agentworkshop 0.5.0 → 0.5.2

package/.output/server/node_modules/jose/dist/webapi/lib/key.js

@@ -0,0 +1,132 @@
+import { withAlg as invalidKeyInput } from './invalid_key_input.js';
+import { isKeyLike, isCryptoKey } from './is_key_like.js';
+import * as jwk from './type_checks.js';
+import { decode } from '../util/base64url.js';
+import { jwkToKey } from './jwk_to_key.js';
+const tag = (key) => key[Symbol.toStringTag];
+const jwkMatchesOp = (entry, key, usage) => {
+    const { alg } = entry;
+    if (key.use !== undefined) {
+        const expected = usage === 'sign' || usage === 'verify' ? 'sig' : 'enc';
+        if (key.use !== expected) {
+            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+        }
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+    }
+    if (Array.isArray(key.key_ops)) {
+        const expectedKeyOp = usage === 'encrypt' || usage === 'decrypt' ? entry.ops?.[usage === 'encrypt' ? 0 : 1] : usage;
+        if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
+            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+        }
+    }
+};
+export function checkKeyType(entry, key, usage) {
+    const { alg, secret } = entry;
+    const privateKey = usage === 'decrypt' || usage === 'sign';
+    if (secret && key instanceof Uint8Array)
+        return [BYTES, key];
+    if (jwk.isJWK(key)) {
+        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+            throw new TypeError(secret
+                ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
+                : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
+        }
+        jwkMatchesOp(entry, key, usage);
+        return [JWK, key];
+    }
+    if (!isKeyLike(key)) {
+        throw new TypeError(secret
+            ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+            : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+    }
+    if (secret) {
+        if (key.type !== 'secret') {
+            throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+        }
+    }
+    else {
+        if (key.type === 'secret') {
+            throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+        }
+        const expectedType = privateKey ? 'private' : 'public';
+        if ((key.type === 'public' || key.type === 'private') && key.type !== expectedType) {
+            const operation = usage === 'sign'
+                ? 'signing'
+                : usage === 'verify'
+                    ? 'verifying'
+                    : `${usage.slice(0, -1)}tion`;
+            throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
+        }
+    }
+    return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+}
+const BYTES = 0;
+const CRYPTO = 1;
+const KEYOBJECT = 2;
+const JWK = 3;
+let cache;
+const nist = {
+    __proto__: null,
+    prime256v1: 'P-256',
+    secp384r1: 'P-384',
+    secp521r1: 'P-521',
+};
+function cached(key, alg, value) {
+    cache ||= new WeakMap();
+    const entry = cache.get(key);
+    if (value) {
+        if (entry) {
+            entry[alg] = value;
+        }
+        else {
+            cache.set(key, { __proto__: null, [alg]: value });
+        }
+    }
+    return value ?? entry?.[alg];
+}
+const handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ??
+    cached(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
+const handleKeyObject = (keyObject, entry) => {
+    const hit = cached(keyObject, entry.alg);
+    if (hit)
+        return hit;
+    const isPublic = keyObject.type === 'public';
+    const usages = entry.usages[isPublic ? 0 : 1];
+    const { asymmetricKeyType } = keyObject;
+    const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
+    const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
+    return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+};
+export async function prepareKey(entry, key, usage) {
+    const tagged = checkKeyType(entry, key, usage);
+    switch (tagged[0]) {
+        case BYTES:
+        case CRYPTO:
+            return tagged[1];
+        case JWK: {
+            const key = tagged[1];
+            if (key.k) {
+                return decode(key.k);
+            }
+            if (!Object.isFrozen(key)) {
+                const { key_ops } = key;
+                if (Array.isArray(key_ops))
+                    Object.freeze(key_ops);
+                Object.freeze(key);
+            }
+            return handleJWK(key, key, entry);
+        }
+        case KEYOBJECT: {
+            const keyObject = tagged[1];
+            if (keyObject.type === 'secret') {
+                return keyObject.export();
+            }
+            if ('toCryptoKey' in keyObject && typeof keyObject.toCryptoKey === 'function') {
+                return handleKeyObject(keyObject, entry);
+            }
+            return handleJWK(keyObject, keyObject.export({ format: 'jwk' }), entry);
+        }
+    }
+}

