@undefineds.co/xpod 0.4.18 → 0.4.19

package/node_modules/jose/dist/browser/runtime/normalize_key.js

@@ -0,0 +1,68 @@
+import { isJWK } from '../lib/is_jwk.js';
+import { decode } from './base64url.js';
+import importJWK from './jwk_to_key.js';
+const exportKeyValue = (k) => decode(k);
+let privCache;
+let pubCache;
+const isKeyObject = (key) => {
+    return key?.[Symbol.toStringTag] === 'KeyObject';
+};
+const importAndCache = async (cache, key, jwk, alg, freeze = false) => {
+    let cached = cache.get(key);
+    if (cached?.[alg]) {
+        return cached[alg];
+    }
+    const cryptoKey = await importJWK({ ...jwk, alg });
+    if (freeze)
+        Object.freeze(key);
+    if (!cached) {
+        cache.set(key, { [alg]: cryptoKey });
+    }
+    else {
+        cached[alg] = cryptoKey;
+    }
+    return cryptoKey;
+};
+const normalizePublicKey = (key, alg) => {
+    if (isKeyObject(key)) {
+        let jwk = key.export({ format: 'jwk' });
+        delete jwk.d;
+        delete jwk.dp;
+        delete jwk.dq;
+        delete jwk.p;
+        delete jwk.q;
+        delete jwk.qi;
+        if (jwk.k) {
+            return exportKeyValue(jwk.k);
+        }
+        pubCache || (pubCache = new WeakMap());
+        return importAndCache(pubCache, key, jwk, alg);
+    }
+    if (isJWK(key)) {
+        if (key.k)
+            return decode(key.k);
+        pubCache || (pubCache = new WeakMap());
+        const cryptoKey = importAndCache(pubCache, key, key, alg, true);
+        return cryptoKey;
+    }
+    return key;
+};
+const normalizePrivateKey = (key, alg) => {
+    if (isKeyObject(key)) {
+        let jwk = key.export({ format: 'jwk' });
+        if (jwk.k) {
+            return exportKeyValue(jwk.k);
+        }
+        privCache || (privCache = new WeakMap());
+        return importAndCache(privCache, key, jwk, alg);
+    }
+    if (isJWK(key)) {
+        if (key.k)
+            return decode(key.k);
+        privCache || (privCache = new WeakMap());
+        const cryptoKey = importAndCache(privCache, key, key, alg, true);
+        return cryptoKey;
+    }
+    return key;
+};
+export default { normalizePublicKey, normalizePrivateKey };

package/node_modules/jose/dist/browser/runtime/pbes2kw.js

@@ -0,0 +1,51 @@
+import random from './random.js';
+import { p2s as concatSalt } from '../lib/buffer_utils.js';
+import { encode as base64url } from './base64url.js';
+import { wrap, unwrap } from './aeskw.js';
+import checkP2s from '../lib/check_p2s.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+function getCryptoKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
+    }
+    if (isCryptoKey(key)) {
+        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
+        return key;
+    }
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+}
+async function deriveKey(p2s, alg, p2c, key) {
+    checkP2s(p2s);
+    const salt = concatSalt(alg, p2s);
+    const keylen = parseInt(alg.slice(13, 16), 10);
+    const subtleAlg = {
+        hash: `SHA-${alg.slice(8, 11)}`,
+        iterations: p2c,
+        name: 'PBKDF2',
+        salt,
+    };
+    const wrapAlg = {
+        length: keylen,
+        name: 'AES-KW',
+    };
+    const cryptoKey = await getCryptoKey(key, alg);
+    if (cryptoKey.usages.includes('deriveBits')) {
+        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+    }
+    if (cryptoKey.usages.includes('deriveKey')) {
+        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
+    }
+    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+}
+export const encrypt = async (alg, key, cek, p2c = 2048, p2s = random(new Uint8Array(16))) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    const encryptedKey = await wrap(alg.slice(-6), derived, cek);
+    return { encryptedKey, p2c, p2s: base64url(p2s) };
+};
+export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    return unwrap(alg.slice(-6), derived, encryptedKey);
+};

package/node_modules/jose/dist/browser/runtime/random.js

@@ -0,0 +1,2 @@
+import crypto from './webcrypto.js';
+export default crypto.getRandomValues.bind(crypto);

