,
-      void 0,
-      void 0,
-      void 0,
-      this.#cek,
-      this.#iv,
-      this.#keyManagementParameters,
-      void 0,
-      !1
-    ], key, options);
-    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+    return compactJWE(await createJWE([...this.#input], key, options));
   }
 }
 export {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -1,6 +1,6 @@
 import { JWEInvalid } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
-import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { isObject } from "../../lib/validate.js";
+import { prepareDecrypt, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
 async function flattenedDecrypt(jwe, key, options) {
   if (!isObject(jwe))
     throw new JWEInvalid("Flattened JWE must be an object");
@@ -8,7 +8,7 @@ async function flattenedDecrypt(jwe, key, options) {
   if (!recipient)
     throw error;
   const snapshot = { ...shared, ...recipient };
-  return checkRecipient(snapshot), decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
+  return checkRecipient(snapshot), decryptJWE(snapshot, prepareDecrypt(options), key);
 }
 export {
   flattenedDecrypt

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js

@@ -1,52 +1,33 @@
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 import { createJWE } from "../../lib/jwe_encrypt.js";
-import { assertUint8Array } from "../../lib/type_checks.js";
 class FlattenedEncrypt {
-  #plaintext;
-  #protectedHeader;
-  #sharedUnprotectedHeader;
-  #unprotectedHeader;
-  #aad;
-  #cek;
-  #iv;
-  #keyManagementParameters;
+  #input;
   constructor(plaintext) {
-    assertUint8Array(plaintext, "plaintext"), this.#plaintext = plaintext;
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
   }
   setKeyManagementParameters(parameters) {
-    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
   }
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-    return assertNotSet(this.#sharedUnprotectedHeader, "setSharedUnprotectedHeader"), this.#sharedUnprotectedHeader = sharedUnprotectedHeader, this;
+    return assertNotSet(this.#input[3], "setSharedUnprotectedHeader"), this.#input[3] = sharedUnprotectedHeader, this;
   }
   setUnprotectedHeader(unprotectedHeader) {
-    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
   }
   setAdditionalAuthenticatedData(aad) {
-    return this.#aad = aad, this;
+    return this.#input[4] = aad, this;
   }
   setContentEncryptionKey(cek) {
-    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
   }
   setInitializationVector(iv) {
-    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
   }
   async encrypt(key, options) {
-    return createJWE([
-      this.#plaintext,
-      this.#protectedHeader,
-      this.#unprotectedHeader,
-      this.#sharedUnprotectedHeader,
-      this.#aad,
-      this.#cek,
-      this.#iv,
-      this.#keyManagementParameters,
-      void 0,
-      !1
-    ], key, options);
+    return createJWE([...this.#input], key, options);
   }
 }
 export {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -1,6 +1,6 @@
-import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { prepareDecrypt, shareJWE, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
 import { JWEDecryptionFailed, JWEInvalid } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
+import { isObject } from "../../lib/validate.js";
 import { JWE, isJWECEKTransport } from "../../lib/jwe_algorithms.js";
 async function generalDecrypt(jwe, key, options) {
   if (!isObject(jwe))
@@ -19,10 +19,10 @@ async function generalDecrypt(jwe, key, options) {
   } catch {
     throw new JWEDecryptionFailed();
   }
-  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient)), recipientAlgorithms = recipientSnapshots.map(([, headerAlg]) => token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg);
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
   if (recipients.length > 1)
-    for (const alg of recipientAlgorithms) {
-      const algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+    for (const [, headerAlg] of recipientSnapshots) {
+      const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg, algEntry = typeof alg == "string" ? JWE[alg] : void 0;
       if (algEntry && !isJWECEKTransport(algEntry))
         throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
     }
@@ -30,7 +30,7 @@ async function generalDecrypt(jwe, key, options) {
     if (recipient)
       try {
         const flattened = { ...sharedJwe, ...recipient };
-        return checkRecipient(flattened), decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
+        return checkRecipient(flattened), await decryptJWE(flattened, shared, key, token);
       } catch {
       }
   throw new JWEDecryptionFailed();

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -1,10 +1,10 @@
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 import { JWEInvalid } from "../../util/errors.js";
 import { generateCek } from "../../lib/content_encryption.js";
 import { encode as b64u } from "../../util/base64url.js";
-import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE, transportCek } from "../../lib/jwe_encrypt.js";
-import { JWE, isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
-import { assertUint8Array } from "../../lib/type_checks.js";
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from "../../lib/jwe_encrypt.js";
