@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/util/base64url.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Decodes base64url text or its UTF-8 bytes.
+ *
+ * @param input Base64url-encoded string or its UTF-8 bytes.
+ * @returns The decoded bytes.
+ * @throws {TypeError} If the input is not valid base64url. Standard Base64 `+` and `/` are
+ *   rejected.
+ */
+export declare function decode(input: Uint8Array | string): Uint8Array;
+/**
+ * Encodes unpadded base64url; strings are first encoded as UTF-8.
+ *
+ * @param input Bytes or a string to encode. Strings are first encoded as UTF-8.
+ * @returns The unpadded base64url representation of the input.
+ */
+export declare function encode(input: Uint8Array | string): string;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,8 @@
+import type * as t from '../types.d.ts';
+/**
+ * Decodes the Claims Set of a JWT in Compact JWS serialization without checking its signature or
+ * validating claim types and values.
+ *
+ * @returns The parsed JWT Claims Set.
+ */
+export declare function decodeJwt<PayloadType = t.JWTPayload>(jwt: string): PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/util/decode_protected_header.d.ts

@@ -0,0 +1,10 @@
+import type * as t from '../types.d.ts';
+/** JWE and JWS Header Parameters returned by {@link decodeProtectedHeader}. */
+export type ProtectedHeaderParameters = t.JWSHeaderParameters & t.JWEHeaderParameters;
+/**
+ * Decodes the Protected Header of a JWE, JWS, or JWT without authenticating the token.
+ *
+ * @param token Compact token or JSON serialization object with a `protected` member.
+ * @returns The parsed Protected Header.
+ */
+export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;

package/dist/node_modules/oidc-provider/node_modules/jose/dist/types/util/errors.d.ts

@@ -0,0 +1,182 @@
+import type * as t from '../types.d.ts';
+/** Stable error codes used by this module. */
+export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
+/** Shared details of JWT claim or header validation failures. */
+export interface JWTClaimValidationFailure {
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /** The parsed JWT Claims Set; validation of other claims may be incomplete. */
+    payload: t.JWTPayload;
+}
+/** Reason codes produced by JWT Claims Set validation. */
+export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
+/** Base class for JOSE errors. */
+export declare class JOSEError extends Error {
+    /** Stable code identifying the error class. */
+    static code: JOSEErrorCode | (string & {});
+    /** Stable code identifying the error class. Use {@link AnyJOSEError} to narrow subclasses by code. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when JWT claim or header validation fails. Expiration is reported separately as
+ * {@link JWTExpired}.
+ */
+export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when a JWT has expired or exceeds the configured maximum token age. */
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when an algorithm is disallowed by configuration. */
+export declare class JOSEAlgNotAllowed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a feature or algorithm is unsupported. */
+export declare class JOSENotSupported extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when JWE ciphertext decryption or authentication fails. */
+export declare class JWEDecryptionFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when a JWE is invalid. */
+export declare class JWEInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWS is invalid. */
+export declare class JWSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWT is invalid. */
+export declare class JWTInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWK is invalid. */
+export declare class JWKInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWKS is invalid. */
+export declare class JWKSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when no keys match in a JWKS. */
+export declare class JWKSNoMatchingKey extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when multiple keys match in a JWKS. */
+export declare class JWKSMultipleMatchingKeys extends JOSEError {
+    /**
+     * Yields public keys matching the JWS Header so verification can be attempted with each. See the
+     * {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} and
+     * {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Empty on manually constructed
+     * errors.
+     */
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<t.CryptoKey>;
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when fetching a remote JWKS times out. */
+export declare class JWKSTimeout extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when JWS signature verification fails. */
+export declare class JWSSignatureVerificationFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Errors thrown during JWT Claims Set validation. */
+export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
+/**
+ * Discriminated union of specific {@link JOSEError} subclasses, narrowed by `code`. Excludes base
+ * {@link JOSEError} instances; use `instanceof JOSEError` to catch all module errors.
+ */
+export type AnyJOSEError = (JOSEAlgNotAllowed & {
+    code: 'ERR_JOSE_ALG_NOT_ALLOWED';
+}) | (JOSENotSupported & {
+    code: 'ERR_JOSE_NOT_SUPPORTED';
+}) | (JWEDecryptionFailed & {
+    code: 'ERR_JWE_DECRYPTION_FAILED';
+}) | (JWEInvalid & {
+    code: 'ERR_JWE_INVALID';
+}) | (JWKInvalid & {
+    code: 'ERR_JWK_INVALID';
+}) | (JWKSInvalid & {
+    code: 'ERR_JWKS_INVALID';
+}) | (JWKSMultipleMatchingKeys & {
+    code: 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+}) | (JWKSNoMatchingKey & {
+    code: 'ERR_JWKS_NO_MATCHING_KEY';
+}) | (JWKSTimeout & {
+    code: 'ERR_JWKS_TIMEOUT';
+}) | (JWSInvalid & {
+    code: 'ERR_JWS_INVALID';
+}) | (JWSSignatureVerificationFailed & {
+    code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+}) | (JWTClaimValidationFailed & {
+    code: 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+}) | (JWTExpired & {
+    code: 'ERR_JWT_EXPIRED';
+}) | (JWTInvalid & {
+    code: 'ERR_JWT_INVALID';
+});

