@undefineds.co/xpod 0.4.20 → 0.4.25

package/node_modules/openid-client/node_modules/jose/dist/browser/jwt/sign.js

@@ -1,21 +0,0 @@
-import { CompactSign } from '../jws/compact/sign.js';
-import { JWTInvalid } from '../util/errors.js';
-import { encoder } from '../lib/buffer_utils.js';
-import { ProduceJWT } from './produce.js';
-export class SignJWT extends ProduceJWT {
-    setProtectedHeader(protectedHeader) {
-        this._protectedHeader = protectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        var _a;
-        const sig = new CompactSign(encoder.encode(JSON.stringify(this._payload)));
-        sig.setProtectedHeader(this._protectedHeader);
-        if (Array.isArray((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.crit) &&
-            this._protectedHeader.crit.includes('b64') &&
-            this._protectedHeader.b64 === false) {
-            throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-        }
-        return sig.sign(key, options);
-    }
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/jwt/unsecured.js

@@ -1,32 +0,0 @@
-import * as base64url from '../runtime/base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
-import { JWTInvalid } from '../util/errors.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { ProduceJWT } from './produce.js';
-export class UnsecuredJWT extends ProduceJWT {
-    encode() {
-        const header = base64url.encode(JSON.stringify({ alg: 'none' }));
-        const payload = base64url.encode(JSON.stringify(this._payload));
-        return `${header}.${payload}.`;
-    }
-    static decode(jwt, options) {
-        if (typeof jwt !== 'string') {
-            throw new JWTInvalid('Unsecured JWT must be a string');
-        }
-        const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split('.');
-        if (length !== 3 || signature !== '') {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        let header;
-        try {
-            header = JSON.parse(decoder.decode(base64url.decode(encodedHeader)));
-            if (header.alg !== 'none')
-                throw new Error();
-        }
-        catch (_a) {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        const payload = jwtPayload(header, base64url.decode(encodedPayload), options);
-        return { payload, header };
-    }
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/jwt/verify.js

@@ -1,16 +0,0 @@
-import { compactVerify } from '../jws/compact/verify.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { JWTInvalid } from '../util/errors.js';
-export async function jwtVerify(jwt, key, options) {
-    var _a;
-    const verified = await compactVerify(jwt, key, options);
-    if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
-        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-    }
-    const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/key/export.js

@@ -1,12 +0,0 @@
-import { toSPKI as exportPublic } from '../runtime/asn1.js';
-import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
-import keyToJWK from '../runtime/key_to_jwk.js';
-export async function exportSPKI(key) {
-    return exportPublic(key);
-}
-export async function exportPKCS8(key) {
-    return exportPrivate(key);
-}
-export async function exportJWK(key) {
-    return keyToJWK(key);
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/key/generate_key_pair.js

@@ -1,4 +0,0 @@
-import { generateKeyPair as generate } from '../runtime/generate.js';
-export async function generateKeyPair(alg, options) {
-    return generate(alg, options);
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/key/generate_secret.js

@@ -1,4 +0,0 @@
-import { generateSecret as generate } from '../runtime/generate.js';
-export async function generateSecret(alg, options) {
-    return generate(alg, options);
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/key/import.js

@@ -1,50 +0,0 @@
-import { decode as decodeBase64URL } from '../runtime/base64url.js';
-import { fromSPKI, fromPKCS8, fromX509 } from '../runtime/asn1.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
-import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
-export async function importSPKI(spki, alg, options) {
-    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
-        throw new TypeError('"spki" must be SPKI formatted string');
-    }
-    return fromSPKI(spki, alg, options);
-}
-export async function importX509(x509, alg, options) {
-    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
-        throw new TypeError('"x509" must be X.509 formatted string');
-    }
-    return fromX509(x509, alg, options);
-}
-export async function importPKCS8(pkcs8, alg, options) {
-    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
-        throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
-    }
-    return fromPKCS8(pkcs8, alg, options);
-}
-export async function importJWK(jwk, alg, octAsKeyObject) {
-    var _a;
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: (_a = jwk.ext) !== null && _a !== void 0 ? _a : false });
-            }
-            return decodeBase64URL(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return asKeyObject({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/aesgcmkw.js

