@nocobase/plugin-idp-oauth 2.3.0-beta.12 → 2.3.0-beta.14

package/dist/node_modules/oidc-provider/node_modules/jose/README.md

@@ -0,0 +1,150 @@
+# jose
+
+`jose` is a JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
+
+## Sponsor
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_dark.png">
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_light.png">
+  <img height="65" align="left" alt="Auth0 by Okta" src="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_light.png">
+</picture>
+
+If you want to quickly add JWT authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. [Create an Auth0 account; it's free!][sponsor-auth0]<br><br>
+
+## [💗 Help the project](https://github.com/sponsors/panva)
+
+Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
+
+## Dependencies: 0
+
+`jose` has no dependencies and it exports tree-shakeable ESM[^cjs].
+
+## Documentation
+
+`jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [jsr.io](https://jsr.io/@panva/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
+
+**`example`** ESM import[^cjs]
+
+```js
+import * as jose from 'jose'
+```
+
+### JSON Web Tokens (JWT)
+
+The `jose` module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.
+
+- [JWT Claims Set Validation & Signature Verification](docs/jwt/verify/functions/jwtVerify.md) using the `jwtVerify` function
+  - [Using a remote JSON Web Key Set (JWKS)](docs/jwks/remote/functions/createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/jwks/local/functions/createLocalJWKSet.md)
+- [Signing](docs/jwt/sign/classes/SignJWT.md) using the `SignJWT` class
+- Utility functions
+  - [Decoding Token's Protected Header](docs/util/decode_protected_header/functions/decodeProtectedHeader.md)
+  - [Decoding JWT Claims Set](docs/util/decode_jwt/functions/decodeJwt.md) prior to its validation
+
+### Encrypted JSON Web Tokens
+
+The `jose` module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.
+
+- [Decryption & JWT Claims Set Validation](docs/jwt/decrypt/functions/jwtDecrypt.md) using the `jwtDecrypt` function
+- [Encryption](docs/jwt/encrypt/classes/EncryptJWT.md) using the `EncryptJWT` class
+- Utility functions
+  - [Decoding Token's Protected Header](docs/util/decode_protected_header/functions/decodeProtectedHeader.md)
+
+### Key Utilities
+
+The `jose` module supports importing, exporting, and generating keys and secrets in various formats, including PEM formats like SPKI, X.509 certificate, and PKCS #8, as well as JSON Web Key (JWK).
+
+- Key Import Functions
+  - [JWK Import](docs/key/import/functions/importJWK.md)
+  - [Public Key Import (SPKI)](docs/key/import/functions/importSPKI.md)
+  - [Public Key Import (X.509 Certificate)](docs/key/import/functions/importX509.md)
+  - [Private Key Import (PKCS #8)](docs/key/import/functions/importPKCS8.md)
+- Key and Secret Generation Functions
+  - [Asymmetric Key Pair Generation](docs/key/generate_key_pair/functions/generateKeyPair.md)
+  - [Symmetric Secret Generation](docs/key/generate_secret/functions/generateSecret.md)
+- Key Export Functions
+  - [JWK Export](docs/key/export/functions/exportJWK.md)
+  - [Private Key Export](docs/key/export/functions/exportPKCS8.md)
+  - [Public Key Export](docs/key/export/functions/exportSPKI.md)
+
+### JSON Web Signature (JWS)
+
+The `jose` module supports signing and verification of JWS messages with arbitrary payloads in Compact, Flattened JSON, and General JSON serialization syntaxes.
+
+- Signing - [Compact](docs/jws/compact/sign/classes/CompactSign.md), [Flattened JSON](docs/jws/flattened/sign/classes/FlattenedSign.md), [General JSON](docs/jws/general/sign/classes/GeneralSign.md)
+- Verification - [Compact](docs/jws/compact/verify/functions/compactVerify.md), [Flattened JSON](docs/jws/flattened/verify/functions/flattenedVerify.md), [General JSON](docs/jws/general/verify/functions/generalVerify.md)
