@zuplo/cli 7.6.9 → 7.7.0

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -1,53 +1,55 @@
 import type * as t from '../types.d.ts';
-/**
- * EncryptJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const EncryptJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Builds and encrypts Compact JWE-formatted JSON Web Tokens. */
 export declare class EncryptJWT extends EncryptJWT_base {
     #private;
     /**
-     * Sets the JWE Protected Header on the EncryptJWT object.
+     * Sets the JWE Protected Header. May only be called once.
      *
      * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
      *   (JWE Encryption Algorithm) properties.
      */
     setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
-     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
-     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
-     * appropriate JOSE Header.
+     * Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds
+     * them to the appropriate JOSE Header. Use this instead of the header setters for algorithm
+     * inputs. May only be called once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption key. By default, a suitable random key is generated for the JWE
+     * "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the Initialization Vector for content encryption. By default, a suitable random IV is
+     * generated for the JWE "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      */
     setInitializationVector(iv: Uint8Array): this;
-    /** Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateIssuerAsHeader(): this;
-    /** Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateSubjectAsHeader(): this;
-    /** Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateAudienceAsHeader(): this;
     /**
      * Encrypts and returns the JWT.
      *
-     * @param key Public Key or Secret to encrypt the JWT with. See
+     * @param key Public key or shared secret to encrypt the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/sign.d.ts

@@ -1,15 +1,11 @@
 import type * as t from '../types.d.ts';
-/**
- * SignJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const SignJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Builds and signs Compact JWS-formatted JSON Web Tokens. */
 export declare class SignJWT extends SignJWT_base {
     #private;
     /**
-     * Sets the JWS Protected Header on the SignJWT object.
+     * Sets the JWS Protected Header. May only be called once.
      *
      * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
      */
@@ -17,7 +13,7 @@ export declare class SignJWT extends SignJWT_base {
     /**
      * Signs and returns the JWT.
      *
-     * @param key Private Key or Secret to sign the JWT with. See
+     * @param key Private key or shared secret to sign the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/unsecured.d.ts

@@ -6,18 +6,14 @@ export interface UnsecuredResult<PayloadType = t.JWTPayload> {
     /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
     header: t.JWSHeaderParameters;
 }
-/**
- * UnsecuredJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const UnsecuredJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Encodes and decodes `{ "alg": "none" }` Unsecured JWTs. */
 export declare class UnsecuredJWT extends UnsecuredJWT_base {
     private jwt;
     /** Encodes the Unsecured JWT. */
     encode(): string;
-    /** Decodes an unsecured JWT. */
+    /** Decodes an unsecured JWT and validates its claims without authenticating the token. */
     static decode<PayloadType = t.JWTPayload>(jwt: string, options?: t.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
 }
 export {};

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/verify.d.ts

@@ -2,27 +2,34 @@ import type * as t from '../types.d.ts';
 /** JWS verification and JWT Claims Set validation options. */
 export interface JWTVerifyOptions extends t.VerifyOptions, t.JWTClaimVerificationOptions {
 }
-/** Dynamic key resolver for JWT verification. */
+/**
+ * Resolves a JWT verification key. No token components have been authenticated when this function
+ * is called.
+ */
 export interface JWTVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Verifies a Compact JWS-formatted JWT and validates its Claims Set.
  *
- * @param key Key to verify the JWT with. See
+ * @param key Public key or shared secret to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType>>;
 /**
- * @param getKey Function resolving a key to verify the JWT with. See
+ * Verifies the JWT signature and claims, returning the resolved key.
+ *
+ * @param getKey Function resolving a public key or shared secret to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey<KeyType>, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
  *
  * @param key Key, or function resolving a key, to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & Partial<t.ResolvedKey>>;