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/index.js

@@ -0,0 +1,70 @@
+import { compactDecrypt } from "./jwe/compact/decrypt.js";
+import { flattenedDecrypt } from "./jwe/flattened/decrypt.js";
+import { generalDecrypt } from "./jwe/general/decrypt.js";
+import { GeneralEncrypt } from "./jwe/general/encrypt.js";
+import { compactVerify } from "./jws/compact/verify.js";
+import { flattenedVerify } from "./jws/flattened/verify.js";
+import { generalVerify } from "./jws/general/verify.js";
+import { jwtVerify } from "./jwt/verify.js";
+import { jwtDecrypt } from "./jwt/decrypt.js";
+import { CompactEncrypt } from "./jwe/compact/encrypt.js";
+import { FlattenedEncrypt } from "./jwe/flattened/encrypt.js";
+import { CompactSign } from "./jws/compact/sign.js";
+import { FlattenedSign } from "./jws/flattened/sign.js";
+import { GeneralSign } from "./jws/general/sign.js";
+import { SignJWT } from "./jwt/sign.js";
+import { EncryptJWT } from "./jwt/encrypt.js";
+import { calculateJwkThumbprint, calculateJwkThumbprintUri } from "./jwk/thumbprint.js";
+import { EmbeddedJWK } from "./jwk/embedded.js";
+import { createLocalJWKSet } from "./jwks/local.js";
+import { createRemoteJWKSet, jwksCache, customFetch } from "./jwks/remote.js";
+import { UnsecuredJWT } from "./jwt/unsecured.js";
+import { exportPKCS8, exportSPKI, exportJWK } from "./key/export.js";
+import { importSPKI, importPKCS8, importX509, importJWK } from "./key/import.js";
+import { decodeProtectedHeader } from "./util/decode_protected_header.js";
+import { decodeJwt } from "./util/decode_jwt.js";
+import * as errors from "./util/errors.js";
+import { generateKeyPair } from "./key/generate_key_pair.js";
+import { generateSecret } from "./key/generate_secret.js";
+import * as base64url from "./util/base64url.js";
+const cryptoRuntime = "WebCryptoAPI";
+export {
+  CompactEncrypt,
+  CompactSign,
+  EmbeddedJWK,
+  EncryptJWT,
+  FlattenedEncrypt,
+  FlattenedSign,
+  GeneralEncrypt,
+  GeneralSign,
+  SignJWT,
+  UnsecuredJWT,
+  base64url,
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri,
+  compactDecrypt,
+  compactVerify,
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  cryptoRuntime,
+  customFetch,
+  decodeJwt,
+  decodeProtectedHeader,
+  errors,
+  exportJWK,
+  exportPKCS8,
+  exportSPKI,
+  flattenedDecrypt,
+  flattenedVerify,
+  generalDecrypt,
+  generalVerify,
+  generateKeyPair,
+  generateSecret,
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509,
+  jwksCache,
+  jwtDecrypt,
+  jwtVerify
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/compact/decrypt.js

