@openclaw/googlechat 2026.5.20-beta.2 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/refreshclient.js

@@ -0,0 +1,160 @@
+"use strict";
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRefreshClient = exports.USER_REFRESH_ACCOUNT_TYPE = void 0;
+const oauth2client_1 = require("./oauth2client");
+const authclient_1 = require("./authclient");
+exports.USER_REFRESH_ACCOUNT_TYPE = 'authorized_user';
+class UserRefreshClient extends oauth2client_1.OAuth2Client {
+    // TODO: refactor tests to make this private
+    // In a future gts release, the _propertyName rule will be lifted.
+    // This is also a hard one because `this.refreshToken` is a function.
+    _refreshToken;
+    /**
+     * The User Refresh Token client.
+     *
+     * @param optionsOrClientId The User Refresh Token client options. Passing an `clientId` directly is **@DEPRECATED**.
+     * @param clientSecret **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param refreshToken **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param eagerRefreshThresholdMillis **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param forceRefreshOnFailure **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     */
+    constructor(optionsOrClientId, 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    clientSecret, 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    refreshToken, 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    eagerRefreshThresholdMillis, 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    forceRefreshOnFailure) {
+        const opts = optionsOrClientId && typeof optionsOrClientId === 'object'
+            ? optionsOrClientId
+            : {
+                clientId: optionsOrClientId,
+                clientSecret,
+                refreshToken,
+                eagerRefreshThresholdMillis,
+                forceRefreshOnFailure,
+            };
+        super(opts);
+        this._refreshToken = opts.refreshToken;
+        this.credentials.refresh_token = opts.refreshToken;
+    }
+    /**
+     * Refreshes the access token.
+     * @param refreshToken An ignored refreshToken..
+     * @param callback Optional callback.
+     */
+    async refreshTokenNoCache() {
+        return super.refreshTokenNoCache(this._refreshToken);
+    }
+    async fetchIdToken(targetAudience) {
+        const opts = {
+            ...UserRefreshClient.RETRY_CONFIG,
+            url: this.endpoints.oauth2TokenUrl,
+            method: 'POST',
+            data: new URLSearchParams({
+                client_id: this._clientId,
+                client_secret: this._clientSecret,
+                grant_type: 'refresh_token',
+                refresh_token: this._refreshToken,
+                target_audience: targetAudience,
+            }),
+            responseType: 'json',
+        };
+        authclient_1.AuthClient.setMethodName(opts, 'fetchIdToken');
+        const res = await this.transporter.request(opts);
+        return res.data.id_token;
+    }
+    /**
+     * Create a UserRefreshClient credentials instance using the given input
+     * options.
+     * @param json The input object.
+     */
+    fromJSON(json) {
+        if (!json) {
+            throw new Error('Must pass in a JSON object containing the user refresh token');
+        }
+        if (json.type !== 'authorized_user') {
+            throw new Error('The incoming JSON object does not have the "authorized_user" type');
+        }
+        if (!json.client_id) {
+            throw new Error('The incoming JSON object does not contain a client_id field');
+        }
+        if (!json.client_secret) {
+            throw new Error('The incoming JSON object does not contain a client_secret field');
+        }
+        if (!json.refresh_token) {
+            throw new Error('The incoming JSON object does not contain a refresh_token field');
+        }
+        this._clientId = json.client_id;
+        this._clientSecret = json.client_secret;
+        this._refreshToken = json.refresh_token;
+        this.credentials.refresh_token = json.refresh_token;
+        this.quotaProjectId = json.quota_project_id;
+        this.universeDomain = json.universe_domain || this.universeDomain;
+    }
+    fromStream(inputStream, callback) {
+        if (callback) {
+            this.fromStreamAsync(inputStream).then(() => callback(), callback);
+        }
+        else {
+            return this.fromStreamAsync(inputStream);
+        }
+    }
+    async fromStreamAsync(inputStream) {
+        return new Promise((resolve, reject) => {
+            if (!inputStream) {
+                return reject(new Error('Must pass in a stream containing the user refresh token.'));
+            }
+            let s = '';
+            inputStream
+                .setEncoding('utf8')
+                .on('error', reject)
+                .on('data', chunk => (s += chunk))
+                .on('end', () => {
+                try {
+                    const data = JSON.parse(s);
+                    this.fromJSON(data);
+                    return resolve();
+                }
+                catch (err) {
+                    return reject(err);
+                }
+            });
+        });
+    }
+    /**
+     * Create a UserRefreshClient credentials instance using the given input
+     * options.
+     * @param json The input object.
+     */
+    static fromJSON(json) {
+        const client = new UserRefreshClient();
+        client.fromJSON(json);
+        return client;
+    }
+}
+exports.UserRefreshClient = UserRefreshClient;
+//# sourceMappingURL=refreshclient.js.map

