repocairn 0.1.6 → 0.1.7

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -12,13 +12,22 @@ const multipliers = {
 };
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 const checkFailed = 'check_failed';
+function invalidDuration() {
+    throw new TypeError('Invalid time period format');
+}
 export function secs(str) {
+    if (typeof str !== 'string') {
+        invalidDuration();
+    }
     const matched = REGEX.exec(str);
     if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
+        invalidDuration();
     }
     const value = parseFloat(matched[2]);
     const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate)) {
+        invalidDuration();
+    }
     if (matched[1] === '-' || matched[4] === 'ago') {
         return -numericDate;
     }
@@ -30,6 +39,17 @@ function validateInput(label, input) {
     }
     return input;
 }
+function validateStringClaim(claim, value) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`"${claim}" claim must be a string`);
+    }
+}
+function validateAudienceClaim(value) {
+    if (typeof value !== 'string' &&
+        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
+        throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+}
 function numericDate(value, label) {
     if (typeof value === 'number')
         return validateInput(label, value);
@@ -38,10 +58,8 @@ function numericDate(value, label) {
     return epoch(new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    if (value.includes('/')) {
-        return value.toLowerCase();
-    }
-    return `application/${value.toLowerCase()}`;
+    const normalized = value.toLowerCase();
+    return value.includes('/') ? normalized : `application/${normalized}`;
 };
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
@@ -75,7 +93,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
     const { typ } = options;
-    if (typ &&
+    if (typ !== undefined &&
         (typeof protectedHeader.typ !== 'string' ||
             normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
         throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
@@ -119,7 +137,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
+    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
     const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
     const nbf = validateNumericDate(payload, 'nbf');
     if (nbf !== undefined) {
@@ -135,63 +153,80 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     if (maxTokenAge !== undefined) {
         const age = now - iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
         }
-        if (age < 0 - tolerance) {
+        if (age < -tolerance) {
             throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
         }
     }
     return payload;
 }
+let producerPayloads;
+function producerPayload(producer) {
+    return producerPayloads.get(producer);
+}
+export function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ['iat', 'nbf', 'exp']) {
+        const value = payload[claim];
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new TypeError(`"${claim}" claim must be a finite number`);
+        }
+    }
+    return encoder.encode(JSON.stringify(payload));
+}
+export function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+}
 export class JWTClaimsBuilder {
-    #payload;
-    constructor(payload) {
+    constructor(payload = {}) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    set nbf(value) {
-        this.#payload.nbf = numericDate(value, 'setNotBefore');
-    }
-    set exp(value) {
-        this.#payload.exp = numericDate(value, 'setExpirationTime');
-    }
-    set iat(value) {
+        ;
+        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
+    }
+    setIssuer(value) {
+        validateStringClaim('iss', value);
+        producerPayload(this).iss = value;
+        return this;
+    }
+    setSubject(value) {
+        validateStringClaim('sub', value);
+        producerPayload(this).sub = value;
+        return this;
+    }
+    setAudience(value) {
+        validateAudienceClaim(value);
+        producerPayload(this).aud = value;
+        return this;
+    }
+    setJti(value) {
+        validateStringClaim('jti', value);
+        producerPayload(this).jti = value;
+        return this;
+    }
+    setNotBefore(value) {
+        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
+        return this;
+    }
+    setExpirationTime(value) {
+        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
+        return this;
+    }
+    setIssuedAt(value) {
+        const payload = producerPayload(this);
         if (value === undefined) {
-            this.#payload.iat = epoch(new Date());
+            payload.iat = epoch(new Date());
         }
         else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this.#payload.iat = numericDate(value, 'setIssuedAt');
+            payload.iat = numericDate(value, 'setIssuedAt');
         }
+        return this;
     }
 }

package/node_modules/jose/dist/webapi/lib/key.js

@@ -1,8 +1,9 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike, isCryptoKey } from './is_key_like.js';
-import * as jwk from './type_checks.js';
+import { isObject } from './type_checks.js';
 import { decode } from '../util/base64url.js';
 import { jwkToKey } from './jwk_to_key.js';
+import { normalizeJwk } from './jwk_metadata.js';
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
     const { alg } = entry;
@@ -27,14 +28,27 @@ export function checkKeyType(entry, key, usage) {
     const privateKey = usage === 'decrypt' || usage === 'sign';
     if (secret && key instanceof Uint8Array)
         return [BYTES, key];
-    if (jwk.isJWK(key)) {
-        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+    if (isObject(key)) {
+        const normalized = normalizeJwk(key);
+        if (typeof normalized.kty !== 'string') {
+            throw new TypeError(secret
+                ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+                : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
+        const valid = secret
+            ? normalized.kty === 'oct' && typeof normalized.k === 'string'
+            : normalized.kty !== 'oct' &&
+                (privateKey
+                    ? (normalized.kty === 'AKP' && typeof normalized.priv === 'string') ||
+                        typeof normalized.d === 'string'
+                    : normalized.d === undefined && normalized.priv === undefined);
+        if (!valid) {
             throw new TypeError(secret
                 ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
                 : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
         }
-        jwkMatchesOp(entry, key, usage);
-        return [JWK, key];
+        jwkMatchesOp(entry, normalized, usage);
+        return [JWK, key, normalized];
     }
     if (!isKeyLike(key)) {
         throw new TypeError(secret
@@ -81,7 +95,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { __proto__: null, [alg]: value });
+            cache.set(key, { [alg]: value });
         }
     }
     return value ?? entry?.[alg];
@@ -107,8 +121,9 @@ export async function prepareKey(entry, key, usage) {
             return tagged[1];
         case JWK: {
             const key = tagged[1];
-            if (key.k) {
-                return decode(key.k);
+            const normalized = tagged[2];
+            if (normalized.kty === 'oct') {
+                return decode(normalized.k);
             }
             if (!Object.isFrozen(key)) {
                 const { key_ops } = key;
@@ -116,7 +131,7 @@ export async function prepareKey(entry, key, usage) {
                     Object.freeze(key_ops);
                 Object.freeze(key);
             }
-            return handleJWK(key, key, entry);
+            return handleJWK(key, normalized, entry);
         }
         case KEYOBJECT: {
             const keyObject = tagged[1];

