@agnostack/verifyd 1.0.13 → 1.0.14-beta.1

package/dist/umd/lib/index.js

@@ -22,5 +22,1165 @@
  * SOFTWARE.
  */
 
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self)["@agnostack/verifyd/external"]={})}(this,(function(e){"use strict";const t=(e,t)=>null!=e&&typeof e===t,r=(e,r)=>(t(e,"string")&&(r&&(e=(e=>(t(e,"string")&&(e=e.trim()),e))(e)),(e.startsWith("{")||e.startsWith("[")||e.startsWith('"'))&&(e=JSON.parse(e))),e),n=e=>e?`${e}`:"",i=(e=[])=>e?Array.isArray(e)?e:[e]:[],o=e=>!(e=>{const t=n(e);return t.length>0&&!["null","undefined"].includes(t)})(e),a=([e],[t])=>((e,t)=>o(e)?1:o(t)?-1:n(e).localeCompare(t))(e,t),s=(e,t="")=>Object.entries((e=>e??{})(e)).sort(a).map((([e,t])=>`${e}=${t}`)).join(t),c=e=>`/${(e=>n(e).replace(/^\//,""))(e)}`,u=(e,t)=>{const r=n(e);return![...i(t),"","false"].includes(r)},y="xyz.com",l=["shop","host"],d="Content-Type",p={APPLICATION_JSON:"application/json"},f=(e,t)=>n(t??(e?"POST":"GET")).toUpperCase(),h=({method:e,body:t,headers:n,...i}={})=>{const o=f(t,e),a={[d]:p.APPLICATION_JSON,...n};let s=t;return s&&a[d].startsWith(p.APPLICATION_JSON)&&(s=JSON.stringify(r(s))),{method:o,headers:a,...s&&"GET"!==o&&{body:s},...i}},g=e=>{const t=(e=>{if(o(e))return;return/^(https?:\/\/).+/i.test(e)?new URL(e):new URL(`https://${y}${c(e)}`)})(e);if(t)return l.forEach((e=>t.searchParams.delete(e))),{...t.hostname!==y&&{origin:t.origin},pathname:t.pathname,search:t.search}};var m,w=((m=function(){return w}).toString=m.toLocaleString=m[Symbol.toPrimitive]=function(){return""},m.valueOf=function(){return!1},new Proxy(Object.freeze(m),{get:function(e,t){return e.hasOwnProperty(t)?e[t]:w}}));let b=global.window,v=e=>!function(e){return e===w}(e),K=void 0!==b?b:w;class A{constructor({crypto:e,util:t}={}){this._crypto=e??{},this._util=t??{}}get subtle(){return this._crypto?.subtle}async getWebCrypto(){if(!this._crypto?.subtle)try{this._crypto=(await import("isomorphic-webcrypto")).default}catch(e){try{this._crypto=(await import("crypto")).default}catch(e){throw console.error("Failed to import node crypto, ensure 'isomorphic-webcrypto' (or node 'crypto') is installed and/or pass in implementation via 'new WebCrypto({ crypto })'"),e}}if(!this._crypto?.subtle)throw new Error("Invalid crypto, missing subtle");return this._crypto}async getTextDecoder(){if(this._util?.TextDecoder)return this._util.TextDecoder;if(v(K)&&"function"==typeof K?.TextDecoder)return K.TextDecoder;try{const e=(await import("util")).TextDecoder;return this._util.TextDecoder=e,e}catch(e){throw console.error("Failed to import 'utils.TextDecoder', ensure 'util' is available and/or pass in implementation via 'new WebCrypto({ util })'"),e}}async getTextEncoder(){if(this._util?.TextEncoder)return this._util.TextEncoder;if(v(K)&&"function"==typeof K?.TextEncoder)return K.TextEncoder;try{const e=(await import("util")).TextEncoder;return this._util.TextEncoder=e,e}catch(e){throw console.error("Failed to import 'utils.TextEncoder', ensure 'util' is available and/or pass in implementation via 'new WebCrypto({ util })'"),e}}timingSafeEqual(e,t){if(null==e||null==t||e.length!==t.length)return!1;let r=0;for(let n=0;n<e.length;n++)r|=e[n]^t[n];return 0===r}stringToHex(e){return Array.from(n(e),(e=>e.charCodeAt(0).toString(16).padStart(2,"0"))).join("")}hexToString(e){return i(n(e).match(/.{1,2}/g)).map((e=>String.fromCharCode(parseInt(e,16)))).join("")}async arrayBufferToString(e){const t=new Uint8Array(e);return(new(await this.getTextDecoder())).decode(t)}arrayToArrayBuffer(e){return null!=ArrayBuffer.from?ArrayBuffer.from(e):new Uint8Array(e).buffer}ensureArrayBuffer(e){return e instanceof ArrayBuffer?e:this.arrayToArrayBuffer(e)}async generateKeyPair(){const e=await this.getWebCrypto();return await e.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveKey"])}getKeyOperations(e){switch(e){case"private":case"privateKey":return["deriveKey"];case"secret":case"secretKey":case"sharedSecret":return["encrypt","decrypt"];default:return[]}}getKeyAlgorythm(e){switch(e){case"derivedKey":case"derived":case"secret":case"secretKey":case"sharedSecret":return{name:"AES-GCM"};default:return{name:"ECDH",namedCurve:"P-256"}}}async generateHMAC(e,t){if(!e||!t)return;const r=await this.getWebCrypto(),n=await this.getTextEncoder(),i=await r.subtle.sign("HMAC",t,(new n).encode(e));return this.stringToHex(this.arrayBufferToString(i))}async verifyHMAC(e,t,r){const n=await this.generateHMAC(e,t);return this.timingSafeEqual(n,r)}async getStorableKey(e){const t=await this.getWebCrypto(),r=await t.subtle.exportKey("jwk",e);return this.stringToHex(JSON.stringify(r))}async restoreStorableKey(e,t){if(!t)return;const r=await this.getWebCrypto(),n=JSON.parse(this.hexToString(t)||"{}");var i;return(i=n)&&Object.keys(i).length?r.subtle.importKey("jwk",n,this.getKeyAlgorythm(e),!0,this.getKeyOperations(e)):void 0}async getStorableKeyPair(e){const t={};for(const[r,n]of Object.entries(e))t[r]=await this.getStorableKey(n);return t}async restoreStorableKeyPair(e){const t={};for(const[r,n]of Object.entries(e))t[r]=await this.restoreStorableKey(r,n);return t}async deriveSharedKey({publicKey:e,privateKey:t}){if(!e||!t)return;const r=await this.getWebCrypto();return await r.subtle.deriveKey({name:"ECDH",public:e},t,{name:"AES-GCM",length:256},!0,["encrypt","decrypt"])}async