package/node_modules/google-auth-library/build/src/auth/stscredentials.d.ts

@@ -0,0 +1,125 @@
+import { GaxiosResponse } from 'gaxios';
+import { HeadersInit } from './authclient';
+import { ClientAuthentication, OAuthClientAuthHandler, OAuthClientAuthHandlerOptions } from './oauth2common';
+/**
+ * Defines the interface needed to initialize an StsCredentials instance.
+ * The interface does not directly map to the spec and instead is converted
+ * to be compliant with the JavaScript style guide. This is because this is
+ * instantiated internally.
+ * StsCredentials implement the OAuth 2.0 token exchange based on
+ * https://tools.ietf.org/html/rfc8693.
+ * Request options are defined in
+ * https://tools.ietf.org/html/rfc8693#section-2.1
+ */
+export interface StsCredentialsOptions {
+    /**
+     * REQUIRED. The value "urn:ietf:params:oauth:grant-type:token-exchange"
+     * indicates that a token exchange is being performed.
+     */
+    grantType: string;
+    /**
+     * OPTIONAL. A URI that indicates the target service or resource where the
+     * client intends to use the requested security token.
+     */
+    resource?: string;
+    /**
+     * OPTIONAL. The logical name of the target service where the client
+     * intends to use the requested security token.  This serves a purpose
+     * similar to the "resource" parameter but with the client providing a
+     * logical name for the target service.
+     */
+    audience?: string;
+    /**
+     * OPTIONAL. A list of space-delimited, case-sensitive strings, as defined
+     * in Section 3.3 of [RFC6749], that allow the client to specify the desired
+     * scope of the requested security token in the context of the service or
+     * resource where the token will be used.
+     */
+    scope?: string[];
+    /**
+     * OPTIONAL. An identifier, as described in Section 3 of [RFC8693], eg.
+     * "urn:ietf:params:oauth:token-type:access_token" for the type of the
+     * requested security token.
+     */
+    requestedTokenType?: string;
+    /**
+     * REQUIRED. A security token that represents the identity of the party on
+     * behalf of whom the request is being made.
+     */
+    subjectToken: string;
+    /**
+     * REQUIRED. An identifier, as described in Section 3 of [RFC8693], that
+     * indicates the type of the security token in the "subject_token" parameter.
+     */
+    subjectTokenType: string;
+    actingParty?: {
+        /**
+         * OPTIONAL. A security token that represents the identity of the acting
+         * party.  Typically, this will be the party that is authorized to use the
+         * requested security token and act on behalf of the subject.
+         */
+        actorToken: string;
+        /**
+         * An identifier, as described in Section 3, that indicates the type of the
+         * security token in the "actor_token" parameter. This is REQUIRED when the
+         * "actor_token" parameter is present in the request but MUST NOT be
+         * included otherwise.
+         */
+        actorTokenType: string;
+    };
+}
+/**
+ * Defines the OAuth 2.0 token exchange successful response based on
+ * https://tools.ietf.org/html/rfc8693#section-2.2.1
+ */
+export interface StsSuccessfulResponse {
+    access_token: string;
+    issued_token_type: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+    res?: GaxiosResponse | null;
+}
+export interface StsCredentialsConstructionOptions extends OAuthClientAuthHandlerOptions {
+    /**
+     * The client authentication credentials if available.
+     */
+    clientAuthentication?: ClientAuthentication;
+    /**
+     * The token exchange endpoint.
+     */
+    tokenExchangeEndpoint: string | URL;
+}
+/**
+ * Implements the OAuth 2.0 token exchange based on
+ * https://tools.ietf.org/html/rfc8693
+ */
+export declare class StsCredentials extends OAuthClientAuthHandler {
+    #private;
+    /**
+     * Initializes an STS credentials instance.
+     *
+     * @param options The STS credentials instance options. Passing an `tokenExchangeEndpoint` directly is **@DEPRECATED**.
+     * @param clientAuthentication **@DEPRECATED**. Provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead.
+     */
+    constructor(options?: StsCredentialsConstructionOptions | string | URL, 
+    /**
+     * @deprecated - provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead
+     */
+    clientAuthentication?: ClientAuthentication);
+    /**
+     * Exchanges the provided token for another type of token based on the
+     * rfc8693 spec.
+     * @param stsCredentialsOptions The token exchange options used to populate
+     *   the token exchange request.
+     * @param additionalHeaders Optional additional headers to pass along the
+     *   request.
+     * @param options Optional additional GCP-specific non-spec defined options
+     *   to send with the request.
+     *   Example: `&options=${encodeUriComponent(JSON.stringified(options))}`
+     * @return A promise that resolves with the token exchange response containing
+     *   the requested token and its expiration time.
+     */
+    exchangeToken(stsCredentialsOptions: StsCredentialsOptions, headers?: HeadersInit, options?: Parameters<JSON['stringify']>[0]): Promise<StsSuccessfulResponse>;
+}

