forges 0.0.0 → 0.1.0

package/dist/crypto-CQNEyYHD.mjs

@@ -0,0 +1,156 @@
+//#region src/crypto.ts
+const encoder = new TextEncoder();
+function toBytes(value) {
+	return typeof value === "string" ? encoder.encode(value) : value;
+}
+function toHex(buffer) {
+	return [...new Uint8Array(buffer)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** Base64 for arbitrary bytes, a byte at a time so a large buffer cannot overflow the call stack. */
+function toBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function toBase64Url(input) {
+	return (typeof input === "string" ? btoa(input) : toBase64(input)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+async function hmacSha256(secret, body) {
+	const key = await crypto.subtle.importKey("raw", toBytes(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return crypto.subtle.sign("HMAC", key, toBytes(body));
+}
+/** Lowercase hex HMAC-SHA256 of `body` under `secret`. */
+async function hmacSha256Hex(secret, body) {
+	return toHex(await hmacSha256(secret, body));
+}
+/** Constant-time comparison of two ASCII strings. */
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let index = 0; index < a.length; index++) mismatch |= a.charCodeAt(index) ^ b.charCodeAt(index);
+	return mismatch === 0;
+}
+function decodePem(pem) {
+	const pkcs1 = pem.includes("BEGIN RSA PRIVATE KEY");
+	const body = pem.replace(/-----(?:BEGIN|END)[^-]+-----/g, "").replace(/\s+/g, "");
+	const binary = atob(body);
+	const der = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index++) der[index] = binary.charCodeAt(index);
+	return {
+		der,
+		pkcs1
+	};
+}
+function derLength(length) {
+	if (length < 128) return [length];
+	const bytes = [];
+	let remaining = length;
+	while (remaining > 0) {
+		bytes.unshift(remaining & 255);
+		remaining >>= 8;
+	}
+	return [128 | bytes.length, ...bytes];
+}
+/**
+* Wraps a PKCS#1 RSA key in a PKCS#8 `PrivateKeyInfo`. GitHub App keys are
+* distributed as PKCS#1, which Web Crypto cannot import directly.
+*/
+function pkcs1ToPkcs8(der) {
+	const algorithm = [
+		48,
+		13,
+		6,
+		9,
+		42,
+		134,
+		72,
+		134,
+		247,
+		13,
+		1,
+		1,
+		1,
+		5,
+		0
+	];
+	const octetString = [
+		4,
+		...derLength(der.length),
+		...der
+	];
+	const contents = [
+		2,
+		1,
+		0,
+		...algorithm,
+		...octetString
+	];
+	return new Uint8Array([
+		48,
+		...derLength(contents.length),
+		...contents
+	]);
+}
+/** Signs an RS256 JWT with a PEM-encoded RSA private key. */
+async function signRs256Jwt(privateKeyPem, claims) {
+	const { der, pkcs1 } = decodePem(privateKeyPem);
+	const key = await crypto.subtle.importKey("pkcs8", pkcs1 ? pkcs1ToPkcs8(der) : der, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const payload = `${toBase64Url(JSON.stringify({
+		alg: "RS256",
+		typ: "JWT"
+	}))}.${toBase64Url(JSON.stringify(claims))}`;
+	const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, encoder.encode(payload));
+	return `${payload}.${toBase64Url(new Uint8Array(signature))}`;
+}
+/** The value of a header, whatever the casing of `name`, from a `Headers` object or a plain record. */
+function headerValue(headers, name) {
+	if (headers instanceof Headers) return headers.get(name) ?? void 0;
+	const lower = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === lower) return value;
+}
+/** A request body as text. */
+function bodyText(body) {
+	return typeof body === "string" ? body : new TextDecoder().decode(body);
+}
+/** Lowercase hex SHA-256 of `body`. */
+async function sha256Hex(body) {
+	return toHex(await crypto.subtle.digest("SHA-256", toBytes(body)));
+}
+/** Signs an EdDSA (Ed25519) JWT with a PKCS#8 PEM private key. `kid` goes in the JOSE header. */
+async function signEdDsaJwt(privateKeyPem, claims, kid) {
+	const key = await crypto.subtle.importKey("pkcs8", decodePem(privateKeyPem).der, { name: "Ed25519" }, false, ["sign"]);
+	const payload = `${toBase64Url(JSON.stringify({
+		alg: "EdDSA",
+		typ: "JWT",
+		...kid ? { kid } : {}
+	}))}.${toBase64Url(JSON.stringify(claims))}`;
+	const signature = await crypto.subtle.sign("Ed25519", key, encoder.encode(payload));
+	return `${payload}.${toBase64Url(new Uint8Array(signature))}`;
+}
+/** Verifies an Ed25519 signature (base64) over `data` with a JWK public key. */
+async function verifyEd25519(jwk, data, signatureBase64) {
+	try {
+		const key = await crypto.subtle.importKey("jwk", {
+			kty: jwk.kty,
+			crv: jwk.crv,
+			x: jwk.x
+		}, { name: "Ed25519" }, false, ["verify"]);
+		const binary = atob(signatureBase64);
+		const signature = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+		return await crypto.subtle.verify("Ed25519", key, signature, toBytes(data));
+	} catch {
+		return false;
+	}
+}
+/** Base64 HMAC-SHA256 of `body` under `secret`. */
+async function hmacSha256Base64(secret, body) {
+	return toBase64(new Uint8Array(await hmacSha256(secret, body)));
+}
+//#endregion
+export { sha256Hex as a, timingSafeEqual as c, hmacSha256Hex as i, toBase64 as l, headerValue as n, signEdDsaJwt as o, hmacSha256Base64 as r, signRs256Jwt as s, bodyText as t, verifyEd25519 as u };

package/dist/cursor-origin/index.d.mts

@@ -0,0 +1,2 @@
+import { a as CursorOriginAuth, i as cursorOriginLite, n as ORIGIN_API_VERSION, r as cursorOrigin, t as CursorOriginOptions } from "../index-Cz_y-t3d.mjs";
+export { type CursorOriginAuth, CursorOriginOptions, ORIGIN_API_VERSION, cursorOrigin, cursorOriginLite };

package/dist/cursor-origin/index.mjs

@@ -0,0 +1 @@
+export { t as ORIGIN_API_VERSION, n as cursorOrigin, r as cursorOriginLite } from "../cursor-origin-BhqYx2oW.mjs";