@undefineds.co/xpod 0.4.18 → 0.4.20

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/decrypt.js

@@ -0,0 +1,85 @@
+import { concat, uint64be } from '../lib/buffer_utils.js';
+import checkIvLength from '../lib/check_iv_length.js';
+import checkCekLength from './check_cek_length.js';
+import timingSafeEqual from './timing_safe_equal.js';
+import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+    if (!(cek instanceof Uint8Array)) {
+        throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
+    }
+    const keySize = parseInt(enc.slice(1, 4), 10);
+    const encKey = await crypto.subtle.importKey('raw', cek.subarray(keySize >> 3), 'AES-CBC', false, ['decrypt']);
+    const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
+        hash: `SHA-${keySize << 1}`,
+        name: 'HMAC',
+    }, false, ['sign']);
+    const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
+    const expectedTag = new Uint8Array((await crypto.subtle.sign('HMAC', macKey, macData)).slice(0, keySize >> 3));
+    let macCheckPassed;
+    try {
+        macCheckPassed = timingSafeEqual(tag, expectedTag);
+    }
+    catch (_a) {
+    }
+    if (!macCheckPassed) {
+        throw new JWEDecryptionFailed();
+    }
+    let plaintext;
+    try {
+        plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: 'AES-CBC' }, encKey, ciphertext));
+    }
+    catch (_b) {
+    }
+    if (!plaintext) {
+        throw new JWEDecryptionFailed();
+    }
+    return plaintext;
+}
+async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+    let encKey;
+    if (cek instanceof Uint8Array) {
+        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['decrypt']);
+    }
+    else {
+        checkEncCryptoKey(cek, enc, 'decrypt');
+        encKey = cek;
+    }
+    try {
+        return new Uint8Array(await crypto.subtle.decrypt({
+            additionalData: aad,
+            iv,
+            name: 'AES-GCM',
+            tagLength: 128,
+        }, encKey, concat(ciphertext, tag)));
+    }
+    catch (_a) {
+        throw new JWEDecryptionFailed();
+    }
+}
+const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
+    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
+    }
+    checkIvLength(enc, iv);
+    switch (enc) {
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            if (cek instanceof Uint8Array)
+                checkCekLength(cek, parseInt(enc.slice(-3), 10));
+            return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM':
+            if (cek instanceof Uint8Array)
+                checkCekLength(cek, parseInt(enc.slice(1, 4), 10));
+            return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
+        default:
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
+    }
+};
+export default decrypt;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/digest.js

@@ -0,0 +1,6 @@
+import crypto from './webcrypto.js';
+const digest = async (algorithm, data) => {
+    const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+};
+export default digest;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/ecdhes.js

@@ -0,0 +1,46 @@
+import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+    if (!isCryptoKey(publicKey)) {
+        throw new TypeError(invalidKeyInput(publicKey, ...types));
+    }
+    checkEncCryptoKey(publicKey, 'ECDH');
+    if (!isCryptoKey(privateKey)) {
+        throw new TypeError(invalidKeyInput(privateKey, ...types));
+    }
+    checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
+    const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+    let length;
+    if (publicKey.algorithm.name === 'X25519') {
+        length = 256;
+    }
+    else if (publicKey.algorithm.name === 'X448') {
+        length = 448;
+    }
+    else {
+        length =
+            Math.ceil(parseInt(publicKey.algorithm.namedCurve.substr(-3), 10) / 8) << 3;
+    }
+    const sharedSecret = new Uint8Array(await crypto.subtle.deriveBits({
+        name: publicKey.algorithm.name,
+        public: publicKey,
+    }, privateKey, length));
+    return concatKdf(sharedSecret, keyLength, value);
+}
+export async function generateEpk(key) {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    return crypto.subtle.generateKey(key.algorithm, true, ['deriveBits']);
+}
+export function ecdhAllowed(key) {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    return (['P-256', 'P-384', 'P-521'].includes(key.algorithm.namedCurve) ||
+        key.algorithm.name === 'X25519' ||
+        key.algorithm.name === 'X448');
+}

