@psnext/slingcli 3.0.20260820-2 → 3.0.20260827-1

package/node_modules/jose/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/type_checks.js';
+import { isJwkSet } from '../lib/type_checks.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.9';
+    const VERSION = 'v6.2.10';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -36,135 +36,114 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     }
 }
 export const jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-    if (typeof input !== 'object' || input === null) {
-        return false;
-    }
-    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {
-        return false;
-    }
-    if (!('jwks' in input) ||
-        !isObject(input.jwks) ||
-        !Array.isArray(input.jwks.keys) ||
-        !Array.prototype.every.call(input.jwks.keys, isObject)) {
-        return false;
-    }
-    return true;
+function isFreshFor(timestamp, duration) {
+    return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
-class RemoteJWKSetImpl {
-    #url;
-    #timeoutDuration;
-    #cooldownDuration;
-    #cacheMaxAge;
-    #jwksTimestamp;
-    #pendingFetch;
-    #headers;
-    #customFetch;
-    #local;
-    #cache;
-    constructor(url, options) {
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this.#url = new URL(url.href);
-        const opts = options ?? {};
-        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
-        this.#cooldownDuration =
-            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
-        this.#headers = new Headers(opts.headers);
-        if (USER_AGENT && !this.#headers.has('User-Agent')) {
-            this.#headers.set('User-Agent', USER_AGENT);
-        }
-        if (!this.#headers.has('accept')) {
-            this.#headers.set('accept', 'application/json');
-            this.#headers.append('accept', 'application/jwk-set+json');
-        }
-        this.#customFetch = opts[customFetch];
-        const cache = opts[jwksCache];
-        if (cache !== undefined) {
-            this.#cache = cache;
-            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
-                this.#jwksTimestamp = this.#cache.uat;
-                this.#local = createLocalJWKSet(this.#cache.jwks);
-            }
-        }
+function validateDuration(value, fallback, option) {
+    if (Number.isNaN(value)) {
+        throw new TypeError(`"${option}" option must not be NaN`);
     }
-    pendingFetch() {
-        return !!this.#pendingFetch;
+    return typeof value === 'number' ? value : fallback;
+}
+export function createRemoteJWKSet(url, options) {
+    if (!(url instanceof URL)) {
+        throw new TypeError('url must be an instance of URL');
     }
-    #validFor(duration) {
-        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    const href = new URL(url.href).href;
+    const opts = options ?? {};
+    const timeoutOption = opts.timeoutDuration;
+    if (typeof timeoutOption === 'number' &&
+        (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+        throw new TypeError('"timeoutDuration" option must be a non-negative integer');
     }
-    coolingDown() {
-        return this.#validFor(this.#cooldownDuration);
+    const timeoutDuration = typeof timeoutOption === 'number' ? timeoutOption : 5000;
+    const cooldownDuration = validateDuration(opts.cooldownDuration, 30000, 'cooldownDuration');
+    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 600000, 'cacheMaxAge');
+    const headers = new Headers(opts.headers);
+    if (USER_AGENT && !headers.has('User-Agent')) {
+        headers.set('User-Agent', USER_AGENT);
     }
-    fresh() {
-        return this.#validFor(this.#cacheMaxAge);
+    if (!headers.has('accept')) {
+        headers.set('accept', 'application/json, application/jwk-set+json');
     }
-    jwks() {
-        return this.#local?.jwks();
+    const fetchImpl = opts[customFetch];
+    const cache = opts[jwksCache];
+    let jwksTimestamp;
+    let pendingFetch;
+    let reloadSequence = 0;
+    let appliedSequence = 0;
+    let local;
+    if (cache && typeof cache === 'object') {
+        const { uat, jwks } = cache;
+        if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+            jwksTimestamp = uat;
+            local = createLocalJWKSet(jwks);
+        }
     }
-    async getKey(protectedHeader, token) {
-        if (!this.#local || !this.fresh()) {
-            await this.reload();
+    const reload = async () => {
+        if (pendingFetch && isCloudflareWorkers()) {
+            pendingFetch = undefined;
+        }
+        if (!pendingFetch) {
+            const sequence = ++reloadSequence;
+            const current = (pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl)
+                .then((json) => {
+                const next = createLocalJWKSet(json);
+                if (sequence <= appliedSequence) {
+                    return;
+                }
+                local = next;
+                const updatedAt = Date.now();
+                if (cache) {
+                    cache.uat = updatedAt;
+                    cache.jwks = json;
+                }
+                jwksTimestamp = updatedAt;
+                appliedSequence = sequence;
+            })
+                .finally(() => {
+                if (pendingFetch === current) {
+                    pendingFetch = undefined;
+                }
+            }));
+        }
+        await pendingFetch;
+    };
+    const remoteJWKSet = async (protectedHeader, token) => {
+        if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+            await reload();
         }
         try {
-            return await this.#local(protectedHeader, token);
+            return await local(protectedHeader, token);
         }
         catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return this.#local(protectedHeader, token);
-                }
+            if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+                await reload();
+                return local(protectedHeader, token);
             }
             throw err;
         }
-    }
-    async reload() {
-        if (this.#pendingFetch && isCloudflareWorkers()) {
-            this.#pendingFetch = undefined;
-        }
-        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
-            .then((json) => {
-            this.#local = createLocalJWKSet(json);
-            if (this.#cache) {
-                this.#cache.uat = Date.now();
-                this.#cache.jwks = json;
-            }
-            this.#jwksTimestamp = Date.now();
-        })
-            .finally(() => {
-            this.#pendingFetch = undefined;
-        });
-        await this.#pendingFetch;
-    }
-}
-export function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSetImpl(url, options);
-    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(remoteJWKSet, {
+    };
+    return Object.defineProperties(remoteJWKSet, {
         coolingDown: {
-            get: () => set.coolingDown(),
+            get: () => isFreshFor(jwksTimestamp, cooldownDuration),
             enumerable: true,
         },
         fresh: {
-            get: () => set.fresh(),
+            get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
             enumerable: true,
         },
         reload: {
-            value: () => set.reload(),
+            value: reload,
             enumerable: true,
         },
         reloading: {
-            get: () => set.pendingFetch(),
+            get: () => !!pendingFetch,
             enumerable: true,
         },
         jwks: {
-            value: () => set.jwks(),
+            value: () => local?.jwks(),
             enumerable: true,
         },
     });
-    return remoteJWKSet;
 }