+  - [Using a remote JSON Web Key Set (JWKS)](docs/jwks/remote/functions/createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/jwks/local/functions/createLocalJWKSet.md)
+- Utility functions
+  - [Decoding Token's Protected Header](docs/util/decode_protected_header/functions/decodeProtectedHeader.md)
+
+### JSON Web Encryption (JWE)
+
+The `jose` module supports encryption and decryption of JWE messages with arbitrary plaintext in Compact, Flattened JSON, and General JSON serialization syntaxes.
+
+- Encryption - [Compact](docs/jwe/compact/encrypt/classes/CompactEncrypt.md), [Flattened JSON](docs/jwe/flattened/encrypt/classes/FlattenedEncrypt.md), [General JSON](docs/jwe/general/encrypt/classes/GeneralEncrypt.md)
+- Decryption - [Compact](docs/jwe/compact/decrypt/functions/compactDecrypt.md), [Flattened JSON](docs/jwe/flattened/decrypt/functions/flattenedDecrypt.md), [General JSON](docs/jwe/general/decrypt/functions/generalDecrypt.md)
+- Utility functions
+  - [Decoding Token's Protected Header](docs/util/decode_protected_header/functions/decodeProtectedHeader.md)
+
+### Other
+
+The following are additional features and utilities provided by the `jose` module:
+
+- [Calculating JWK Thumbprint](docs/jwk/thumbprint/functions/calculateJwkThumbprint.md)
+- [Calculating JWK Thumbprint URI](docs/jwk/thumbprint/functions/calculateJwkThumbprintUri.md)
+- [Verification using a JWK Embedded in a JWS Header](docs/jwk/embedded/functions/EmbeddedJWK.md)
+- [Unsecured JWT](docs/jwt/unsecured/classes/UnsecuredJWT.md)
+- [JOSE Errors](docs/util/errors/README.md)
+
+## Supported Runtimes
+
+The `jose` module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.
+
+The following runtimes are supported _(this is not an exhaustive list)_:
+
+- [Bun](https://github.com/panva/jose/issues/471)
+- [Browsers](https://github.com/panva/jose/issues/263)
+- [Cloudflare Workers](https://github.com/panva/jose/issues/265)
+- [Deno](https://github.com/panva/jose/issues/266)
+- [Electron](https://github.com/panva/jose/issues/264)
+- [Node.js](https://github.com/panva/jose/issues/262)
+
+Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.
+
+## Supported Versions
+
+| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | Runtime and Module type         |
+| ----------------------------------------------- | ----------------- | ------------------ | --------------- | ------------------------------- |
+| [v6.x](https://github.com/panva/jose/tree/v6.x) | [Security Policy] | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
+
+## Specifications
+
+<details>
+<summary>Details</summary>
+
+- JSON Web Signature (JWS) - [RFC7515](https://www.rfc-editor.org/info/rfc7515/)
+- JSON Web Encryption (JWE) - [RFC7516](https://www.rfc-editor.org/info/rfc7516/)
+- JSON Web Key (JWK) - [RFC7517](https://www.rfc-editor.org/info/rfc7517/)
+- JSON Web Algorithms (JWA) - [RFC7518](https://www.rfc-editor.org/info/rfc7518/)
+- JSON Web Token (JWT) - [RFC7519](https://www.rfc-editor.org/info/rfc7519/)
+- JSON Web Key Thumbprint - [RFC7638](https://www.rfc-editor.org/info/rfc7638/)
+- JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/info/rfc9278/)
+- JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/info/rfc7797/)
+- CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/info/rfc8037/)
+- Fully-Specified Algorithms for JOSE - [RFC9864](https://www.rfc-editor.org/info/rfc9864/)
+- ML-DSA for JOSE - [RFC9964](https://www.rfc-editor.org/info/rfc9964/)
+
+The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/info/rfc7520/).
+
+</details>
+
+[sponsor-auth0]: https://a0.to/signup/panva
+[WebCryptoAPI]: https://w3c.github.io/webcrypto/
+[Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
+[Security Policy]: https://github.com/panva/jose/security/policy
+
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where the `require(esm)` feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0).
+
+[^universal]: Assumes runtime support of [WebCryptoAPI][] and [Fetch API][]