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/key/export.d.ts

@@ -1,19 +1,19 @@
 import type * as t from '../types.d.ts';
 /**
- * Exports a public {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded SPKI string format.
+ * Exports a public key to PEM-encoded SPKI. CryptoKey inputs must be extractable.
  *
- * @param key Key to export to a PEM-encoded SPKI string format.
+ * @param key Key to export.
  */
 export declare function exportSPKI(key: t.CryptoKey | t.KeyObject): Promise<string>;
 /**
- * Exports a private {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded PKCS8 string format.
+ * Exports a private key to PEM-encoded PKCS#8. CryptoKey inputs must be extractable.
  *
- * @param key Key to export to a PEM-encoded PKCS8 string format.
+ * @param key Key to export.
  */
 export declare function exportPKCS8(key: t.CryptoKey | t.KeyObject): Promise<string>;
 /**
- * Exports a {@link !CryptoKey}, {@link !KeyObject}, or {@link !Uint8Array} to a JWK.
+ * Exports a key to JWK. CryptoKey inputs must be extractable.
  *
- * @param key Key to export as JWK.
+ * @param key Key to export.
  */
 export declare function exportJWK(key: t.CryptoKey | t.KeyObject | Uint8Array): Promise<t.JWK>;

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/key/generate_key_pair.d.ts

@@ -1,36 +1,31 @@
 import type * as t from '../types.d.ts';
-/**
- * JWA Algorithm Identifiers that {@link generateKeyPair} is able to generate a key pair for, subject
- * to runtime support.
- */
+/** Algorithms supported by {@link generateKeyPair}, subject to runtime support. */
 export type GenerateKeyPairAlgorithm = 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'ES256' | 'ES384' | 'ES512' | 'Ed25519' | 'EdDSA' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | (string & {});
 /** Generated asymmetric key pair. */
 export interface GenerateKeyPairResult {
-    /** The generated Private Key. */
     privateKey: t.CryptoKey;
-    /** Public Key corresponding to the generated Private Key. */
     publicKey: t.CryptoKey;
 }
 /** Asymmetric key pair generation options. */
 export interface GenerateKeyPairOptions {
     /**
-     * The EC "crv" (Curve) or OKP "crv" (Subtype of Key Pair) value to generate. The curve must be
-     * both supported on the runtime as well as applicable for the given JWA algorithm identifier.
+     * EC curve or OKP key subtype. Must be supported by the algorithm and runtime. ECDH-ES defaults
+     * to P-256.
      */
     crv?: string;
+    /** RSA modulus length in bits. Must be an integer of at least 2048; defaults to 2048. */
+    modulusLength?: number;
     /**
-     * A hint for RSA algorithms to generate an RSA key of a given `modulusLength` (Key size in bits).
-     * JOSE requires 2048 bits or larger. Default is 2048.
+     * Whether the private key is extractable. Defaults to false; the public key is always
+     * extractable.
      */
-    modulusLength?: number;
-    /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
     extractable?: boolean;
 }
 /**
  * Generates an asymmetric key pair for a JWA algorithm identifier.
  *
- * > Note: The `privateKey` is generated with `extractable` set to `false` by default. See
- * > {@link GenerateKeyPairOptions.extractable} to generate an extractable `privateKey`.
+ * > Note: Private keys are not extractable by default. Set {@link GenerateKeyPairOptions.extractable} to
+ * > export them; public keys are always extractable.
  *
  * @param alg JWA Algorithm Identifier to be used with the generated key pair. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/key/generate_secret.d.ts

@@ -1,18 +1,18 @@
 import type * as t from '../types.d.ts';
+/** Algorithms supported by {@link generateSecret}, subject to runtime support. */
+export type GenerateSecretAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'A128GCM' | 'A192GCM' | 'A256GCM' | (string & {});
 /**
- * JWA Algorithm Identifiers that {@link generateSecret} is able to generate a secret for, subject to
- * runtime support.
+ * Maps a JWA algorithm identifier to the value returned by {@link generateSecret}. AES-CBC-HMAC
+ * algorithms return {@link !Uint8Array}; other supported algorithms return
+ * {@link t.CryptoKey CryptoKey}. When the algorithm is not statically known, the result is their
+ * union.
  */
-export type GenerateSecretAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'A128GCM' | 'A192GCM' | 'A256GCM' | (string & {});
-/** Maps a JWA algorithm identifier to the value returned by {@link generateSecret}. */
 export type GeneratedSecret<Alg extends string> = Alg extends 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' ? Uint8Array : string extends Alg ? t.CryptoKey | Uint8Array : t.CryptoKey;
 /** Secret generation options. */
 export interface GenerateSecretOptions {
     /**
-     * The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
-     *
-     * > Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
-     * > {@link !CryptoKey} this option has no effect for them.
+     * Whether the generated CryptoKey is extractable. Defaults to false; has no effect for
+     * A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512, which return raw bytes.
      */
     extractable?: boolean;
 }
@@ -21,8 +21,8 @@ export interface GenerateSecretOptions {
  *
  * > Note: The secret key is generated with `extractable` set to `false` by default.
  *
- * > Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
- * > {@link !CryptoKey} this method yields a {@link !Uint8Array} for them instead.
+ * > Note: A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 return {@link !Uint8Array} because these secrets
+ * > have no CryptoKey representation.
  *
  * @param alg JWA Algorithm Identifier to be used with the generated secret. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/key/import.d.ts