package/.output/server/node_modules/jose/dist/webapi/lib/key_algorithm.js

@@ -0,0 +1,10 @@
+import { JOSENotSupported } from '../util/errors.js';
+import { JWS } from './jws_algorithms.js';
+import { JWE } from './jwe_algorithms.js';
+export const algArgument = '"alg" (Algorithm)';
+export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+export function keyAlgorithm(alg, source) {
+    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
+}

package/.output/server/node_modules/jose/dist/webapi/lib/key_descriptor.js

@@ -0,0 +1,7 @@
+export function table(entries) {
+    const out = { __proto__: null };
+    for (const alg in entries) {
+        out[alg] = { ...entries[alg], alg };
+    }
+    return out;
+}

package/.output/server/node_modules/jose/dist/webapi/lib/key_management.js

@@ -0,0 +1,256 @@
+import { encode as b64u } from '../util/base64url.js';
+import { prepareKey } from './key.js';
+import { jwkToKey } from './jwk_to_key.js';
+import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
+import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
+import { decodeBase64url, digest } from './helpers.js';
+import { generateCek, encrypt, decrypt } from './content_encryption.js';
+import { isObject } from './type_checks.js';
+import { checkCryptoKey, checkModulusLength, checkUsage } from './crypto_key.js';
+import { concat, encode, uint32be } from './buffer_utils.js';
+import { assertCryptoKey } from './is_key_like.js';
+function checkEcdhCryptoKey(key, usage) {
+    if (key.algorithm.name !== 'ECDH' && key.algorithm.name !== 'X25519') {
+        throw new TypeError('CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519');
+    }
+    checkUsage(key, usage);
+}
+async function aeskwCryptoKey(key, alg, usage) {
+    const expected = jweAlgorithm(alg).subtle;
+    const cryptoKey = key instanceof Uint8Array
+        ? await crypto.subtle.importKey('raw', key, 'AES-KW', true, [
+            usage,
+        ])
+        : key;
+    checkCryptoKey(cryptoKey, expected, usage);
+    return cryptoKey;
+}
+async function aeskwWrap(alg, key, cek) {
+    const cryptoKey = await aeskwCryptoKey(key, alg, 'wrapKey');
+    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
+    return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, cryptoKey, 'AES-KW'));
+}
+async function aeskwUnwrap(alg, key, encryptedKey) {
+    const cryptoKey = await aeskwCryptoKey(key, alg, 'unwrapKey');
+    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
+    return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
+}
+function checkRsaKey(alg, key, usage) {
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, usage);
+    checkModulusLength(alg, key);
+}
+function pbes2CryptoKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
+            'deriveBits',
+        ]);
+    }
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, 'deriveBits');
+    return key;
+}
+async function deriveKey(p2s, alg, p2c, key) {
+    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
+        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
+    }
+    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) {
+        throw new JWEInvalid('PBES2 Count Input must be a positive integer');
+    }
+    const salt = concat(encode(alg), Uint8Array.of(0), p2s);
+    const keylen = parseInt(alg.slice(13, 16), 10);
+    const subtleAlg = {
+        hash: `SHA-${alg.slice(8, 11)}`,
+        iterations: p2c,
+        name: 'PBKDF2',
+        salt,
+    };
+    const cryptoKey = await pbes2CryptoKey(key, alg);
+    return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+function lengthAndInput(input) {
+    return concat(uint32be(input.length), input);
+}
+async function concatKdf(Z, L, OtherInfo) {
+    const dkLen = L >> 3;
+    const hashLen = 32;
+    const reps = Math.ceil(dkLen / hashLen);
+    const dk = new Uint8Array(reps * hashLen);
+    for (let i = 1; i <= reps; i++) {
+        const hashResult = await digest('sha256', concat(uint32be(i), Z, OtherInfo));
+        dk.set(hashResult, (i - 1) * hashLen);
+    }
+    return dk.slice(0, dkLen);
+}
+async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
+    checkEcdhCryptoKey(publicKey);
+    checkEcdhCryptoKey(privateKey, 'deriveBits');
+    const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+    const Z = new Uint8Array(await crypto.subtle.deriveBits({
+        name: publicKey.algorithm.name,
+        public: publicKey,
+    }, privateKey, publicKey.algorithm.name === 'X25519'
+        ? 256
+        : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
+    return concatKdf(Z, keyLength, otherInfo);
+}
+function assertEcdhKey(key) {
+    assertCryptoKey(key);
+    const curve = key.algorithm.namedCurve;
+    if (curve !== 'P-256' &&
+        curve !== 'P-384' &&
+        curve !== 'P-521' &&
+        key.algorithm.name !== 'X25519') {
+        throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
+    }
+}
+function assertEncryptedKey(encryptedKey) {
+    if (encryptedKey === undefined)
+        throw new JWEInvalid('JWE Encrypted Key missing');
+}
+function assertNoEncryptedKey(encryptedKey) {
+    if (encryptedKey !== undefined)
+        throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
+}
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+    const entry = jweAlgorithm(alg);
+    if (alg === 'dir') {
+        assertNoEncryptedKey(encryptedKey);
+        return key;
+    }
+    switch (entry.subtle.name) {
+        case 'ECDH': {
+            if (alg === 'ECDH-ES')
+                assertNoEncryptedKey(encryptedKey);
+            if (!isObject(joseHeader.epk))
+                throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
+            assertEcdhKey(key);
+            const epk = await jwkToKey(entry, joseHeader.epk);
