@gjsify/crypto 0.3.12 → 0.3.14

package/lib/esm/key-object.js

@@ -1,330 +1,371 @@
+import { derToPem, encodePrivateKeyInfo, encodeRsaPrivateKeyPkcs1, encodeRsaPublicKeyPkcs1, encodeSubjectPublicKeyInfo, parsePemKey, rsaKeySize } from "./asn1.js";
 import { Buffer } from "node:buffer";
-import {
-  parsePemKey,
-  rsaKeySize,
-  encodeSubjectPublicKeyInfo,
-  encodeRsaPublicKeyPkcs1,
-  encodeRsaPrivateKeyPkcs1,
-  encodePrivateKeyInfo,
-  derToPem
-} from "./asn1.js";
+
+//#region src/key-object.ts
+/** Convert BigInt to base64url-encoded string (no padding). */
 function bigintToBase64url(value) {
-  if (value === 0n) return "AA";
-  const hex = value.toString(16);
-  const paddedHex = hex.length % 2 ? "0" + hex : hex;
-  const bytes = [];
-  for (let i = 0; i < paddedHex.length; i += 2) {
-    bytes.push(parseInt(paddedHex.substring(i, i + 2), 16));
-  }
-  return Buffer.from(bytes).toString("base64url");
+	if (value === 0n) return "AA";
+	const hex = value.toString(16);
+	const paddedHex = hex.length % 2 ? "0" + hex : hex;
+	const bytes = [];
+	for (let i = 0; i < paddedHex.length; i += 2) {
+		bytes.push(parseInt(paddedHex.substring(i, i + 2), 16));
+	}
+	return Buffer.from(bytes).toString("base64url");
 }
+/** Convert base64url-encoded string to BigInt. */
 function base64urlToBigint(b64) {
-  const buf = Buffer.from(b64, "base64url");
-  let result = 0n;
-  for (let i = 0; i < buf.length; i++) {
-    result = result << 8n | BigInt(buf[i]);
-  }
-  return result;
-}
-class KeyObject {
-  type;
-  /** @internal */
-  _handle;
-  constructor(type, handle) {
-    if (type !== "secret" && type !== "public" && type !== "private") {
-      throw new TypeError(`Invalid KeyObject type: ${type}`);
-    }
-    this.type = type;
-    this._handle = handle;
-  }
-  get symmetricKeySize() {
-    if (this.type !== "secret") return void 0;
-    return this._handle.byteLength;
-  }
-  get asymmetricKeyType() {
-    if (this.type === "secret") return void 0;
-    const handle = this._handle;
-    if (handle.parsed.type === "rsa-public" || handle.parsed.type === "rsa-private") {
-      return "rsa";
-    }
-    return void 0;
-  }
-  get asymmetricKeySize() {
-    if (this.type === "secret") return void 0;
-    const handle = this._handle;
-    if (handle.parsed.type === "rsa-public") {
-      return rsaKeySize(handle.parsed.components.n) / 8;
-    }
-    if (handle.parsed.type === "rsa-private") {
-      return rsaKeySize(handle.parsed.components.n) / 8;
-    }
-    return void 0;
-  }
-  equals(otherKeyObject) {
-    if (!(otherKeyObject instanceof KeyObject)) return false;
-    if (this.type !== otherKeyObject.type) return false;
-    if (this.type === "secret") {
-      const a2 = this._handle;
-      const b2 = otherKeyObject._handle;
-      if (a2.byteLength !== b2.byteLength) return false;
-      for (let i = 0; i < a2.byteLength; i++) {
-        if (a2[i] !== b2[i]) return false;
-      }
-      return true;
-    }
-    const a = this._handle;
-    const b = otherKeyObject._handle;
-    return a.pem === b.pem;
-  }
-  export(options) {
-    if (this.type === "secret") {
-      const key = this._handle;
-      if (options?.format === "jwk") {
-        return {
-          kty: "oct",
-          k: Buffer.from(key).toString("base64url")
-        };
-      }
-      return Buffer.from(key);
-    }
-    const handle = this._handle;
-    const format = options?.format ?? "pem";
-    const keyType = options?.type;
-    if (format === "jwk") {
-      return exportJwk(handle.parsed, this.type);
-    }
-    if (format === "pem") {
-      if (handle.pem && !handle.pem.startsWith("[")) {
-        return handle.pem;
-      }
-      return generatePem(handle.parsed, this.type, keyType);
