@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/jwt-rsa.d.ts

@@ -0,0 +1,348 @@
+import { JwksCache, Jwk, RsaSignatureJwk, Jwks } from "./jwk.js";
+import { JwtHeader, JwtPayload, SupportedSignatureAlgorithm } from "./jwt-model.js";
+import { AsAsync, Properties } from "./typing-util.js";
+import { DecomposedJwt } from "./jwt.js";
+/** Interface for JWT verification properties */
+export interface VerifyProperties {
+    /**
+     * The audience that you expect to be present in the JWT's aud claim.
+     * If you provide a string array, that means at least one of those audiences
+     * must be present in the JWT's aud claim.
+     * Pass null explicitly to not check the JWT's audience--if you know what you're doing
+     */
+    audience: string | string[] | null;
+    /**
+     * The scope that you expect to be present in the JWT's scope claim.
+     * If you provide a string array, that means at least one of those scopes
+     * must be present in the JWT's scope claim.
+     */
+    scope?: string | string[];
+    /**
+     * The number of seconds after expiration (exp claim) or before not-before (nbf claim) that you will allow
+     * (use this to account for clock differences between systems)
+     */
+    graceSeconds?: number;
+    /**
+     * Your custom function with checks. It will be called, at the end of the verification,
+     * after standard verifcation checks have all passed.
+     * Throw an error in this function if you want to reject the JWT for whatever reason you deem fit.
+     * Your function will be called with a properties object that contains:
+     * - the decoded JWT header
+     * - the decoded JWT payload
+     * - the JWK that was used to verify the JWT's signature
+     */
+    customJwtCheck?: (props: {
+        header: JwtHeader;
+        payload: JwtPayload;
+        jwk: Jwk;
+    }) => Promise<void> | void;
+    /**
+     * If you want to peek inside the invalid JWT when verification fails, set `includeRawJwtInErrors` to true.
+     * Then, if an error is thrown during verification of the invalid JWT (e.g. the JWT is invalid because it is expired),
+     * the Error object will include a property `rawJwt`, with the raw decoded contents of the **invalid** JWT.
+     * The `rawJwt` will only be included in the Error object, if the JWT's signature can at least be verified.
+     */
+    includeRawJwtInErrors?: boolean;
+}
+/** Type for JWT RSA verifier properties, for a single issuer */
+export type JwtRsaVerifierProperties<VerifyProps> = {
+    /**
+     * URI where the JWKS (JSON Web Key Set) can be downloaded from.
+     * The JWKS contains one or more JWKs, which represent the public keys with which
+     * JWTs have been signed.
+     */
+    jwksUri?: string;
+    /**
+     * The issuer of the JWTs you want to verify.
+     * Set this to the expected value of the `iss` claim in the JWT.
+     */
+    issuer: string;
+} & Partial<VerifyProps>;
+/**
+ * Type for JWT RSA verifier properties, when multiple issuers are used in the verifier.
+ * In this case, you should be explicit in mapping audience to issuer.
+ */
+export type JwtRsaVerifierMultiProperties<T> = {
+    /**
+     * URI where the JWKS (JSON Web Key Set) can be downloaded from.
+     * The JWKS contains one or more JWKs, which represent the public keys with which
+     * JWTs have been signed.
+     */
+    jwksUri?: string;
+    /**
+     * The issuer of the JWTs you want to verify.
+     * Set this to the expected value of the `iss` claim in the JWT.
+     */
+    issuer: string;
+} & T;
+/**
+ * JWT Verifier (RSA) for a single issuer
+ */
+export type JwtRsaVerifierSingleIssuer<T extends JwtRsaVerifierProperties<VerifyProperties>> = JwtRsaVerifier<Properties<VerifyProperties, T>, T & JwtRsaVerifierProperties<VerifyProperties>, false>;
+/**
+ * Parameters used for verification of a JWT.
+ * The first parameter is the JWT, which is (of course) mandatory.
+ * The second parameter is an object with specific properties to use during verification.