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/encrypt.js

@@ -0,0 +1,68 @@
+import { concat, uint64be } from '../lib/buffer_utils.js';
+import checkIvLength from '../lib/check_iv_length.js';
+import checkCekLength from './check_cek_length.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { JOSENotSupported } from '../util/errors.js';
+import { types } from './is_key_like.js';
+async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+    if (!(cek instanceof Uint8Array)) {
+        throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
+    }
+    const keySize = parseInt(enc.slice(1, 4), 10);
+    const encKey = await crypto.subtle.importKey('raw', cek.subarray(keySize >> 3), 'AES-CBC', false, ['encrypt']);
+    const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
+        hash: `SHA-${keySize << 1}`,
+        name: 'HMAC',
+    }, false, ['sign']);
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+        iv,
+        name: 'AES-CBC',
+    }, encKey, plaintext));
+    const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
+    const tag = new Uint8Array((await crypto.subtle.sign('HMAC', macKey, macData)).slice(0, keySize >> 3));
+    return { ciphertext, tag };
+}
+async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
+    let encKey;
+    if (cek instanceof Uint8Array) {
+        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['encrypt']);
+    }
+    else {
+        checkEncCryptoKey(cek, enc, 'encrypt');
+        encKey = cek;
+    }
+    const encrypted = new Uint8Array(await crypto.subtle.encrypt({
+        additionalData: aad,
+        iv,
+        name: 'AES-GCM',
+        tagLength: 128,
+    }, encKey, plaintext));
+    const tag = encrypted.slice(-16);
+    const ciphertext = encrypted.slice(0, -16);
+    return { ciphertext, tag };
+}
+const encrypt = async (enc, plaintext, cek, iv, aad) => {
+    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
+    }
+    checkIvLength(enc, iv);
+    switch (enc) {
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            if (cek instanceof Uint8Array)
+                checkCekLength(cek, parseInt(enc.slice(-3), 10));
+            return cbcEncrypt(enc, plaintext, cek, iv, aad);
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM':
+            if (cek instanceof Uint8Array)
+                checkCekLength(cek, parseInt(enc.slice(1, 4), 10));
+            return gcmEncrypt(enc, plaintext, cek, iv, aad);
+        default:
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
+    }
+};
+export default encrypt;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/fetch_jwks.js

@@ -0,0 +1,34 @@
+import { JOSEError, JWKSTimeout } from '../util/errors.js';
+const fetchJwks = async (url, timeout, options) => {
+    let controller;
+    let id;
+    let timedOut = false;
+    if (typeof AbortController === 'function') {
+        controller = new AbortController();
+        id = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeout);
+    }
+    const response = await fetch(url.href, {
+        signal: controller ? controller.signal : undefined,
+        redirect: 'manual',
+        headers: options.headers,
+    }).catch((err) => {
+        if (timedOut)
+            throw new JWKSTimeout();
+        throw err;
+    });
+    if (id !== undefined)
+        clearTimeout(id);
+    if (response.status !== 200) {
+        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
+    }
+    try {
+        return await response.json();
+    }
+    catch (_a) {
+        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
+    }
+};
+export default fetchJwks;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/generate.js

@@ -0,0 +1,141 @@
+import crypto from './webcrypto.js';
+import { JOSENotSupported } from '../util/errors.js';
+import random from './random.js';
+export async function generateSecret(alg, options) {
+    var _a;
+    let length;
+    let algorithm;
+    let keyUsages;
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512':
+            length = parseInt(alg.slice(-3), 10);
+            algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            length = parseInt(alg.slice(-3), 10);
+            return random(new Uint8Array(length >> 3));
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW':
+            length = parseInt(alg.slice(1, 4), 10);
+            algorithm = { name: 'AES-KW', length };
+            keyUsages = ['wrapKey', 'unwrapKey'];
+            break;
+        case 'A128GCMKW':
+        case 'A192GCMKW':
+        case 'A256GCMKW':
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM':
+            length = parseInt(alg.slice(1, 4), 10);
+            algorithm = { name: 'AES-GCM', length };
+            keyUsages = ['encrypt', 'decrypt'];
+            break;
+        default:
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
+    return crypto.subtle.generateKey(algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+}
+function getModulusLengthOption(options) {
+    var _a;
+    const modulusLength = (_a = options === null || options === void 0 ? void 0 : options.modulusLength) !== null && _a !== void 0 ? _a : 2048;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
+        throw new JOSENotSupported('Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used');
+    }
+    return modulusLength;
+}
+export async function generateKeyPair(alg, options) {
+    var _a, _b, _c;
+    let algorithm;
+    let keyUsages;
+    switch (alg) {
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
+            algorithm = {
+                name: 'RSA-PSS',
+                hash: `SHA-${alg.slice(-3)}`,
+                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                modulusLength: getModulusLengthOption(options),
+            };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'RS256':
+        case 'RS384':
+        case 'RS512':
+            algorithm = {
+                name: 'RSASSA-PKCS1-v1_5',
+                hash: `SHA-${alg.slice(-3)}`,
+                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                modulusLength: getModulusLengthOption(options),
+            };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            algorithm = {
+                name: 'RSA-OAEP',
+                hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
+                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                modulusLength: getModulusLengthOption(options),
+            };
+            keyUsages = ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey'];
+            break;
+        case 'ES256':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'ES384':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'ES512':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'EdDSA':
+            keyUsages = ['sign', 'verify'];
+            const crv = (_a = options === null || options === void 0 ? void 0 : options.crv) !== null && _a !== void 0 ? _a : 'Ed25519';
+            switch (crv) {
+                case 'Ed25519':
+                case 'Ed448':
+                    algorithm = { name: crv };
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
+            }
+            break;
+        case 'ECDH-ES':
+        case 'ECDH-ES+A128KW':
+        case 'ECDH-ES+A192KW':
+        case 'ECDH-ES+A256KW': {
+            keyUsages = ['deriveKey', 'deriveBits'];
+            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            switch (crv) {
+                case 'P-256':
+                case 'P-384':
+                case 'P-521': {
+                    algorithm = { name: 'ECDH', namedCurve: crv };
+                    break;
+                }
+                case 'X25519':
+                case 'X448':
+                    algorithm = { name: crv };
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
+            }
+            break;
+        }
+        default:
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
+    return (crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
+}