-    }
-    if (format === "der") {
-      if (handle.pem && !handle.pem.startsWith("[")) {
-        const lines = handle.pem.trim().split(/\r?\n/);
-        const headerIdx = lines.findIndex((l) => l.startsWith("-----BEGIN "));
-        const footerIdx = lines.findIndex((l, i) => i > headerIdx && l.startsWith("-----END "));
-        const base64Body = lines.slice(headerIdx + 1, footerIdx).join("");
-        return Buffer.from(base64Body, "base64");
-      }
-      return generateDer(handle.parsed, this.type, keyType);
-    }
-    throw new TypeError(`Unsupported export format: ${format}`);
-  }
-  get [Symbol.toStringTag]() {
-    return "KeyObject";
-  }
+	const buf = Buffer.from(b64, "base64url");
+	let result = 0n;
+	for (let i = 0; i < buf.length; i++) {
+		result = result << 8n | BigInt(buf[i]);
+	}
+	return result;
 }
+var KeyObject = class KeyObject {
+	type;
+	/** @internal */
+	_handle;
+	constructor(type, handle) {
+		if (type !== "secret" && type !== "public" && type !== "private") {
+			throw new TypeError(`Invalid KeyObject type: ${type}`);
+		}
+		this.type = type;
+		this._handle = handle;
+	}
+	get symmetricKeySize() {
+		if (this.type !== "secret") return undefined;
+		return this._handle.byteLength;
+	}
+	get asymmetricKeyType() {
+		if (this.type === "secret") return undefined;
+		const handle = this._handle;
+		if (handle.parsed.type === "rsa-public" || handle.parsed.type === "rsa-private") {
+			return "rsa";
+		}
+		return undefined;
+	}
+	get asymmetricKeySize() {
+		if (this.type === "secret") return undefined;
+		const handle = this._handle;
+		if (handle.parsed.type === "rsa-public") {
+			return rsaKeySize(handle.parsed.components.n) / 8;
+		}
+		if (handle.parsed.type === "rsa-private") {
+			return rsaKeySize(handle.parsed.components.n) / 8;
+		}
+		return undefined;
+	}
+	equals(otherKeyObject) {
+		if (!(otherKeyObject instanceof KeyObject)) return false;
+		if (this.type !== otherKeyObject.type) return false;
+		if (this.type === "secret") {
+			const a = this._handle;
+			const b = otherKeyObject._handle;
+			if (a.byteLength !== b.byteLength) return false;
+			for (let i = 0; i < a.byteLength; i++) {
+				if (a[i] !== b[i]) return false;
+			}
+			return true;
+		}
+		const a = this._handle;
+		const b = otherKeyObject._handle;
+		return a.pem === b.pem;
+	}
+	export(options) {
+		if (this.type === "secret") {
+			const key = this._handle;
+			if (options?.format === "jwk") {
+				return {
+					kty: "oct",
+					k: Buffer.from(key).toString("base64url")
+				};
+			}
+			return Buffer.from(key);
+		}
+		const handle = this._handle;
+		const format = options?.format ?? "pem";
+		const keyType = options?.type;
+		if (format === "jwk") {
+			return exportJwk(handle.parsed, this.type);
+		}
+		if (format === "pem") {
+			if (handle.pem && !handle.pem.startsWith("[")) {
+				return handle.pem;
+			}
+			return generatePem(handle.parsed, this.type, keyType);
+		}
+		if (format === "der") {
+			if (handle.pem && !handle.pem.startsWith("[")) {
+				const lines = handle.pem.trim().split(/\r?\n/);
+				const headerIdx = lines.findIndex((l) => l.startsWith("-----BEGIN "));
+				const footerIdx = lines.findIndex((l, i) => i > headerIdx && l.startsWith("-----END "));
+				const base64Body = lines.slice(headerIdx + 1, footerIdx).join("");
+				return Buffer.from(base64Body, "base64");
+			}
+			return generateDer(handle.parsed, this.type, keyType);
+		}
+		throw new TypeError(`Unsupported export format: ${format}`);
+	}
+	get [Symbol.toStringTag]() {
+		return "KeyObject";
+	}
+};
 function exportJwk(parsed, keyType) {
-  if (parsed.type === "rsa-public") {
-    return {
-      kty: "RSA",
-      n: bigintToBase64url(parsed.components.n),
