better-auth 1.7.0-beta.2 → 1.7.0-beta.4

package/dist/node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pbkdf2.mjs

@@ -0,0 +1,125 @@
+import { __commonJSMin, __require } from "../../../../../../_virtual/_rolldown/runtime.mjs";
+import { require_forge } from "./forge.mjs";
+import { require_util } from "./util.mjs";
+import { require_md } from "./md.mjs";
+import { require_hmac } from "./hmac.mjs";
+//#region ../../node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pbkdf2.js
+var require_pbkdf2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Password-Based Key-Derivation Function #2 implementation.
+	*
+	* See RFC 2898 for details.
+	*
+	* @author Dave Longley
+	*
+	* Copyright (c) 2010-2013 Digital Bazaar, Inc.
+	*/
+	var forge = require_forge();
+	require_hmac();
+	require_md();
+	require_util();
+	var pkcs5 = forge.pkcs5 = forge.pkcs5 || {};
+	var crypto;
+	if (forge.util.isNodejs && !forge.options.usePureJavaScript) crypto = __require("crypto");
+	/**
+	* Derives a key from a password.
+	*
+	* @param p the password as a binary-encoded string of bytes.
+	* @param s the salt as a binary-encoded string of bytes.
+	* @param c the iteration count, a positive integer.
+	* @param dkLen the intended length, in bytes, of the derived key,
+	*          (max: 2^32 - 1) * hash length of the PRF.
+	* @param [md] the message digest (or algorithm identifier as a string) to use
+	*          in the PRF, defaults to SHA-1.
+	* @param [callback(err, key)] presence triggers asynchronous version, called
+	*          once the operation completes.
+	*
+	* @return the derived key, as a binary-encoded string of bytes, for the
+	*           synchronous version (if no callback is specified).
+	*/
+	module.exports = forge.pbkdf2 = pkcs5.pbkdf2 = function(p, s, c, dkLen, md, callback) {
+		if (typeof md === "function") {
+			callback = md;
+			md = null;
+		}
+		if (forge.util.isNodejs && !forge.options.usePureJavaScript && crypto.pbkdf2 && (md === null || typeof md !== "object") && (crypto.pbkdf2Sync.length > 4 || !md || md === "sha1")) {
+			if (typeof md !== "string") md = "sha1";
+			p = Buffer.from(p, "binary");
+			s = Buffer.from(s, "binary");
+			if (!callback) {
+				if (crypto.pbkdf2Sync.length === 4) return crypto.pbkdf2Sync(p, s, c, dkLen).toString("binary");
+				return crypto.pbkdf2Sync(p, s, c, dkLen, md).toString("binary");
+			}
+			if (crypto.pbkdf2Sync.length === 4) return crypto.pbkdf2(p, s, c, dkLen, function(err, key) {
+				if (err) return callback(err);
+				callback(null, key.toString("binary"));
+			});
+			return crypto.pbkdf2(p, s, c, dkLen, md, function(err, key) {
+				if (err) return callback(err);
+				callback(null, key.toString("binary"));
+			});
+		}
+		if (typeof md === "undefined" || md === null) md = "sha1";
+		if (typeof md === "string") {
+			if (!(md in forge.md.algorithms)) throw new Error("Unknown hash algorithm: " + md);
+			md = forge.md[md].create();
+		}
+		var hLen = md.digestLength;
+		if (dkLen > 4294967295 * hLen) {
+			var err = /* @__PURE__ */ new Error("Derived key is too long.");
+			if (callback) return callback(err);
+			throw err;
+		}
+		var len = Math.ceil(dkLen / hLen);
+		var r = dkLen - (len - 1) * hLen;
+		var prf = forge.hmac.create();
+		prf.start(md, p);
+		var dk = "";
+		var xor, u_c, u_c1;
+		if (!callback) {
+			for (var i = 1; i <= len; ++i) {
+				prf.start(null, null);
+				prf.update(s);
+				prf.update(forge.util.int32ToBytes(i));
+				xor = u_c1 = prf.digest().getBytes();
+				for (var j = 2; j <= c; ++j) {
+					prf.start(null, null);
+					prf.update(u_c1);
+					u_c = prf.digest().getBytes();
+					xor = forge.util.xorBytes(xor, u_c, hLen);