+import { encryptKeyManagement } from "../../lib/key_management.js";
+import { isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
 class IndividualRecipient {
   #parent;
   state;
@@ -27,10 +27,6 @@ class IndividualRecipient {
     return this.#parent;
   }
 }
-function copyOptionalMembers(flattened, jwe, recipient) {
-  const { aad, protected: protectedHeader, unprotected, header } = flattened;
-  aad && (jwe.aad = aad), protectedHeader && (jwe.protected = protectedHeader), unprotected && (jwe.unprotected = unprotected), header && (recipient.header = header);
-}
 class GeneralEncrypt {
   #plaintext;
   #recipients = [];
@@ -56,28 +52,12 @@ class GeneralEncrypt {
   async encrypt() {
     if (!this.#recipients.length)
       throw new JWEInvalid("at least one recipient must be added");
-    if (assertUint8Array(this.#plaintext, "plaintext"), this.#recipients.length === 1) {
-      const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state, flattened = await createJWE([
-        this.#plaintext,
-        this.#protectedHeader,
-        unprotectedHeader,
-        this.#unprotectedHeader,
-        this.#aad,
-        void 0,
-        void 0,
-        keyManagementParameters,
-        crit,
-        !1
-      ], key), jwe2 = {
-        ciphertext: flattened.ciphertext,
-        recipients: [{}]
-      };
-      return flattened.iv && (jwe2.iv = flattened.iv), flattened.tag && (jwe2.tag = flattened.tag), flattened.encrypted_key && (jwe2.recipients[0].encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]), jwe2;
-    }
+    assertUint8Array(this.#plaintext, "plaintext");
+    const multiple = this.#recipients.length > 1;
     let enc, protectedHeader = this.#protectedHeader, sharedUnprotectedHeader = this.#unprotectedHeader;
-    const inputs = [], checked = [];
-    for (let i = 0; i < this.#recipients.length; i++) {
-      const recipient = this.#recipients[i], [unprotectedHeader, keyManagementParameters, , crit] = recipient.state, input = [
+    const recipients = [];
+    for (const recipient of this.#recipients) {
+      const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state, input = [
         this.#plaintext,
         protectedHeader,
         unprotectedHeader,
@@ -87,39 +67,35 @@ class GeneralEncrypt {
         void 0,
         keyManagementParameters,
         crit,
-        !0
-      ], headers = checkEncryptHeaders(input);
-      inputs.push(input), checked.push(headers), i === 0 && (protectedHeader = input[1], sharedUnprotectedHeader = input[3]);
-      const algEntry = JWE[headers[1]];
-      if (algEntry && !isJWECEKTransport(algEntry))
-        throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+        multiple
+      ], headers = checkEncryptHeaders(input, void 0, recipients.length > 0);
+      recipients.length || (protectedHeader = input[1], sharedUnprotectedHeader = input[3]), recipients.push([input, headers, key]);
+      const [{ alg, enc: recipientEnc }, , algEntry] = headers;
+      if (multiple && algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
       if (!enc)
-        enc = headers[2];
-      else if (enc !== headers[2])
+        enc = recipientEnc;
+      else if (enc !== recipientEnc)
         throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
     }
-    const algEntries = checked.map(([, alg]) => {
-      const algEntry = jweAlgorithm(alg);
-      if (!isJWECEKTransport(algEntry))
-        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
-      return algEntry;
-    }), cek = generateCek(checked[0][3]), jwe = {
-      ciphertext: "",
-      recipients: []
+    for (const [, headers] of recipients)
+      headers[2] ??= jweAlgorithm(headers[0].alg);
+    const [firstInput, firstHeaders, firstKey] = recipients[0], cek = multiple ? generateCek(firstHeaders[1]) : void 0;
+    firstInput[5] = cek;
+    const { encrypted_key, header, ...shared } = await encryptJWE(firstInput, firstHeaders, firstKey), jwe = {
+      ...shared,
+      recipients: [{}]
     };
-    for (let i = 0; i < this.#recipients.length; i++) {
-      const recipient = this.#recipients[i], [, keyManagementParameters, key] = recipient.state, target = {};
-      if (jwe.recipients.push(target), i === 0) {
-        inputs[0][5] = cek;
-        const flattened = await encryptJWE(inputs[0], checked[0], key, algEntries[0]);
-        jwe.ciphertext = flattened.ciphertext, flattened.iv && (jwe.iv = flattened.iv), flattened.tag && (jwe.tag = flattened.tag), flattened.encrypted_key && (target.encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe, target);
-        continue;
-      }
-      const [joseHeader, , , encEntry] = checked[i], unprotectedHeader = inputs[i][2], [, encryptedKey, parameters] = await transportCek(algEntries[i], encEntry, key, cek, joseHeader, keyManagementParameters);
-      if (target.encrypted_key = b64u(encryptedKey), unprotectedHeader || parameters) {
-        const header = { ...unprotectedHeader, ...parameters };
-        parameters && checkDisjoint(inputs[i][1], header, inputs[i][3]), target.header = header;
+    encrypted_key && (jwe.recipients[0].encrypted_key = encrypted_key), header && (jwe.recipients[0].header = header);
+    for (let i = 1; i < recipients.length; i++) {