@@ -1,14 +0,0 @@
-import encrypt from '../runtime/encrypt.js';
-import decrypt from '../runtime/decrypt.js';
-import generateIv from './iv.js';
-import { encode as base64url } from '../runtime/base64url.js';
-export async function wrap(alg, key, cek, iv) {
-    const jweAlgorithm = alg.slice(0, 7);
-    iv || (iv = generateIv(jweAlgorithm));
-    const { ciphertext: encryptedKey, tag } = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
-    return { encryptedKey, iv: base64url(iv), tag: base64url(tag) };
-}
-export async function unwrap(alg, key, encryptedKey, iv, tag) {
-    const jweAlgorithm = alg.slice(0, 7);
-    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/buffer_utils.js

@@ -1,51 +0,0 @@
-import digest from '../runtime/digest.js';
-export const encoder = new TextEncoder();
-export const decoder = new TextDecoder();
-const MAX_INT32 = 2 ** 32;
-export function concat(...buffers) {
-    const size = buffers.reduce((acc, { length }) => acc + length, 0);
-    const buf = new Uint8Array(size);
-    let i = 0;
-    buffers.forEach((buffer) => {
-        buf.set(buffer, i);
-        i += buffer.length;
-    });
-    return buf;
-}
-export function p2s(alg, p2sInput) {
-    return concat(encoder.encode(alg), new Uint8Array([0]), p2sInput);
-}
-function writeUInt32BE(buf, value, offset) {
-    if (value < 0 || value >= MAX_INT32) {
-        throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
-    }
-    buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);
-}
-export function uint64be(value) {
-    const high = Math.floor(value / MAX_INT32);
-    const low = value % MAX_INT32;
-    const buf = new Uint8Array(8);
-    writeUInt32BE(buf, high, 0);
-    writeUInt32BE(buf, low, 4);
-    return buf;
-}
-export function uint32be(value) {
-    const buf = new Uint8Array(4);
-    writeUInt32BE(buf, value);
-    return buf;
-}
-export function lengthAndInput(input) {
-    return concat(uint32be(input.length), input);
-}
-export async function concatKdf(secret, bits, value) {
-    const iterations = Math.ceil((bits >> 3) / 32);
-    const res = new Uint8Array(iterations * 32);
-    for (let iter = 0; iter < iterations; iter++) {
-        const buf = new Uint8Array(4 + secret.length + value.length);
-        buf.set(uint32be(iter + 1));
-        buf.set(secret, 4);
-        buf.set(value, 4 + secret.length);
-        res.set(await digest('sha256', buf), iter * 32);
-    }
-    return res.slice(0, bits >> 3);
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/cek.js

@@ -1,20 +0,0 @@
-import { JOSENotSupported } from '../util/errors.js';
-import random from '../runtime/random.js';
-export function bitLength(alg) {
-    switch (alg) {
-        case 'A128GCM':
-            return 128;
-        case 'A192GCM':
-            return 192;
-        case 'A256GCM':
-        case 'A128CBC-HS256':
-            return 256;
-        case 'A192CBC-HS384':
-            return 384;
-        case 'A256CBC-HS512':
-            return 512;
-        default:
-            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
-    }
-}
-export default (alg) => random(new Uint8Array(bitLength(alg) >> 3));

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/check_iv_length.js

@@ -1,8 +0,0 @@
-import { JWEInvalid } from '../util/errors.js';
-import { bitLength } from './iv.js';
-const checkIvLength = (enc, iv) => {
-    if (iv.length << 3 !== bitLength(enc)) {
-        throw new JWEInvalid('Invalid Initialization Vector length');
-    }
-};
-export default checkIvLength;

