deadbyte-mcp 0.8.7

package/node_modules/jose/dist/webapi/lib/jwk_to_key.js

@@ -0,0 +1,17 @@
+import { JOSENotSupported } from '../util/errors.js';
+export async function jwkToKey(entry, jwk) {
+    if (jwk.kty === 'RSA' && 'oth' in jwk && jwk.oth !== undefined) {
+        throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+    }
+    if (!entry.kty.includes(jwk.kty)) {
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
+    const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
+    const isPrivate = !!(jwk.d || jwk.priv);
+    const keyData = { ...jwk };
+    if (keyData.kty !== 'AKP') {
+        delete keyData.alg;
+    }
+    delete keyData.use;
+    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}

package/node_modules/jose/dist/webapi/lib/jws_algorithms.js

@@ -0,0 +1,73 @@
+import { JOSENotSupported } from '../util/errors.js';
+import { table } from './key_descriptor.js';
+const sig = [['verify'], ['sign']];
+function hmac(bits) {
+    const subtle = { name: 'HMAC', hash: `SHA-${bits}` };
+    return { kty: ['oct'], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+    const name = saltLength ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5';
+    const subtle = { name, hash: `SHA-${bits}` };
+    return {
+        kty: ['RSA'],
+        subtle,
+        signing: saltLength ? { ...subtle, saltLength } : subtle,
+        usages: sig,
+        minRsaBits: 2048,
+    };
+}
+function ecdsa(crv, bits) {
+    return {
+        kty: ['EC'],
+        crv,
+        subtle: { name: 'ECDSA', namedCurve: crv },
+        signing: { name: 'ECDSA', hash: `SHA-${bits}` },
+        usages: sig,
+    };
+}
+function eddsa() {
+    const subtle = { name: 'Ed25519' };
+    return {
+        kty: ['OKP'],
+        crv: 'Ed25519',
+        subtle,
+        signing: subtle,
+        usages: sig,
+    };
+}
+function mldsa(bits) {
+    const name = `ML-DSA-${bits}`;
+    const subtle = { name };
+    return {
+        kty: ['AKP'],
+        subtle,
+        signing: subtle,
+        usages: sig,
+    };
+}
+export const JWS = table({
+    HS256: hmac(256),
+    HS384: hmac(384),
+    HS512: hmac(512),
+    RS256: rsa(256),
+    RS384: rsa(384),
+    RS512: rsa(512),
+    PS256: rsa(256, 32),
+    PS384: rsa(384, 48),
+    PS512: rsa(512, 64),
+    ES256: ecdsa('P-256', 256),
+    ES384: ecdsa('P-384', 384),
+    ES512: ecdsa('P-521', 512),
+    EdDSA: eddsa(),
+    Ed25519: eddsa(),
+    'ML-DSA-44': mldsa(44),
+    'ML-DSA-65': mldsa(65),
+    'ML-DSA-87': mldsa(87),
+});
+export function jwsAlgorithm(alg) {
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
+    if (!entry) {
+        throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+    return entry;
+}