package/node_modules/google-auth-library/build/src/auth/stscredentials.js

@@ -0,0 +1,107 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StsCredentials = void 0;
+const gaxios_1 = require("gaxios");
+const authclient_1 = require("./authclient");
+const oauth2common_1 = require("./oauth2common");
+const util_1 = require("../util");
+/**
+ * Implements the OAuth 2.0 token exchange based on
+ * https://tools.ietf.org/html/rfc8693
+ */
+class StsCredentials extends oauth2common_1.OAuthClientAuthHandler {
+    #tokenExchangeEndpoint;
+    /**
+     * Initializes an STS credentials instance.
+     *
+     * @param options The STS credentials instance options. Passing an `tokenExchangeEndpoint` directly is **@DEPRECATED**.
+     * @param clientAuthentication **@DEPRECATED**. Provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead.
+     */
+    constructor(options = {
+        tokenExchangeEndpoint: '',
+    }, 
+    /**
+     * @deprecated - provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead
+     */
+    clientAuthentication) {
+        if (typeof options !== 'object' || options instanceof URL) {
+            options = {
+                tokenExchangeEndpoint: options,
+                clientAuthentication,
+            };
+        }
+        super(options);
+        this.#tokenExchangeEndpoint = options.tokenExchangeEndpoint;
+    }
+    /**
+     * Exchanges the provided token for another type of token based on the
+     * rfc8693 spec.
+     * @param stsCredentialsOptions The token exchange options used to populate
+     *   the token exchange request.
+     * @param additionalHeaders Optional additional headers to pass along the
+     *   request.
+     * @param options Optional additional GCP-specific non-spec defined options
+     *   to send with the request.
+     *   Example: `&options=${encodeUriComponent(JSON.stringified(options))}`
+     * @return A promise that resolves with the token exchange response containing
+     *   the requested token and its expiration time.
+     */
+    async exchangeToken(stsCredentialsOptions, headers, options) {
+        const values = {
+            grant_type: stsCredentialsOptions.grantType,
+            resource: stsCredentialsOptions.resource,
+            audience: stsCredentialsOptions.audience,
+            scope: stsCredentialsOptions.scope?.join(' '),
+            requested_token_type: stsCredentialsOptions.requestedTokenType,
+            subject_token: stsCredentialsOptions.subjectToken,
+            subject_token_type: stsCredentialsOptions.subjectTokenType,
+            actor_token: stsCredentialsOptions.actingParty?.actorToken,
+            actor_token_type: stsCredentialsOptions.actingParty?.actorTokenType,
+            // Non-standard GCP-specific options.
+            options: options && JSON.stringify(options),
+        };
+        const opts = {
+            ...StsCredentials.RETRY_CONFIG,
+            url: this.#tokenExchangeEndpoint.toString(),
+            method: 'POST',
+            headers,
+            data: new URLSearchParams((0, util_1.removeUndefinedValuesInObject)(values)),
+            responseType: 'json',
+        };
+        authclient_1.AuthClient.setMethodName(opts, 'exchangeToken');
+        // Apply OAuth client authentication.
+        this.applyClientAuthenticationOptions(opts);
+        try {
+            const response = await this.transporter.request(opts);
+            // Successful response.
+            const stsSuccessfulResponse = response.data;
+            stsSuccessfulResponse.res = response;
+            return stsSuccessfulResponse;
+        }
+        catch (error) {
+            // Translate error to OAuthError.
+            if (error instanceof gaxios_1.GaxiosError && error.response) {
+                throw (0, oauth2common_1.getErrorFromOAuthErrorResponse)(error.response.data, 
+                // Preserve other fields from the original error.
+                error);
+            }
+            // Request could fail before the server responds.
+            throw error;
+        }
+    }
+}
+exports.StsCredentials = StsCredentials;
+//# sourceMappingURL=stscredentials.js.map