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/check_key_type.js

@@ -1,45 +0,0 @@
-import { withAlg as invalidKeyInput } from './invalid_key_input.js';
-import isKeyLike, { types } from '../runtime/is_key_like.js';
-const symmetricTypeCheck = (alg, key) => {
-    if (key instanceof Uint8Array)
-        return;
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
-    }
-};
-const asymmetricTypeCheck = (alg, key, usage) => {
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
-    }
-    if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
-    }
-    if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
-    }
-    if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
-    }
-    if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
-    }
-};
-const checkKeyType = (alg, key, usage) => {
-    const symmetric = alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        /^A\d{3}(?:GCM)?KW$/.test(alg);
-    if (symmetric) {
-        symmetricTypeCheck(alg, key);
-    }
-    else {
-        asymmetricTypeCheck(alg, key, usage);
-    }
-};
-export default checkKeyType;

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/check_p2s.js

@@ -1,6 +0,0 @@
-import { JWEInvalid } from '../util/errors.js';
-export default function checkP2s(p2s) {
-    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
-        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
-    }
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/crypto_key.js

@@ -1,152 +0,0 @@
-function unusable(name, prop = 'algorithm.name') {
-    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-    return algorithm.name === name;
-}
-function getHashLength(hash) {
-    return parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-        default:
-            throw new Error('unreachable');
-    }
-}
-function checkUsage(key, usages) {
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
-    }
-}
-export function checkSigCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (!isAlgorithm(key.algorithm, 'HMAC'))
-                throw unusable('HMAC');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
-                throw unusable('RSASSA-PKCS1-v1_5');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
-                throw unusable('RSA-PSS');
-            const expected = parseInt(alg.slice(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        case 'EdDSA': {
-            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
-                throw unusable('Ed25519 or Ed448');
-            }
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (!isAlgorithm(key.algorithm, 'ECDSA'))
-                throw unusable('ECDSA');
-            const expected = getNamedCurve(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.namedCurve');
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    checkUsage(key, usages);
-}
-export function checkEncCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM': {
-            if (!isAlgorithm(key.algorithm, 'AES-GCM'))
-                throw unusable('AES-GCM');
-            const expected = parseInt(alg.slice(1, 4), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.length');
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (!isAlgorithm(key.algorithm, 'AES-KW'))
-                throw unusable('AES-KW');
-            const expected = parseInt(alg.slice(1, 4), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.length');
-            break;
-        }
-        case 'ECDH': {
-            switch (key.algorithm.name) {
-                case 'ECDH':
-                case 'X25519':
-                case 'X448':
-                    break;
-                default:
-                    throw unusable('ECDH, X25519, or X448');
-            }
-            break;
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW':
-            if (!isAlgorithm(key.algorithm, 'PBKDF2'))
-                throw unusable('PBKDF2');
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
-                throw unusable('RSA-OAEP');
-            const expected = parseInt(alg.slice(9), 10) || 1;
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected)
-                throw unusable(`SHA-${expected}`, 'algorithm.hash');
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    checkUsage(key, usages);
-}