-      e: bigintToBase64url(parsed.components.e)
-    };
-  }
-  if (parsed.type === "rsa-private") {
-    if (keyType === "public") {
-      return {
-        kty: "RSA",
-        n: bigintToBase64url(parsed.components.n),
-        e: bigintToBase64url(parsed.components.e)
-      };
-    }
-    const { n, e, d, p, q } = parsed.components;
-    const dp = d % (p - 1n);
-    const dq = d % (q - 1n);
-    const qi = modInverse(q, p);
-    return {
-      kty: "RSA",
-      n: bigintToBase64url(n),
-      e: bigintToBase64url(e),
-      d: bigintToBase64url(d),
-      p: bigintToBase64url(p),
-      q: bigintToBase64url(q),
-      dp: bigintToBase64url(dp),
-      dq: bigintToBase64url(dq),
-      qi: bigintToBase64url(qi)
-    };
-  }
-  throw new Error("Unsupported key type for JWK export");
+	if (parsed.type === "rsa-public") {
+		return {
+			kty: "RSA",
+			n: bigintToBase64url(parsed.components.n),
+			e: bigintToBase64url(parsed.components.e)
+		};
+	}
+	if (parsed.type === "rsa-private") {
+		if (keyType === "public") {
+			return {
+				kty: "RSA",
+				n: bigintToBase64url(parsed.components.n),
+				e: bigintToBase64url(parsed.components.e)
+			};
+		}
+		const { n, e, d, p, q } = parsed.components;
+		const dp = d % (p - 1n);
+		const dq = d % (q - 1n);
+		const qi = modInverse(q, p);
+		return {
+			kty: "RSA",
+			n: bigintToBase64url(n),
+			e: bigintToBase64url(e),
+			d: bigintToBase64url(d),
+			p: bigintToBase64url(p),
+			q: bigintToBase64url(q),
+			dp: bigintToBase64url(dp),
+			dq: bigintToBase64url(dq),
+			qi: bigintToBase64url(qi)
+		};
+	}
+	throw new Error("Unsupported key type for JWK export");
 }
 function importJwkRsa(jwk) {
-  if (jwk.d) {
-    const components2 = {
-      n: base64urlToBigint(jwk.n),
-      e: base64urlToBigint(jwk.e),
-      d: base64urlToBigint(jwk.d),
-      p: base64urlToBigint(jwk.p),
-      q: base64urlToBigint(jwk.q)
-    };
-    const parsed2 = { type: "rsa-private", components: components2 };
-    const der2 = encodeRsaPrivateKeyPkcs1(components2);
-    const pem2 = derToPem(der2, "RSA PRIVATE KEY");
-    return { parsed: parsed2, pem: pem2 };
-  }
-  const components = {
-    n: base64urlToBigint(jwk.n),
-    e: base64urlToBigint(jwk.e)
-  };
-  const parsed = { type: "rsa-public", components };
-  const der = encodeSubjectPublicKeyInfo(components);
-  const pem = derToPem(der, "PUBLIC KEY");
-  return { parsed, pem };
+	if (jwk.d) {
+		const components = {
+			n: base64urlToBigint(jwk.n),
+			e: base64urlToBigint(jwk.e),
+			d: base64urlToBigint(jwk.d),
+			p: base64urlToBigint(jwk.p),
+			q: base64urlToBigint(jwk.q)
+		};
+		const parsed = {
+			type: "rsa-private",
+			components
+		};
+		const der = encodeRsaPrivateKeyPkcs1(components);
+		const pem = derToPem(der, "RSA PRIVATE KEY");
+		return {
+			parsed,
+			pem
+		};
+	}
+	const components = {
+		n: base64urlToBigint(jwk.n),
+		e: base64urlToBigint(jwk.e)
+	};
+	const parsed = {
+		type: "rsa-public",
+		components
+	};
+	const der = encodeSubjectPublicKeyInfo(components);
+	const pem = derToPem(der, "PUBLIC KEY");
+	return {
+		parsed,
+		pem
+	};
 }
 function generatePem(parsed, keyType, type) {
-  if (parsed.type === "rsa-public") {
-    if (type === "pkcs1") {
-      const der2 = encodeRsaPublicKeyPkcs1(parsed.components);
-      return derToPem(der2, "RSA PUBLIC KEY");
-    }
-    const der = encodeSubjectPublicKeyInfo(parsed.components);
-    return derToPem(der, "PUBLIC KEY");
-  }
-  if (parsed.type === "rsa-private" && keyType === "public") {
-    const pubComponents = {
-      n: parsed.components.n,
-      e: parsed.components.e
-    };
-    if (type === "pkcs1") {
-      const der2 = encodeRsaPublicKeyPkcs1(pubComponents);