package/node_modules/jose/dist/browser/runtime/rsaes.js

@@ -0,0 +1,37 @@
+import subtleAlgorithm from './subtle_rsaes.js';
+import bogusWebCrypto from './bogus.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import checkKeyLength from './check_key_length.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+export const encrypt = async (alg, key, cek) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
+    checkKeyLength(alg, key);
+    if (key.usages.includes('encrypt')) {
+        return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
+    }
+    if (key.usages.includes('wrapKey')) {
+        const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, ...bogusWebCrypto);
+        return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, key, subtleAlgorithm(alg)));
+    }
+    throw new TypeError('RSA-OAEP key "usages" must include "encrypt" or "wrapKey" for this operation');
+};
+export const decrypt = async (alg, key, encryptedKey) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
+    checkKeyLength(alg, key);
+    if (key.usages.includes('decrypt')) {
+        return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
+    }
+    if (key.usages.includes('unwrapKey')) {
+        const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, key, subtleAlgorithm(alg), ...bogusWebCrypto);
+        return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
+    }
+    throw new TypeError('RSA-OAEP key "usages" must include "decrypt" or "unwrapKey" for this operation');
+};

package/node_modules/jose/dist/browser/runtime/runtime.js

@@ -0,0 +1 @@
+export default 'WebCryptoAPI';

package/node_modules/jose/dist/browser/runtime/sign.js

@@ -0,0 +1,11 @@
+import subtleAlgorithm from './subtle_dsa.js';
+import crypto from './webcrypto.js';
+import checkKeyLength from './check_key_length.js';
+import getSignKey from './get_sign_verify_key.js';
+const sign = async (alg, key, data) => {
+    const cryptoKey = await getSignKey(alg, key, 'sign');
+    checkKeyLength(alg, cryptoKey);
+    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
+    return new Uint8Array(signature);
+};
+export default sign;

package/node_modules/jose/dist/browser/runtime/subtle_dsa.js

@@ -0,0 +1,28 @@
+import { JOSENotSupported } from '../util/errors.js';
+export default function subtleDsa(alg, algorithm) {
+    const hash = `SHA-${alg.slice(-3)}`;
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512':
+            return { hash, name: 'HMAC' };
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
+            return { hash, name: 'RSA-PSS', saltLength: alg.slice(-3) >> 3 };
+        case 'RS256':
+        case 'RS384':
+        case 'RS512':
+            return { hash, name: 'RSASSA-PKCS1-v1_5' };
+        case 'ES256':
+        case 'ES384':
+        case 'ES512':
+            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
+        case 'Ed25519':
+            return { name: 'Ed25519' };
+        case 'EdDSA':
+            return { name: algorithm.name };
+        default:
+            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+}

package/node_modules/jose/dist/browser/runtime/subtle_rsaes.js

@@ -0,0 +1,12 @@
+import { JOSENotSupported } from '../util/errors.js';
+export default function subtleRsaEs(alg) {
+    switch (alg) {
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            return 'RSA-OAEP';
+        default:
+            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+}

package/node_modules/jose/dist/browser/runtime/timing_safe_equal.js

@@ -0,0 +1,19 @@
+const timingSafeEqual = (a, b) => {
+    if (!(a instanceof Uint8Array)) {
+        throw new TypeError('First argument must be a buffer');
+    }
+    if (!(b instanceof Uint8Array)) {
+        throw new TypeError('Second argument must be a buffer');
+    }
+    if (a.length !== b.length) {
+        throw new TypeError('Input buffers must have the same length');
+    }
+    const len = a.length;
+    let out = 0;
+    let i = -1;
+    while (++i < len) {
+        out |= a[i] ^ b[i];
+    }
+    return out === 0;
+};
+export default timingSafeEqual;

package/node_modules/jose/dist/browser/runtime/verify.js

@@ -0,0 +1,16 @@
+import subtleAlgorithm from './subtle_dsa.js';
+import crypto from './webcrypto.js';
+import checkKeyLength from './check_key_length.js';
+import getVerifyKey from './get_sign_verify_key.js';
+const verify = async (alg, key, signature, data) => {
+    const cryptoKey = await getVerifyKey(alg, key, 'verify');
+    checkKeyLength(alg, cryptoKey);
+    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+    try {
+        return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+    }
+    catch {
+        return false;
+    }
+};
+export default verify;