+ * The second parameter is only mandatory if its mandatory members (e.g. audience) were not
+ *  yet provided at verifier level. In that case, they must now be provided.
+ */
+type VerifyParameters<SpecificVerifyProperties> = {
+    [key: string]: never;
+} extends SpecificVerifyProperties ? [jwt: string, props?: SpecificVerifyProperties] : [jwt: string, props: SpecificVerifyProperties];
+/**
+ * JWT Verifier (RSA) for multiple issuers
+ */
+export type JwtRsaVerifierMultiIssuer<T extends JwtRsaVerifierMultiProperties<VerifyProperties>> = JwtRsaVerifier<Properties<VerifyProperties, T>, T & JwtRsaVerifierProperties<VerifyProperties>, true>;
+/**
+ * Verify (synchronously) the JSON Web Signature (JWS) of a JWT
+ * https://datatracker.ietf.org/doc/html/rfc7515
+ *
+ * @param keyObject: the keyobject (representing the public key) in native crypto format
+ * @param alg: the JWS algorithm that was used to create the JWS (e.g. RS256)
+ * @param jwsSigningInput: the input for which the JWS was created, i.e. that what was signed
+ * @param signature: the JSON Web Signature (JWS)
+ * @returns boolean: true if the JWS is valid, or false otherwise
+ */
+export type JwsVerificationFunctionSync = (props: {
+    keyObject: GenericKeyObject;
+    alg: SupportedSignatureAlgorithm;
+    jwsSigningInput: string;
+    signature: string;
+}) => boolean;
+/**
+ * Verify (asynchronously) the JSON Web Signature (JWS) of a JWT
+ * https://datatracker.ietf.org/doc/html/rfc7515
+ *
+ * @param keyObject: the keyobject (representing the public key) in native crypto format
+ * @param alg: the JWS algorithm that was used to create the JWS (e.g. RS256)
+ * @param jwsSigningInput: the input for which the JWS was created, i.e. that what was signed
+ * @param signature: the JSON Web Signature (JWS)
+ * @returns Promise that resolves to a boolean: true if the JWS is valid, or false otherwise
+ */
+export type JwsVerificationFunctionAsync = AsAsync<JwsVerificationFunctionSync>;
+/**
+ * Verify a JWT asynchronously (thus allowing for the JWKS to be fetched from the JWKS URI)
+ *
+ * @param jwt The JWT
+ * @param jwksUri The JWKS URI, where the JWKS can be fetched from
+ * @param options Verification options
+ * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+ */
+export declare function verifyJwt(jwt: string, jwksUri: string, options: {
+    issuer: string | string[] | null;
+    audience: string | string[] | null;
+    scope?: string | string[];
+    graceSeconds?: number;
+    customJwtCheck?: (props: {
+        header: JwtHeader;
+        payload: JwtPayload;
+        jwk: Jwk;
+    }) => Promise<void> | void;
+    includeRawJwtInErrors?: boolean;
+}): Promise<JwtPayload>;
+/**
+ * Verify a JWT synchronously, using a JWKS or JWK that has already been fetched
+ *
+ * @param jwt The JWT
+ * @param jwkOrJwks The JWKS that includes the right JWK (indexed by kid). Alternatively, provide the right JWK directly
+ * @param options Verification options
+ * @param transformJwkToKeyObjectFn A function that can transform a JWK into a crypto native key object
+ * @returns The (JSON parsed) payload of the JWT––if the JWT is valid, otherwise an error is thrown
+ */
+export declare function verifyJwtSync(jwt: string, jwkOrJwks: Jwk | Jwks, options: {
+    issuer: string | string[] | null;
+    audience: string | string[] | null;
+    scope?: string | string[];
+    graceSeconds?: number;
+    customJwtCheck?: (props: {
+        header: JwtHeader;
+        payload: JwtPayload;
+        jwk: Jwk;
+    }) => void;
+    includeRawJwtInErrors?: boolean;
+}, transformJwkToKeyObjectFn?: JwkToKeyObjectTransformerSync): JwtPayload;
+/** Type alias for better readability below */
+type Issuer = string;
+/**
+ * Abstract class representing a verifier for JWTs signed with RSA (e.g. RS256, RS384, RS512)
+ *
+ * A class is used, because there is state:
+ * - The JWKS is fetched (downloaded) from the JWKS URI and cached in memory
+ * - Verification properties at verifier level, are used as default options for individual verify calls
+ *
+ * When instantiating this class, relevant type parameters should be provided, for your concrete case:
+ * @param StillToProvide The verification options that you want callers of verify to provide on individual verify calls
+ * @param SpecificVerifyProperties The verification options that you'll use
+ * @param IssuerConfig The issuer config that you'll use (config options are used as default verification options)
+ * @param MultiIssuer Verify multiple issuers (true) or just a single one (false)
+ */
+export declare abstract class JwtRsaVerifierBase<SpecificVerifyProperties extends Record<string | number, unknown>, IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties>, MultiIssuer extends boolean> {
+    private jwksCache;
+    private issuersConfig;
+    private publicKeyCache;
+    protected constructor(verifyProperties: IssuerConfig | IssuerConfig[], jwksCache?: JwksCache);
+    protected get expectedIssuers(): string[];
+    protected getIssuerConfig(issuer?: string): IssuerConfig & {
+        jwksUri: string;
+    };
+    /**
+     * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+     * available for JWT verification. Use this method to speed up the first JWT verification
+     * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+     * in case the JwtVerifier does not have internet access to download the JWKS
+     *
+     * @param jwksThe JWKS
+     * @param issuer The issuer for which you want to cache the JWKS
+     *  Supply this field, if you instantiated the JwtVerifier with multiple issuers
+     * @returns void
+     */
+    cacheJwks(...[jwks, issuer]: MultiIssuer extends false ? [jwks: Jwks, issuer?: string] : [jwks: Jwks, issuer: string]): void;
+    /**
+     * Hydrate the JWKS cache for (all of) the configured issuer(s).
+     * This will fetch and cache the latest and greatest JWKS for concerned issuer(s).
+     *
+     * @param issuer The issuer to fetch the JWKS for
+     * @returns void
+     */
+    hydrate(): Promise<void>;
+    /**
+     * Verify (synchronously) a JWT that is signed using RS256 / RS384 / RS512.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    verifySync(...[jwt, properties]: VerifyParameters<SpecificVerifyProperties>): JwtPayload;
+    /**
+     * Verify (synchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
+     *
+     * @param decomposedJwt The decomposed Jwt
+     * @param jwk The JWK to verify the JWTs signature with
+     * @param verifyProperties The properties to use for verification
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    protected verifyDecomposedJwtSync(decomposedJwt: DecomposedJwt, jwksUri: string, verifyProperties: SpecificVerifyProperties): JwtPayload;
+    /**
+     * Verify (asynchronously) a JWT that is signed using RS256 / RS384 / RS512.
+     * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+     * in case it is not yet available in the cache.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+     */
+    verify(...[jwt, properties]: VerifyParameters<SpecificVerifyProperties>): Promise<JwtPayload>;
+    /**
+     * Verify (asynchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
+     *
+     * @param decomposedJwt The decomposed Jwt
+     * @param jwk The JWK to verify the JWTs signature with
+     * @param verifyProperties The properties to use for verification
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    protected verifyDecomposedJwt(decomposedJwt: DecomposedJwt, jwksUri: string, verifyProperties: SpecificVerifyProperties): Promise<JwtPayload>;
+    /**
+     * Get the verification parameters to use, by merging the issuer configuration,
+     * with the overriding properties that are now provided
+     *
+     * @param jwt: the JWT that is going to be verified
+     * @param verifyProperties: the overriding properties, that override the issuer configuration
+     * @returns The merged verification parameters
+     */
+    protected getVerifyParameters(jwt: string, verifyProperties?: Partial<SpecificVerifyProperties>): {
+        decomposedJwt: DecomposedJwt;
+        jwksUri: string;
+        verifyProperties: SpecificVerifyProperties;
+    };
+    /**
+     * Get issuer config with JWKS URI, by adding a default JWKS URI if needed
+     *
+     * @param config: the issuer config.