@@ -0,0 +1,7 @@
+import { prepareDecrypt, decryptCompact } from "../../lib/jwe_decrypt.js";
+async function compactDecrypt(jwe, key, options) {
+  return decryptCompact(jwe, prepareDecrypt(options), key);
+}
+export {
+  compactDecrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/compact/encrypt.js

@@ -0,0 +1,26 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { compactJWE, createJWE } from "../../lib/jwe_encrypt.js";
+class CompactEncrypt {
+  #input;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  async encrypt(key, options) {
+    return compactJWE(await createJWE([...this.#input], key, options));
+  }
+}
+export {
+  CompactEncrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -0,0 +1,15 @@
+import { JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { prepareDecrypt, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+async function flattenedDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("Flattened JWE must be an object");
+  const shared = snapshotSharedJWE(jwe), [recipient, , error] = snapshotRecipientJWE(jwe);
+  if (!recipient)
+    throw error;
+  const snapshot = { ...shared, ...recipient };
+  return checkRecipient(snapshot), decryptJWE(snapshot, prepareDecrypt(options), key);
+}
+export {
+  flattenedDecrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js

@@ -0,0 +1,35 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { createJWE } from "../../lib/jwe_encrypt.js";
+class FlattenedEncrypt {
+  #input;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#input[3], "setSharedUnprotectedHeader"), this.#input[3] = sharedUnprotectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#input[4] = aad, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  async encrypt(key, options) {
+    return createJWE([...this.#input], key, options);
+  }
+}
+export {
+  FlattenedEncrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -0,0 +1,40 @@
+import { prepareDecrypt, shareJWE, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { JWEDecryptionFailed, JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { JWE, isJWECEKTransport } from "../../lib/jwe_algorithms.js";
+async function generalDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("General JWE must be an object");
+  const inputRecipients = jwe.recipients;
+  if (!Array.isArray(inputRecipients))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  const recipients = Array.from(inputRecipients);
+  if (!recipients.every(isObject))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  if (!recipients.length)
+    throw new JWEInvalid("JWE Recipients has no members");
+  let shared, sharedJwe, token;
+  try {
+    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+  } catch {
+    throw new JWEDecryptionFailed();
+  }
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+  if (recipients.length > 1)
+    for (const [, headerAlg] of recipientSnapshots) {
+      const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg, algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+    }
+  for (const [recipient] of recipientSnapshots)
+    if (recipient)
+      try {
+        const flattened = { ...sharedJwe, ...recipient };
+        return checkRecipient(flattened), await decryptJWE(flattened, shared, key, token);
+      } catch {
+      }
+  throw new JWEDecryptionFailed();
+}
+export {
+  generalDecrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -0,0 +1,105 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { JWEInvalid } from "../../util/errors.js";
+import { generateCek } from "../../lib/content_encryption.js";
+import { encode as b64u } from "../../util/base64url.js";
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from "../../lib/jwe_encrypt.js";
+import { encryptKeyManagement } from "../../lib/key_management.js";
+import { isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
+class IndividualRecipient {
+  #parent;
+  state;
+  constructor(enc, key, crit) {
+    this.#parent = enc, this.state = [void 0, void 0, key, crit];
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[0], "setUnprotectedHeader"), this.state[0] = unprotectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.state[1], "setKeyManagementParameters"), this.state[1] = parameters, this;
+  }
+  addRecipient(...args) {
+    return this.#parent.addRecipient(...args);
+  }
+  encrypt(...args) {
+    return this.#parent.encrypt(...args);
+  }
+  done() {
+    return this.#parent;
+  }
+}
+class GeneralEncrypt {
+  #plaintext;
+  #recipients = [];
+  #protectedHeader;
+  #unprotectedHeader;
+  #aad;
+  constructor(plaintext) {
+    this.#plaintext = plaintext;
+  }