deriveHMACKey({publicKey:e,privateKey:t}){if(!e||!t)return;const r=await this.getWebCrypto();return await r.subtle.deriveKey({name:"ECDH",public:e},t,{name:"HMAC",hash:{name:"SHA-256"},length:256},!0,["sign","verify"])}async getVerificationKeys({publicKey:e,privateKey:t}){if(!e||!t)return{};const r=await this.restoreStorableKeyPair({publicKey:e,privateKey:t}),n=await this.deriveHMACKey(r);return{derivedSecretKey:await this.deriveSharedKey(r),derivedHMACKey:n}}async encryptMessage(e,t){if(!e||!t)return;const r=await this.getWebCrypto(),n=r.getRandomValues(new Uint8Array(12)),i=(new(await this.getTextEncoder())).encode(e),o=await r.subtle.encrypt({name:"AES-GCM",iv:n},t,i),a=new Uint8Array([...n,...new Uint8Array(o)]);return Array.from(a)}async decryptMessage(e,t){if(!e||!t)return;const r=await this.getWebCrypto(),n=this.ensureArrayBuffer(e),i=n.slice(0,12),o=n.slice(12),a=await r.subtle.decrypt({name:"AES-GCM",iv:i},t,o);return(new(await this.getTextDecoder())).decode(a)}}class S extends Error{constructor(e,t){super(e);const{code:r=500,...n}=t??{};this.code=r,this.data=n,this.name="VerificationError",Object.setPrototypeOf(this,S.prototype)}}const T=async e=>(async e=>{if(e?.rawBody)return e.rawBody;try{return(0,(await Promise.resolve().then((function(){return M}))).default)(e)}catch(e){throw console.error("Failed to import 'raw-body', please ensure the dependency is installed"),e}})(e).then((e=>e.toString())).catch((t=>{throw console.error(`Error getting raw body for '${e?.url}'`,t),t}));var C=function(){try{return require("async_hooks")}catch(e){return{}}}(),E=require("bytes"),x=require("http-errors"),P=require("iconv-lite"),O=require("unpipe");module.exports=function(e,t,r){var n=r,i=t||{};if(void 0===e)throw new TypeError("argument stream is required");if("object"!=typeof e||null===e||"function"!=typeof e.on)throw new TypeError("argument stream must be a stream");!0!==t&&"string"!=typeof t||(i={encoding:t});"function"==typeof t&&(n=t,i={});if(void 0!==n&&"function"!=typeof n)throw new TypeError("argument callback must be a function");if(!n&&!global.Promise)throw new TypeError("argument callback is required");var o=!0!==i.encoding?i.encoding:"utf-8",a=E.parse(i.limit),s=null==i.length||isNaN(i.length)?null:parseInt(i.length,10);if(n)return H(e,o,s,a,function(e){var t;C.AsyncResource&&(t=new C.AsyncResource(e.name||"bound-anonymous-fn"));if(!t||!t.runInAsyncScope)return e;return t.runInAsyncScope.bind(t,e,null)}(n));return new Promise((function(t,r){H(e,o,s,a,(function(e,n){if(e)return r(e);t(n)}))}))};var _=/^Encoding not recognized: /;function H(e,t,r,n,i){var o=!1,a=!0;if(null!==n&&null!==r&&r>n)return l(x(413,"request entity too large",{expected:r,length:r,limit:n,type:"entity.too.large"}));var s=e._readableState;if(e._decoder||s&&(s.encoding||s.decoder))return l(x(500,"stream encoding should not be set",{type:"stream.encoding.set"}));if(void 0!==e.readable&&!e.readable)return l(x(500,"stream is not readable",{type:"stream.not.readable"}));var c,u=0;try{c=function(e){if(!e)return null;try{return P.getDecoder(e)}catch(t){if(!_.test(t.message))throw t;throw x(415,"specified encoding unsupported",{encoding:e,type:"encoding.unsupported"})}}(t)}catch(e){return l(e)}var y=c?"":[];function l(){for(var t=new Array(arguments.length),r=0;r<t.length;r++)t[r]=arguments[r];function n(){h(),t[0]&&function(e){O(e),"function"==typeof e.pause&&e.pause()}(e),i.apply(null,t)}o=!0,a?process.nextTick(n):n()}function d(){o||l(x(400,"request aborted",{code:"ECONNABORTED",expected:r,length:r,received:u,type:"request.aborted"}))}function p(e){o||(u+=e.length,null!==n&&u>n?l(x(413,"request entity too large",{limit:n,received:u,type:"entity.too.large"})):c?y+=c.write(e):y.push(e))}function f(e){if(!o){if(e)return l(e);if(null!==r&&u!==r)l(x(400,"request size did not match content length",{expected:r,length:r,received:u,type:"request.size.invalid"}));else l(null,c?y+(c.end()||""):Buffer.concat(y))}}function h(){y=null,e.removeListener("aborted",d),e.removeListener("data",p),e.removeListener("end",f),e.removeListener("error",f),e.removeListener("close",h)}e.on("aborted",d),e.on("close",h),e.on("data",p),e.on("end",f),e.on("error",f),a=!1}var M=Object.freeze({__proto__:null});e.CONTENT_TYPES=p,e.HEADER_CONTENT_TYPE=d,e.VerificationError=S,e.WebCrypto=A,e.ensureRawBody=T,e.generateStorableKeyPairs=async({crypto:e,util:t}={})=>{const r=new A({crypto:e,util:t}),n=await r.generateKeyPair();return r.getStorableKeyPair({publicKey:n.publicKey,privateKey:n.privateKey})},e.getRequestMethod=f,e.getVerificationHelpers=({keyPairs:e,crypto:t,util:i}={})=>{const o=new A({crypto:t,util:i});return async(t,i)=>{const{"x-public-key":a,"x-ephemeral-key":c,"x-authorization-timestamp":y,"x-authorization":l}=t.headers??{},{uri:d,disableRecryption:p}=i??{},h=d??t.url,m=u(p);let w;try{const[i,d]=n(l).split(" ");let p;w=u(a&&c&&e?.shared&&y&&d&&"HMAC-SHA256"===i);const b=await T(t);let v=r(b);if(w){if(!