package/node_modules/google-auth-library/build/src/auth/urlsubjecttokensupplier.d.ts

@@ -0,0 +1,57 @@
+import { ExternalAccountSupplierContext } from './baseexternalclient';
+import { GaxiosOptions } from 'gaxios';
+import { SubjectTokenFormatType, SubjectTokenSupplier } from './identitypoolclient';
+/**
+ * Interface that defines options used to build a {@link UrlSubjectTokenSupplier}
+ */
+export interface UrlSubjectTokenSupplierOptions {
+    /**
+     * The URL to call to retrieve the subject token. This is typically a local
+     * metadata server.
+     */
+    url: string;
+    /**
+     * The token file or URL response type (JSON or text).
+     */
+    formatType: SubjectTokenFormatType;
+    /**
+     * For JSON response types, this is the subject_token field name. For Azure,
+     * this is access_token. For text response types, this is ignored.
+     */
+    subjectTokenFieldName?: string;
+    /**
+     * The optional additional headers to send with the request to the metadata
+     * server url.
+     */
+    headers?: {
+        [key: string]: string;
+    };
+    /**
+     * Additional gaxios options to use for the request to the specified URL.
+     */
+    additionalGaxiosOptions?: GaxiosOptions;
+}
+/**
+ * Internal subject token supplier implementation used when a URL
+ * is configured in the credential configuration used to build an {@link IdentityPoolClient}
+ */
+export declare class UrlSubjectTokenSupplier implements SubjectTokenSupplier {
+    private readonly url;
+    private readonly headers?;
+    private readonly formatType;
+    private readonly subjectTokenFieldName?;
+    private readonly additionalGaxiosOptions?;
+    /**
+     * Instantiates a URL subject token supplier.
+     * @param opts The URL subject token supplier options to build the supplier with.
+     */
+    constructor(opts: UrlSubjectTokenSupplierOptions);
+    /**
+     * Sends a GET request to the URL provided in the constructor and resolves
+     * with the returned external subject token.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link IdentityPoolClient}, contains the requested audience and subject
+     *   token type for the external account identity. Not used.
+     */
+    getSubjectToken(context: ExternalAccountSupplierContext): Promise<string>;
+}

package/node_modules/google-auth-library/build/src/auth/urlsubjecttokensupplier.js