+  addRecipient(key, options) {
+    const recipient = new IndividualRecipient(this, key, options?.crit);
+    return this.#recipients.push(recipient), recipient;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setSharedUnprotectedHeader"), this.#unprotectedHeader = sharedUnprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#aad = aad, this;
+  }
+  async encrypt() {
+    if (!this.#recipients.length)
+      throw new JWEInvalid("at least one recipient must be added");
+    assertUint8Array(this.#plaintext, "plaintext");
+    const multiple = this.#recipients.length > 1;
+    let enc, protectedHeader = this.#protectedHeader, sharedUnprotectedHeader = this.#unprotectedHeader;
+    const recipients = [];
+    for (const recipient of this.#recipients) {
+      const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state, input = [
+        this.#plaintext,
+        protectedHeader,
+        unprotectedHeader,
+        sharedUnprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        multiple
+      ], headers = checkEncryptHeaders(input, void 0, recipients.length > 0);
+      recipients.length || (protectedHeader = input[1], sharedUnprotectedHeader = input[3]), recipients.push([input, headers, key]);
+      const [{ alg, enc: recipientEnc }, , algEntry] = headers;
+      if (multiple && algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+      if (!enc)
+        enc = recipientEnc;
+      else if (enc !== recipientEnc)
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+    }
+    for (const [, headers] of recipients)
+      headers[2] ??= jweAlgorithm(headers[0].alg);
+    const [firstInput, firstHeaders, firstKey] = recipients[0], cek = multiple ? generateCek(firstHeaders[1]) : void 0;
+    firstInput[5] = cek;
+    const { encrypted_key, header, ...shared } = await encryptJWE(firstInput, firstHeaders, firstKey), jwe = {
+      ...shared,
+      recipients: [{}]
+    };
+    encrypted_key && (jwe.recipients[0].encrypted_key = encrypted_key), header && (jwe.recipients[0].header = header);
+    for (let i = 1; i < recipients.length; i++) {
+      const [input, [joseHeader, encEntry, algEntry], key] = recipients[i], unprotectedHeader = input[2], [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, cek, input[7]), target = {
+        encrypted_key: b64u(encryptedKey)
+      };
+      if (unprotectedHeader || parameters) {
+        const header2 = { ...unprotectedHeader, ...parameters };
+        parameters && checkDisjoint(input[1], header2, input[3]), target.header = header2;
+      }
+      jwe.recipients.push(target);
+    }
+    return jwe;
+  }
+}
+export {
+  GeneralEncrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -0,0 +1,30 @@
+import { jwkToKey, normalizeJwk } from "../lib/key.js";
+import { jwsAlgorithm } from "../lib/jws_algorithms.js";
+import { isObject } from "../lib/validate.js";
+import { JWSInvalid } from "../util/errors.js";
+async function EmbeddedJWK(protectedHeader, token) {
+  const joseHeader = {
+    ...protectedHeader,
+    ...token?.header
+  };
+  if (!isObject(joseHeader.jwk))
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
+  let jwk;
+  try {
+    jwk = normalizeJwk(joseHeader.jwk);
+  } catch (cause) {
+    throw new JWSInvalid("Invalid Embedded JWK", { cause });
+  }
+  const entry = jwsAlgorithm(joseHeader.alg);
+  if (jwk.use !== void 0 && jwk.use !== "sig")
+    throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+  if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
+    throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+  const key = await jwkToKey(entry, jwk, !0);
+  if (key.type !== "public")
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
+  return key;
+}
+export {
+  EmbeddedJWK
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -0,0 +1,55 @@
+import { digest, encode } from "../lib/buffer_utils.js";
+import { encode as b64u } from "../util/base64url.js";
+import { JOSENotSupported, JWKInvalid } from "../util/errors.js";
+import { isKeyLike, invalidKeyInput, snapshotJwk } from "../lib/key.js";
+import { isObject } from "../lib/validate.js";
+import { exportJWK } from "../key/export.js";
+const check = (value, description) => {
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
+};
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return b64u(await digest(digestAlgorithm, data));
+}
+async function calculateJwkThumbprintUri(key, digestAlgorithm) {
+  digestAlgorithm ??= "sha256";
+  const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+  return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}
+export {
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri
+};