(a&&c&&y&&d&&e?.shared&&a===e.shared.publicKey&&"HMAC-SHA256"===i))throw new S("Invalid or missing authorization",{code:401});if(p=await o.getVerificationKeys({publicKey:c,privateKey:e.shared.privateKey}),!p)throw new S("Invalid or missing verification",{code:412});const n=s({method:f(b,t.method),timestamp:y,body:v,...g(h)});if(!await o.verifyHMAC(n,p.derivedHMACKey,d))throw new S("Invalid or missing verification",{code:412});if(!m&&v){const e=await o.decryptMessage(v,p.derivedSecretKey);v=r(e)}}return{rawBody:b,requestBody:v,processResponse:async e=>e&&!m&&w&&p?.derivedSecretKey?o.encryptMessage(JSON.stringify(e),p.derivedSecretKey):e}}catch(e){throw console.error(`Error handling request verification for '${h}'`,{error:e,isVerifiable:w,disableRecryption:m}),e}}},e.getVerificationKeysData=async(e,{crypto:t,util:r}={})=>{if(o(e))return{};const n=new A({crypto:t,util:r}),i=await n.getStorableKeyPair(await n.generateKeyPair());return{publicKey:e,ephemeral:i,verification:await n.getVerificationKeys({publicKey:e,privateKey:i.privateKey})}},e.normalizeURIParts=g,e.prepareRequestOptions=h,e.prepareVerificationRequest=({keysData:e,disableRecryption:t,crypto:n,util:i}={})=>{const a=new A({crypto:n,util:i}),c=u(t);return async(t,{method:n,body:i,headers:u,...y}={})=>{let l=r(i);const d=f(l,n);if(c||o(e?.publicKey))return[t,h({method:d,body:l,headers:u,...y})];const{verification:{derivedHMACKey:p,derivedSecretKey:m}={},ephemeral:{publicKey:w}={}}=e??{};if(!p||!w)return;l&&m&&(l=await a.encryptMessage(JSON.stringify(l),m));const b=(()=>{const e=(new Date).getTime();return Math.floor(e/1e3).toString()})(),v=await a.generateHMAC(s({body:l,method:d,timestamp:b,...g(t)}),p);return[t,h({method:d,body:l,headers:{"X-Authorization":`HMAC-SHA256 ${v}`,"X-Authorization-Timestamp":b,"X-Ephemeral-Key":w,"X-Public-Key":e.publicKey,...u},...y}),m]}},e.processVerificationResponse=({keysData:e,disableRecryption:t,crypto:n,util:i}={})=>{const o=new A({crypto:n,util:i}),a=u(t);return async(t,n)=>{const i=n??e.verification?.derivedSecretKey;if(a||!t||!i)return t;const s=await o.decryptMessage(t,i);return r(s)}},Object.defineProperty(e,"__esModule",{value:!0})}));
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+  typeof define === 'function' && define.amd ? define(['exports'], factory) :
+  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["@agnostack/verifyd/external"] = {}));
+})(this, (function (exports) { 'use strict';
+
+  /* eslint-disable no-use-before-define */
+
+  const isType = (value, type) => (
+    // eslint-disable-next-line eqeqeq, valid-typeof
+    (value != undefined) && (typeof value === type)
+  );
+
+  const safeTrim = (value) => {
+    if (isType(value, 'string')) {
+      // eslint-disable-next-line no-param-reassign
+      value = value.trim();
+    }
+
+    return value
+  };
+
+  const safeParse = (value, trim) => {
+    if (isType(value, 'string')) {
+      if (trim) {
+        // eslint-disable-next-line no-param-reassign
+        value = safeTrim(value);
+      }
+
+      if (value.startsWith('{') || value.startsWith('[') || value.startsWith('"')) {
+        // eslint-disable-next-line no-param-reassign
+        value = JSON.parse(value);
+      }
+    }
+
+    // TODO: should this be value ?? {}
+    return value
+  };
+
+  const ensureString = (string) => (
+    string ? `${string}` : ''
+  );
+
+  const ensureArray = (array = []) => (
+    // eslint-disable-next-line no-nested-ternary
+    !array ? [] : Array.isArray(array) ? array : [array]
+  );
+
+  const ensureObject = (object) => (
+    object ?? {}
+  );
+
+  // NOTE: this does not ensure !isType(string)
+  const objectEmpty = (object) => (
+    !object || !Object.keys(object).length
+  );
+
+  const stringNotEmpty = (stringable) => {
+    const string = ensureString(stringable);
+    return ((string.length > 0) && !['null', 'undefined'].includes(string))
+  };
+
+  const stringEmpty = (stringable) => (
+    !stringNotEmpty(stringable)
+  );
+
+  const compareString = (string1, string2) => {
+    if (stringEmpty(string1)) {
+      return 1
+    }
+
+    if (stringEmpty(string2)) {
+      return -1
+    }
+
+    return ensureString(string1).localeCompare(string2)
+  };
+
+  const compareEntryKeys = ([string1], [string2]) => (
+    compareString(string1, string2)
+  );
+
+  const objectToSortedString = (object, separator = '') => (
+    Object.entries(ensureObject(object))
+      .sort(compareEntryKeys)
+      .map(([key, value]) => `${key}=${value}`)
+      .join(separator)
+  );
+
+  const uppercase = (string) => (
+    ensureString(string).toUpperCase()
+  );
+
+  const removeLeadingSlash = (string) => (
+    ensureString(string).replace(/^\//, '')
+  );
+
+  const ensureLeadingSlash = (string) => (
+    `/${removeLeadingSlash(string)}`
+  );
+
+  const isTrue = (value, falsy) => {
+    const string = ensureString(value);
+    return ![...ensureArray(falsy), '', 'false'].includes(string)
+  };
+
+  const TEMP_HOSTNAME = 'xyz.com';
+  const REMOVABLE_KEYS = ['shop', 'host'];
+
+  const HEADER_CONTENT_TYPE = 'Content-Type';
+  const CONTENT_TYPES = {
+    APPLICATION_JSON: 'application/json',
+  };
+
+  const getRequestMethod = (body, _method) => {
+    const method = _method ?? (body ? 'POST' : 'GET');
+
+    return uppercase(method)
+  };
+
+  const prepareRequestOptions = ({ method: _method, body: _body, headers: _header, ...requestOptions } = {}) => {
+    const method = getRequestMethod(_body, _method);
+
+    const headers = {
+      [HEADER_CONTENT_TYPE]: CONTENT_TYPES.APPLICATION_JSON,
+      ..._header,
+    };
+
+    let body = _body;
+    if (body && headers[HEADER_CONTENT_TYPE].startsWith(CONTENT_TYPES.APPLICATION_JSON)) {
