@psnext/slingcli 3.1.20260904-1 → 3.3.20260911-1

package/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -1,27 +1,20 @@
 import { createSignature } from "../../lib/jws_sign.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class FlattenedSign {
-  #payload;
-  #protectedHeader;
-  #unprotectedHeader;
+  #input;
   constructor(payload) {
-    if (!(payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
-    this.#payload = payload;
+    assertUint8Array(payload, "payload"), this.#input = [payload];
   }
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setUnprotectedHeader(unprotectedHeader) {
-    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
   }
   async sign(key, options) {
-    const [jws] = await createSignature({
-      payload: this.#payload,
-      protectedHeader: this.#protectedHeader,
-      unprotectedHeader: this.#unprotectedHeader,
-      crit: options?.crit
-    }, key);
+    const input = [...this.#input];
+    input[3] = options?.crit;
+    const [jws] = await createSignature(input, key);
     return jws;
   }
 }

package/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,21 +1,11 @@
 import { JWSInvalid } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
-import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+import { isObject } from "../../lib/validate.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws))
     throw new JWSInvalid("Flattened JWS must be an object");
-  const snapshot = snapshotJws(jws);
-  if (snapshot.protected === void 0 && snapshot.header === void 0)
-    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-  if (snapshot.protected !== void 0 && typeof snapshot.protected != "string")
-    throw new JWSInvalid("JWS Protected Header incorrect type");
-  if (snapshot.payload === void 0)
-    throw new JWSInvalid("JWS Payload missing");
-  if (typeof snapshot.signature != "string")
-    throw new JWSInvalid("JWS Signature missing or incorrect type");
-  if (snapshot.header !== void 0 && !isObject(snapshot.header))
-    throw new JWSInvalid("JWS Unprotected Header incorrect type");
-  return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
+  const snapshot = snapshotJws(jws), [result] = await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload);
+  return result;
 }
 export {
   flattenedVerify

package/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -1,6 +1,6 @@
 import { createSignature } from "../../lib/jws_sign.js";
 import { JWSInvalid } from "../../util/errors.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class IndividualSignature {
   #parent;
   state;
@@ -36,21 +36,14 @@ class GeneralSign {
   async sign() {
     if (!this.#signatures.length)
       throw new JWSInvalid("at least one signature must be added");
-    if (!(this.#payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
+    assertUint8Array(this.#payload, "payload");
     const jws = {
       signatures: [],
       payload: ""
     }, encoded = [];
     let b64;
-    for (let i = 0; i < this.#signatures.length; i++) {
-      const signature = this.#signatures[i], [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature({
-        payload: this.#payload,
-        protectedHeader,
-        unprotectedHeader,
-        crit,
-        encoded
-      }, key);
+    for (const signature of this.#signatures) {
+      const [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature([this.#payload, protectedHeader, unprotectedHeader, crit, encoded], key);
       if (b64 === void 0)
         b64 = signatureB64, jws.payload = payload;
       else if (b64 !== signatureB64)

package/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -1,12 +1,9 @@
-import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
 import { JWSInvalid, JWSSignatureVerificationFailed } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
+import { isObject } from "../../lib/validate.js";
 function snapshotSignature(signature, payload) {
   try {
-    const jws = snapshotJws(signature, [payload]), { protected: encodedProtected, header, signature: encodedSignature } = jws;
-    if (encodedProtected === void 0 && header === void 0 || encodedProtected !== void 0 && typeof encodedProtected != "string" || typeof encodedSignature != "string" || header !== void 0 && !isObject(header))
-      return;
-    const protectedHeader = parseProtectedHeader(encodedProtected), { b64, crit } = protectedHeader;
+    const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
     return [
       jws,
       protectedHeader,
@@ -40,7 +37,8 @@ async function generalVerify(jws, key, options) {
       throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
   for (const candidate of candidates)
     try {
-      return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
+      const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+      return result;
     } catch {
     }
   throw new JWSSignatureVerificationFailed();

package/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -2,12 +2,11 @@ import { prepareDecrypt, decryptCompact } from "../lib/jwe_decrypt.js";
 import { validateClaimsSet } from "../lib/jwt_claims_set.js";
 import { JWTClaimValidationFailed } from "../util/errors.js";
 async function jwtDecrypt(jwt, key, options) {
-  const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key), protectedHeader = decrypted[1], payload = validateClaimsSet(protectedHeader, decrypted[0], options);
+  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
   for (const claim of ["iss", "sub", "aud"])
     if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
       throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
-  const result = { payload, protectedHeader };
-  return typeof key == "function" ? { ...result, key: decrypted[2] } : result;
+  return { payload, ...result };
 }
 export {
   jwtDecrypt