package/node_modules/jose/dist/webapi/lib/jws_sign.js

@@ -0,0 +1,85 @@
+import { encode as b64u } from '../util/base64url.js';
+import { sign } from './signing.js';
+import { jwsAlgorithm } from './jws_algorithms.js';
+import { isDisjoint } from './type_checks.js';
+import { JWSInvalid } from '../util/errors.js';
+import { concat, encode } from './buffer_utils.js';
+import { serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED, } from './options.js';
+import { prepareKey } from './key.js';
+function serializeProtectedHeader(protectedHeader) {
+    if (protectedHeader === undefined)
+        return [undefined, ''];
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    return [normalized[0], b64u(normalized[1])];
+}
+function validateSignatureHeader(protectedHeader, joseHeader, crit) {
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+}
+function signatureAlgorithm(joseHeader) {
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    return jwsAlgorithm(alg);
+}
+async function signSignature(protectedHeader, payload, entry, key) {
+    const data = concat(encode(protectedHeader), encode('.'), payload);
+    const k = await prepareKey(entry, key, 'sign');
+    return b64u(await sign(entry, k, data));
+}
+export async function createSignature(input, key, assertB64) {
+    let { protectedHeader, unprotectedHeader } = input;
+    let protectedHeaderString;
+    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
+    if (unprotectedHeader !== undefined) {
+        unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
+    }
+    if (!protectedHeader && !unprotectedHeader) {
+        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
+    }
+    if (!isDisjoint(protectedHeader, unprotectedHeader)) {
+        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
+    }
+    const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
+    assertB64?.(b64);
+    const entry = signatureAlgorithm(joseHeader);
+    let payloadS;
+    let payloadB;
+    if (b64) {
+        const encoded = (input.encoded ??= []);
+        encoded[0] ??= b64u(input.payload);
+        encoded[1] ??= encode(encoded[0]);
+        payloadS = encoded[0];
+        payloadB = encoded[1];
+    }
+    else {
+        payloadB = input.payload;
+        payloadS = '';
+    }
+    const jws = {
+        signature: await signSignature(protectedHeaderString, payloadB, entry, key),
+        payload: payloadS,
+    };
+    if (protectedHeader) {
+        jws.protected = protectedHeaderString;
+    }
+    if (unprotectedHeader) {
+        jws.header = unprotectedHeader;
+    }
+    return [jws, b64];
+}
+export async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
+    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
+    if (!protectedHeader) {
+        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
+    }
+    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
+    if (!b64)
+        rejectUnencoded();
+    const entry = signatureAlgorithm(protectedHeader);
+    const encodedPayload = b64u(payload);
+    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
+    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
+}

package/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -0,0 +1,139 @@
+import { verify } from './signing.js';
+import { jwsAlgorithm } from './jws_algorithms.js';
+import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../util/errors.js';
+import { concat, decoder, encoder, encode } from './buffer_utils.js';
+import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
+import { isDisjoint, isObject } from './type_checks.js';
+import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+export function snapshotJws(jws, sharedPayload) {
+    const encodedProtected = jws.protected;
+    const inputHeader = jws.header;
+    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+    let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+    if (!sharedPayload && payload instanceof Uint8Array) {
+        payload = new Uint8Array(payload);
+    }
+    const signature = jws.signature;
+    const snapshot = { payload, signature };
+    if (encodedProtected !== undefined)