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/get_sign_verify_key.js

@@ -0,0 +1,17 @@
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkSigCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+export default function getCryptoKey(alg, key, usage) {
+    if (isCryptoKey(key)) {
+        checkSigCryptoKey(key, alg, usage);
+        return key;
+    }
+    if (key instanceof Uint8Array) {
+        if (!alg.startsWith('HS')) {
+            throw new TypeError(invalidKeyInput(key, ...types));
+        }
+        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);
+    }
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+}

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/is_key_like.js

@@ -0,0 +1,5 @@
+import { isCryptoKey } from './webcrypto.js';
+export default (key) => {
+    return isCryptoKey(key);
+};
+export const types = ['CryptoKey'];

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/jwk_to_key.js

@@ -0,0 +1,143 @@
+import crypto from './webcrypto.js';
+import { JOSENotSupported } from '../util/errors.js';
+import { decode as base64url } from './base64url.js';
+function subtleMapping(jwk) {
+    let algorithm;
+    let keyUsages;
+    switch (jwk.kty) {
+        case 'oct': {
+            switch (jwk.alg) {
+                case 'HS256':
+                case 'HS384':
+                case 'HS512':
+                    algorithm = { name: 'HMAC', hash: `SHA-${jwk.alg.slice(-3)}` };
+                    keyUsages = ['sign', 'verify'];
+                    break;
+                case 'A128CBC-HS256':
+                case 'A192CBC-HS384':
+                case 'A256CBC-HS512':
+                    throw new JOSENotSupported(`${jwk.alg} keys cannot be imported as CryptoKey instances`);
+                case 'A128GCM':
+                case 'A192GCM':
+                case 'A256GCM':
+                case 'A128GCMKW':
+                case 'A192GCMKW':
+                case 'A256GCMKW':
+                    algorithm = { name: 'AES-GCM' };
+                    keyUsages = ['encrypt', 'decrypt'];
+                    break;
+                case 'A128KW':
+                case 'A192KW':
+                case 'A256KW':
+                    algorithm = { name: 'AES-KW' };
+                    keyUsages = ['wrapKey', 'unwrapKey'];
+                    break;
+                case 'PBES2-HS256+A128KW':
+                case 'PBES2-HS384+A192KW':
+                case 'PBES2-HS512+A256KW':
+                    algorithm = { name: 'PBKDF2' };
+                    keyUsages = ['deriveBits'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'RSA': {
+            switch (jwk.alg) {
+                case 'PS256':
+                case 'PS384':
+                case 'PS512':
+                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'RS256':
+                case 'RS384':
+                case 'RS512':
+                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'RSA-OAEP':
+                case 'RSA-OAEP-256':
+                case 'RSA-OAEP-384':
+                case 'RSA-OAEP-512':
+                    algorithm = {
+                        name: 'RSA-OAEP',
+                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,
+                    };
+                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'EC': {
+            switch (jwk.alg) {
+                case 'ES256':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ES384':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ES512':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ECDH-ES':
+                case 'ECDH-ES+A128KW':
+                case 'ECDH-ES+A192KW':
+                case 'ECDH-ES+A256KW':
+                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };
+                    keyUsages = jwk.d ? ['deriveBits'] : [];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'OKP': {
+            switch (jwk.alg) {
+                case 'EdDSA':
+                    algorithm = { name: jwk.crv };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ECDH-ES':
+                case 'ECDH-ES+A128KW':
+                case 'ECDH-ES+A192KW':
+                case 'ECDH-ES+A256KW':
+                    algorithm = { name: jwk.crv };
+                    keyUsages = jwk.d ? ['deriveBits'] : [];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        default:
+            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+    }
+    return { algorithm, keyUsages };
+}
+const parse = async (jwk) => {
+    var _a, _b;
+    if (!jwk.alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    const { algorithm, keyUsages } = subtleMapping(jwk);
+    const rest = [
+        algorithm,
+        (_a = jwk.ext) !== null && _a !== void 0 ? _a : false,
+        (_b = jwk.key_ops) !== null && _b !== void 0 ? _b : keyUsages,
+    ];
+    if (algorithm.name === 'PBKDF2') {
+        return crypto.subtle.importKey('raw', base64url(jwk.k), ...rest);
+    }
+    const keyData = { ...jwk };
+    delete keyData.alg;
+    delete keyData.use;
+    return crypto.subtle.importKey('jwk', keyData, ...rest);
+};
+export default parse;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/key_to_jwk.js

