@suveren/gateway 0.7.4 → 0.8.0

package/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -1,48 +1,44 @@
-import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm, unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
+import { JOSENotSupported } from "../util/errors.js";
+import { validateExtractableOption } from "../lib/key_options.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
 function getModulusLengthOption(options) {
-    const modulusLength = options?.modulusLength ?? 2048;
-    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
-        throw new JOSENotSupported('Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used');
-    }
-    return modulusLength;
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  return modulusLength;
 }
-export async function generateKeyPair(alg, options) {
-    const entry = keyAlgorithm(alg, algArgument);
-    if (entry.secret) {
-        unsupportedAlg(algArgument);
-    }
-    let algorithm;
-    if (entry.resolve) {
-        const crv = options?.crv ?? 'P-256';
-        switch (crv) {
-            case 'P-256':
-            case 'P-384':
-            case 'P-521':
-                algorithm = { name: 'ECDH', namedCurve: crv };
-                break;
-            case 'X25519':
-                algorithm = { name: 'X25519' };
-                break;
-            default:
-                throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
-        }
-    }
-    else {
-        if (entry.crv !== undefined && options?.crv !== undefined && options.crv !== entry.crv) {
-            throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
-        }
-        algorithm =
-            entry.kty[0] === 'RSA'
-                ? {
-                    ...entry.subtle,
-                    publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                    modulusLength: getModulusLengthOption(options),
-                }
-                : entry.subtle;
+async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  let algorithm;
+  if (entry.resolve) {
+    const crv = options?.crv ?? "P-256";
+    switch (crv) {
+      case "P-256":
+      case "P-384":
+      case "P-521":
+        algorithm = { name: "ECDH", namedCurve: crv };
+        break;
+      case "X25519":
+        algorithm = { name: "X25519" };
+        break;
+      default:
+        throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
     }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
-        ...entry.usages[1],
-        ...entry.usages[0],
-    ]);
+  } else {
+    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
+      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
+    algorithm = entry.kty[0] === "RSA" ? {
+      ...entry.subtle,
+      publicExponent: Uint8Array.of(1, 0, 1),
+      modulusLength: getModulusLengthOption(options)
+    } : entry.subtle;
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, [
+    ...entry.usages[1],
+    ...entry.usages[0]
+  ]);
 }
+export {
+  generateKeyPair
+};

package/node_modules/jose/dist/webapi/key/generate_secret.js

@@ -1,40 +1,36 @@
-import { unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
-export async function generateSecret(alg, options) {
-    let length;
-    let algorithm;
-    let keyUsages;
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512':
-            length = parseInt(alg.slice(-3), 10);
-            algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            length = parseInt(alg.slice(-3), 10);
-            return crypto.getRandomValues(new Uint8Array(length >> 3));
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW':
-            length = parseInt(alg.slice(1, 4), 10);
-            algorithm = { name: 'AES-KW', length };
-            keyUsages = ['wrapKey', 'unwrapKey'];
-            break;
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW':
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM':
-            length = parseInt(alg.slice(1, 4), 10);
-            algorithm = { name: 'AES-GCM', length };
-            keyUsages = ['encrypt', 'decrypt'];
-            break;
-        default:
-            unsupportedAlg(algArgument);
-    }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+import { unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
+import { validateExtractableOption } from "../lib/key_options.js";
+async function generateSecret(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable);
+  let length, algorithm, keyUsages;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      length = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${length}`, length }, keyUsages = ["sign", "verify"];
+      break;
+    case "A128CBC-HS256":
+    case "A192CBC-HS384":
+    case "A256CBC-HS512":
+      return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3));
+    case "A128KW":
+    case "A192KW":
+    case "A256KW":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-KW", length }, keyUsages = ["wrapKey", "unwrapKey"];
+      break;
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW":
+    case "A128GCM":
+    case "A192GCM":
+    case "A256GCM":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length }, keyUsages = ["encrypt", "decrypt"];
+      break;
+    default:
+      unsupportedAlg(algArgument);
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, keyUsages);
 }
+export {
+  generateSecret
+};