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/index.d.ts

@@ -0,0 +1,55 @@
+export { compactDecrypt } from './jwe/compact/decrypt.js';
+export type { CompactDecryptGetKey } from './jwe/compact/decrypt.js';
+export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
+export type { FlattenedDecryptGetKey } from './jwe/flattened/decrypt.js';
+export { generalDecrypt } from './jwe/general/decrypt.js';
+export type { GeneralDecryptGetKey } from './jwe/general/decrypt.js';
+export { GeneralEncrypt } from './jwe/general/encrypt.js';
+export type { Recipient } from './jwe/general/encrypt.js';
+export { compactVerify } from './jws/compact/verify.js';
+export type { CompactVerifyGetKey } from './jws/compact/verify.js';
+export { flattenedVerify } from './jws/flattened/verify.js';
+export type { FlattenedVerifyGetKey } from './jws/flattened/verify.js';
+export { generalVerify } from './jws/general/verify.js';
+export type { GeneralVerifyGetKey } from './jws/general/verify.js';
+export { jwtVerify } from './jwt/verify.js';
+export type { JWTVerifyOptions, JWTVerifyGetKey } from './jwt/verify.js';
+export { jwtDecrypt } from './jwt/decrypt.js';
+export type { JWTDecryptOptions, JWTDecryptGetKey } from './jwt/decrypt.js';
+export { CompactEncrypt } from './jwe/compact/encrypt.js';
+export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
+export { CompactSign } from './jws/compact/sign.js';
+export { FlattenedSign } from './jws/flattened/sign.js';
+export { GeneralSign } from './jws/general/sign.js';
+export type { Signature } from './jws/general/sign.js';
+export { SignJWT } from './jwt/sign.js';
+export { EncryptJWT } from './jwt/encrypt.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
+export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
+export type { LocalJWKSet } from './jwks/local.js';
+export { createRemoteJWKSet, jwksCache, customFetch } from './jwks/remote.js';
+export type { RemoteJWKSet, RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache, FetchImplementation, } from './jwks/remote.js';
+export { UnsecuredJWT } from './jwt/unsecured.js';
+export type { UnsecuredResult } from './jwt/unsecured.js';
+export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
+export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
+export type { KeyImportOptions } from './key/import.js';
+export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
+export type { ProtectedHeaderParameters } from './util/decode_protected_header.js';
+import * as errors from './util/errors.js';
+export { errors };
+export { generateKeyPair } from './key/generate_key_pair.js';
+export type { GenerateKeyPairAlgorithm, GenerateKeyPairResult, GenerateKeyPairOptions, } from './key/generate_key_pair.js';
+export { generateSecret } from './key/generate_secret.js';
+export type { GenerateSecretAlgorithm, GenerateSecretOptions } from './key/generate_secret.js';
+import * as base64url from './util/base64url.js';
+export { base64url };
+export type { AnyJWK, CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEContentEncryptionAlgorithm, JWEHeaderParameters, JWEKeyManagementAlgorithm, JWEKeyManagementHeaderParameters, JWK_AKP_Private, JWK_AKP_Public, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKKeyType, JWKParameters, JWSAlgorithm, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyInput, KeyObject, ProduceJWT, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
+/**
+ * Identified the loaded runtime-specific build in prior releases; now always `"WebCryptoAPI"`.
+ *
+ * @deprecated Remove any runtime branching on this value; it is always `"WebCryptoAPI"`.
+ */
+export declare const cryptoRuntime = "WebCryptoAPI";

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts

@@ -0,0 +1,24 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Compact JWE decryption from unverified headers and token data. */
+export interface CompactDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a Compact JWE.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.CompactDecryptResult>;
+/**
+ * Decrypts a Compact JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function compactDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: string | Uint8Array, getKey: CompactDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a Compact JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput | CompactDecryptGetKey, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & Partial<t.ResolvedKey>>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts

@@ -0,0 +1,40 @@
+import type * as t from '../../types.d.ts';
+/** Builds and encrypts Compact JWE strings. */
+export declare class CompactEncrypt {
+    #private;
+    /**
+     * Creates a Compact JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setContentEncryptionKey(cek: Uint8Array): this;
+    /**
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setInitializationVector(iv: Uint8Array): this;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
+    /**
+     * Encrypts the plaintext as a Compact JWE.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;
+}

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts

@@ -0,0 +1,24 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Flattened JWE decryption from unverified headers and token data. */
+export interface FlattenedDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a Flattened JWE.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult>;
+/**
+ * Decrypts a Flattened JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function flattenedDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.FlattenedJWE, getKey: FlattenedDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a Flattened JWE with a key or key resolver. The result includes `key` only when a
+ * resolver is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput | FlattenedDecryptGetKey, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & Partial<t.ResolvedKey>>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts

@@ -0,0 +1,46 @@
+import type * as t from '../../types.d.ts';
+/** Builds and encrypts Flattened JWE objects. */
+export declare class FlattenedEncrypt {
+    #private;
+    /**
+     * Creates a Flattened JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets additional data to authenticate without encrypting it. */
+    setAdditionalAuthenticatedData(aad: Uint8Array): this;
+    /**
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setContentEncryptionKey(cek: Uint8Array): this;
+    /**
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setInitializationVector(iv: Uint8Array): this;
+    /**
+     * Encrypts the plaintext as a Flattened JWE.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<t.FlattenedJWE>;
+}