+      body = JSON.stringify(safeParse(body));
+    }
+
+    return {
+      method,
+      headers,
+      ...(body && (method !== 'GET')) && { body },
+      ...requestOptions,
+    }
+  };
+
+  const convertToURL = (uri) => {
+    if (stringEmpty(uri)) {
+      return undefined
+    }
+
+    const protocolRegex = /^(https?:\/\/).+/i;
+
+    if (!protocolRegex.test(uri)) {
+      return new URL(`https://${TEMP_HOSTNAME}${ensureLeadingSlash(uri)}`)
+    }
+
+    return new URL(uri)
+  };
+
+  const normalizeURIParts = (uri) => {
+    const urlObject = convertToURL(uri);
+    if (!urlObject) {
+      return undefined
+    }
+
+    REMOVABLE_KEYS.forEach((key) => urlObject.searchParams.delete(key));
+
+    return {
+      ...(urlObject.hostname !== TEMP_HOSTNAME) && {
+        origin: urlObject.origin,
+      },
+      pathname: urlObject.pathname,
+      search: urlObject.search,
+    }
+  };
+
+  var n,r=((n=function(){return r}).toString=n.toLocaleString=n[Symbol.toPrimitive]=function(){return ""},n.valueOf=function(){return !1},new Proxy(Object.freeze(n),{get:function(n,t){return n.hasOwnProperty(t)?n[t]:r}})),u=function(n){return n===r};
+
+  let win = global.window;
+  let exists = (variable) => !u(variable);
+  let window = typeof win !== "undefined" ? win : r;
+
+  class WebCrypto {
+    constructor({ crypto: _crypto, util: _util } = {}) {
+      this._crypto = _crypto ?? {};
+      this._util = _util ?? {};
+    }
+
+    get subtle() {
+      return this._crypto?.subtle
+    }
+
+    async getWebCrypto() {
+      if (!this._crypto?.subtle) {
+        try {
+          this._crypto = (await import('isomorphic-webcrypto')).default;
+        } catch (_ignore) {
+          console.info('Failed to import isomorphic-webcrypto, retrying w/ node crypto');
+          try {
+            this._crypto = (await import('crypto')).default;
+          } catch (error) {
+            // eslint-disable-next-line max-len
+            console.error(`Failed to import node crypto, ensure 'isomorphic-webcrypto' (or node 'crypto') is installed and/or pass in implementation via 'new WebCrypto({ crypto })'`);
+            throw error
+          }
+        }
+      }
+
+      if (!this._crypto?.subtle) {
+        throw new Error('Invalid crypto, missing subtle')
+      }
+
+      return this._crypto
+    }
+
+    async getTextDecoder() {
+      if (this._util?.TextDecoder) {
+        return this._util.TextDecoder
+      }
+
+      if (exists(window) && typeof window?.TextDecoder === 'function') {
+        return window.TextDecoder
+      }
+
+      try {
+        const TextDecoder = (await import('util')).TextDecoder;
+        this._util.TextDecoder = TextDecoder;
+
+        return TextDecoder
+      } catch (error) {
+        console.error(`Failed to import 'utils.TextDecoder', ensure 'util' is available and/or pass in implementation via 'new WebCrypto({ util })'`);
+        throw error
+      }
+    }
+
+    async getTextEncoder() {
+      if (this._util?.TextEncoder) {
+        return this._util.TextEncoder
+      }
+
+      if (exists(window) && typeof window?.TextEncoder === 'function') {
+        return window.TextEncoder
+      }
+
+      try {
+        const TextEncoder = (await import('util')).TextEncoder;
+        this._util.TextEncoder = TextEncoder;
+
+        return TextEncoder
+      } catch (error) {
+        console.error(`Failed to import 'utils.TextEncoder', ensure 'util' is available and/or pass in implementation via 'new WebCrypto({ util })'`);
+        throw error
+      }
+    }
+
+    timingSafeEqual(value1, value2) {
+      if (
+        (value1 == undefined) ||
+        (value2 == undefined) ||
+        (value1.length !== value2.length)
+      ) {
+        return false
+      }
+
+      let result = 0;
+      // eslint-disable-next-line no-plusplus
+      for (let i = 0; i < value1.length; i++) {
+        // eslint-disable-next-line no-bitwise
+        result |= value1[i] ^ value2[i];
+      }
+
+      return (result === 0)
+    }
+
+    stringToHex(stringValue) {
+      return (
+        Array.from(ensureString(stringValue), (char) => (
+          char.charCodeAt(0).toString(16).padStart(2, '0')
+        )).join('')
+      )
+    }
+
+    hexToString(hexValue) {
+      return (
+        ensureArray(
+          ensureString(hexValue).match(/.{1,2}/g)
+        )
+        .map((byte) => String.fromCharCode(parseInt(byte, 16)))
+        .join('')
+      )
+    }
+
+    async arrayBufferToString(arrayBuffer) {
+      const uint8Array = new Uint8Array(arrayBuffer);
+      const Decoder = await this.getTextDecoder();
+      return new Decoder().decode(uint8Array)
+    }
+
+    arrayToArrayBuffer(array) {
+      return (
+        (ArrayBuffer.from != undefined)
+          ? ArrayBuffer.from(array)
+          : new Uint8Array(array).buffer
+      )
+    }
+
+    ensureArrayBuffer(arrayOrArrayBuffer) {
+      return (
+        (arrayOrArrayBuffer instanceof ArrayBuffer)
+          ? arrayOrArrayBuffer
+          : this.arrayToArrayBuffer(arrayOrArrayBuffer)
+      )
+    }
+
+    async generateKeyPair() {
+      const crypto = await this.getWebCrypto();
+      const keyPair = await crypto.subtle.generateKey(
+        {
+          name: 'ECDH',
+          namedCurve: 'P-256',
+        },
+        true,
+        ['deriveKey']
