@suveren/gateway 0.7.6 → 0.8.0

package/node_modules/jose/dist/webapi/jwks/local.js

@@ -1,70 +1,53 @@
-import { jwkToKey } from '../lib/jwk_to_key.js';
-import { JWS } from '../lib/jws_algorithms.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isJwkSet } from '../lib/type_checks.js';
-import { snapshotJwk } from '../lib/jwk_metadata.js';
+import { jwkToKey } from "../lib/jwk_to_key.js";
+import { JWS } from "../lib/jws_algorithms.js";
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
+import { isJwkSet } from "../lib/type_checks.js";
+import { snapshotJwk } from "../lib/jwk_metadata.js";
 function isUsableJWK(jwk, entry, alg, kid) {
-    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
-    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
-    return ((ext === undefined || typeof ext === 'boolean') &&
-        (keyOps === undefined ||
-            (Array.isArray(keyOps) &&
-                keyOps.every((operation, index) => typeof operation === 'string' && keyOps.indexOf(operation) === index) &&
-                keyOps.includes('verify'))) &&
-        entry.kty.includes(kty) &&
-        (kid === undefined || (typeof kid === 'string' && kid === jwkKid)) &&
-        (jwkAlg === undefined ? kty !== 'AKP' : alg === jwkAlg) &&
-        (use === undefined || use === 'sig') &&
-        (!entry.crv || crv === entry.crv));
+  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk), keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
-    const { alg } = entry;
-    if (cached[alg] === undefined) {
-        const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
-        if (key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[alg] = key;
-    }
-    return cached[alg];
+  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === void 0) {
+    const key = await jwkToKey(entry, { ...jwk, alg, ext: !0 });
+    if (key.type !== "public")
+      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+    cached[alg] = key;
+  }
+  return cached[alg];
 }
-export function createLocalJWKSet(jwks) {
-    let snapshot;
-    try {
-        snapshot = structuredClone(jwks);
-    }
-    catch { }
-    if (!isJwkSet(snapshot)) {
-        throw new JWKSInvalid('JSON Web Key Set malformed');
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const cached = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {
+          }
+      }, error;
     }
-    const cached = new WeakMap();
-    const localJWKSet = async (protectedHeader, token) => {
-        const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-        if (!entry || entry.secret) {
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-        }
-        const candidates = snapshot.keys.filter((jwk) => isUsableJWK(jwk, entry, alg, kid));
-        const { 0: jwk, length } = candidates;
-        if (!length) {
-            throw new JWKSNoMatchingKey();
-        }
-        if (length !== 1) {
-            const error = new JWKSMultipleMatchingKeys();
-            error[Symbol.asyncIterator] = async function* () {
-                for (const jwk of candidates) {
-                    try {
-                        yield await importWithAlgCache(cached, jwk, entry);
-                    }
-                    catch { }
-                }
-            };
-            throw error;
-        }
-        return importWithAlgCache(cached, jwk, entry);
-    };
-    return Object.defineProperty(localJWKSet, 'jwks', {
-        value: () => structuredClone(snapshot),
-    });
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
 }
+export {
+  createLocalJWKSet
+};