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/general/decrypt.d.ts

@@ -0,0 +1,28 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for General JWE decryption from unverified headers and token data. */
+export interface GeneralDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a General JWE.
+ *
+ * > Note: Returns plaintext and headers from the first recipient that decrypts successfully. Other
+ * > recipients may be inspected to enforce serialization rules, but their headers are not included in
+ * > the result. Rely only on the returned data.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult>;
+/**
+ * Decrypts a General JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function generalDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.GeneralJWE, getKey: GeneralDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a General JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput | GeneralDecryptGetKey, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & Partial<t.ResolvedKey>>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -0,0 +1,51 @@
+import type * as t from '../../types.d.ts';
+/** Configures an individual recipient in a General JWE. */
+export interface Recipient {
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): Recipient;
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): Recipient;
+    /**
+     * Adds another recipient to the enclosing {@link GeneralEncrypt} and returns its configuration.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
+    /**
+     * Encrypts for all recipients on the enclosing {@link GeneralEncrypt}, using their configured
+     * keys.
+     */
+    encrypt(): Promise<t.GeneralJWE>;
+    /** Returns the enclosing {@link GeneralEncrypt} instance. */
+    done(): GeneralEncrypt;
+}
+/** Builds and encrypts General JWE objects. */
+export declare class GeneralEncrypt {
+    #private;
+    /**
+     * Creates a General JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Adds a recipient and returns its configuration.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets additional data to authenticate without encrypting it. */
+    setAdditionalAuthenticatedData(aad: Uint8Array): this;
+    /** Encrypts the plaintext as a General JWE. */
+    encrypt(): Promise<t.GeneralJWE>;
+}

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwk/embedded.d.ts

@@ -0,0 +1,10 @@
+import type * as t from '../types.d.ts';
+/**
+ * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter. This key
+ * resolver opts JWS and JWT verification into trusting a public key supplied by the token. Use the
+ * verification function's `algorithms` option to restrict accepted algorithms.
+ *
+ * @param token The consumed JWS token.
+ * @returns The public key from the JWS "jwk" (JSON Web Key) Header Parameter.
+ */
+export declare function EmbeddedJWK(protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwk/thumbprint.d.ts

@@ -0,0 +1,15 @@
+import type * as t from '../types.d.ts';
+/**
+ * Calculates a base64url-encoded JWK Thumbprint. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to calculate the thumbprint for.
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
+ */
+export declare function calculateJwkThumbprint(key: t.JWK | t.CryptoKey | t.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
+/**
+ * Calculates a JWK Thumbprint URI. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to calculate the thumbprint for.
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
+ */
+export declare function calculateJwkThumbprintUri(key: t.CryptoKey | t.KeyObject | t.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwks/local.d.ts

@@ -0,0 +1,17 @@
+import type * as t from '../types.d.ts';
+/** A key resolver created by {@link createLocalJWKSet}. */
+export interface LocalJWKSet {
+    (protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
+    /** Returns a structured clone of the original JSON Web Key Set. */
+    jwks: () => t.JSONWebKeySet;
+}
+/**
+ * Creates a resolver for a locally available JSON Web Key Set. Selection uses the header's "alg"
+ * (Algorithm) and "kid" (Key ID), and respects the JWK's "use" (Public Key Use) and "key_ops" (Key
+ * Operations). Exactly one key must match.
+ *
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
+ *
+ * @param jwks JSON Web Key Set formatted object.
+ */
+export declare function createLocalJWKSet(jwks: t.JSONWebKeySet): LocalJWKSet;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jwks/remote.d.ts