@@ -1,5 +1,9 @@
 import type * as t from '../types.d.ts';
-/** Maps a JWK key type to the value returned by {@link importJWK}. */
+/**
+ * Maps a JWK key type to the value returned by {@link importJWK}. An "oct" JWK returns
+ * {@link !Uint8Array}; other supported key types return {@link t.CryptoKey CryptoKey}. A JWK
+ * whose "kty" is not statically known resolves to their union.
+ */
 export type ImportedJWK<JWKType extends t.JWK> = JWKType extends {
     kty: 'oct';
 } ? Uint8Array : JWKType extends {
@@ -8,17 +12,16 @@ export type ImportedJWK<JWKType extends t.JWK> = JWKType extends {
 /** Key import options. */
 export interface KeyImportOptions {
     /**
-     * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
-     * private keys, true otherwise.
+     * Whether the imported CryptoKey is extractable. Overrides JWK "ext" when set. Without either,
+     * defaults to false for private keys, true otherwise.
      */
     extractable?: boolean;
 }
 /**
  * Imports a PEM-encoded SPKI string as a {@link !CryptoKey}.
  *
- * > Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
- * > {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
- * > (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
  *
  * @param spki PEM-encoded SPKI string
  * @param alg JSON Web Algorithm identifier to be used with the imported key. See
@@ -26,11 +29,10 @@ export interface KeyImportOptions {
  */
 export declare function importSPKI(spki: string, alg: string, options?: KeyImportOptions): Promise<t.CryptoKey>;
 /**
- * Imports the SPKI from an X.509 string certificate as a {@link !CryptoKey}.
+ * Imports a PEM-encoded X.509 certificate's public key as a {@link !CryptoKey}.
  *
- * > Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
- * > {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
- * > (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
  *
  * @param x509 X.509 certificate string
  * @param alg JSON Web Algorithm identifier to be used with the imported key. See
@@ -40,9 +42,8 @@ export declare function importX509(x509: string, alg: string, options?: KeyImpor
 /**
  * Imports a PEM-encoded PKCS#8 string as a {@link !CryptoKey}.
  *
- * > Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
- * > {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
- * > (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
  *
  * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg JSON Web Algorithm identifier to be used with the imported key. See
@@ -50,13 +51,13 @@ export declare function importX509(x509: string, alg: string, options?: KeyImpor
  */
 export declare function importPKCS8(pkcs8: string, alg: string, options?: KeyImportOptions): Promise<t.CryptoKey>;
 /**
- * Imports a JWK as a {@link !CryptoKey} or {@link !Uint8Array}.
+ * Imports a JWK as a {@link !CryptoKey} or {@link !Uint8Array}. Asymmetric imports require either the
+ * "alg" argument or JWK "alg" parameter. For AKP keys, the JWK "alg" parameter is required and must
+ * match the argument when provided.
  *
- * > Note: The JSON Web Key parameters "key_ops" and "ext" are also used in the {@link !CryptoKey} import
- * > process.
+ * > Note: CryptoKey imports honor the JWK "key_ops" and "ext" parameters.
  *
- * > Note: Symmetric JSON Web Keys (i.e. `kty: "oct"`) yield back an {@link !Uint8Array} instead of a
- * > {@link !CryptoKey}.
+ * > Note: Symmetric JWKs (`kty: "oct"`) return {@link !Uint8Array} instead of CryptoKey.
  *
  * @param jwk JSON Web Key.
  * @param alg JSON Web Algorithm identifier to be used with the imported key. Default is the "alg"