+     * @returns The config with JWKS URI
+     */
+    private withJwksUri;
+}
+/**
+ * Class representing a verifier for JWTs signed with RSA (e.g. RS256 / RS384 / RS512)
+ */
+export declare class JwtRsaVerifier<SpecificVerifyProperties extends Partial<VerifyProperties>, IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties>, MultiIssuer extends boolean> extends JwtRsaVerifierBase<SpecificVerifyProperties, IssuerConfig, MultiIssuer> {
+    /**
+     * Create an RSA JWT verifier for a single issuer
+     *
+     * @param verifyProperties The verification properties for your issuer
+     * @param additionalProperties Additional properties
+     * @param additionalProperties.jwksCache Overriding JWKS cache that you want to use
+     * @returns An RSA JWT Verifier instance, that you can use to verify JWTs with
+     */
+    static create<T extends JwtRsaVerifierProperties<VerifyProperties>>(verifyProperties: T & Partial<JwtRsaVerifierProperties<VerifyProperties>>, additionalProperties?: {
+        jwksCache: JwksCache;
+    }): JwtRsaVerifierSingleIssuer<T>;
+    /**
+     * Create an RSA JWT verifier for multiple issuer
+     *
+     * @param verifyProperties An array of verification properties, one for each issuer
+     * @param additionalProperties Additional properties
+     * @param additionalProperties.jwksCache Overriding JWKS cache that you want to use
+     * @returns An RSA JWT Verifier instance, that you can use to verify JWTs with
+     */
+    static create<T extends JwtRsaVerifierMultiProperties<VerifyProperties>>(verifyProperties: (T & Partial<JwtRsaVerifierProperties<VerifyProperties>>)[], additionalProperties?: {
+        jwksCache: JwksCache;
+    }): JwtRsaVerifierMultiIssuer<T>;
+}
+/**
+ * Type for a generic key object, at runtime either the Node.js or WebCrypto concrete key object is used
+ */
+type GenericKeyObject = Object;
+/**
+ * Transform (synchronously) the JWK into an RSA public key in crypto native key object format
+ *
+ * @param jwk: the JWK
+ * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+ * @param issuer: the issuer that uses the JWK for signing JWTs (may be used for caching the transformation)
+ * @returns the RSA public key in crypto native key object format
+ */
+export type JwkToKeyObjectTransformerSync = (jwk: RsaSignatureJwk, jwtHeaderAlg?: SupportedSignatureAlgorithm, issuer?: string) => GenericKeyObject;
+/**
+ * Transform (asynchronously) the JWK into an RSA public key in crypto native key object format
+ *
+ * @param jwk: the JWK
+ * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+ * @param issuer: the issuer that uses the JWK for signing JWTs (may be used for caching the transformation)
+ * @returns Promise that will resolve with the RSA public key in crypto native key object format
+ */
+export type JwkToKeyObjectTransformerAsync = AsAsync<JwkToKeyObjectTransformerSync>;
+/**
+ * Class representing a cache of RSA public keys in native key object format
+ *
+ * Because it takes a bit of compute time to turn a JWK into native key object format,
+ * we want to cache this computation.
+ */
+export declare class KeyObjectCache {
+    transformJwkToKeyObjectSyncFn: JwkToKeyObjectTransformerSync;
+    transformJwkToKeyObjectAsyncFn: JwkToKeyObjectTransformerAsync;
+    private publicKeys;
+    constructor(transformJwkToKeyObjectSyncFn?: JwkToKeyObjectTransformerSync, transformJwkToKeyObjectAsyncFn?: JwkToKeyObjectTransformerAsync);
+    /**
+     * Transform the JWK into an RSA public key in native key object format.