package/node_modules/jose/dist/webapi/key/import.js

@@ -1,57 +1,57 @@
-import { decode as decodeBase64URL } from '../util/base64url.js';
-import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
-import { jwkToKey } from '../lib/jwk_to_key.js';
-import { keyAlgorithm } from '../lib/key_algorithm.js';
-import { JOSENotSupported } from '../util/errors.js';
-import { isObject } from '../lib/type_checks.js';
-export async function importSPKI(spki, alg, options) {
-    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
-        throw new TypeError('"spki" must be SPKI formatted string');
-    }
-    return fromSPKI(spki, alg, options);
+import { decode as decodeBase64URL } from "../util/base64url.js";
+import { fromSPKI, fromPKCS8, fromX509 } from "../lib/asn1.js";
+import { jwkToKey } from "../lib/jwk_to_key.js";
+import { keyAlgorithm } from "../lib/key_algorithm.js";
+import { JOSENotSupported } from "../util/errors.js";
+import { isObject } from "../lib/type_checks.js";
+import { validateExtractableOption } from "../lib/key_options.js";
+import { normalizeJwk } from "../lib/jwk_metadata.js";
+async function importSPKI(spki, alg, options) {
+  if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
+    throw new TypeError('"spki" must be SPKI formatted string');
+  return fromSPKI(spki, alg, options);
 }
-export async function importX509(x509, alg, options) {
-    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
-        throw new TypeError('"x509" must be X.509 formatted string');
-    }
-    return fromX509(x509, alg, options);
+async function importX509(x509, alg, options) {
+  if (typeof x509 != "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0)
+    throw new TypeError('"x509" must be X.509 formatted string');
+  return fromX509(x509, alg, options);
 }
-export async function importPKCS8(pkcs8, alg, options) {
-    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
-        throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
-    }
-    return fromPKCS8(pkcs8, alg, options);
+async function importPKCS8(pkcs8, alg, options) {
+  if (typeof pkcs8 != "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
+    throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
+  return fromPKCS8(pkcs8, alg, options);
 }
-export async function importJWK(jwk, alg, options) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg ??= jwk.alg;
-    const ext = options?.extractable ?? jwk.ext;
-    if (jwk.kty !== 'oct' && !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            return decodeBase64URL(jwk.k);
-        case 'RSA':
-            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
-        case 'AKP': {
-            if (typeof jwk.alg !== 'string' || !jwk.alg) {
-                throw new TypeError('missing "alg" (Algorithm) Parameter value');
-            }
-            if (alg !== undefined && alg !== jwk.alg) {
-                throw new TypeError('JWK alg and alg option value mismatch');
-            }
-            return jwkToKey(keyAlgorithm(jwk.alg), { ...jwk, ext });
-        }
-        case 'EC':
-        case 'OKP':
-            return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk))
+    throw new TypeError("JWK must be an object");
+  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+  alg ??= jwkAlg;
+  const ext = extractable ?? normalized.ext;
+  if (normalized.kty !== "oct" && !alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  switch (normalized.kty) {
+    case "oct":
+      if (typeof normalized.k != "string")
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return decodeBase64URL(normalized.k);
+    case "AKP": {
+      if (typeof jwkAlg != "string" || !jwkAlg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (alg !== jwkAlg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
     }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
 }
+export {
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509
+};