@@ -0,0 +1,21 @@
+import crypto, { isCryptoKey } from './webcrypto.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { encode as base64url } from './base64url.js';
+import { types } from './is_key_like.js';
+const keyToJWK = async (key) => {
+    if (key instanceof Uint8Array) {
+        return {
+            kty: 'oct',
+            k: base64url(key),
+        };
+    }
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
+    }
+    const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey('jwk', key);
+    return jwk;
+};
+export default keyToJWK;

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/pbes2kw.js

@@ -0,0 +1,51 @@
+import random from './random.js';
+import { p2s as concatSalt } from '../lib/buffer_utils.js';
+import { encode as base64url } from './base64url.js';
+import { wrap, unwrap } from './aeskw.js';
+import checkP2s from '../lib/check_p2s.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+function getCryptoKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
+    }
+    if (isCryptoKey(key)) {
+        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
+        return key;
+    }
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+}
+async function deriveKey(p2s, alg, p2c, key) {
+    checkP2s(p2s);
+    const salt = concatSalt(alg, p2s);
+    const keylen = parseInt(alg.slice(13, 16), 10);
+    const subtleAlg = {
+        hash: `SHA-${alg.slice(8, 11)}`,
+        iterations: p2c,
+        name: 'PBKDF2',
+        salt,
+    };
+    const wrapAlg = {
+        length: keylen,
+        name: 'AES-KW',
+    };
+    const cryptoKey = await getCryptoKey(key, alg);
+    if (cryptoKey.usages.includes('deriveBits')) {
+        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+    }
+    if (cryptoKey.usages.includes('deriveKey')) {
+        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
+    }
+    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+}
+export const encrypt = async (alg, key, cek, p2c = 2048, p2s = random(new Uint8Array(16))) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    const encryptedKey = await wrap(alg.slice(-6), derived, cek);
+    return { encryptedKey, p2c, p2s: base64url(p2s) };
+};
+export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    return unwrap(alg.slice(-6), derived, encryptedKey);
+};

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/random.js

@@ -0,0 +1,2 @@
+import crypto from './webcrypto.js';
+export default crypto.getRandomValues.bind(crypto);

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/rsaes.js

@@ -0,0 +1,37 @@
+import subtleAlgorithm from './subtle_rsaes.js';
+import bogusWebCrypto from './bogus.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import checkKeyLength from './check_key_length.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
+export const encrypt = async (alg, key, cek) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
+    checkKeyLength(alg, key);
+    if (key.usages.includes('encrypt')) {
+        return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
+    }
+    if (key.usages.includes('wrapKey')) {
+        const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, ...bogusWebCrypto);
+        return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, key, subtleAlgorithm(alg)));
+    }
+    throw new TypeError('RSA-OAEP key "usages" must include "encrypt" or "wrapKey" for this operation');
+};
+export const decrypt = async (alg, key, encryptedKey) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
+    }
+    checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
+    checkKeyLength(alg, key);
+    if (key.usages.includes('decrypt')) {
+        return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
+    }
+    if (key.usages.includes('unwrapKey')) {
+        const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, key, subtleAlgorithm(alg), ...bogusWebCrypto);
+        return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
+    }
+    throw new TypeError('RSA-OAEP key "usages" must include "decrypt" or "unwrapKey" for this operation');
+};

package/node_modules/openid-client/node_modules/jose/dist/browser/runtime/runtime.js

@@ -0,0 +1 @@
+export default 'WebCryptoAPI';