+     * If the transformed JWK is already in the cache, it is returned from the cache instead.
+     *
+     * @param jwk: the JWK
+     * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+     * @param issuer: the issuer that uses the JWK for signing JWTs (used for caching the transformation)
+     * @returns the RSA public key in native key object format
+     */
+    transformJwkToKeyObjectSync(jwk: RsaSignatureJwk, jwtHeaderAlg?: SupportedSignatureAlgorithm, issuer?: string): GenericKeyObject;
+    /**
+     * Transform the JWK into an RSA public key in native key object format (async).
+     * If the transformed JWK is already in the cache, it is returned from the cache instead.
+     *
+     * @param jwk: the JWK
+     * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+     * @param issuer: the issuer that uses the JWK for signing JWTs (used for caching the transformation)
+     * @returns the RSA public key in native key object format
+     */
+    transformJwkToKeyObjectAsync(jwk: RsaSignatureJwk, jwtHeaderAlg?: SupportedSignatureAlgorithm, issuer?: string): Promise<GenericKeyObject>;
+    private putKeyObjectInCache;
+    clearCache(issuer: Issuer): void;
+}
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/jwt.d.ts

@@ -0,0 +1,51 @@
+import { JwtHeader, JwtPayload } from "./jwt-model.js";
+/**
+ * Sanity check, decompose and JSON parse a JWT string into its constituent, and yet unverified, parts:
+ * - header object
+ * - payload object
+ * - signature string
+ *
+ * This function does NOT verify a JWT, do not trust the returned payload and header!
+ *
+ * For most use cases, you would not want to call this function directly yourself, rather you
+ * would call verify() with the JWT, which would call this function (and others) for you.
+ *
+ * @param jwt The JWT (as string)
+ * @returns the decomposed, and yet unverified, JWT
+ */
+export declare function decomposeUnverifiedJwt(jwt: unknown): DecomposedJwt;
+export interface DecomposedJwt {
+    /**
+     * The yet unverified (!) header of the JWT
+     */
+    header: JwtHeader;
+    /**
+     * The yet unverified (!) header of the JWT, as base64url-encoded string
+     */
+    headerB64: string;
+    /**
+     * The yet unverified (!) payload of the JWT
+     */
+    payload: JwtPayload;
+    /**
+     * The yet unverified (!) payload of the JWT, as base64url-encoded string
+     */
+    payloadB64: string;
+    /**
+     * The yet unverified (!) signature of the JWT, as base64url-encoded string
+     */
+    signatureB64: string;
+}
+/**
+ * Validate JWT payload fields. Throws an error in case there's any validation issue.
+ *
+ * @param payload The (JSON parsed) JWT payload
+ * @param options The options to use during validation
+ * @returns void
+ */
+export declare function validateJwtFields(payload: JwtPayload, options: {
+    issuer?: string | string[] | null;
+    audience?: string | string[] | null;
+    scope?: string | string[] | null;
+    graceSeconds?: number;
+}): void;

package/assets/api/vendor_modules/aws-jwt-verify/package.json

@@ -0,0 +1,136 @@
+{
+  "name": "aws-jwt-verify",
+  "version": "4.0.1",
+  "description": "Verify RS256/RS384/RS512 signed JSON Web Tokens (JWT)",
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Amazon Web Services",
+    "url": "https://aws.amazon.com"
+  },
+  "main": "dist/cjs/index.js",
+  "type": "commonjs",
+  "types": "index.d.ts",
+  "module": "dist/esm/index.js",
+  "files": [