package/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -1,21 +1,22 @@
-import { FlattenedSign } from '../flattened/sign.js';
-import { unencodedPayload } from '../../lib/jws_sign.js';
+import { createCompactSignature } from '../../lib/jws_sign.js';
+import { assertNotSet } from '../../lib/helpers.js';
 export class CompactSign {
-    #flattened;
+    #payload;
     #protectedHeader;
     constructor(payload) {
-        this.#flattened = new FlattenedSign(payload);
+        if (!(payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
+        this.#payload = payload;
     }
     setProtectedHeader(protectedHeader) {
-        this.#flattened.setProtectedHeader(protectedHeader);
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        if (unencodedPayload(this.#protectedHeader)) {
+        return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
             throw new TypeError('use the flattened module for creating JWS with b64: false');
-        }
-        const jws = await this.#flattened.sign(key, options);
-        return `${jws.protected}.${jws.payload}.${jws.signature}`;
+        });
     }
 }

package/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -21,11 +21,12 @@ export class FlattenedSign {
         return this;
     }
     async sign(key, options) {
-        return createSignature({
+        const [jws] = await createSignature({
             payload: this.#payload,
             protectedHeader: this.#protectedHeader,
             unprotectedHeader: this.#unprotectedHeader,
             crit: options?.crit,
         }, key);
+        return jws;
     }
 }

package/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,24 +1,25 @@
 import { JWSInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
-    if (jws.protected === undefined && jws.header === undefined) {
+    const snapshot = snapshotJws(jws);
+    if (snapshot.protected === undefined && snapshot.header === undefined) {
         throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
     }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
+    if (snapshot.protected !== undefined && typeof snapshot.protected !== 'string') {
         throw new JWSInvalid('JWS Protected Header incorrect type');
     }
-    if (jws.payload === undefined) {
+    if (snapshot.payload === undefined) {
         throw new JWSInvalid('JWS Payload missing');
     }
-    if (typeof jws.signature !== 'string') {
+    if (typeof snapshot.signature !== 'string') {
         throw new JWSInvalid('JWS Signature missing or incorrect type');
     }
-    if (jws.header !== undefined && !isObject(jws.header)) {
+    if (snapshot.header !== undefined && !isObject(snapshot.header)) {
         throw new JWSInvalid('JWS Unprotected Header incorrect type');
     }
-    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+    return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
 }