+        snapshot.protected = encodedProtected;
+    if (inputHeader !== undefined)
+        snapshot.header = header;
+    return snapshot;
+}
+export function verifyResult(jws, verified) {
+    const [payload, parsedProt, , key, resolvedKey] = verified;
+    const result = { payload };
+    if (jws.protected !== undefined) {
+        result.protectedHeader = parsedProt;
+    }
+    if (jws.header !== undefined) {
+        result.unprotectedHeader = jws.header;
+    }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
+    return result;
+}
+export function prepareVerify(options) {
+    return [options && validateAlgorithms('algorithms', options.algorithms), options?.crit];
+}
+export function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === undefined
+    ? {}
+    : parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid')) {
+    return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    if (shared[0] && !shared[0].has(alg)) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    return [b64, alg];
+}
+export function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
+    let joseHeader;
+    if (header !== undefined) {
+        if (!isDisjoint(parsedProt, header)) {
+            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
+        }
+        joseHeader = { ...parsedProt, ...header };
+    }
+    else {
+        joseHeader = parsedProt;
+    }
+    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+}
+export function encodeJsonUnencodedPayload(payload) {
+    const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+    if (invalid !== undefined) {
+        throw new JWSInvalid(/\p{Cs}/u.test(invalid)
+            ? 'JWS Payload must be a well-formed Unicode string'
+            : 'JWS Payload must not contain unassigned Unicode code points');
+    }
+    return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+    try {
+        return encode(payload);
+    }
+    catch {
+        throw new JWSInvalid('JWS Compact Serialization payload must use only ASCII characters');
+    }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
+    let resolvedKey = false;
+    if (typeof key === 'function') {
+        key = await key(parsedProt, jws);
+        resolvedKey = true;
+    }
+    const b64 = typeof signingPayload === 'string';
+    const entry = jwsAlgorithm(alg);
+    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), b64
+        ?
+            (shared[2] ??= encodeBase64url(signingPayload, 'payload', JWSInvalid))
+        : signingPayload);
+    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
+    const k = await prepareKey(entry, key, 'verify');
+    if (!(await verify(entry, k, signature, data))) {
+        throw new JWSSignatureVerificationFailed();
+    }
+    const payload = b64 ? decodeBase64url(signingPayload, 'payload', JWSInvalid) : signingPayload;
+    return [payload, parsedProt, b64, k, resolvedKey];
+}
+export async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+    const { protected: encodedProtected, header, payload: inputPayload } = jws;
+    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
+    if (b64) {
+        if (typeof inputPayload !== 'string') {
+            throw new JWSInvalid('JWS Payload must be a string');
+        }
+    }
+    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
+        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
+    }
+    const signingPayload = b64 || typeof inputPayload !== 'string' ? inputPayload : encodeUnencodedPayload(inputPayload);
+    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
+}
+export async function verifyCompact(jws, shared, key) {
+    if (jws instanceof Uint8Array) {
+        jws = decoder.decode(jws);
+    }
+    if (typeof jws !== 'string') {
+        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
+    }
+    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
+    if (length !== 3) {
+        throw new JWSInvalid('Invalid Compact JWS');
+    }
+    const compactJws = { payload, protected: protectedHeader, signature };
+    const parsedProt = parseProtectedHeader(protectedHeader);
+    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+}