package/node_modules/jose/dist/browser/runtime/webcrypto.js

@@ -0,0 +1,2 @@
+export default crypto;
+export const isCryptoKey = (key) => key instanceof CryptoKey;

package/node_modules/jose/dist/browser/util/base64url.js

@@ -0,0 +1,3 @@
+import * as base64url from '../runtime/base64url.js';
+export const encode = base64url.encode;
+export const decode = base64url.decode;

package/node_modules/jose/dist/browser/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to base64url decode the payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/node_modules/jose/dist/browser/util/decode_protected_header.js

@@ -0,0 +1,34 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+export function decodeProtectedHeader(token) {
+    let protectedB64u;
+    if (typeof token === 'string') {
+        const parts = token.split('.');
+        if (parts.length === 3 || parts.length === 5) {
+            ;
+            [protectedB64u] = parts;
+        }
+    }
+    else if (typeof token === 'object' && token) {
+        if ('protected' in token) {
+            protectedB64u = token.protected;
+        }
+        else {
+            throw new TypeError('Token does not contain a Protected Header');
+        }
+    }
+    try {
+        if (typeof protectedB64u !== 'string' || !protectedB64u) {
+            throw new Error();
+        }
+        const result = JSON.parse(decoder.decode(base64url(protectedB64u)));
+        if (!isObject(result)) {
+            throw new Error();
+        }
+        return result;
+    }
+    catch {
+        throw new TypeError('Invalid Token or Protected Header formatting');
+    }
+}

package/node_modules/jose/dist/browser/util/errors.js

@@ -0,0 +1,114 @@
+export class JOSEError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.code = 'ERR_JOSE_GENERIC';
+        this.name = this.constructor.name;
+        Error.captureStackTrace?.(this, this.constructor);
+    }
+}
+JOSEError.code = 'ERR_JOSE_GENERIC';
+export class JWTClaimValidationFailed extends JOSEError {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
+        super(message, { cause: { claim, reason, payload } });
+        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+        this.claim = claim;
+        this.reason = reason;
+        this.payload = payload;
+    }
+}
+JWTClaimValidationFailed.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+export class JWTExpired extends JOSEError {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
+        super(message, { cause: { claim, reason, payload } });
+        this.code = 'ERR_JWT_EXPIRED';
+        this.claim = claim;
+        this.reason = reason;
+        this.payload = payload;
+    }
+}
+JWTExpired.code = 'ERR_JWT_EXPIRED';
+export class JOSEAlgNotAllowed extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
+    }
+}
+JOSEAlgNotAllowed.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
+export class JOSENotSupported extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JOSE_NOT_SUPPORTED';
+    }
+}
+JOSENotSupported.code = 'ERR_JOSE_NOT_SUPPORTED';
+export class JWEDecryptionFailed extends JOSEError {
+    constructor(message = 'decryption operation failed', options) {
+        super(message, options);
+        this.code = 'ERR_JWE_DECRYPTION_FAILED';
+    }
+}
+JWEDecryptionFailed.code = 'ERR_JWE_DECRYPTION_FAILED';
+export class JWEInvalid extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWE_INVALID';
+    }
+}
+JWEInvalid.code = 'ERR_JWE_INVALID';
+export class JWSInvalid extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWS_INVALID';
+    }
+}
+JWSInvalid.code = 'ERR_JWS_INVALID';
+export class JWTInvalid extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWT_INVALID';
+    }
+}
+JWTInvalid.code = 'ERR_JWT_INVALID';
+export class JWKInvalid extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWK_INVALID';
+    }
+}
+JWKInvalid.code = 'ERR_JWK_INVALID';
+export class JWKSInvalid extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWKS_INVALID';
+    }
+}
+JWKSInvalid.code = 'ERR_JWKS_INVALID';
+export class JWKSNoMatchingKey extends JOSEError {
+    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
+        super(message, options);
+        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
+    }
+}
+JWKSNoMatchingKey.code = 'ERR_JWKS_NO_MATCHING_KEY';
+export class JWKSMultipleMatchingKeys extends JOSEError {
+    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
+        super(message, options);
+        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    }
+}
+Symbol.asyncIterator;
+JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+export class JWKSTimeout extends JOSEError {
+    constructor(message = 'request timed out', options) {
+        super(message, options);
+        this.code = 'ERR_JWKS_TIMEOUT';
+    }
+}
+JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
+export class JWSSignatureVerificationFailed extends JOSEError {
+    constructor(message = 'signature verification failed', options) {
+        super(message, options);
+        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+    }
+}
+JWSSignatureVerificationFailed.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';