package/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -51,20 +51,22 @@ export class GeneralSign {
             payload: '',
         };
         const encoded = [];
+        let b64;
         for (let i = 0; i < this.#signatures.length; i++) {
             const signature = this.#signatures[i];
             const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-            const { payload, ...rest } = await createSignature({
+            const [{ payload, ...rest }, signatureB64] = await createSignature({
                 payload: this.#payload,
                 protectedHeader,
                 unprotectedHeader,
                 crit,
                 encoded,
             }, key);
-            if (i === 0) {
+            if (b64 === undefined) {
+                b64 = signatureB64;
                 jws.payload = payload;
             }
-            else if (jws.payload !== payload) {
+            else if (b64 !== signatureB64) {
                 throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
             }
             jws.signatures.push(rest);

package/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -1,41 +1,71 @@
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
+function snapshotSignature(signature, payload) {
+    try {
+        const jws = snapshotJws(signature, [payload]);
+        const { protected: encodedProtected, header, signature: encodedSignature } = jws;
+        if (encodedProtected === undefined && header === undefined)
+            return undefined;
+        if (encodedProtected !== undefined && typeof encodedProtected !== 'string')
+            return undefined;
+        if (typeof encodedSignature !== 'string')
+            return undefined;
+        if (header !== undefined && !isObject(header))
+            return undefined;
+        const protectedHeader = parseProtectedHeader(encodedProtected);
+        const { b64, crit } = protectedHeader;
+        return [
+            jws,
+            protectedHeader,
+            Array.isArray(crit) && crit.includes('b64')
+                ? typeof b64 === 'boolean'
+                    ? b64
+                        ? 1
+                        : 2
+                    : 0
+                : 1,
+        ];
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');
     }
-    const { signatures, payload } = jws;
-    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
+    const { signatures, payload: inputPayload } = jws;
+    if (!Array.isArray(signatures)) {
+        throw new JWSInvalid('JWS Signatures missing or incorrect type');
+    }
+    const signatureEntries = Array.from(signatures);
+    if (!signatureEntries.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
     let shared;
     try {
-        if (payload === undefined)
+        if (inputPayload === undefined)
             throw new Error();
         shared = prepareVerify(options);
     }
     catch {
         throw new JWSSignatureVerificationFailed();
     }
-    for (const signature of signatures) {
+    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
+    const candidates = signatureEntries
+        .map((signature) => snapshotSignature(signature, payload))
+        .filter((candidate) => candidate !== undefined);
+    let modes = 0;
+    for (const [, , mode] of candidates) {
+        modes |= mode;
+        if (modes === 3) {
+            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
+        }
+    }
+    for (const candidate of candidates) {
         try {
-            const { protected: encodedProtected, header, signature: encodedSignature } = signature;
-            if (encodedProtected === undefined && header === undefined)
-                throw new Error();
-            if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
-                throw new Error();
-            }
-            if (typeof encodedSignature !== 'string')
-                throw new Error();
-            if (header !== undefined && !isObject(header))
-                throw new Error();
-            return verifyResult(signature, await verifySignature({
-                header,
-                payload,
-                protected: encodedProtected,
-                signature: encodedSignature,
-            }, shared, key));
+            return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
         }
         catch {
         }

package/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -5,15 +5,13 @@ export async function jwtDecrypt(jwt, key, options) {
     const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
     const protectedHeader = decrypted[1];
     const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
-    }
-    if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
-    }
-    if (protectedHeader.aud !== undefined &&
-        JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
+    for (const claim of ['iss', 'sub', 'aud']) {
+        if (protectedHeader[claim] !== undefined &&
+            (claim === 'aud'
+                ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)
+                : protectedHeader[claim] !== payload[claim])) {
+            throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, 'mismatch');
+        }
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/node_modules/jose/dist/webapi/jwt/encrypt.js