+            let partyUInfo;
+            let partyVInfo;
+            if (joseHeader.apu !== undefined) {
+                if (typeof joseHeader.apu !== 'string')
+                    throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
+                partyUInfo = decodeBase64url(joseHeader.apu, 'apu', JWEInvalid);
+            }
+            if (joseHeader.apv !== undefined) {
+                if (typeof joseHeader.apv !== 'string')
+                    throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
+                partyVInfo = decodeBase64url(joseHeader.apv, 'apv', JWEInvalid);
+            }
+            const sharedSecret = await ecdhesDeriveKey(epk, key, alg === 'ECDH-ES' ? enc.alg : alg, alg === 'ECDH-ES' ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+            if (alg === 'ECDH-ES')
+                return sharedSecret;
+            assertEncryptedKey(encryptedKey);
+            return aeskwUnwrap(alg.slice(-6), sharedSecret, encryptedKey);
+        }
+        case 'RSA-OAEP': {
+            assertEncryptedKey(encryptedKey);
+            assertCryptoKey(key);
+            checkRsaKey(alg, key, 'decrypt');
+            return new Uint8Array(await crypto.subtle.decrypt('RSA-OAEP', key, encryptedKey));
+        }
+        case 'PBKDF2': {
+            assertEncryptedKey(encryptedKey);
+            if (typeof joseHeader.p2c !== 'number')
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = options?.maxPBES2Count || 10_000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
+            if (typeof joseHeader.p2s !== 'string')
+                throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
+            const p2s = decodeBase64url(joseHeader.p2s, 'p2s', JWEInvalid);
+            const derived = await deriveKey(p2s, alg, joseHeader.p2c, key);
+            return aeskwUnwrap(alg.slice(-6), derived, encryptedKey);
+        }
+        case 'AES-KW': {
+            assertEncryptedKey(encryptedKey);
+            return aeskwUnwrap(alg, key, encryptedKey);
+        }
+        case 'AES-GCM': {
+            assertEncryptedKey(encryptedKey);
+            if (typeof joseHeader.iv !== 'string')
+                throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
+            if (typeof joseHeader.tag !== 'string')
+                throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
+            let iv;
+            iv = decodeBase64url(joseHeader.iv, 'iv', JWEInvalid);
+            let tag;
+            tag = decodeBase64url(joseHeader.tag, 'tag', JWEInvalid);
+            return decrypt(jweEncryption(alg.slice(0, -2)), key, encryptedKey, iv, tag, new Uint8Array());
+        }
+    }
+}
+export async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
+    let encryptedKey;
+    let parameters;
+    let cek;
+    const entry = jweAlgorithm(alg);
+    if (alg === 'dir')
+        return [key, undefined, undefined];
+    switch (entry.subtle.name) {
+        case 'ECDH': {
+            assertEcdhKey(key);
+            const { apu, apv } = providedParameters;
+            let ephemeralKey;
+            if (providedParameters.epk) {
+                ephemeralKey = (await prepareKey(entry, providedParameters.epk, 'decrypt'));
+            }
+            else {
+                ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ['deriveBits'])).privateKey;
+            }
+            const subtle = crypto.subtle;
+            let exportableEpk = ephemeralKey;
+            if (!exportableEpk.extractable) {
+                if (typeof subtle.getPublicKey !== 'function') {
+                    throw new TypeError('CryptoKey for "epk" must be extractable');
+                }
+                exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+            }
+            const { x, y, crv, kty } = (await subtle.exportKey('jwk', exportableEpk));
+            const sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc.alg : alg, alg === 'ECDH-ES' ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv);
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
+            if (apu)
+                parameters.apu = b64u(apu);
+            if (apv)
+                parameters.apv = b64u(apv);
+            if (alg === 'ECDH-ES') {
+                cek = sharedSecret;
+                break;
+            }
+            cek = providedCek || generateCek(enc);
+            const kwAlg = alg.slice(-6);
+            encryptedKey = await aeskwWrap(kwAlg, sharedSecret, cek);
+            break;
+        }
+        case 'RSA-OAEP': {
+            cek = providedCek || generateCek(enc);
+            assertCryptoKey(key);
+            checkRsaKey(alg, key, 'encrypt');
+            encryptedKey = new Uint8Array(await crypto.subtle.encrypt('RSA-OAEP', key, cek));
+            break;
+        }
+        case 'PBKDF2': {
+            cek = providedCek || generateCek(enc);
+            const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters;
+            const derived = await deriveKey(p2s, alg, p2c, key);
+            encryptedKey = await aeskwWrap(alg.slice(-6), derived, cek);
+            parameters = { p2c, p2s: b64u(p2s) };
+            break;
+        }
+        case 'AES-KW': {
+            cek = providedCek || generateCek(enc);
+            encryptedKey = await aeskwWrap(alg, key, cek);
+            break;
+        }
+        case 'AES-GCM': {
+            cek = providedCek || generateCek(enc);
+            const { iv } = providedParameters;
+            const wrapped = await encrypt(jweEncryption(alg.slice(0, -2)), cek, key, iv, new Uint8Array());
+            encryptedKey = wrapped.ciphertext;
+            parameters = { iv: b64u(wrapped.iv), tag: b64u(wrapped.tag) };
+            break;
+        }
+    }
+    return [cek, encryptedKey, parameters];
+}