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/decrypt_key_management.js

@@ -1,127 +0,0 @@
-import { unwrap as aesKw } from '../runtime/aeskw.js';
-import * as ECDH from '../runtime/ecdhes.js';
-import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
-import { decrypt as rsaEs } from '../runtime/rsaes.js';
-import { decode as base64url } from '../runtime/base64url.js';
-import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { bitLength as cekLength } from '../lib/cek.js';
-import { importJWK } from '../key/import.js';
-import checkKeyType from './check_key_type.js';
-import isObject from './is_object.js';
-import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
-    checkKeyType(alg, key, 'decrypt');
-    switch (alg) {
-        case 'dir': {
-            if (encryptedKey !== undefined)
-                throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            return key;
-        }
-        case 'ECDH-ES':
-            if (encryptedKey !== undefined)
-                throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            if (!isObject(joseHeader.epk))
-                throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
-            if (!ECDH.ecdhAllowed(key))
-                throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
-            const epk = await importJWK(joseHeader.epk, alg);
-            let partyUInfo;
-            let partyVInfo;
-            if (joseHeader.apu !== undefined) {
-                if (typeof joseHeader.apu !== 'string')
-                    throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                try {
-                    partyUInfo = base64url(joseHeader.apu);
-                }
-                catch (_a) {
-                    throw new JWEInvalid('Failed to base64url decode the apu');
-                }
-            }
-            if (joseHeader.apv !== undefined) {
-                if (typeof joseHeader.apv !== 'string')
-                    throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                try {
-                    partyVInfo = base64url(joseHeader.apv);
-                }
-                catch (_b) {
-                    throw new JWEInvalid('Failed to base64url decode the apv');
-                }
-            }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
-            if (alg === 'ECDH-ES')
-                return sharedSecret;
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg.slice(-6), sharedSecret, encryptedKey);
-        }
-        case 'RSA1_5':
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return rsaEs(alg, key, encryptedKey);
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            if (typeof joseHeader.p2c !== 'number')
-                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
-            if (joseHeader.p2c > p2cLimit)
-                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
-            if (typeof joseHeader.p2s !== 'string')
-                throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            let p2s;
-            try {
-                p2s = base64url(joseHeader.p2s);
-            }
-            catch (_c) {
-                throw new JWEInvalid('Failed to base64url decode the p2s');
-            }
-            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg, key, encryptedKey);
-        }
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            if (typeof joseHeader.iv !== 'string')
-                throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
-            if (typeof joseHeader.tag !== 'string')
-                throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            let iv;
-            try {
-                iv = base64url(joseHeader.iv);
-            }
-            catch (_d) {
-                throw new JWEInvalid('Failed to base64url decode the iv');
-            }
-            let tag;
-            try {
-                tag = base64url(joseHeader.tag);
-            }
-            catch (_e) {
-                throw new JWEInvalid('Failed to base64url decode the tag');
-            }
-            return aesGcmKw(alg, key, encryptedKey, iv, tag);
-        }
-        default: {
-            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
-        }
-    }
-}
-export default decryptKeyManagement;

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/encrypt_key_management.js

@@ -1,87 +0,0 @@
-import { wrap as aesKw } from '../runtime/aeskw.js';
-import * as ECDH from '../runtime/ecdhes.js';
-import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
-import { encrypt as rsaEs } from '../runtime/rsaes.js';
-import { encode as base64url } from '../runtime/base64url.js';
-import generateCek, { bitLength as cekLength } from '../lib/cek.js';
-import { JOSENotSupported } from '../util/errors.js';
-import { exportJWK } from '../key/export.js';
-import checkKeyType from './check_key_type.js';
-import { wrap as aesGcmKw } from './aesgcmkw.js';
-async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
-    let encryptedKey;
-    let parameters;
-    let cek;
-    checkKeyType(alg, key, 'encrypt');
-    switch (alg) {
-        case 'dir': {
-            cek = key;
-            break;
-        }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            if (!ECDH.ecdhAllowed(key)) {
-                throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
-            }
-            const { apu, apv } = providedParameters;
-            let { epk: ephemeralKey } = providedParameters;
-            ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
-            const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
-            parameters = { epk: { x, crv, kty } };
-            if (kty === 'EC')
-                parameters.epk.y = y;
-            if (apu)
-                parameters.apu = base64url(apu);
-            if (apv)
-                parameters.apv = base64url(apv);
-            if (alg === 'ECDH-ES') {
-                cek = sharedSecret;
-                break;
-            }
-            cek = providedCek || generateCek(enc);
-            const kwAlg = alg.slice(-6);
-            encryptedKey = await aesKw(kwAlg, sharedSecret, cek);
-            break;
-        }
-        case 'RSA1_5':
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await rsaEs(alg, key, cek);
-            break;
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW': {
-            cek = providedCek || generateCek(enc);
-            const { p2c, p2s } = providedParameters;
-            ({ encryptedKey, ...parameters } = await pbes2Kw(alg, key, cek, p2c, p2s));
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await aesKw(alg, key, cek);
-            break;
-        }
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW': {
-            cek = providedCek || generateCek(enc);
-            const { iv } = providedParameters;
-            ({ encryptedKey, ...parameters } = await aesGcmKw(alg, key, cek, iv));
-            break;
-        }
-        default: {
-            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
-        }
-    }
-    return { cek, encryptedKey, parameters };
-}
-export default encryptKeyManagement;

package/node_modules/openid-client/node_modules/jose/dist/browser/lib/epoch.js

@@ -1 +0,0 @@
-export default (date) => Math.floor(date.getTime() / 1000);