@@ -1,7 +1,8 @@
-import { CompactEncrypt } from '../jwe/compact/encrypt.js';
-import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
+import { createJWE } from '../lib/jwe_encrypt.js';
+import { JWTClaimsBuilder, jwtClaim, jwtData } from '../lib/jwt_claims_set.js';
 import { assertNotSet } from '../lib/helpers.js';
-export class EncryptJWT {
+const EncryptJWT_base = JWTClaimsBuilder;
+export class EncryptJWT extends EncryptJWT_base {
     #cek;
     #iv;
     #keyManagementParameters;
@@ -9,38 +10,6 @@ export class EncryptJWT {
     #replicateIssuerAsHeader;
     #replicateSubjectAsHeader;
     #replicateAudienceAsHeader;
-    #jwt;
-    constructor(payload = {}) {
-        this.#jwt = new JWTClaimsBuilder(payload);
-    }
-    setIssuer(issuer) {
-        this.#jwt.iss = issuer;
-        return this;
-    }
-    setSubject(subject) {
-        this.#jwt.sub = subject;
-        return this;
-    }
-    setAudience(audience) {
-        this.#jwt.aud = audience;
-        return this;
-    }
-    setJti(jwtId) {
-        this.#jwt.jti = jwtId;
-        return this;
-    }
-    setNotBefore(input) {
-        this.#jwt.nbf = input;
-        return this;
-    }
-    setExpirationTime(input) {
-        this.#jwt.exp = input;
-        return this;
-    }
-    setIssuedAt(input) {
-        this.#jwt.iat = input;
-        return this;
-    }
     setProtectedHeader(protectedHeader) {
         assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
@@ -74,28 +43,30 @@ export class EncryptJWT {
         return this;
     }
     async encrypt(key, options) {
-        const enc = new CompactEncrypt(this.#jwt.data());
+        const plaintext = jwtData(this);
         if (this.#protectedHeader &&
             (this.#replicateIssuerAsHeader ||
                 this.#replicateSubjectAsHeader ||
                 this.#replicateAudienceAsHeader)) {
             this.#protectedHeader = {
                 ...this.#protectedHeader,
-                iss: this.#replicateIssuerAsHeader ? this.#jwt.iss : undefined,
-                sub: this.#replicateSubjectAsHeader ? this.#jwt.sub : undefined,
-                aud: this.#replicateAudienceAsHeader ? this.#jwt.aud : undefined,
+                iss: this.#replicateIssuerAsHeader ? jwtClaim(this, 'iss') : undefined,
+                sub: this.#replicateSubjectAsHeader ? jwtClaim(this, 'sub') : undefined,
+                aud: this.#replicateAudienceAsHeader ? jwtClaim(this, 'aud') : undefined,
             };
         }
-        enc.setProtectedHeader(this.#protectedHeader);
-        if (this.#iv) {
-            enc.setInitializationVector(this.#iv);
-        }
-        if (this.#cek) {
-            enc.setContentEncryptionKey(this.#cek);
-        }
-        if (this.#keyManagementParameters) {
-            enc.setKeyManagementParameters(this.#keyManagementParameters);
-        }
-        return enc.encrypt(key, options);
+        const jwe = await createJWE([
+            plaintext,
+            this.#protectedHeader,
+            undefined,
+            undefined,
+            undefined,
+            this.#cek,
+            this.#iv,
+            this.#keyManagementParameters,
+            undefined,
+            false,
+        ], key, options);
+        return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
     }
 }

package/node_modules/jose/dist/webapi/jwt/sign.js

@@ -1,51 +1,18 @@
-import { CompactSign } from '../jws/compact/sign.js';
-import { unencodedPayload } from '../lib/jws_sign.js';
+import { createCompactSignature } from '../lib/jws_sign.js';
 import { JWTInvalid } from '../util/errors.js';
-import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
-export class SignJWT {
+import { JWTClaimsBuilder, jwtData } from '../lib/jwt_claims_set.js';
+import { assertNotSet } from '../lib/helpers.js';
+const SignJWT_base = JWTClaimsBuilder;
+export class SignJWT extends SignJWT_base {
     #protectedHeader;
-    #jwt;
-    constructor(payload = {}) {
-        this.#jwt = new JWTClaimsBuilder(payload);
-    }
-    setIssuer(issuer) {
-        this.#jwt.iss = issuer;
-        return this;
-    }
-    setSubject(subject) {
-        this.#jwt.sub = subject;
-        return this;
-    }
-    setAudience(audience) {
-        this.#jwt.aud = audience;
-        return this;
-    }
-    setJti(jwtId) {
-        this.#jwt.jti = jwtId;
-        return this;
-    }
-    setNotBefore(input) {
-        this.#jwt.nbf = input;
-        return this;
-    }
-    setExpirationTime(input) {
-        this.#jwt.exp = input;
-        return this;
-    }
-    setIssuedAt(input) {
-        this.#jwt.iat = input;
-        return this;
-    }
     setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        const sig = new CompactSign(this.#jwt.data());
-        sig.setProtectedHeader(this.#protectedHeader);
-        if (unencodedPayload(this.#protectedHeader)) {
+        return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
             throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-        }
-        return sig.sign(key, options);
+        });
     }
 }