package/.output/server/node_modules/jose/dist/webapi/lib/options.js

@@ -0,0 +1,48 @@
+import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+export const JWS_RECOGNIZED = { __proto__: null, b64: true };
+export const JWE_RECOGNIZED = { __proto__: null };
+export function validateAlgorithms(option, algorithms) {
+    if (algorithms !== undefined &&
+        (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {
+        throw new TypeError(`"${option}" option must be an array of strings`);
+    }
+    if (!algorithms) {
+        return undefined;
+    }
+    return new Set(algorithms);
+}
+export function validateCritDuplicates(Err, protectedHeader) {
+    const { crit } = protectedHeader ?? {};
+    if (Array.isArray(crit) && new Set(crit).size !== crit.length) {
+        throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+    }
+}
+export function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
+        throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+    }
+    if (!protectedHeader || protectedHeader.crit === undefined) {
+        return [];
+    }
+    if (!Array.isArray(protectedHeader.crit) ||
+        protectedHeader.crit.length === 0 ||
+        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {
+        throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+    }
+    const recognized = recognizedOption === undefined
+        ? recognizedDefault
+        : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+    for (const parameter of protectedHeader.crit) {
+        if (!(parameter in recognized)) {
+            throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+        }
+        if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === undefined) {
+            throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+        }
+        if (recognized[parameter] &&
+            (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === undefined)) {
+            throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+        }
+    }
+    return protectedHeader.crit;
+}