package/node_modules/jose/dist/webapi/lib/key_management.js

@@ -5,7 +5,7 @@ import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { decodeBase64url, digest } from './helpers.js';
 import { generateCek, encrypt, decrypt } from './content_encryption.js';
-import { isObject } from './type_checks.js';
+import { assertUint8Array, isObject } from './type_checks.js';
 import { checkCryptoKey, checkModulusLength, checkUsage } from './crypto_key.js';
 import { concat, encode, uint32be } from './buffer_utils.js';
 import { assertCryptoKey } from './is_key_like.js';
@@ -110,7 +110,7 @@ function assertNoEncryptedKey(encryptedKey) {
     if (encryptedKey !== undefined)
         throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
 }
-export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
     const entry = jweAlgorithm(alg);
     if (alg === 'dir') {
         assertNoEncryptedKey(encryptedKey);
@@ -152,7 +152,7 @@ export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHead
             assertEncryptedKey(encryptedKey);
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = options?.maxPBES2Count || 10_000;
+            const p2cLimit = maxPBES2Count || 10_000;
             if (joseHeader.p2c > p2cLimit)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -190,8 +190,14 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'ECDH': {
             assertEcdhKey(key);
             const { apu, apv } = providedParameters;
+            if (apu !== undefined) {
+                assertUint8Array(apu, '"apu"');
+            }
+            if (apv !== undefined) {
+                assertUint8Array(apv, '"apv"');
+            }
             let ephemeralKey;
-            if (providedParameters.epk) {
+            if (providedParameters.epk !== undefined) {
                 ephemeralKey = (await prepareKey(entry, providedParameters.epk, 'decrypt'));
             }
             else {

package/node_modules/jose/dist/webapi/lib/key_options.js

@@ -0,0 +1,6 @@
+export function validateExtractableOption(extractable) {
+    if (extractable !== undefined && typeof extractable !== 'boolean') {
+        throw new TypeError('"extractable" option must be a boolean');
+    }
+    return extractable;
+}

package/node_modules/jose/dist/webapi/lib/options.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+import { isObject } from './type_checks.js';
 export const JWS_RECOGNIZED = { __proto__: null, b64: true };
 export const JWE_RECOGNIZED = { __proto__: null };
 export function validateAlgorithms(option, algorithms) {
@@ -46,3 +47,28 @@ export function validateCrit(Err, recognizedDefault, recognizedOption, protected
     }
     return protectedHeader.crit;
 }
+export function validateB64(protectedHeader, extensions) {
+    if (extensions.includes('b64')) {
+        const b64 = protectedHeader.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+        return b64;
+    }
+    return true;
+}
+export function serializeJoseHeader(Err, header) {
+    let serialized;
+    let parsed;
+    try {
+        serialized = JSON.stringify(header);
+        parsed = JSON.parse(serialized);
+    }
+    catch (cause) {
+        throw new Err('JOSE Header is not valid JSON', { cause });
+    }
+    if (!isObject(parsed)) {
+        throw new Err('JOSE Header is not a JSON object');
+    }
+    return [parsed, serialized];
+}

package/node_modules/jose/dist/webapi/lib/type_checks.js

@@ -1,3 +1,8 @@
+export function assertUint8Array(input, label) {
+    if (!(input instanceof Uint8Array)) {
+        throw new TypeError(`${label} must be an instance of Uint8Array`);
+    }
+}
 export function isObject(input) {
     if (typeof input !== 'object' ||
         input === null ||
@@ -5,14 +10,12 @@ export function isObject(input) {
         return false;
     }
     const prototype = Object.getPrototypeOf(input);
-    if (prototype === null) {
-        return true;
-    }
-    let proto = prototype;
-    while (Object.getPrototypeOf(proto) !== null) {
-        proto = Object.getPrototypeOf(proto);
-    }
-    return prototype === proto;
+    return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+export function isJwkSet(input) {
+    return (isObject(input) &&
+        Array.isArray(input.keys) &&
+        Array.from(input.keys).every(isObject));
 }
 export function isDisjoint(...headers) {
     const parameters = new Set();
@@ -28,8 +31,3 @@ export function isDisjoint(...headers) {
     }
     return true;
 }
-export const isJWK = (key) => isObject(key) && typeof key.kty === 'string';
-export const isPrivateJWK = (key) => key.kty !== 'oct' &&
-    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');
-export const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;
-export const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';

package/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.9",
+  "version": "6.2.10",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repocairn",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Persistent, token-efficient repository memory for AI tools: symbols, import graph and LLM summaries per file — CLI, library and MCP server",
   "type": "module",
   "bin": {