+					u_c1 = u_c;
+				}
+				dk += i < len ? xor : xor.substr(0, r);
+			}
+			return dk;
+		}
+		var i = 1, j;
+		function outer() {
+			if (i > len) return callback(null, dk);
+			prf.start(null, null);
+			prf.update(s);
+			prf.update(forge.util.int32ToBytes(i));
+			xor = u_c1 = prf.digest().getBytes();
+			j = 2;
+			inner();
+		}
+		function inner() {
+			if (j <= c) {
+				prf.start(null, null);
+				prf.update(u_c1);
+				u_c = prf.digest().getBytes();
+				xor = forge.util.xorBytes(xor, u_c, hLen);
+				u_c1 = u_c;
+				++j;
+				return forge.util.setImmediate(inner);
+			}
+			dk += i < len ? xor : xor.substr(0, r);
+			++i;
+			outer();
+		}
+		outer();
+	};
+}));
+//#endregion
+export default require_pbkdf2();
+export { require_pbkdf2 };

package/dist/node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pem.mjs

@@ -0,0 +1,175 @@
+import { __commonJSMin } from "../../../../../../_virtual/_rolldown/runtime.mjs";
+import { require_forge } from "./forge.mjs";
+import { require_util } from "./util.mjs";
+//#region ../../node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pem.js
+var require_pem = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Javascript implementation of basic PEM (Privacy Enhanced Mail) algorithms.
+	*
+	* See: RFC 1421.
+	*
+	* @author Dave Longley
+	*
+	* Copyright (c) 2013-2014 Digital Bazaar, Inc.
+	*
+	* A Forge PEM object has the following fields:
+	*
+	* type: identifies the type of message (eg: "RSA PRIVATE KEY").
+	*
+	* procType: identifies the type of processing performed on the message,
+	*   it has two subfields: version and type, eg: 4,ENCRYPTED.
+	*
+	* contentDomain: identifies the type of content in the message, typically
+	*   only uses the value: "RFC822".
+	*
+	* dekInfo: identifies the message encryption algorithm and mode and includes
+	*   any parameters for the algorithm, it has two subfields: algorithm and
+	*   parameters, eg: DES-CBC,F8143EDE5960C597.
+	*
+	* headers: contains all other PEM encapsulated headers -- where order is
+	*   significant (for pairing data like recipient ID + key info).
+	*
+	* body: the binary-encoded body.
+	*/
+	var forge = require_forge();
+	require_util();
+	var pem = module.exports = forge.pem = forge.pem || {};
+	/**
+	* Encodes (serializes) the given PEM object.
+	*
+	* @param msg the PEM message object to encode.
+	* @param options the options to use:
+	*          maxline the maximum characters per line for the body, (default: 64).
+	*
+	* @return the PEM-formatted string.
+	*/
+	pem.encode = function(msg, options) {
+		options = options || {};
+		var rval = "-----BEGIN " + msg.type + "-----\r\n";
+		var header;
+		if (msg.procType) {
+			header = {
+				name: "Proc-Type",
+				values: [String(msg.procType.version), msg.procType.type]
+			};
+			rval += foldHeader(header);
+		}
+		if (msg.contentDomain) {
+			header = {
+				name: "Content-Domain",
+				values: [msg.contentDomain]
+			};
+			rval += foldHeader(header);
+		}
+		if (msg.dekInfo) {
+			header = {
+				name: "DEK-Info",
+				values: [msg.dekInfo.algorithm]
+			};
+			if (msg.dekInfo.parameters) header.values.push(msg.dekInfo.parameters);
+			rval += foldHeader(header);
+		}
+		if (msg.headers) for (var i = 0; i < msg.headers.length; ++i) rval += foldHeader(msg.headers[i]);
+		if (msg.procType) rval += "\r\n";
+		rval += forge.util.encode64(msg.body, options.maxline || 64) + "\r\n";
+		rval += "-----END " + msg.type + "-----\r\n";
+		return rval;
+	};
+	/**
+	* Decodes (deserializes) all PEM messages found in the given string.
+	*
+	* @param str the PEM-formatted string to decode.
+	*
+	* @return the PEM message objects in an array.