package/node_modules/jose/dist/webapi/jwks/remote.js

@@ -1,149 +1,101 @@
-import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
-import { createLocalJWKSet } from './local.js';
-import { isJwkSet } from '../lib/type_checks.js';
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
+import { createLocalJWKSet } from "./local.js";
+import { isJwkSet } from "../lib/type_checks.js";
 function isCloudflareWorkers() {
-    return (typeof WebSocketPair !== 'undefined' ||
-        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
-        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
-    const NAME = 'jose';
-    const VERSION = 'v6.2.10';
-    USER_AGENT = `${NAME}/${VERSION}`;
-}
-export const customFetch = Symbol();
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.11");
+const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
-    const response = await fetchImpl(url, {
-        method: 'GET',
-        signal,
-        redirect: 'manual',
-        headers,
-    }).catch((err) => {
-        if (err.name === 'TimeoutError') {
-            throw new JWKSTimeout();
-        }
-        throw err;
-    });
-    if (response.status !== 200) {
-        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
-    }
-    try {
-        return await response.json();
-    }
-    catch {
-        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
-    }
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
 }
-export const jwksCache = Symbol();
+const jwksCache = /* @__PURE__ */ Symbol();
 function isFreshFor(timestamp, duration) {
-    return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
 function validateDuration(value, fallback, option) {
-    if (Number.isNaN(value)) {
-        throw new TypeError(`"${option}" option must not be NaN`);
-    }
-    return typeof value === 'number' ? value : fallback;
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
 }
-export function createRemoteJWKSet(url, options) {
-    if (!(url instanceof URL)) {
-        throw new TypeError('url must be an instance of URL');
-    }
-    const href = new URL(url.href).href;
-    const opts = options ?? {};
-    const timeoutOption = opts.timeoutDuration;
-    if (typeof timeoutOption === 'number' &&
-        (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
-        throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache && typeof cache == "object") {
+    const { uat, jwks } = cache;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
     }
-    const timeoutDuration = typeof timeoutOption === 'number' ? timeoutOption : 5000;
-    const cooldownDuration = validateDuration(opts.cooldownDuration, 30000, 'cooldownDuration');
-    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 600000, 'cacheMaxAge');
-    const headers = new Headers(opts.headers);
-    if (USER_AGENT && !headers.has('User-Agent')) {
-        headers.set('User-Agent', USER_AGENT);
-    }
-    if (!headers.has('accept')) {
-        headers.set('accept', 'application/json, application/jwk-set+json');
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
     }
-    const fetchImpl = opts[customFetch];
-    const cache = opts[jwksCache];
-    let jwksTimestamp;
-    let pendingFetch;
-    let reloadSequence = 0;
-    let appliedSequence = 0;
-    let local;
-    if (cache && typeof cache === 'object') {
-        const { uat, jwks } = cache;
-        if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
-            jwksTimestamp = uat;
-            local = createLocalJWKSet(jwks);
-        }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: !0
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: !0
+    },
+    reload: {
+      value: reload,
+      enumerable: !0
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: !0
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: !0
     }
-    const reload = async () => {
-        if (pendingFetch && isCloudflareWorkers()) {
-            pendingFetch = undefined;
-        }
-        if (!pendingFetch) {
-            const sequence = ++reloadSequence;
-            const current = (pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl)
-                .then((json) => {
-                const next = createLocalJWKSet(json);
-                if (sequence <= appliedSequence) {
-                    return;
-                }
-                local = next;
-                const updatedAt = Date.now();
-                if (cache) {
-                    cache.uat = updatedAt;
-                    cache.jwks = json;
-                }
-                jwksTimestamp = updatedAt;
-                appliedSequence = sequence;
-            })
-                .finally(() => {
-                if (pendingFetch === current) {
-                    pendingFetch = undefined;
-                }
-            }));
-        }
-        await pendingFetch;
-    };
-    const remoteJWKSet = async (protectedHeader, token) => {
-        if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
-            await reload();
-        }
-        try {
-            return await local(protectedHeader, token);
-        }
-        catch (err) {
-            if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
-                await reload();
-                return local(protectedHeader, token);
-            }
-            throw err;
-        }
-    };
-    return Object.defineProperties(remoteJWKSet, {
-        coolingDown: {
-            get: () => isFreshFor(jwksTimestamp, cooldownDuration),
-            enumerable: true,
-        },
-        fresh: {
-            get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
-            enumerable: true,
-        },
-        reload: {
-            value: reload,
-            enumerable: true,
-        },
-        reloading: {
-            get: () => !!pendingFetch,
-            enumerable: true,
-        },
-        jwks: {
-            value: () => local?.jwks(),
-            enumerable: true,
-        },
-    });
+  });
 }
+export {
+  createRemoteJWKSet,
+  customFetch,
+  jwksCache
+};

package/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -1,22 +1,22 @@
-import { createCompactSignature } from '../../lib/jws_sign.js';
-import { assertNotSet } from '../../lib/helpers.js';
-export class CompactSign {
-    #payload;
-    #protectedHeader;
-    constructor(payload) {
-        if (!(payload instanceof Uint8Array)) {
-            throw new TypeError('payload must be an instance of Uint8Array');
-        }
-        this.#payload = payload;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
-            throw new TypeError('use the flattened module for creating JWS with b64: false');
-        });
-    }
+import { createCompactSignature } from "../../lib/jws_sign.js";
+import { assertNotSet } from "../../lib/helpers.js";
+class CompactSign {
+  #payload;
+  #protectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array))
+      throw new TypeError("payload must be an instance of Uint8Array");
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    });
+  }
 }
+export {
+  CompactSign
+};