-      return derToPem(der2, "RSA PUBLIC KEY");
-    }
-    const der = encodeSubjectPublicKeyInfo(pubComponents);
-    return derToPem(der, "PUBLIC KEY");
-  }
-  if (parsed.type === "rsa-private") {
-    if (type === "pkcs8") {
-      const der2 = encodePrivateKeyInfo(parsed.components);
-      return derToPem(der2, "PRIVATE KEY");
-    }
-    const der = encodeRsaPrivateKeyPkcs1(parsed.components);
-    return derToPem(der, "RSA PRIVATE KEY");
-  }
-  throw new Error("Cannot generate PEM for this key type");
+	if (parsed.type === "rsa-public") {
+		if (type === "pkcs1") {
+			const der = encodeRsaPublicKeyPkcs1(parsed.components);
+			return derToPem(der, "RSA PUBLIC KEY");
+		}
+		const der = encodeSubjectPublicKeyInfo(parsed.components);
+		return derToPem(der, "PUBLIC KEY");
+	}
+	if (parsed.type === "rsa-private" && keyType === "public") {
+		const pubComponents = {
+			n: parsed.components.n,
+			e: parsed.components.e
+		};
+		if (type === "pkcs1") {
+			const der = encodeRsaPublicKeyPkcs1(pubComponents);
+			return derToPem(der, "RSA PUBLIC KEY");
+		}
+		const der = encodeSubjectPublicKeyInfo(pubComponents);
+		return derToPem(der, "PUBLIC KEY");
+	}
+	if (parsed.type === "rsa-private") {
+		if (type === "pkcs8") {
+			const der = encodePrivateKeyInfo(parsed.components);
+			return derToPem(der, "PRIVATE KEY");
+		}
+		const der = encodeRsaPrivateKeyPkcs1(parsed.components);
+		return derToPem(der, "RSA PRIVATE KEY");
+	}
+	throw new Error("Cannot generate PEM for this key type");
 }
 function generateDer(parsed, keyType, type) {
-  if (parsed.type === "rsa-public") {
-    if (type === "pkcs1") {
-      return Buffer.from(encodeRsaPublicKeyPkcs1(parsed.components));
-    }
-    return Buffer.from(encodeSubjectPublicKeyInfo(parsed.components));
-  }
-  if (parsed.type === "rsa-private" && keyType === "public") {
-    const pubComponents = {
-      n: parsed.components.n,
-      e: parsed.components.e
-    };
-    if (type === "pkcs1") {
-      return Buffer.from(encodeRsaPublicKeyPkcs1(pubComponents));
-    }
-    return Buffer.from(encodeSubjectPublicKeyInfo(pubComponents));
-  }
-  if (parsed.type === "rsa-private") {
-    if (type === "pkcs8") {
-      return Buffer.from(encodePrivateKeyInfo(parsed.components));
-    }
-    return Buffer.from(encodeRsaPrivateKeyPkcs1(parsed.components));
-  }
-  throw new Error("Cannot generate DER for this key type");
+	if (parsed.type === "rsa-public") {
+		if (type === "pkcs1") {
+			return Buffer.from(encodeRsaPublicKeyPkcs1(parsed.components));
+		}
+		return Buffer.from(encodeSubjectPublicKeyInfo(parsed.components));
+	}
+	if (parsed.type === "rsa-private" && keyType === "public") {
+		const pubComponents = {
+			n: parsed.components.n,
+			e: parsed.components.e
+		};
+		if (type === "pkcs1") {
+			return Buffer.from(encodeRsaPublicKeyPkcs1(pubComponents));
+		}
+		return Buffer.from(encodeSubjectPublicKeyInfo(pubComponents));
+	}
+	if (parsed.type === "rsa-private") {
+		if (type === "pkcs8") {
+			return Buffer.from(encodePrivateKeyInfo(parsed.components));
+		}
+		return Buffer.from(encodeRsaPrivateKeyPkcs1(parsed.components));
+	}
+	throw new Error("Cannot generate DER for this key type");
 }
 function modInverse(a, m) {
-  let [old_r, r] = [a % m, m];
-  let [old_s, s] = [1n, 0n];
-  while (r !== 0n) {
-    const q = old_r / r;
-    [old_r, r] = [r, old_r - q * r];
-    [old_s, s] = [s, old_s - q * s];
-  }
-  return (old_s % m + m) % m;
+	let [old_r, r] = [a % m, m];
+	let [old_s, s] = [1n, 0n];
+	while (r !== 0n) {
+		const q = old_r / r;
+		[old_r, r] = [r, old_r - q * r];
+		[old_s, s] = [s, old_s - q * s];
+	}
+	return (old_s % m + m) % m;
 }
+/**
+* Create a secret key from raw bytes.