package/node_modules/jose/dist/webapi/lib/asn1.js

@@ -1,174 +1,140 @@
-import { invalidKeyInput } from './invalid_key_input.js';
-import { encodeBase64, decodeBase64 } from '../lib/base64.js';
-import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm, unsupportedAlg, algArgument } from './key_algorithm.js';
-import { isCryptoKey, isKeyObject } from './is_key_like.js';
+import { invalidKeyInput } from "./invalid_key_input.js";
+import { encodeBase64, decodeBase64 } from "../lib/base64.js";
+import { JOSENotSupported } from "../util/errors.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "./key_algorithm.js";
+import { isCryptoKey, isKeyObject } from "./is_key_like.js";
+import { validateExtractableOption } from "./key_options.js";
 const formatPEM = (b64, descriptor) => {
-    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
-    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
-};
-const genericExport = async (keyType, keyFormat, key) => {
-    if (isKeyObject(key)) {
-        if (key.type !== keyType) {
-            throw new TypeError(`key is not a ${keyType} key`);
-        }
-        return key.export({ format: 'pem', type: keyFormat });
-    }
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject'));
-    }
-    if (!key.extractable) {
-        throw new TypeError('CryptoKey is not extractable');
-    }
-    if (key.type !== keyType) {
-        throw new TypeError(`key is not a ${keyType} key`);
-    }
-    return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
-};
-export const toSPKI = (key) => genericExport('public', 'spki', key);
-export const toPKCS8 = (key) => genericExport('private', 'pkcs8', key);
-const bytesEqual = (a, b) => {
-    if (a.byteLength !== b.length)
-        return false;
-    for (let i = 0; i < a.byteLength; i++) {
-        if (a[i] !== b[i])
-            return false;
-    }
-    return true;
-};
-const createASN1State = (data) => ({ data, pos: 0 });
-const readByte = (state) => {
-    const byte = state.data[state.pos++];
-    if (byte === undefined) {
-        throw new Error('Unexpected end of ASN.1 input');
-    }
-    return byte;
-};
-const parseLength = (state) => {
-    const first = readByte(state);
-    if (first & 0x80) {
-        const lengthOfLen = first & 0x7f;
-        let length = 0;
-        for (let i = 0; i < lengthOfLen; i++) {
-            length = (length << 8) | readByte(state);
-        }
-        return length;
-    }
-    return first;
-};
-const skipElement = (state, count = 1) => {
-    while (count-- > 0) {
-        state.pos++;
-        const length = parseLength(state);
-        state.pos += length;
-    }
-};
-const expectTag = (state, expectedTag, errorMessage) => {
-    if (readByte(state) !== expectedTag) {
-        throw new Error(errorMessage);
-    }
-};
-const getSubarray = (state, length) => {
-    if (length < 0 || state.pos + length > state.data.length) {
-        throw new Error('Unexpected end of ASN.1 input');
-    }
-    const result = state.data.subarray(state.pos, state.pos + length);
+  const newlined = (b64.match(/.{1,64}/g) || []).join(`
+`);
+  return `-----BEGIN ${descriptor}-----
+${newlined}
+-----END ${descriptor}-----`;
+}, genericExport = async (keyType, keyFormat, key) => {
+  if (isKeyObject(key)) {
+    if (key.type !== keyType)
+      throw new TypeError(`key is not a ${keyType} key`);
+    return key.export({ format: "pem", type: keyFormat });
+  }
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject"));
+  if (!key.extractable)
+    throw new TypeError("CryptoKey is not extractable");
+  if (key.type !== keyType)
+    throw new TypeError(`key is not a ${keyType} key`);
+  return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+}, toSPKI = (key) => genericExport("public", "spki", key), toPKCS8 = (key) => genericExport("private", "pkcs8", key), bytesEqual = (a, b) => {
+  if (a.byteLength !== b.length)
+    return !1;
+  for (let i = 0; i < a.byteLength; i++)
+    if (a[i] !== b[i])
+      return !1;
+  return !0;
+}, createASN1State = (data) => ({ data, pos: 0 }), readByte = (state) => {
+  const byte = state.data[state.pos++];
+  if (byte === void 0)
+    throw new Error("Unexpected end of ASN.1 input");
+  return byte;
+}, parseLength = (state) => {
+  const first = readByte(state);
+  if (first & 128) {
+    const lengthOfLen = first & 127;
+    let length = 0;
+    for (let i = 0; i < lengthOfLen; i++)
+      length = length << 8 | readByte(state);
+    return length;
+  }
+  return first;
+}, skipElement = (state, count = 1) => {
+  for (; count-- > 0; ) {
+    state.pos++;
+    const length = parseLength(state);
     state.pos += length;
-    return result;
-};
-const parseAlgorithmOID = (state) => {
-    expectTag(state, 0x06, 'Expected algorithm OID');
-    const oidLen = parseLength(state);
-    return getSubarray(state, oidLen);
+  }
+}, expectTag = (state, expectedTag, errorMessage) => {
+  if (readByte(state) !== expectedTag)
+    throw new Error(errorMessage);
+}, getSubarray = (state, length) => {
+  if (length < 0 || state.pos + length > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  const result = state.data.subarray(state.pos, state.pos + length);
+  return state.pos += length, result;
+}, parseAlgorithmOID = (state) => {
+  expectTag(state, 6, "Expected algorithm OID");
+  const oidLen = parseLength(state);
+  return getSubarray(state, oidLen);
 };
 function parseKeyHeader(state, keyFormat) {
-    expectTag(state, 0x30, `Invalid ${keyFormat === 'spki' ? 'SPKI' : 'PKCS#8'} structure`);
-    parseLength(state);
-    if (keyFormat === 'pkcs8') {
-        expectTag(state, 0x02, 'Expected version field');
-        const length = parseLength(state);
-        state.pos += length;
-    }
-    expectTag(state, 0x30, 'Expected algorithm identifier');
-    parseLength(state);
+  if (expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`), parseLength(state), keyFormat === "pkcs8") {
+    expectTag(state, 2, "Expected version field");
+    const length = parseLength(state);
+    state.pos += length;
+  }
+  expectTag(state, 48, "Expected algorithm identifier"), parseLength(state);
 }
 const parseECAlgorithmIdentifier = (state) => {
-    const algOid = parseAlgorithmOID(state);