+	*/
+	pem.decode = function(str) {
+		var rval = [];
+		var rMessage = /\s*-----BEGIN ([A-Z0-9- ]+)-----\r?\n?([\x21-\x7e\s]+?(?:\r?\n\r?\n))?([:A-Za-z0-9+\/=\s]+?)-----END \1-----/g;
+		var rHeader = /([\x21-\x7e]+):\s*([\x21-\x7e\s^:]+)/;
+		var rCRLF = /\r?\n/;
+		var match;
+		while (true) {
+			match = rMessage.exec(str);
+			if (!match) break;
+			var type = match[1];
+			if (type === "NEW CERTIFICATE REQUEST") type = "CERTIFICATE REQUEST";
+			var msg = {
+				type,
+				procType: null,
+				contentDomain: null,
+				dekInfo: null,
+				headers: [],
+				body: forge.util.decode64(match[3])
+			};
+			rval.push(msg);
+			if (!match[2]) continue;
+			var lines = match[2].split(rCRLF);
+			var li = 0;
+			while (match && li < lines.length) {
+				var line = lines[li].replace(/\s+$/, "");
+				for (var nl = li + 1; nl < lines.length; ++nl) {
+					var next = lines[nl];
+					if (!/\s/.test(next[0])) break;
+					line += next;
+					li = nl;
+				}
+				match = line.match(rHeader);
+				if (match) {
+					var header = {
+						name: match[1],
+						values: []
+					};
+					var values = match[2].split(",");
+					for (var vi = 0; vi < values.length; ++vi) header.values.push(ltrim(values[vi]));
+					if (!msg.procType) {
+						if (header.name !== "Proc-Type") throw new Error("Invalid PEM formatted message. The first encapsulated header must be \"Proc-Type\".");
+						else if (header.values.length !== 2) throw new Error("Invalid PEM formatted message. The \"Proc-Type\" header must have two subfields.");
+						msg.procType = {
+							version: values[0],
+							type: values[1]
+						};
+					} else if (!msg.contentDomain && header.name === "Content-Domain") msg.contentDomain = values[0] || "";
+					else if (!msg.dekInfo && header.name === "DEK-Info") {
+						if (header.values.length === 0) throw new Error("Invalid PEM formatted message. The \"DEK-Info\" header must have at least one subfield.");
+						msg.dekInfo = {
+							algorithm: values[0],
+							parameters: values[1] || null
+						};
+					} else msg.headers.push(header);
+				}
+				++li;
+			}
+			if (msg.procType === "ENCRYPTED" && !msg.dekInfo) throw new Error("Invalid PEM formatted message. The \"DEK-Info\" header must be present if \"Proc-Type\" is \"ENCRYPTED\".");
+		}
+		if (rval.length === 0) throw new Error("Invalid PEM formatted message.");
+		return rval;
+	};
+	function foldHeader(header) {
+		var rval = header.name + ": ";
+		var values = [];
+		var insertSpace = function(match, $1) {
+			return " " + $1;
+		};
+		for (var i = 0; i < header.values.length; ++i) values.push(header.values[i].replace(/^(\S+\r\n)/, insertSpace));
+		rval += values.join(",") + "\r\n";
+		var length = 0;
+		var candidate = -1;
+		for (var i = 0; i < rval.length; ++i, ++length) if (length > 65 && candidate !== -1) {
+			var insert = rval[candidate];
+			if (insert === ",") {
+				++candidate;
+				rval = rval.substr(0, candidate) + "\r\n " + rval.substr(candidate);
+			} else rval = rval.substr(0, candidate) + "\r\n" + insert + rval.substr(candidate + 1);
+			length = i - candidate - 1;
+			candidate = -1;
+			++i;
+		} else if (rval[i] === " " || rval[i] === "	" || rval[i] === ",") candidate = i;
+		return rval;
+	}
+	function ltrim(str) {
+		return str.replace(/^\s+/, "");
+	}
+}));
+//#endregion
+export default require_pem();
+export { require_pem };

package/dist/node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pkcs1.mjs

@@ -0,0 +1,200 @@
+import { __commonJSMin } from "../../../../../../_virtual/_rolldown/runtime.mjs";
+import { require_forge } from "./forge.mjs";
+import { require_util } from "./util.mjs";
+import { require_random } from "./random.mjs";
+import { require_sha1 } from "./sha1.mjs";
+//#region ../../node_modules/.pnpm/node-forge@1.4.0/node_modules/node-forge/lib/pkcs1.js
+var require_pkcs1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Partial implementation of PKCS#1 v2.2: RSA-OEAP
+	*
+	* Modified but based on the following MIT and BSD licensed code:
+	*
+	* https://github.com/kjur/jsjws/blob/master/rsa.js:
+	*
+	* The 'jsjws'(JSON Web Signature JavaScript Library) License
+	*
+	* Copyright (c) 2012 Kenji Urushima
+	*
+	* Permission is hereby granted, free of charge, to any person obtaining a copy
+	* of this software and associated documentation files (the "Software"), to deal
+	* in the Software without restriction, including without limitation the rights
+	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+	* copies of the Software, and to permit persons to whom the Software is
+	* furnished to do so, subject to the following conditions:
+	*
+	* The above copyright notice and this permission notice shall be included in
+	* all copies or substantial portions of the Software.