+*/
 function createSecretKey(key, encoding) {
-  let keyBuf;
-  if (typeof key === "string") {
-    keyBuf = Buffer.from(key, encoding ?? "utf8");
-  } else {
-    keyBuf = new Uint8Array(key);
-  }
-  return new KeyObject("secret", keyBuf);
+	let keyBuf;
+	if (typeof key === "string") {
+		keyBuf = Buffer.from(key, encoding ?? "utf8");
+	} else {
+		keyBuf = new Uint8Array(key);
+	}
+	return new KeyObject("secret", keyBuf);
 }
+/**
+* Create a public key from PEM, DER, JWK, or another KeyObject.
+*/
 function createPublicKey(key) {
-  if (key instanceof KeyObject) {
-    if (key.type === "public") return key;
-    if (key.type === "private") {
-      const handle = key._handle;
-      if (handle.parsed.type === "rsa-private") {
-        const pubComponents = {
-          n: handle.parsed.components.n,
-          e: handle.parsed.components.e
-        };
-        const pubParsed = { type: "rsa-public", components: pubComponents };
-        const der = encodeSubjectPublicKeyInfo(pubComponents);
-        const pem2 = derToPem(der, "PUBLIC KEY");
-        return new KeyObject("public", { parsed: pubParsed, pem: pem2 });
-      }
-    }
-    throw new TypeError("Cannot create public key from secret key");
-  }
-  if (typeof key === "object" && !Buffer.isBuffer(key) && "key" in key) {
-    const input = key;
-    if (input.format === "jwk") {
-      const jwk = input.key;
-      if (jwk.kty === "RSA") {
-        const { parsed: parsed2, pem: pem2 } = importJwkRsa({ n: jwk.n, e: jwk.e });
-        return new KeyObject("public", { parsed: parsed2, pem: pem2 });
-      }
-      throw new Error(`Unsupported JWK key type: ${jwk.kty}`);
-    }
-  }
-  const pem = normalizePem(key);
-  const parsed = parsePemKey(pem);
-  if (parsed.type === "rsa-private") {
-    const pubComponents = {
-      n: parsed.components.n,
-      e: parsed.components.e
-    };
-    const pubParsed = { type: "rsa-public", components: pubComponents };
-    const der = encodeSubjectPublicKeyInfo(pubComponents);
-    const pubPem = derToPem(der, "PUBLIC KEY");
-    return new KeyObject("public", { parsed: pubParsed, pem: pubPem });
-  }
-  return new KeyObject("public", { parsed, pem });
+	if (key instanceof KeyObject) {
+		if (key.type === "public") return key;
+		if (key.type === "private") {
+			const handle = key._handle;
+			if (handle.parsed.type === "rsa-private") {
+				const pubComponents = {
+					n: handle.parsed.components.n,
+					e: handle.parsed.components.e
+				};
+				const pubParsed = {
+					type: "rsa-public",
+					components: pubComponents
+				};
+				const der = encodeSubjectPublicKeyInfo(pubComponents);
+				const pem = derToPem(der, "PUBLIC KEY");
+				return new KeyObject("public", {
+					parsed: pubParsed,
+					pem
+				});
+			}
+		}
+		throw new TypeError("Cannot create public key from secret key");
+	}
+	if (typeof key === "object" && !Buffer.isBuffer(key) && "key" in key) {
+		const input = key;
+		if (input.format === "jwk") {
+			const jwk = input.key;
+			if (jwk.kty === "RSA") {
+				const { parsed, pem } = importJwkRsa({
+					n: jwk.n,
+					e: jwk.e
+				});
+				return new KeyObject("public", {