+      );
+
+      return keyPair
+    }
+
+    getKeyOperations(keyType) {
+      switch (keyType) {
+        case 'private':
+        case 'privateKey': {
+          return ['deriveKey']
+        }
+
+        case 'secret':
+        case 'secretKey':
+        case 'sharedSecret': {
+          return ['encrypt', 'decrypt'] 
+        }
+
+        default: {
+          return []
+        }
+      }
+    }
+
+    getKeyAlgorythm(keyType) {
+      switch (keyType) {
+        case 'derivedKey':
+        case 'derived':
+        case 'secret':
+        case 'secretKey':
+        case 'sharedSecret': {
+          return {
+            name: 'AES-GCM',
+          }
+        }
+
+        default: {
+          return {
+            name: 'ECDH',
+            namedCurve: 'P-256',
+          }
+        }
+      }
+    }
+
+    async generateHMAC(message, derivedKey) {
+      if (!message || !derivedKey) {
+        return undefined
+      } 
+
+      const crypto = await this.getWebCrypto();
+      const Encoder = await this.getTextEncoder();
+
+      const signature = await crypto.subtle.sign(
+        'HMAC',
+        derivedKey,
+        new Encoder().encode(message)
+      );
+
+      return this.stringToHex(
+        this.arrayBufferToString(signature)
+      )
+    }
+
+    async verifyHMAC(message, derivedKey, verifiableHMAC) {
+      const calculatedHMAC = await this.generateHMAC(message, derivedKey);
+
+      return this.timingSafeEqual(calculatedHMAC, verifiableHMAC)
+    }
+
+    async getStorableKey(key) {
+      const crypto = await this.getWebCrypto();
+
+      const exportedJWK = await crypto.subtle.exportKey('jwk', key);
+      return this.stringToHex(JSON.stringify(exportedJWK))
+    }
+
+    async restoreStorableKey(keyType, storableHex) {
+      if (!storableHex) {
+        return undefined
+      }
+      const crypto = await this.getWebCrypto();
+
+      const exportedJWK = JSON.parse(this.hexToString(storableHex) || '{}');
+      if (objectEmpty(exportedJWK)) {
+        return undefined
+      }
+
+      return crypto.subtle.importKey(
+        'jwk',
+        exportedJWK,
+        this.getKeyAlgorythm(keyType),
+        true,
+        this.getKeyOperations(keyType)
+      )
+    }
+
+    async getStorableKeyPair(keyPair) {
+      const storableKeys = {};
+
+      // eslint-disable-next-line no-restricted-syntax
+      for (const [keyType, key] of Object.entries(keyPair)) {
+        // eslint-disable-next-line no-await-in-loop
+        storableKeys[keyType] = await this.getStorableKey(key);
+      }
+
+      return storableKeys
+    }
+
+    async restoreStorableKeyPair(keyPair) {
+      const restoredKeys = {};
+
+      // eslint-disable-next-line no-restricted-syntax
+      for (const [keyType, key] of Object.entries(keyPair)) {
+        // eslint-disable-next-line no-await-in-loop
+        restoredKeys[keyType] = await this.restoreStorableKey(keyType, key);
+      }
+
+      return restoredKeys
+    }
+
+    async deriveSharedKey({ publicKey, privateKey }) {
+      if (!publicKey || !privateKey) {
+        return undefined
+      }
+
+      const crypto = await this.getWebCrypto();
+      const derivedKey = await crypto.subtle.deriveKey(
+        {
+          name: 'ECDH',
+          public: publicKey,
+        },
+        privateKey,
+        {
+          name: 'AES-GCM',
+          length: 256,
+        },
+        true,
+        ['encrypt', 'decrypt']
+      );
+      return derivedKey
+    }
+
+    async deriveHMACKey({ publicKey, privateKey }) {
+      if (!publicKey || !privateKey) {
+        return undefined
+      }
+
+      const crypto = await this.getWebCrypto();
+      const derivedKey = await crypto.subtle.deriveKey(
+        {
+          name: 'ECDH',
+          public: publicKey,
+        },
+        privateKey,
+        {
+          name: 'HMAC',
+          hash: { name: 'SHA-256' },
+          length: 256,  // Adjusted key length, e.g., 128 bits
+        },
+        true,
+        ['sign', 'verify']
+      );
+      return derivedKey
+    }
+
+    async getVerificationKeys({ publicKey, privateKey }) {
+      if (!publicKey || !privateKey) {
+        return {}
+      }
+
+      const sharedKeyPair = await this.restoreStorableKeyPair({ publicKey, privateKey });
+      const derivedHMACKey = await this.deriveHMACKey(sharedKeyPair);
+      const derivedSecretKey = await this.deriveSharedKey(sharedKeyPair);
+
+      return {
+        derivedSecretKey,
+        derivedHMACKey,
+      }
+    }
+
+    async encryptMessage(decryptedMessage, derivedKey) {
+      if (!decryptedMessage || !derivedKey) {
+        return undefined
+      }
+
+      const crypto = await this.getWebCrypto();
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const Encoder = await this.getTextEncoder();
+      const encodedMessage = new Encoder().encode(decryptedMessage);
+      const ciphertext = await crypto.subtle.encrypt(
+        {
+          name: 'AES-GCM',
+          iv,
+        },
+        derivedKey,
+        encodedMessage
+      );
+
+      const encryptedMessage = new Uint8Array([
+        ...iv,
+        ...new Uint8Array(ciphertext)
+      ]);
+      return Array.from(encryptedMessage)
+    }
+
+    async decryptMessage(encryptedMessage, derivedKey) {
+      if (!encryptedMessage || !derivedKey) {