package/node_modules/jose/dist/browser/util/runtime.js

@@ -0,0 +1,2 @@
+import value from '../runtime/runtime.js';
+export default value;

package/node_modules/openid-client/node_modules/jose/dist/browser/index.js

@@ -0,0 +1,32 @@
+export { compactDecrypt } from './jwe/compact/decrypt.js';
+export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
+export { generalDecrypt } from './jwe/general/decrypt.js';
+export { GeneralEncrypt } from './jwe/general/encrypt.js';
+export { compactVerify } from './jws/compact/verify.js';
+export { flattenedVerify } from './jws/flattened/verify.js';
+export { generalVerify } from './jws/general/verify.js';
+export { jwtVerify } from './jwt/verify.js';
+export { jwtDecrypt } from './jwt/decrypt.js';
+export { CompactEncrypt } from './jwe/compact/encrypt.js';
+export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
+export { CompactSign } from './jws/compact/sign.js';
+export { FlattenedSign } from './jws/flattened/sign.js';
+export { GeneralSign } from './jws/general/sign.js';
+export { SignJWT } from './jwt/sign.js';
+export { EncryptJWT } from './jwt/encrypt.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
+export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
+export { createRemoteJWKSet } from './jwks/remote.js';
+export { UnsecuredJWT } from './jwt/unsecured.js';
+export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
+export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
+export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
+import * as errors_1 from './util/errors.js';
+export { errors_1 as errors };
+export { generateKeyPair } from './key/generate_key_pair.js';
+export { generateSecret } from './key/generate_secret.js';
+import * as base64url_1 from './util/base64url.js';
+export { base64url_1 as base64url };
+export { default as cryptoRuntime } from './util/runtime.js';

package/node_modules/openid-client/node_modules/jose/dist/browser/jwe/compact/decrypt.js

@@ -0,0 +1,27 @@
+import { flattenedDecrypt } from '../flattened/decrypt.js';
+import { JWEInvalid } from '../../util/errors.js';
+import { decoder } from '../../lib/buffer_utils.js';
+export async function compactDecrypt(jwe, key, options) {
+    if (jwe instanceof Uint8Array) {
+        jwe = decoder.decode(jwe);
+    }
+    if (typeof jwe !== 'string') {
+        throw new JWEInvalid('Compact JWE must be a string or Uint8Array');
+    }
+    const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length, } = jwe.split('.');
+    if (length !== 5) {
+        throw new JWEInvalid('Invalid Compact JWE');
+    }
+    const decrypted = await flattenedDecrypt({
+        ciphertext,
+        iv: (iv || undefined),
+        protected: protectedHeader || undefined,
+        tag: (tag || undefined),
+        encrypted_key: encryptedKey || undefined,
+    }, key, options);
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
+}

package/node_modules/openid-client/node_modules/jose/dist/browser/jwe/compact/encrypt.js

@@ -0,0 +1,26 @@
+import { FlattenedEncrypt } from '../flattened/encrypt.js';
+export class CompactEncrypt {
+    constructor(plaintext) {
+        this._flattened = new FlattenedEncrypt(plaintext);
+    }
+    setContentEncryptionKey(cek) {
+        this._flattened.setContentEncryptionKey(cek);
+        return this;
+    }
+    setInitializationVector(iv) {
+        this._flattened.setInitializationVector(iv);
+        return this;
+    }
+    setProtectedHeader(protectedHeader) {
+        this._flattened.setProtectedHeader(protectedHeader);
+        return this;
+    }
+    setKeyManagementParameters(parameters) {
+        this._flattened.setKeyManagementParameters(parameters);
+        return this;
+    }
+    async encrypt(key, options) {
+        const jwe = await this._flattened.encrypt(key, options);
+        return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
+    }
+}