@@ -0,0 +1,71 @@
+"use strict";
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UrlSubjectTokenSupplier = void 0;
+const authclient_1 = require("./authclient");
+/**
+ * Internal subject token supplier implementation used when a URL
+ * is configured in the credential configuration used to build an {@link IdentityPoolClient}
+ */
+class UrlSubjectTokenSupplier {
+    url;
+    headers;
+    formatType;
+    subjectTokenFieldName;
+    additionalGaxiosOptions;
+    /**
+     * Instantiates a URL subject token supplier.
+     * @param opts The URL subject token supplier options to build the supplier with.
+     */
+    constructor(opts) {
+        this.url = opts.url;
+        this.formatType = opts.formatType;
+        this.subjectTokenFieldName = opts.subjectTokenFieldName;
+        this.headers = opts.headers;
+        this.additionalGaxiosOptions = opts.additionalGaxiosOptions;
+    }
+    /**
+     * Sends a GET request to the URL provided in the constructor and resolves
+     * with the returned external subject token.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link IdentityPoolClient}, contains the requested audience and subject
+     *   token type for the external account identity. Not used.
+     */
+    async getSubjectToken(context) {
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: this.url,
+            method: 'GET',
+            headers: this.headers,
+            responseType: this.formatType,
+        };
+        authclient_1.AuthClient.setMethodName(opts, 'getSubjectToken');
+        let subjectToken;
+        if (this.formatType === 'text') {
+            const response = await context.transporter.request(opts);
+            subjectToken = response.data;
+        }
+        else if (this.formatType === 'json' && this.subjectTokenFieldName) {
+            const response = await context.transporter.request(opts);
+            subjectToken = response.data[this.subjectTokenFieldName];
+        }
+        if (!subjectToken) {
+            throw new Error('Unable to parse the subject_token from the credential_source URL');
+        }
+        return subjectToken;
+    }
+}
+exports.UrlSubjectTokenSupplier = UrlSubjectTokenSupplier;
+//# sourceMappingURL=urlsubjecttokensupplier.js.map

package/node_modules/google-auth-library/build/src/crypto/browser/crypto.d.ts

@@ -0,0 +1,27 @@
+import { Crypto, JwkCertificate } from '../shared';
+export declare class BrowserCrypto implements Crypto {
+    constructor();
+    sha256DigestBase64(str: string): Promise<string>;
+    randomBytesBase64(count: number): string;
+    private static padBase64;
+    verify(pubkey: JwkCertificate, data: string, signature: string): Promise<boolean>;
+    sign(privateKey: JwkCertificate, data: string): Promise<string>;
+    decodeBase64StringUtf8(base64: string): string;
+    encodeBase64StringUtf8(text: string): string;
+    /**
+     * Computes the SHA-256 hash of the provided string.
+     * @param str The plain text string to hash.
+     * @return A promise that resolves with the SHA-256 hash of the provided
+     *   string in hexadecimal encoding.
+     */
+    sha256DigestHex(str: string): Promise<string>;
+    /**
+     * Computes the HMAC hash of a message using the provided crypto key and the
+     * SHA-256 algorithm.
+     * @param key The secret crypto key in utf-8 or ArrayBuffer format.
+     * @param msg The plain text message.
+     * @return A promise that resolves with the HMAC-SHA256 hash in ArrayBuffer
+     *   format.
+     */
+    signWithHmacSha256(key: string | ArrayBuffer, msg: string): Promise<ArrayBuffer>;
+}