@@ -0,0 +1,94 @@
+import type * as t from '../types.d.ts';
+/**
+ * Configures a custom fetch implementation for remote JWKS retrieval.
+ *
+ * > Note: Fetch-like libraries may have incompatible TypeScript signatures even when they accept the
+ * > supplied arguments at runtime.
+ */
+export declare const customFetch: unique symbol;
+/** Custom fetch function. Must return HTTP 200 with a JSON JWKS. See {@link customFetch}. */
+export type FetchImplementation = (
+/** JWKS URL, passed as the fetch resource. */
+url: string, 
+/** Options passed to fetch. */
+options: {
+    headers: Headers;
+    method: 'GET';
+    /** See {@link !Request.redirect} */
+    redirect: 'manual';
+    signal: AbortSignal;
+}) => Promise<Response>;
+/**
+ * Symbol used to configure an externally persisted remote JWKS cache.
+ *
+ * > Warning: Only trusted application code must be allowed to write this cache; its keys are trusted for
+ * > signature verification.
+ */
+export declare const jwksCache: unique symbol;
+/** Remote JWKS resolver options. */
+export interface RemoteJWKSetOptions {
+    /**
+     * Timeout (in milliseconds) for the HTTP request. When reached the request will be aborted and
+     * the verification will fail. Must be a non-negative integer. Default is 5000 (5 seconds).
+     */
+    timeoutDuration?: number;
+    /**
+     * Time in milliseconds after a successful fetch before a missing key can trigger another fetch.
+     * Must not be `NaN`. Defaults to 30000 (30 seconds).
+     */
+    cooldownDuration?: number;
+    /**
+     * Maximum age of cached keys in milliseconds. Defaults to 600000 (10 minutes); `Infinity`
+     * disables expiry. Must not be `NaN`.
+     */
+    cacheMaxAge?: number | typeof Infinity;
+    /** Headers to be sent with the HTTP request. */
+    headers?: Record<string, string>;
+    /** See {@link jwksCache}. */
+    [jwksCache]?: JWKSCacheInput;
+    /** See {@link customFetch}. */
+    [customFetch]?: FetchImplementation;
+}
+/** Shape of an externally persisted remote JWKS cache. */
+export interface ExportedJWKSCache {
+    /** Current cached JSON Web Key Set */
+    jwks: t.JSONWebKeySet;
+    /** Last successful fetch, in milliseconds since Unix epoch. */
+    uat: number;
+}
+/** Values accepted by the {@link jwksCache} option. */
+export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
+/** A key resolver created by {@link createRemoteJWKSet}. */
+export interface RemoteJWKSet {
+    (protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
+    /** Whether the cooldown window following the last successful fetch is still in effect. */
+    readonly coolingDown: boolean;
+    /**
+     * Whether the currently cached JSON Web Key Set is within its
+     * {@link RemoteJWKSetOptions.cacheMaxAge}.
+     */
+    readonly fresh: boolean;
+    /** Whether a JSON Web Key Set fetch is currently in flight. */
+    readonly reloading: boolean;
+    /**
+     * Triggers a JSON Web Key Set fetch, bypassing
+     * {@link RemoteJWKSetOptions.cooldownDuration the cooldown}.
+     */
+    reload: () => Promise<void>;
+    /**
+     * Returns a structured clone of the cached JSON Web Key Set, or `undefined` before keys have been
+     * fetched or seeded via {@link jwksCache}.
+     */
+    jwks: () => t.JSONWebKeySet | undefined;
+}
+/**
+ * Creates a resolver for a JSON Web Key Set available at an HTTP(S) URL. Fetches the JSON Web Key
+ * Set when the cache is missing or stale. An unmatched key triggers another fetch only when
+ * `cooldownDuration` has elapsed since the last successful fetch. Selection uses the header's "alg"
+ * and "kid" and respects the JWK's "use" and "key_ops". Exactly one key must match.
+ *
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
+ *
+ * @param url URL to fetch the JSON Web Key Set from.
+ */
+export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): RemoteJWKSet;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jws/compact/sign.d.ts

@@ -0,0 +1,20 @@
+import type * as t from '../../types.d.ts';
+/** Builds and signs Compact JWS strings. */
+export declare class CompactSign {
+    #private;
+    /**
+     * Creates a Compact JWS signer.
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
+    constructor(payload: Uint8Array);
+    /** Sets the JWS Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.CompactJWSHeaderParameters): this;
+    /**
+     * Signs the payload as a Compact JWS.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;
+}

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jws/compact/verify.d.ts

@@ -0,0 +1,25 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Compact JWS verification from unverified headers and token data. */
+export interface CompactVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a Compact JWS signature and decodes its payload.
+ *
+ * @param key Public key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ */
+export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.CompactVerifyResult>;
+/**
+ * Verifies a Compact JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
+ *
+ * @param getKey Resolves a public key or shared secret from unverified token data.
+ */
+export declare function compactVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: string | Uint8Array, getKey: CompactVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & t.ResolvedKey<KeyType>>;
+/**
+ * Verifies a Compact JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
+ *
+ * @param key Public key or shared secret, or a function resolving one.
+ */
+export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput | CompactVerifyGetKey, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & Partial<t.ResolvedKey>>;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/jws/flattened/sign.d.ts

@@ -0,0 +1,22 @@
+import type * as t from '../../types.d.ts';
+/** Builds and signs Flattened JWS objects. */
+export declare class FlattenedSign {
+    #private;
+    /**
+     * Creates a Flattened JWS signer.
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
+    constructor(payload: Uint8Array);
+    /** Sets the JWS Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWSHeaderParameters): this;
+    /** Sets the JWS Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): this;
+    /**
+     * Signs the payload as a Flattened JWS.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<t.FlattenedJWS>;
+}