+	*
+	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+	* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+	* THE SOFTWARE.
+	*
+	* http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain:
+	*
+	* RSAES-OAEP.js
+	* $Id: RSAES-OAEP.js,v 1.1.1.1 2003/03/19 15:37:20 ellispritchard Exp $
+	* JavaScript Implementation of PKCS #1 v2.1 RSA CRYPTOGRAPHY STANDARD (RSA Laboratories, June 14, 2002)
+	* Copyright (C) Ellis Pritchard, Guardian Unlimited 2003.
+	* Contact: ellis@nukinetics.com
+	* Distributed under the BSD License.
+	*
+	* Official documentation: http://www.rsa.com/rsalabs/node.asp?id=2125
+	*
+	* @author Evan Jones (http://evanjones.ca/)
+	* @author Dave Longley
+	*
+	* Copyright (c) 2013-2014 Digital Bazaar, Inc.
+	*/
+	var forge = require_forge();
+	require_util();
+	require_random();
+	require_sha1();
+	var pkcs1 = module.exports = forge.pkcs1 = forge.pkcs1 || {};
+	/**
+	* Encode the given RSAES-OAEP message (M) using key, with optional label (L)
+	* and seed.
+	*
+	* This method does not perform RSA encryption, it only encodes the message
+	* using RSAES-OAEP.
+	*
+	* @param key the RSA key to use.
+	* @param message the message to encode.
+	* @param options the options to use:
+	*          label an optional label to use.
+	*          seed the seed to use.
+	*          md the message digest object to use, undefined for SHA-1.
+	*          mgf1 optional mgf1 parameters:
+	*            md the message digest object to use for MGF1.
+	*
+	* @return the encoded message bytes.
+	*/
+	pkcs1.encode_rsa_oaep = function(key, message, options) {
+		var label;
+		var seed;
+		var md;
+		var mgf1Md;
+		if (typeof options === "string") {
+			label = options;
+			seed = arguments[3] || void 0;
+			md = arguments[4] || void 0;
+		} else if (options) {
+			label = options.label || void 0;
+			seed = options.seed || void 0;
+			md = options.md || void 0;
+			if (options.mgf1 && options.mgf1.md) mgf1Md = options.mgf1.md;
+		}
+		if (!md) md = forge.md.sha1.create();
+		else md.start();
+		if (!mgf1Md) mgf1Md = md;
+		var keyLength = Math.ceil(key.n.bitLength() / 8);
+		var maxLength = keyLength - 2 * md.digestLength - 2;
+		if (message.length > maxLength) {
+			var error = /* @__PURE__ */ new Error("RSAES-OAEP input message length is too long.");
+			error.length = message.length;
+			error.maxLength = maxLength;
+			throw error;
+		}
+		if (!label) label = "";
+		md.update(label, "raw");
+		var lHash = md.digest();
+		var PS = "";
+		var PS_length = maxLength - message.length;
+		for (var i = 0; i < PS_length; i++) PS += "\0";
+		var DB = lHash.getBytes() + PS + "
" + message;
+		if (!seed) seed = forge.random.getBytes(md.digestLength);
+		else if (seed.length !== md.digestLength) {
+			var error = /* @__PURE__ */ new Error("Invalid RSAES-OAEP seed. The seed length must match the digest length.");
+			error.seedLength = seed.length;
+			error.digestLength = md.digestLength;
+			throw error;
+		}
+		var dbMask = rsa_mgf1(seed, keyLength - md.digestLength - 1, mgf1Md);
+		var maskedDB = forge.util.xorBytes(DB, dbMask, DB.length);
+		var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
+		return "\0" + forge.util.xorBytes(seed, seedMask, seed.length) + maskedDB;
+	};
+	/**
+	* Decode the given RSAES-OAEP encoded message (EM) using key, with optional
+	* label (L).