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -0,0 +1,232 @@
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
+import { encoder, strictDecoder } from './buffer_utils.js';
+import { isObject } from './type_checks.js';
+const epoch = (date) => Math.floor(date.getTime() / 1000);
+const multipliers = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800,
+    y: 31557600,
+};
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+const checkFailed = 'check_failed';
+function invalidDuration() {
+    throw new TypeError('Invalid time period format');
+}
+export function secs(str) {
+    if (typeof str !== 'string') {
+        invalidDuration();
+    }
+    const matched = REGEX.exec(str);
+    if (!matched || (matched[4] && matched[1])) {
+        invalidDuration();
+    }
+    const value = parseFloat(matched[2]);
+    const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate)) {
+        invalidDuration();
+    }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
+}
+function validateInput(label, input) {
+    if (!Number.isFinite(input)) {
+        throw new TypeError(`Invalid ${label} input`);
+    }
+    return input;
+}
+function validateStringClaim(claim, value) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`"${claim}" claim must be a string`);
+    }
+}
+function validateAudienceClaim(value) {
+    if (typeof value !== 'string' &&
+        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
+        throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+}
+function numericDate(value, label) {
+    if (typeof value === 'number')
+        return validateInput(label, value);
+    if (value instanceof Date)
+        return validateInput(label, epoch(value));
+    return epoch(new Date()) + secs(value);
+}
+const normalizeTyp = (value) => {
+    const normalized = value.toLowerCase();
+    return value.includes('/') ? normalized : `application/${normalized}`;
+};
+const checkAudiencePresence = (audPayload, audOption) => {
+    if (typeof audPayload === 'string') {
+        return audOption.includes(audPayload);
+    }
+    if (Array.isArray(audPayload)) {
+        return audOption.some((aud) => audPayload.includes(aud));
+    }
+    return false;
+};
+function validateNumericDate(payload, claim, required = false) {
+    const value = payload[claim];
+    if (value === undefined && !required)
+        return undefined;
+    if (typeof value !== 'number') {
+        throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, 'invalid');
+    }
+    return value;
+}
+function unexpectedClaim(payload, claim) {
+    throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+    let payload;
+    try {
+        payload = JSON.parse(strictDecoder.decode(encodedPayload));
+    }
+    catch {
+    }
+    if (!isObject(payload)) {
+        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
+    }
+    const { typ } = options;
+    if (typ !== undefined &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
+    }
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+    const presenceCheck = [...requiredClaims];
+    if (maxTokenAge !== undefined)
+        presenceCheck.push('iat');
+    if (audience !== undefined)
+        presenceCheck.push('aud');
+    if (subject !== undefined)
+        presenceCheck.push('sub');
+    if (issuer !== undefined)
+        presenceCheck.push('iss');
+    for (const claim of new Set(presenceCheck.reverse())) {
+        if (!Object.hasOwn(payload, claim)) {
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
+        }
+    }
+    if (issuer !== undefined &&
+        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+        unexpectedClaim(payload, 'iss');
+    }
+    if (subject !== undefined && payload.sub !== subject) {
+        unexpectedClaim(payload, 'sub');
+    }
+    if (audience !== undefined &&
+        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
+        unexpectedClaim(payload, 'aud');
+    }
+    const { clockTolerance } = options;
+    let tolerance = 0;
+    if (typeof clockTolerance === 'string') {
+        tolerance = secs(clockTolerance);
+    }
+    else if (clockTolerance !== undefined) {
+        if (typeof clockTolerance !== 'number') {
+            throw new TypeError('Invalid clockTolerance option type');
+        }
+        tolerance = clockTolerance;
+    }
+    validateInput('clockTolerance option', tolerance);
+    const { currentDate } = options;
+    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
+    const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
+    const nbf = validateNumericDate(payload, 'nbf');
+    if (nbf !== undefined) {
+        if (nbf > now + tolerance) {
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', checkFailed);
+        }
+    }
+    const exp = validateNumericDate(payload, 'exp');
+    if (exp !== undefined) {
+        if (exp <= now - tolerance) {
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', checkFailed);
+        }
+    }
+    if (maxTokenAge !== undefined) {
+        const age = now - iat;
+        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
+        if (age - tolerance > max) {
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
+        }
+        if (age < -tolerance) {
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
+        }
+    }
+    return payload;
+}
+let producerPayloads;
+function producerPayload(producer) {
+    return producerPayloads.get(producer);
+}
+export function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ['iat', 'nbf', 'exp']) {
+        const value = payload[claim];
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new TypeError(`"${claim}" claim must be a finite number`);
+        }
+    }
+    return encoder.encode(JSON.stringify(payload));
+}
+export function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+}
+export class JWTClaimsBuilder {
+    constructor(payload = {}) {
+        if (!isObject(payload)) {
+            throw new TypeError('JWT Claims Set MUST be an object');
+        }
+        ;
+        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
+    }
+    setIssuer(value) {
+        validateStringClaim('iss', value);
+        producerPayload(this).iss = value;
+        return this;
+    }
+    setSubject(value) {
+        validateStringClaim('sub', value);
+        producerPayload(this).sub = value;
+        return this;
+    }
+    setAudience(value) {
+        validateAudienceClaim(value);
+        producerPayload(this).aud = value;
+        return this;
+    }
+    setJti(value) {
+        validateStringClaim('jti', value);
+        producerPayload(this).jti = value;
+        return this;
+    }
+    setNotBefore(value) {
+        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
+        return this;
+    }
+    setExpirationTime(value) {
+        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
+        return this;
+    }
+    setIssuedAt(value) {
+        const payload = producerPayload(this);
+        if (value === undefined) {
+            payload.iat = epoch(new Date());
+        }
+        else if (typeof value === 'string') {
+            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+        }
+        else {
+            payload.iat = numericDate(value, 'setIssuedAt');
+        }
+        return this;
+    }
+}