+    "asn1.d.ts",
+    "assert.d.ts",
+    "cognito-verifier.d.ts",
+    "dist",
+    "error.d.ts",
+    "https-common.d.ts",
+    "https-node.d.ts",
+    "https.d.ts",
+    "index.d.ts",
+    "jwk.d.ts",
+    "jwt-model.d.ts",
+    "jwt-rsa.d.ts",
+    "jwt.d.ts",
+    "safe-json-parse.d.ts",
+    "typing-util.d.ts"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js",
+      "types": "./index.d.ts"
+    },
+    "./asn1": {
+      "import": "./dist/esm/asn1.js",
+      "require": "./dist/cjs/asn1.js",
+      "types": "./asn1.d.ts"
+    },
+    "./assert": {
+      "import": "./dist/esm/assert.js",
+      "require": "./dist/cjs/assert.js",
+      "types": "./assert.d.ts"
+    },
+    "./cognito-verifier": {
+      "import": "./dist/esm/cognito-verifier.js",
+      "require": "./dist/cjs/cognito-verifier.js",
+      "types": "./cognito-verifier.d.ts"
+    },
+    "./error": {
+      "import": "./dist/esm/error.js",
+      "require": "./dist/cjs/error.js",
+      "types": "./error.d.ts"
+    },
+    "./https": {
+      "import": "./dist/esm/https.js",
+      "require": "./dist/cjs/https.js",
+      "types": "./https.d.ts"
+    },
+    "./jwk": {
+      "import": "./dist/esm/jwk.js",
+      "require": "./dist/cjs/jwk.js",
+      "types": "./jwk.d.ts"
+    },
+    "./jwt": {
+      "import": "./dist/esm/jwt.js",
+      "require": "./dist/cjs/jwt.js",
+      "types": "./jwt.d.ts"
+    },
+    "./jwt-model": {
+      "import": "./dist/esm/jwt-model.js",
+      "require": "./dist/cjs/jwt-model.js",
+      "types": "./jwt-model.d.ts"
+    },
+    "./jwt-rsa": {
+      "import": "./dist/esm/jwt-rsa.js",
+      "require": "./dist/cjs/jwt-rsa.js",
+      "types": "./jwt-rsa.d.ts"
+    },
+    "./safe-json-parse": {
+      "import": "./dist/esm/safe-json-parse.js",
+      "require": "./dist/cjs/safe-json-parse.js",
+      "types": "./safe-json-parse.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@tsconfig/node14": "^1.0.3",
+    "@types/jest": "^29.2.5",
+    "@typescript-eslint/eslint-plugin": "^5.48.0",
+    "@typescript-eslint/parser": "^5.48.0",
+    "eslint": "^8.31.0",
+    "eslint-plugin-security": "^1.5.0",
+    "jest": "^29.3.1",
+    "jest-junit": "^15.0.0",
+    "nock": "^13.2.9",
+    "prettier": "^2.8.1",
+    "ts-jest": "^29.0.3",
+    "ts-node": "^10.9.1",
+    "typescript": "^4.9.4"
+  },
+  "scripts": {
+    "dist:cjs": "tsc --module CommonJS --outDir dist/cjs && node dist-create-package.cjs cjs",
+    "dist:esm": "tsc --module ES2020 --outDir dist/esm && node dist-create-package.cjs esm",
+    "dist:types": "tsc --declarationDir . --declaration --emitDeclarationOnly",
+    "dist": "rm -rf dist && npm run dist:cjs && npm run dist:esm && npm run dist:types",
+    "lint:check": "eslint . --ignore-path .gitignore --max-warnings 0",
+    "lint": "eslint . --fix --ignore-path .gitignore --max-warnings 0",
+    "pack-for-tests": "rm -f aws-jwt-verify.tgz 'aws-jwt-verify-?.?.?.tgz' && npm pack && mv aws-jwt-verify-*.tgz aws-jwt-verify.tgz",
+    "prepack": "npm run dist",
+    "prettier:check": "prettier --check .",
+    "prettier": "prettier -w .",
+    "test:all": "npm run prettier:check && npm run lint && npm run test:unit && npm run test:install && npm run test:import && npm run test:browser && npm run test:cognito && npm run test:speed",
+    "test:cognito": "cd tests/cognito && npm remove aws-jwt-verify.tgz && npm install --no-save --force --no-package-lock ../../aws-jwt-verify.tgz && npm run test",