+					parsed,
+					pem
+				});
+			}
+			throw new Error(`Unsupported JWK key type: ${jwk.kty}`);
+		}
+	}
+	const pem = normalizePem(key);
+	const parsed = parsePemKey(pem);
+	if (parsed.type === "rsa-private") {
+		const pubComponents = {
+			n: parsed.components.n,
+			e: parsed.components.e
+		};
+		const pubParsed = {
+			type: "rsa-public",
+			components: pubComponents
+		};
+		const der = encodeSubjectPublicKeyInfo(pubComponents);
+		const pubPem = derToPem(der, "PUBLIC KEY");
+		return new KeyObject("public", {
+			parsed: pubParsed,
+			pem: pubPem
+		});
+	}
+	return new KeyObject("public", {
+		parsed,
+		pem
+	});
 }
+/**
+* Create a private key from PEM, DER, JWK, or KeyInput.
+*/
 function createPrivateKey(key) {
-  if (typeof key === "object" && !Buffer.isBuffer(key) && "key" in key) {
-    const input = key;
-    if (input.format === "jwk") {
-      const jwk = input.key;
-      if (jwk.kty === "RSA" && jwk.d) {
-        const { parsed: parsed2, pem: pem2 } = importJwkRsa(jwk);
-        return new KeyObject("private", { parsed: parsed2, pem: pem2 });
-      }
-      throw new Error("JWK does not contain a private key");
-    }
-  }
-  const pem = normalizePem(key);
-  const parsed = parsePemKey(pem);
-  if (parsed.type !== "rsa-private") {
-    throw new TypeError("Key is not a private key");
-  }
-  return new KeyObject("private", { parsed, pem });
+	if (typeof key === "object" && !Buffer.isBuffer(key) && "key" in key) {
+		const input = key;
+		if (input.format === "jwk") {
+			const jwk = input.key;
+			if (jwk.kty === "RSA" && jwk.d) {
+				const { parsed, pem } = importJwkRsa(jwk);
+				return new KeyObject("private", {
+					parsed,
+					pem
+				});
+			}
+			throw new Error("JWK does not contain a private key");
+		}
+	}
+	const pem = normalizePem(key);
+	const parsed = parsePemKey(pem);
+	if (parsed.type !== "rsa-private") {
+		throw new TypeError("Key is not a private key");
+	}
+	return new KeyObject("private", {
+		parsed,
+		pem
+	});
 }
 function normalizePem(key) {
-  if (typeof key === "string") return key;
-  if (Buffer.isBuffer(key)) return key.toString("utf8");
-  if (key && typeof key === "object" && "key" in key) {
-    const input = key;
-    if (typeof input.key === "string") return input.key;
-    if (Buffer.isBuffer(input.key)) return input.key.toString(input.encoding ?? "utf8");
-    if (input.key instanceof KeyObject) {
-      return input.key.export({ format: "pem" });
-    }
-  }
-  throw new TypeError("Invalid key input");
+	if (typeof key === "string") return key;
+	if (Buffer.isBuffer(key)) return key.toString("utf8");
+	if (key && typeof key === "object" && "key" in key) {
+		const input = key;
+		if (typeof input.key === "string") return input.key;
+		if (Buffer.isBuffer(input.key)) return input.key.toString(input.encoding ?? "utf8");
+		if (input.key instanceof KeyObject) {
+			return input.key.export({ format: "pem" });
+		}
+	}
+	throw new TypeError("Invalid key input");
 }
-export {
-  KeyObject,
-  createPrivateKey,
-  createPublicKey,
-  createSecretKey
-};
+
+//#endregion
+export { KeyObject, createPrivateKey, createPublicKey, createSecretKey };