+        return undefined
+      }
+
+      const crypto = await this.getWebCrypto();
+      // NOTE: this presumed an array or arrayBuffer coming in as encryptedMessage (will fail w/ IV error if its a string)
+      const encryptedArrayBuffer = this.ensureArrayBuffer(encryptedMessage);
+      const iv = encryptedArrayBuffer.slice(0, 12);
+      const ciphertext = encryptedArrayBuffer.slice(12);
+
+      const decryptedArrayBuffer = await crypto.subtle.decrypt(
+        {
+          name: 'AES-GCM',
+          iv,
+        },
+        derivedKey,
+        ciphertext
+      );
+
+      const Decoder = await this.getTextDecoder();
+      const decryptedMessage = new Decoder().decode(decryptedArrayBuffer);
+      return decryptedMessage
+    }
+  }
+
+  const getUnixString = () => {
+    const currentDate = new Date();
+    const unixTimestamp = currentDate.getTime();
+    return Math.floor(unixTimestamp / 1000).toString()
+  };
+
+  const getVerificationKeysData = async (publicKey, { crypto: _crypto, util: _util } = {}) => {
+    if (stringEmpty(publicKey)) {
+      return {}
+    }
+
+    const webCrypto = new WebCrypto({ crypto: _crypto, util: _util });
+
+    const _ephemeralStoreableKeyPair = await webCrypto.getStorableKeyPair(
+      await webCrypto.generateKeyPair()
+    );
+
+    const _verificationKeyPair = await webCrypto.getVerificationKeys({
+      publicKey,
+      privateKey: _ephemeralStoreableKeyPair.privateKey,
+    });
+
+    return {
+      publicKey,
+      ephemeral: _ephemeralStoreableKeyPair,
+      verification: _verificationKeyPair,
+    }
+  };
+
+  // eslint-disable-next-line arrow-body-style
+  const prepareVerificationRequest = ({ keysData: _keysData, disableRecryption: _disableRecryption, crypto: _crypto, util: _util } = {}) => {
+    const webCrypto = new WebCrypto({ crypto: _crypto, util: _util });
+    const disableRecryption = isTrue(_disableRecryption);
+
+    return async (requestPath, { method: rawMethod, body: rawBody, headers: rawHeaders,  ...requestOptions } = {}) => {
+      let parsedBody = safeParse(rawBody);
+      const method = getRequestMethod(parsedBody, rawMethod);
+
+      if (disableRecryption || stringEmpty(_keysData?.publicKey)) {
+        return [
+          requestPath,
+          prepareRequestOptions({
+            method,
+            body: parsedBody,
+            headers: rawHeaders,
+            ...requestOptions,
+          })
+        ]
+      }
+
+      const {
+        verification: {
+          derivedHMACKey,
+          derivedSecretKey,
+        } = {},
+        ephemeral: {
+          publicKey: ephemeralPublicKey,
+        } = {},
+      } = _keysData ?? {};
+
+      if (!derivedHMACKey || !ephemeralPublicKey) {
+        return undefined
+      }
+
+      if (parsedBody && derivedSecretKey) {
+        parsedBody = await webCrypto.encryptMessage(JSON.stringify(parsedBody), derivedSecretKey);
+      }
+
+      const timestamp = getUnixString();
+      const computedHMAC = await webCrypto.generateHMAC(
+        objectToSortedString({
+          body: parsedBody,
+          method,
+          timestamp,
+          ...normalizeURIParts(requestPath),
+        }),
+        derivedHMACKey
+      );
+
+      return [
+        requestPath,
+        prepareRequestOptions({
+          method,
+          body: parsedBody,
+          headers: {
+            'X-Authorization': `HMAC-SHA256 ${computedHMAC}`,
+            'X-Authorization-Timestamp': timestamp,
+            'X-Ephemeral-Key': ephemeralPublicKey,
+            'X-Public-Key': _keysData.publicKey,
+            ...rawHeaders,
+          },
+          ...requestOptions,
+        }),
+        derivedSecretKey
+      ]
+    }
+  };
+
+  const processVerificationResponse = ({ keysData, disableRecryption: _disableRecryption, crypto: _crypto, util: _util } = {}) => {
+    const webCrypto = new WebCrypto({ crypto: _crypto, util: _util });
+    const disableRecryption = isTrue(_disableRecryption);
+
+    return async (encryptedResponse, _derivedSecretKey) => {
+      const derivedSecretKey = _derivedSecretKey ?? keysData.verification?.derivedSecretKey;
+      if (disableRecryption || !encryptedResponse || !derivedSecretKey) {
+        return encryptedResponse
+      }
+    
+      const decryptedMessage = await webCrypto.decryptMessage(encryptedResponse, derivedSecretKey);
+      return safeParse(decryptedMessage)
+    }
+  };
+
+  class VerificationError extends Error {
+    constructor(message, _data) {
+      super(message);
+      const { code = 500, ...data } = _data ?? {};
+      this.code = code;
+      this.data = data;
+      this.name = 'VerificationError';
+      Object.setPrototypeOf(this, VerificationError.prototype);
+    }
+  }
+
+  const getChunkedRawBody = async (readable) => {
+    if (readable?.rawBody) {
+      return readable.rawBody
+    }
+
+    // TODO: move to req.text() after next 13.5: https://github.com/vercel/next.js/discussions/13405
+    try {
+      const getRawBody = (await Promise.resolve().then(function () { return index; })).default;
+      return getRawBody(readable)
+    } catch (error) {
+      console.error(`Failed to import 'raw-body', please ensure the dependency is installed`);
+      throw error
+    }
+  };
+
+  // TODO: explore returning mutated request object adding on req.rawBody??