+    "test:import": "cd tests/import-tests && npm remove aws-jwt-verify.tgz && npm install --no-save --force --no-package-lock ../../aws-jwt-verify.tgz && node esm.mjs && node commonjs.cjs && tsc -v && tsc && node typescript.js && tsc -p tsconfig-nodenext.json && node typescript.js && COMPILE_ERRORS=$(2>&1 tsc -p tsconfig-should-not-compile.json || true) && ([ \"$COMPILE_ERRORS\" != \"\" ] || (echo \"Ooops I did compile successfully :(\"; false))",
+    "test:install": "./tests/installation-and-basic-usage/run-tests.sh",
+    "test:browser": "cd tests/vite-app && npm remove aws-jwt-verify.tgz && npm install --no-save --force --no-package-lock ../../aws-jwt-verify.tgz && ./run-tests.sh",
+    "test:speed": "jest -t \"speed\"",
+    "test:unit": "jest --collect-coverage -t \"unit\" --testMatch '**/*.test.ts' --reporters=\"jest-junit\" --reporters=\"default\"",
+    "test": "npm run test:unit",
+    "tsc": "tsc"
+  },
+  "prettier": {
+    "trailingComma": "es5",
+    "tabWidth": 2,
+    "semi": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/awslabs/aws-jwt-verify.git"
+  },
+  "engines": {
+    "node": ">=14.0.0"
+  }
+}

package/assets/api/vendor_modules/aws-jwt-verify/safe-json-parse.d.ts

@@ -0,0 +1,18 @@
+/** JSON type */
+export type Json = null | string | number | boolean | Json[] | JsonObject;
+/** JSON Object type */
+export type JsonObject = {
+    [name: string]: Json;
+};
+/**
+ * Check if a piece of JSON is a JSON object, and not e.g. a mere string or null
+ *
+ * @param j - the JSON
+ */
+export declare function isJsonObject(j: Json): j is JsonObject;
+/**
+ * Parse a string as JSON, while removing __proto__ and constructor, so JS prototype pollution is prevented
+ *
+ * @param s - the string to JSON parse
+ */
+export declare function safeJsonParse(s: string): Json;

package/assets/api/vendor_modules/aws-jwt-verify/typing-util.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Type that returns the list of fields in Base, that are not part of Provided
+ *
+ * @param Base The base object
+ * @param Provided The object whose fields should be omitted from the field list of base
+ */
+type StillToProvideVerifyKeys<Base, Provided> = keyof Omit<Base, keyof Provided>;
+/**
+ * Type that returns the Base type, with only those properties, that are not part of Provided
+ *
+ * @param Base The base object
+ * @param Provided The object whose fields should be omitted from base
+ */
+type StillToProvideProperties<Base, Provided> = {
+    [key in StillToProvideVerifyKeys<WithoutOptionalFields<Base>, WithoutOptionalFields<Provided>>]: Base[key];
+};
+/**
+ * Type that returns all optional fields of the input type
+ *
+ * @param T The type to extract optional fields from
+ */
+type ExtractOptionalFields<T> = {
+    [P in keyof T]-?: undefined extends T[P] ? P : never;
+}[keyof T];
+/**
+ * Type that is similar to the input type, but only contains its mandatory properties
+ *
+ * @param T The type to return without optional fields
+ */
+type WithoutOptionalFields<T> = Omit<T, ExtractOptionalFields<T>>;
+/**
+ * Type that returns merged properties as follows:
+ * - Properties in Base that are not in Provided, are mandatory
+ * - Properties in Base that are in Provided, are optional
+ */
+export type Properties<Base, Provided> = StillToProvideProperties<Base, Provided> & Partial<Base>;
+export type AsAsync<T extends (...args: any[]) => unknown> = (...args: Parameters<T>) => Promise<ReturnType<T>>;
+export {};