package/.output/server/node_modules/jose/dist/webapi/lib/signing.js

@@ -0,0 +1,26 @@
+import { checkCryptoKey, checkModulusLength } from './crypto_key.js';
+async function getSigKey(entry, key, usage) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, entry.subtle, false, [
+            usage,
+        ]);
+    }
+    checkCryptoKey(key, entry.subtle, usage);
+    if (entry.minRsaBits)
+        checkModulusLength(entry.alg, key);
+    return key;
+}
+export async function sign(entry, key, data) {
+    const cryptoKey = await getSigKey(entry, key, 'sign');
+    const signature = await crypto.subtle.sign(entry.signing, cryptoKey, data);
+    return new Uint8Array(signature);
+}
+export async function verify(entry, key, signature, data) {
+    const cryptoKey = await getSigKey(entry, key, 'verify');
+    try {
+        return await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+    }
+    catch {
+        return false;
+    }
+}

package/.output/server/node_modules/jose/dist/webapi/lib/type_checks.js

@@ -0,0 +1,35 @@
+export function isObject(input) {
+    if (typeof input !== 'object' ||
+        input === null ||
+        Object.prototype.toString.call(input) !== '[object Object]') {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype === null) {
+        return true;
+    }
+    let proto = prototype;
+    while (Object.getPrototypeOf(proto) !== null) {
+        proto = Object.getPrototypeOf(proto);
+    }
+    return prototype === proto;
+}
+export function isDisjoint(...headers) {
+    const parameters = new Set();
+    for (const header of headers) {
+        if (!header)
+            continue;
+        for (const parameter of Object.keys(header)) {
+            if (parameters.has(parameter)) {
+                return false;
+            }
+            parameters.add(parameter);
+        }
+    }
+    return true;
+}
+export const isJWK = (key) => isObject(key) && typeof key.kty === 'string';
+export const isPrivateJWK = (key) => key.kty !== 'oct' &&
+    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');
+export const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;
+export const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';

package/.output/server/node_modules/jose/dist/webapi/util/base64url.js

@@ -0,0 +1,39 @@
+import { encoder, decoder } from '../lib/buffer_utils.js';
+import { encodeBase64, decodeBase64 } from '../lib/base64.js';
+const invalid = 'The input to be decoded is not correctly encoded.';
+export function decode(input) {
+    if (Uint8Array.fromBase64) {
+        try {
+            return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
+                alphabet: 'base64url',
+            });
+        }
+        catch (cause) {
+            throw new TypeError(invalid, { cause });
+        }
+    }
+    let encoded = input;
+    if (encoded instanceof Uint8Array) {
+        encoded = decoder.decode(encoded);
+    }
+    if (encoded.includes('+') || encoded.includes('/')) {
+        throw new TypeError(invalid);
+    }
+    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');
+    try {
+        return decodeBase64(encoded);
+    }
+    catch {
+        throw new TypeError(invalid);
+    }
+}
+export function encode(input) {
+    let unencoded = input;
+    if (typeof unencoded === 'string') {
+        unencoded = encoder.encode(unencoded);
+    }
+    if (Uint8Array.prototype.toBase64) {
+        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
+    }
+    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}

package/.output/server/node_modules/jose/dist/webapi/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as b64u } from './base64url.js';
+import { strictDecoder } from '../lib/buffer_utils.js';
+import { isObject } from '../lib/type_checks.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = b64u(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to base64url decode the payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(strictDecoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/.output/server/node_modules/jose/dist/webapi/util/decode_protected_header.js

@@ -0,0 +1,24 @@
+import { parseJoseHeader } from '../lib/helpers.js';
+export function decodeProtectedHeader(token) {
+    let protectedB64u;
+    if (typeof token === 'string') {
+        const parts = token.split('.');
+        if (parts.length === 3 || parts.length === 5) {
+            ;
+            [protectedB64u] = parts;
+        }
+    }
+    else if (typeof token === 'object' && token) {
+        if ('protected' in token) {
+            protectedB64u = token.protected;
+        }
+        else {
+            throw new TypeError('Token does not contain a Protected Header');
+        }
+    }
+    const invalid = 'Invalid Token or Protected Header formatting';
+    if (typeof protectedB64u !== 'string' || !protectedB64u) {
+        throw new TypeError(invalid);
+    }
+    return parseJoseHeader(protectedB64u, TypeError, invalid);
+}