-    if (bytesEqual(algOid, [0x2b, 0x65, 0x6e])) {
-        return 'X25519';
-    }
-    if (!bytesEqual(algOid, [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01])) {
-        throw new Error('Unsupported key algorithm');
-    }
-    expectTag(state, 0x06, 'Expected curve OID');
-    const curveOidLen = parseLength(state);
-    const curveOid = getSubarray(state, curveOidLen);
-    if (bytesEqual(curveOid, [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07]))
-        return 'P-256';
-    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x22]))
-        return 'P-384';
-    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x23]))
-        return 'P-521';
-    throw new Error('Unsupported named curve');
-};
-const genericImport = async (keyFormat, keyData, alg, options) => {
-    const entry = keyAlgorithm(alg, algArgument);
-    if (entry.secret) {
-        unsupportedAlg(algArgument);
-    }
-    const isPublic = keyFormat === 'spki';
-    let algorithm;
-    if (entry.resolve) {
-        try {
-            const state = createASN1State(keyData);
-            parseKeyHeader(state, keyFormat);
-            algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
-        }
-        catch {
-            throw new JOSENotSupported('Invalid or unsupported key format');
-        }
-    }
-    else {
-        algorithm = entry.subtle;
-    }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
-};
-const processPEMData = (pem, pattern) => {
-    return decodeBase64(pem.replace(pattern, ''));
-};
-export const fromPKCS8 = (pem, alg, options) => {
-    const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
-    return genericImport('pkcs8', keyData, alg, options);
-};
-export const fromSPKI = (pem, alg, options) => {
-    const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);
-    return genericImport('spki', keyData, alg, options);
+  const algOid = parseAlgorithmOID(state);
+  if (bytesEqual(algOid, [43, 101, 110]))
+    return "X25519";
+  if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1]))
+    throw new Error("Unsupported key algorithm");
+  expectTag(state, 6, "Expected curve OID");
+  const curveOidLen = parseLength(state), curveOid = getSubarray(state, curveOidLen);
+  if (bytesEqual(curveOid, [42, 134, 72, 206, 61, 3, 1, 7]))
+    return "P-256";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 34]))
+    return "P-384";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 35]))
+    return "P-521";
+  throw new Error("Unsupported named curve");
+}, genericImport = async (keyFormat, keyData, alg, options) => {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  const isPublic = keyFormat === "spki";
+  let algorithm;
+  if (entry.resolve)
+    try {
+      const state = createASN1State(keyData);
+      parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
+    } catch {
+      throw new JOSENotSupported("Invalid or unsupported key format");
+    }
+  else
+    algorithm = entry.subtle;
+  return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
+}, processPEMData = (pem, pattern) => decodeBase64(pem.replace(pattern, "")), fromPKCS8 = (pem, alg, options) => {
+  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
+  return genericImport("pkcs8", keyData, alg, options);
+}, fromSPKI = (pem, alg, options) => {
+  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);
+  return genericImport("spki", keyData, alg, options);
 };
 function spkiFromX509(buf) {
-    const state = createASN1State(buf);
-    expectTag(state, 0x30, 'Invalid certificate structure');
-    parseLength(state);
-    expectTag(state, 0x30, 'Invalid tbsCertificate structure');
-    parseLength(state);
-    if (buf[state.pos] === 0xa0) {
-        skipElement(state, 6);
-    }
-    else {
-        skipElement(state, 5);
-    }
-    const spkiStart = state.pos;
-    expectTag(state, 0x30, 'Invalid SPKI structure');
-    const spkiContentLen = parseLength(state);
-    return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
+  const state = createASN1State(buf);
+  expectTag(state, 48, "Invalid certificate structure");
+  const certificateLength = parseLength(state);
+  if (certificateLength < 0 || state.pos + certificateLength > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  expectTag(state, 48, "Invalid tbsCertificate structure"), parseLength(state), buf[state.pos] === 160 ? skipElement(state, 6) : skipElement(state, 5);
+  const spkiStart = state.pos;
+  expectTag(state, 48, "Invalid SPKI structure");
+  const spkiContentLen = parseLength(state);
+  return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
 }
-export const fromX509 = (pem, alg, options) => {
-    let spki;
-    try {
-        const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
-        spki = spkiFromX509(certificate);
-    }
-    catch (cause) {
-        throw new TypeError('Failed to parse the X.509 certificate', { cause });
-    }
-    return genericImport('spki', spki, alg, options);
+const fromX509 = (pem, alg, options) => {
+  let spki;
+  try {
+    const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
+    spki = spkiFromX509(certificate);
+  } catch (cause) {
+    throw new TypeError("Failed to parse the X.509 certificate", { cause });
+  }
+  return genericImport("spki", spki, alg, options);
+};
+export {
+  fromPKCS8,
+  fromSPKI,
+  fromX509,
+  toPKCS8,
+  toSPKI
 };

package/node_modules/jose/dist/webapi/lib/base64.js

@@ -1,22 +1,20 @@
-export function encodeBase64(input) {
-    if (Uint8Array.prototype.toBase64) {
-        return input.toBase64();
-    }
-    const CHUNK_SIZE = 0x8000;
-    const arr = [];
-    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
-        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join(''));
+function encodeBase64(input) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64();
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  return btoa(arr.join(""));
 }
-export function decodeBase64(encoded) {
-    if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(encoded);
-    }
-    const binary = atob(encoded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded);
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
 }
+export {
+  decodeBase64,
+  encodeBase64
+};