package/node_modules/google-auth-library/build/src/crypto/browser/crypto.js

@@ -0,0 +1,127 @@
+"use strict";
+// Copyright 2019 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/* global window */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserCrypto = void 0;
+// This file implements crypto functions we need using in-browser
+// SubtleCrypto interface `window.crypto.subtle`.
+const base64js = require("base64-js");
+const shared_1 = require("../shared");
+class BrowserCrypto {
+    constructor() {
+        if (typeof window === 'undefined' ||
+            window.crypto === undefined ||
+            window.crypto.subtle === undefined) {
+            throw new Error("SubtleCrypto not found. Make sure it's an https:// website.");
+        }
+    }
+    async sha256DigestBase64(str) {
+        // SubtleCrypto digest() method is async, so we must make
+        // this method async as well.
+        // To calculate SHA256 digest using SubtleCrypto, we first
+        // need to convert an input string to an ArrayBuffer:
+        const inputBuffer = new TextEncoder().encode(str);
+        // Result is ArrayBuffer as well.
+        const outputBuffer = await window.crypto.subtle.digest('SHA-256', inputBuffer);
+        return base64js.fromByteArray(new Uint8Array(outputBuffer));
+    }
+    randomBytesBase64(count) {
+        const array = new Uint8Array(count);
+        window.crypto.getRandomValues(array);
+        return base64js.fromByteArray(array);
+    }
+    static padBase64(base64) {
+        // base64js requires padding, so let's add some '='
+        while (base64.length % 4 !== 0) {
+            base64 += '=';
+        }
+        return base64;
+    }
+    async verify(pubkey, data, signature) {
+        const algo = {
+            name: 'RSASSA-PKCS1-v1_5',
+            hash: { name: 'SHA-256' },
+        };
+        const dataArray = new TextEncoder().encode(data);
+        const signatureArray = base64js.toByteArray(BrowserCrypto.padBase64(signature));
+        const cryptoKey = await window.crypto.subtle.importKey('jwk', pubkey, algo, true, ['verify']);
+        // SubtleCrypto's verify method is async so we must make
+        // this method async as well.
+        const result = await window.crypto.subtle.verify(algo, cryptoKey, Buffer.from(signatureArray), dataArray);
+        return result;
+    }
+    async sign(privateKey, data) {
+        const algo = {
+            name: 'RSASSA-PKCS1-v1_5',
+            hash: { name: 'SHA-256' },
+        };
+        const dataArray = new TextEncoder().encode(data);
+        const cryptoKey = await window.crypto.subtle.importKey('jwk', privateKey, algo, true, ['sign']);
+        // SubtleCrypto's sign method is async so we must make
+        // this method async as well.
+        const result = await window.crypto.subtle.sign(algo, cryptoKey, dataArray);
+        return base64js.fromByteArray(new Uint8Array(result));
+    }
+    decodeBase64StringUtf8(base64) {
+        const uint8array = base64js.toByteArray(BrowserCrypto.padBase64(base64));
+        const result = new TextDecoder().decode(uint8array);
+        return result;
+    }
+    encodeBase64StringUtf8(text) {
+        const uint8array = new TextEncoder().encode(text);
+        const result = base64js.fromByteArray(uint8array);
+        return result;
+    }
+    /**
+     * Computes the SHA-256 hash of the provided string.
+     * @param str The plain text string to hash.
+     * @return A promise that resolves with the SHA-256 hash of the provided
+     *   string in hexadecimal encoding.
+     */
+    async sha256DigestHex(str) {
+        // SubtleCrypto digest() method is async, so we must make
+        // this method async as well.
+        // To calculate SHA256 digest using SubtleCrypto, we first
+        // need to convert an input string to an ArrayBuffer:
+        const inputBuffer = new TextEncoder().encode(str);
+        // Result is ArrayBuffer as well.
+        const outputBuffer = await window.crypto.subtle.digest('SHA-256', inputBuffer);
+        return (0, shared_1.fromArrayBufferToHex)(outputBuffer);
+    }
+    /**
+     * Computes the HMAC hash of a message using the provided crypto key and the
+     * SHA-256 algorithm.
+     * @param key The secret crypto key in utf-8 or ArrayBuffer format.
+     * @param msg The plain text message.
+     * @return A promise that resolves with the HMAC-SHA256 hash in ArrayBuffer
+     *   format.
+     */
+    async signWithHmacSha256(key, msg) {
+        // Convert key, if provided in ArrayBuffer format, to string.
+        const rawKey = typeof key === 'string'
+            ? key
+            : String.fromCharCode(...new Uint16Array(key));
+        const enc = new TextEncoder();
+        const cryptoKey = await window.crypto.subtle.importKey('raw', enc.encode(rawKey), {
+            name: 'HMAC',
+            hash: {
+                name: 'SHA-256',
+            },
+        }, false, ['sign']);
+        return window.crypto.subtle.sign('HMAC', cryptoKey, enc.encode(msg));
+    }
+}
+exports.BrowserCrypto = BrowserCrypto;
+//# sourceMappingURL=crypto.js.map