+  const ensureRawBody = async (req) => (
+    getChunkedRawBody(req)
+      .then((_rawBody) => _rawBody.toString())
+      .catch((error) => {
+        console.error(`Error getting raw body for '${req?.url}'`, error);
+        throw error
+    })
+  );
+
+  const generateStorableKeyPairs = async ({ crypto: _crypto, util: _util  } = {}) => {
+    const webCrypto = new WebCrypto({ crypto: _crypto, util: _util });
+    const sharedKeyPair = await webCrypto.generateKeyPair();
+
+    return webCrypto.getStorableKeyPair({
+      publicKey: sharedKeyPair.publicKey,
+      privateKey: sharedKeyPair.privateKey,
+    })
+  };
+
+  const getVerificationHelpers = ({ keyPairs, crypto: _crypto, util: _util  } = {}) => {
+    const webCrypto = new WebCrypto({ crypto: _crypto, util: _util });
+
+    return async (req, params) => {
+      const {
+        'x-public-key': apiKey,
+        'x-ephemeral-key': ephemeralPublicKey,
+        'x-authorization-timestamp': customAuthTimestamp,
+        'x-authorization': customAuth,
+      } = req.headers ?? {};
+
+      const { uri: _uri, disableRecryption: _disableRecryption } = params ?? {};
+      const uri = _uri ?? req.url;
+      const disableRecryption = isTrue(_disableRecryption);
+
+      let isVerifiable;
+      try {
+        const [authProtocol, authSignature] = ensureString(customAuth).split(' ');
+        isVerifiable = isTrue(
+          apiKey &&
+          ephemeralPublicKey &&
+          keyPairs?.shared &&
+          customAuthTimestamp &&
+          authSignature &&
+          (authProtocol === 'HMAC-SHA256')
+        );
+
+        let verificationKeys;
+        const rawBody = await ensureRawBody(req);
+
+        // NOTE: requestBody should be wind up decrypted when isVerifiable (unless disableRecryption, then will pass through)
+        let requestBody = safeParse(rawBody);
+
+        // TEMP!!! remove isVerifiable check once webwidget moved to react
+        if (isVerifiable) {
+          if (
+            !apiKey ||
+            !ephemeralPublicKey ||
+            !customAuthTimestamp ||
+            !authSignature ||
+            !keyPairs?.shared ||
+            (apiKey !== keyPairs.shared.publicKey) ||
+            (authProtocol !== 'HMAC-SHA256')
+          ) {
+            throw new VerificationError('Invalid or missing authorization', { code: 401 })
+          }
+
+          verificationKeys = await webCrypto.getVerificationKeys({
+            publicKey: ephemeralPublicKey,
+            privateKey: keyPairs.shared.privateKey,
+          });
+
+          if (!verificationKeys) {
+            throw new VerificationError('Invalid or missing verification', { code: 412 })
+          }
+
+          const verificationPayload = objectToSortedString({
+            method: getRequestMethod(rawBody, req.method),
+            timestamp: customAuthTimestamp,
+            body: requestBody, // NOTE: requestBody should be encrypted when isVerifiable
+            ...normalizeURIParts(uri),
+          });
+
+          const isValid = await webCrypto.verifyHMAC(
+            verificationPayload,
+            verificationKeys.derivedHMACKey,
+            authSignature
+          );
+
+          if (!isValid) {
+            throw new VerificationError('Invalid or missing verification', { code: 412 })
+          }
+
+          if (!disableRecryption && requestBody) {
+            const decryptedMessage = await webCrypto.decryptMessage(requestBody, verificationKeys.derivedSecretKey);
+            requestBody = safeParse(decryptedMessage);
+          }
+        }
+
+        const processResponse = async (response) => {
+          if (!response || disableRecryption || !isVerifiable || !verificationKeys?.derivedSecretKey) {
+            return response
+          }
+
+          return webCrypto.encryptMessage(JSON.stringify(response), verificationKeys.derivedSecretKey)
+        };
+
+        return { rawBody, requestBody, processResponse }
+      } catch (error) {
+        console.error(`Error handling request verification for '${uri}'`, { error, isVerifiable, disableRecryption });
+        throw error
+      }
+    }
+  };
+
+  /*!
+   * raw-body
+   * Copyright(c) 2013-2014 Jonathan Ong
+   * Copyright(c) 2014-2022 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+
+  /**
+   * Module dependencies.
+   * @private
+   */
+
+  var asyncHooks = tryRequireAsyncHooks();
+  var bytes = require('bytes');
+  var createError = require('http-errors');
+  var iconv = require('iconv-lite');
+  var unpipe = require('unpipe');
+
+  /**
+   * Module exports.
+   * @public
+   */
+
+  module.exports = getRawBody;
+
+  /**
+   * Module variables.
+   * @private
+   */
+
+  var ICONV_ENCODING_MESSAGE_REGEXP = /^Encoding not recognized: /;
+
+  /**
+   * Get the decoder for a given encoding.
+   *
+   * @param {string} encoding
+   * @private
+   */
+
+  function getDecoder (encoding) {
+    if (!encoding) return null
+
+    try {
+      return iconv.getDecoder(encoding)
+    } catch (e) {
+      // error getting decoder
+      if (!ICONV_ENCODING_MESSAGE_REGEXP.test(e.message)) throw e
+
+      // the encoding was not found
+      throw createError(415, 'specified encoding unsupported', {
+        encoding: encoding,
+        type: 'encoding.unsupported'
+      })
+    }
+  }
+
+  /**
+   * Get the raw body of a stream (typically HTTP).
+   *
+   * @param {object} stream
+   * @param {object|string|function} [options]
+   * @param {function} [callback]
+   * @public
+   */
+
+  function getRawBody (stream, options, callback) {
+    var done = callback;
+    var opts = options || {};
+
+    // light validation
+    if (stream === undefined) {
+      throw new TypeError('argument stream is required')
+    } else if (typeof stream !== 'object' || stream === null || typeof stream.on !== 'function') {
+      throw new TypeError('argument stream must be a stream')
+    }
+
+    if (options === true || typeof options === 'string') {
+      // short cut for encoding
+      opts = {
+        encoding: options
+      };
+    }
+
+    if (typeof options === 'function') {
+      done = options;
+      opts = {};
+    }
+
+    // validate callback is a function, if provided
+    if (done !== undefined && typeof done !== 'function') {
+      throw new TypeError('argument callback must be a function')
+    }
+
+    // require the callback without promises
+    if (!done && !global.Promise) {
+      throw new TypeError('argument callback is required')
+    }
+
+    // get encoding
+    var encoding = opts.encoding !== true
+      ? opts.encoding
+      : 'utf-8';
+
+    // convert the limit to an integer
+    var limit = bytes.parse(opts.limit);
+
+    // convert the expected length to an integer
+    var length = opts.length != null && !isNaN(opts.length)
+      ? parseInt(opts.length, 10)
+      : null;
+
+    if (done) {
+      // classic callback style
+      return readStream(stream, encoding, length, limit, wrap(done))
+    }
+
+    return new Promise(function executor (resolve, reject) {
+      readStream(stream, encoding, length, limit, function onRead (err, buf) {
+        if (err) return reject(err)
+        resolve(buf);
+      });
+    })
+  }
+
+  /**
+   * Halt a stream.