+	*
+	* This method does not perform RSA decryption, it only decodes the message
+	* using RSAES-OAEP.
+	*
+	* @param key the RSA key to use.
+	* @param em the encoded message to decode.
+	* @param options the options to use:
+	*          label an optional label to use.
+	*          md the message digest object to use for OAEP, undefined for SHA-1.
+	*          mgf1 optional mgf1 parameters:
+	*            md the message digest object to use for MGF1.
+	*
+	* @return the decoded message bytes.
+	*/
+	pkcs1.decode_rsa_oaep = function(key, em, options) {
+		var label;
+		var md;
+		var mgf1Md;
+		if (typeof options === "string") {
+			label = options;
+			md = arguments[3] || void 0;
+		} else if (options) {
+			label = options.label || void 0;
+			md = options.md || void 0;
+			if (options.mgf1 && options.mgf1.md) mgf1Md = options.mgf1.md;
+		}
+		var keyLength = Math.ceil(key.n.bitLength() / 8);
+		if (em.length !== keyLength) {
+			var error = /* @__PURE__ */ new Error("RSAES-OAEP encoded message length is invalid.");
+			error.length = em.length;
+			error.expectedLength = keyLength;
+			throw error;
+		}
+		if (md === void 0) md = forge.md.sha1.create();
+		else md.start();
+		if (!mgf1Md) mgf1Md = md;
+		if (keyLength < 2 * md.digestLength + 2) throw new Error("RSAES-OAEP key is too short for the hash function.");
+		if (!label) label = "";
+		md.update(label, "raw");
+		var lHash = md.digest().getBytes();
+		var y = em.charAt(0);
+		var maskedSeed = em.substring(1, md.digestLength + 1);
+		var maskedDB = em.substring(1 + md.digestLength);
+		var seedMask = rsa_mgf1(maskedDB, md.digestLength, mgf1Md);
+		var dbMask = rsa_mgf1(forge.util.xorBytes(maskedSeed, seedMask, maskedSeed.length), keyLength - md.digestLength - 1, mgf1Md);
+		var db = forge.util.xorBytes(maskedDB, dbMask, maskedDB.length);
+		var lHashPrime = db.substring(0, md.digestLength);
+		var error = y !== "\0";
+		for (var i = 0; i < md.digestLength; ++i) error |= lHash.charAt(i) !== lHashPrime.charAt(i);
+		var in_ps = 1;
+		var index = md.digestLength;
+		for (var j = md.digestLength; j < db.length; j++) {
+			var code = db.charCodeAt(j);
+			var is_0 = code & 1 ^ 1;
+			error |= code & (in_ps ? 65534 : 0);
+			in_ps = in_ps & is_0;
+			index += in_ps;
+		}
+		if (error || db.charCodeAt(index) !== 1) throw new Error("Invalid RSAES-OAEP padding.");
+		return db.substring(index + 1);
+	};
+	function rsa_mgf1(seed, maskLength, hash) {
+		if (!hash) hash = forge.md.sha1.create();
+		var t = "";
+		var count = Math.ceil(maskLength / hash.digestLength);
+		for (var i = 0; i < count; ++i) {
+			var c = String.fromCharCode(i >> 24 & 255, i >> 16 & 255, i >> 8 & 255, i & 255);
+			hash.start();
+			hash.update(seed + c);
+			t += hash.digest().getBytes();
+		}
+		return t.substring(0, maskLength);
+	}
+}));
+//#endregion
+export default require_pkcs1();
+export { require_pkcs1 };