package/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -1,9 +1,8 @@
-import { prepareVerify, verifyCompact } from '../../lib/jws_verify.js';
-export async function compactVerify(jws, key, options) {
-    const verified = await verifyCompact(jws, prepareVerify(options), key);
-    const result = { payload: verified[0], protectedHeader: verified[1] };
-    if (typeof key === 'function') {
-        return { ...result, key: verified[3] };
-    }
-    return result;
+import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
+async function compactVerify(jws, key, options) {
+  const verified = await verifyCompact(jws, prepareVerify(options), key), result = { payload: verified[0], protectedHeader: verified[1] };
+  return typeof key == "function" ? { ...result, key: verified[3] } : result;
 }
+export {
+  compactVerify
+};

package/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -1,32 +1,30 @@
-import { createSignature } from '../../lib/jws_sign.js';
-import { assertNotSet } from '../../lib/helpers.js';
-export class FlattenedSign {
-    #payload;
-    #protectedHeader;
-    #unprotectedHeader;
-    constructor(payload) {
-        if (!(payload instanceof Uint8Array)) {
-            throw new TypeError('payload must be an instance of Uint8Array');
-        }
-        this.#payload = payload;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
-        this.#unprotectedHeader = unprotectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        const [jws] = await createSignature({
-            payload: this.#payload,
-            protectedHeader: this.#protectedHeader,
-            unprotectedHeader: this.#unprotectedHeader,
-            crit: options?.crit,
-        }, key);
-        return jws;
-    }
+import { createSignature } from "../../lib/jws_sign.js";
+import { assertNotSet } from "../../lib/helpers.js";
+class FlattenedSign {
+  #payload;
+  #protectedHeader;
+  #unprotectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array))
+      throw new TypeError("payload must be an instance of Uint8Array");
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+  }
+  async sign(key, options) {
+    const [jws] = await createSignature({
+      payload: this.#payload,
+      protectedHeader: this.#protectedHeader,
+      unprotectedHeader: this.#unprotectedHeader,
+      crit: options?.crit
+    }, key);
+    return jws;
+  }
 }
+export {
+  FlattenedSign
+};

package/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,25 +1,22 @@
-import { JWSInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
-import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
-export async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('Flattened JWS must be an object');
-    }
-    const snapshot = snapshotJws(jws);
-    if (snapshot.protected === undefined && snapshot.header === undefined) {
-        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (snapshot.protected !== undefined && typeof snapshot.protected !== 'string') {
-        throw new JWSInvalid('JWS Protected Header incorrect type');
-    }
-    if (snapshot.payload === undefined) {
-        throw new JWSInvalid('JWS Payload missing');
-    }
-    if (typeof snapshot.signature !== 'string') {
-        throw new JWSInvalid('JWS Signature missing or incorrect type');
-    }
-    if (snapshot.header !== undefined && !isObject(snapshot.header)) {
-        throw new JWSInvalid('JWS Unprotected Header incorrect type');
-    }
-    return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
+import { JWSInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/type_checks.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+async function flattenedVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("Flattened JWS must be an object");
+  const snapshot = snapshotJws(jws);
+  if (snapshot.protected === void 0 && snapshot.header === void 0)
+    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+  if (snapshot.protected !== void 0 && typeof snapshot.protected != "string")
+    throw new JWSInvalid("JWS Protected Header incorrect type");
+  if (snapshot.payload === void 0)
+    throw new JWSInvalid("JWS Payload missing");
+  if (typeof snapshot.signature != "string")
+    throw new JWSInvalid("JWS Signature missing or incorrect type");
+  if (snapshot.header !== void 0 && !isObject(snapshot.header))
+    throw new JWSInvalid("JWS Unprotected Header incorrect type");
+  return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
 }
+export {
+  flattenedVerify
+};