+   *
+   * @param {Object} stream
+   * @private
+   */
+
+  function halt (stream) {
+    // unpipe everything from the stream
+    unpipe(stream);
+
+    // pause stream
+    if (typeof stream.pause === 'function') {
+      stream.pause();
+    }
+  }
+
+  /**
+   * Read the data from the stream.
+   *
+   * @param {object} stream
+   * @param {string} encoding
+   * @param {number} length
+   * @param {number} limit
+   * @param {function} callback
+   * @public
+   */
+
+  function readStream (stream, encoding, length, limit, callback) {
+    var complete = false;
+    var sync = true;
+
+    // check the length and limit options.
+    // note: we intentionally leave the stream paused,
+    // so users should handle the stream themselves.
+    if (limit !== null && length !== null && length > limit) {
+      return done(createError(413, 'request entity too large', {
+        expected: length,
+        length: length,
+        limit: limit,
+        type: 'entity.too.large'
+      }))
+    }
+
+    // streams1: assert request encoding is buffer.
+    // streams2+: assert the stream encoding is buffer.
+    //   stream._decoder: streams1
+    //   state.encoding: streams2
+    //   state.decoder: streams2, specifically < 0.10.6
+    var state = stream._readableState;
+    if (stream._decoder || (state && (state.encoding || state.decoder))) {
+      // developer error
+      return done(createError(500, 'stream encoding should not be set', {
+        type: 'stream.encoding.set'
+      }))
+    }
+
+    if (typeof stream.readable !== 'undefined' && !stream.readable) {
+      return done(createError(500, 'stream is not readable', {
+        type: 'stream.not.readable'
+      }))
+    }
+
+    var received = 0;
+    var decoder;
+
+    try {
+      decoder = getDecoder(encoding);
+    } catch (err) {
+      return done(err)
+    }
+
+    var buffer = decoder
+      ? ''
+      : [];
+
+    // attach listeners
+    stream.on('aborted', onAborted);
+    stream.on('close', cleanup);
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    stream.on('error', onEnd);
+
+    // mark sync section complete
+    sync = false;
+
+    function done () {
+      var args = new Array(arguments.length);
+
+      // copy arguments
+      for (var i = 0; i < args.length; i++) {
+        args[i] = arguments[i];
+      }
+
+      // mark complete
+      complete = true;
+
+      if (sync) {
+        process.nextTick(invokeCallback);
+      } else {
+        invokeCallback();
+      }
+
+      function invokeCallback () {
+        cleanup();
+
+        if (args[0]) {
+          // halt the stream on error
+          halt(stream);
+        }
+
+        callback.apply(null, args);
+      }
+    }
+
+    function onAborted () {
+      if (complete) return
+
+      done(createError(400, 'request aborted', {
+        code: 'ECONNABORTED',
+        expected: length,
+        length: length,
+        received: received,
+        type: 'request.aborted'
+      }));
+    }
+
+    function onData (chunk) {
+      if (complete) return
+
+      received += chunk.length;
+
+      if (limit !== null && received > limit) {
+        done(createError(413, 'request entity too large', {
+          limit: limit,
+          received: received,
+          type: 'entity.too.large'
+        }));
+      } else if (decoder) {
+        buffer += decoder.write(chunk);
+      } else {
+        buffer.push(chunk);
+      }
+    }
+
+    function onEnd (err) {
+      if (complete) return
+      if (err) return done(err)
+
+      if (length !== null && received !== length) {
+        done(createError(400, 'request size did not match content length', {
+          expected: length,
+          length: length,
+          received: received,
+          type: 'request.size.invalid'
+        }));
+      } else {
+        var string = decoder
+          ? buffer + (decoder.end() || '')
+          : Buffer.concat(buffer);
+        done(null, string);
+      }
+    }
+
+    function cleanup () {
+      buffer = null;
+
+      stream.removeListener('aborted', onAborted);
+      stream.removeListener('data', onData);
+      stream.removeListener('end', onEnd);
+      stream.removeListener('error', onEnd);
+      stream.removeListener('close', cleanup);
+    }
+  }
+
+  /**
+   * Try to require async_hooks
+   * @private
+   */
+
+  function tryRequireAsyncHooks () {
+    try {
+      return require('async_hooks')
+    } catch (e) {
+      return {}
+    }
+  }
+
+  /**
+   * Wrap function with async resource, if possible.
+   * AsyncResource.bind static method backported.
+   * @private
+   */
+
+  function wrap (fn) {
+    var res;
+
+    // create anonymous resource
+    if (asyncHooks.AsyncResource) {
+      res = new asyncHooks.AsyncResource(fn.name || 'bound-anonymous-fn');
+    }
+
+    // incompatible node.js
+    if (!res || !res.runInAsyncScope) {
+      return fn
+    }
+
+    // return bound function
+    return res.runInAsyncScope.bind(res, fn, null)
+  }
+
+  var index = /*#__PURE__*/Object.freeze({
+    __proto__: null
+  });
+
+  exports.CONTENT_TYPES = CONTENT_TYPES;
+  exports.HEADER_CONTENT_TYPE = HEADER_CONTENT_TYPE;
+  exports.VerificationError = VerificationError;
+  exports.WebCrypto = WebCrypto;
+  exports.ensureRawBody = ensureRawBody;
+  exports.generateStorableKeyPairs = generateStorableKeyPairs;
+  exports.getRequestMethod = getRequestMethod;
+  exports.getVerificationHelpers = getVerificationHelpers;
+  exports.getVerificationKeysData = getVerificationKeysData;
+  exports.normalizeURIParts = normalizeURIParts;
+  exports.prepareRequestOptions = prepareRequestOptions;
+  exports.prepareVerificationRequest = prepareVerificationRequest;
+  exports.processVerificationResponse = processVerificationResponse;
+
+  Object.defineProperty(exports, '__esModule', { value: true });
+
+}));
 //# sourceMappingURL=index.js.map