+      const [input, [joseHeader, encEntry, algEntry], key] = recipients[i], unprotectedHeader = input[2], [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, cek, input[7]), target = {
+        encrypted_key: b64u(encryptedKey)
+      };
+      if (unprotectedHeader || parameters) {
+        const header2 = { ...unprotectedHeader, ...parameters };
+        parameters && checkDisjoint(input[1], header2, input[3]), target.header = header2;
       }
+      jwe.recipients.push(target);
     }
     return jwe;
   }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -1,8 +1,7 @@
-import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwkToKey, normalizeJwk } from "../lib/key.js";
 import { jwsAlgorithm } from "../lib/jws_algorithms.js";
-import { isObject } from "../lib/type_checks.js";
+import { isObject } from "../lib/validate.js";
 import { JWSInvalid } from "../util/errors.js";
-import { normalizeJwk } from "../lib/jwk_metadata.js";
 async function EmbeddedJWK(protectedHeader, token) {
   const joseHeader = {
     ...protectedHeader,
@@ -21,7 +20,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
   if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
     throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
-  const key = await jwkToKey(entry, { ...jwk, ext: !0 });
+  const key = await jwkToKey(entry, jwk, !0);
   if (key.type !== "public")
     throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
   return key;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -1,12 +1,9 @@
-import { digest } from "../lib/helpers.js";
+import { digest, encode } from "../lib/buffer_utils.js";
 import { encode as b64u } from "../util/base64url.js";
 import { JOSENotSupported, JWKInvalid } from "../util/errors.js";
-import { encode } from "../lib/buffer_utils.js";
-import { isKeyLike } from "../lib/is_key_like.js";
-import { isObject } from "../lib/type_checks.js";
+import { isKeyLike, invalidKeyInput, snapshotJwk } from "../lib/key.js";
+import { isObject } from "../lib/validate.js";
 import { exportJWK } from "../key/export.js";
-import { invalidKeyInput } from "../lib/invalid_key_input.js";
-import { snapshotJwk } from "../lib/jwk_metadata.js";
 const check = (value, description) => {
   if (typeof value != "string" || !value)
     throw new JWKInvalid(`${description} missing or invalid`);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/local.js

@@ -1,19 +1,22 @@
-import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwkToKey, snapshotJwk } from "../lib/key.js";
 import { JWS } from "../lib/jws_algorithms.js";
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
-import { isJwkSet } from "../lib/type_checks.js";
-import { snapshotJwk } from "../lib/jwk_metadata.js";
+import { isJwkSet } from "../lib/validate.js";
 function isUsableJWK(jwk, entry, alg, kid) {
-  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk), keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
   return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache, jwk, entry) {
   const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
   if (cached[alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg, ext: !0 });
-    if (key.type !== "public")
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    cached[alg] = key;
+    const pending = jwkToKey(entry, jwk, !0).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
   }
   return cached[alg];
 }
@@ -25,12 +28,15 @@ function createLocalJWKSet(jwks) {
   }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
-  const cached = /* @__PURE__ */ new WeakMap();
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap();
   return Object.defineProperty(async (protectedHeader, token) => {
     const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
     if (!entry || entry.secret)
       throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid)), { 0: jwk, length } = candidates;
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
     if (!length)
       throw new JWKSNoMatchingKey();
     if (length !== 1) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -1,11 +1,11 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
 import { createLocalJWKSet } from "./local.js";
-import { isJwkSet } from "../lib/type_checks.js";
+import { isJwkSet } from "../lib/validate.js";
 function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.11");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -1,12 +1,10 @@
 import { createCompactSignature } from "../../lib/jws_sign.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class CompactSign {
   #payload;
   #protectedHeader;
   constructor(payload) {
-    if (!(payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
-    this.#payload = payload;
+    assertUint8Array(payload, "payload"), this.#payload = payload;
   }
   setProtectedHeader(protectedHeader) {
     return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -1,7 +1,7 @@
 import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
 async function compactVerify(jws, key, options) {
-  const verified = await verifyCompact(jws, prepareVerify(options), key), result = { payload: verified[0], protectedHeader: verified[1] };
-  return typeof key == "function" ? { ...result, key: verified[3] } : result;
+  const [result] = await verifyCompact(jws, prepareVerify(options), key);
+  return result;
 }
 export {
   compactVerify