package/node_modules/jose/dist/webapi/jwt/encrypt.js

@@ -1,26 +1,23 @@
-import { createJWE } from "../lib/jwe_encrypt.js";
+import { compactJWE, createJWE } from "../lib/jwe_encrypt.js";
 import { JWTClaimsBuilder, jwtClaim, jwtData } from "../lib/jwt_claims_set.js";
-import { assertNotSet } from "../lib/helpers.js";
+import { assertNotSet } from "../lib/validate.js";
 const EncryptJWT_base = JWTClaimsBuilder;
 class EncryptJWT extends EncryptJWT_base {
-  #cek;
-  #iv;
-  #keyManagementParameters;
-  #protectedHeader;
+  #input = [void 0];
   #replicateIssuerAsHeader;
   #replicateSubjectAsHeader;
   #replicateAudienceAsHeader;
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setKeyManagementParameters(parameters) {
-    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
   }
   setContentEncryptionKey(cek) {
-    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
   }
   setInitializationVector(iv) {
-    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
   }
   replicateIssuerAsHeader() {
     return this.#replicateIssuerAsHeader = !0, this;
@@ -33,25 +30,14 @@ class EncryptJWT extends EncryptJWT_base {
   }
   async encrypt(key, options) {
     const plaintext = jwtData(this);
-    this.#protectedHeader && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#protectedHeader = {
-      ...this.#protectedHeader,
+    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {
+      ...this.#input[1],
       iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
       sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
       aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
     });
-    const jwe = await createJWE([
-      plaintext,
-      this.#protectedHeader,
-      void 0,
-      void 0,
-      void 0,
-      this.#cek,
-      this.#iv,
-      this.#keyManagementParameters,
-      void 0,
-      !1
-    ], key, options);
-    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+    const input = [...this.#input];
+    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
   }
 }
 export {

package/node_modules/jose/dist/webapi/jwt/sign.js

@@ -1,7 +1,7 @@
 import { createCompactSignature } from "../lib/jws_sign.js";
 import { JWTInvalid } from "../util/errors.js";
 import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
-import { assertNotSet } from "../lib/helpers.js";
+import { assertNotSet } from "../lib/validate.js";
 const SignJWT_base = JWTClaimsBuilder;
 class SignJWT extends SignJWT_base {
   #protectedHeader;

package/node_modules/jose/dist/webapi/jwt/unsecured.js

@@ -1,8 +1,7 @@
 import * as b64u from "../util/base64url.js";
-import { decodeBase64url, parseJoseHeader } from "../lib/helpers.js";
+import { decodeBase64url, parseJoseHeader, JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/validate.js";
 import { JWSInvalid, JWTInvalid } from "../util/errors.js";
 import { validateClaimsSet, JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
-import { JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/options.js";
 const UnsecuredJWT_base = JWTClaimsBuilder;
 class UnsecuredJWT extends UnsecuredJWT_base {
   encode() {

package/node_modules/jose/dist/webapi/jwt/verify.js

@@ -2,11 +2,11 @@ import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
 import { validateClaimsSet } from "../lib/jwt_claims_set.js";
 import { JWTInvalid } from "../util/errors.js";
 async function jwtVerify(jwt, key, options) {
-  const verified = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!verified[2])
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
     throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  const result = { payload: validateClaimsSet(verified[1], verified[0], options), protectedHeader: verified[1] };
-  return typeof key == "function" ? { ...result, key: verified[3] } : result;
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
 }
 export {
   jwtVerify

package/node_modules/jose/dist/webapi/key/export.js

@@ -1,11 +1,13 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from "../lib/asn1.js";
-import { invalidKeyInput } from "../lib/invalid_key_input.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject } from "../lib/key.js";
 import { encode as b64u } from "../util/base64url.js";
-import { isCryptoKey, isKeyObject } from "../lib/is_key_like.js";
-function omitUndefinedProperties(jwk) {
-  return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
+function exportSPKI(key) {
+  return exportPublic(key);
+}
+function exportPKCS8(key) {
+  return exportPrivate(key);
 }
-async function keyToJWK(key) {
+async function exportJWK(key) {
   if (isKeyObject(key))
     if (key.type === "secret")
       key = key.export();
@@ -20,17 +22,11 @@ async function keyToJWK(key) {
     throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
   if (!key.extractable)
     throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-  const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey("jwk", key));
-  return jwk.kty === "AKP" && (jwk.alg = alg), jwk;
-}
-function exportSPKI(key) {
-  return exportPublic(key);
-}
-function exportPKCS8(key) {
-  return exportPrivate(key);
-}
-function exportJWK(key) {
-  return keyToJWK(key);
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
 }
 export {
   exportJWK,

package/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from "../util/errors.js";
-import { validateExtractableOption } from "../lib/key_options.js";
+import { validateExtractableOption } from "../lib/key.js";
 import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
 function getModulusLengthOption(options) {
   const modulusLength = options?.modulusLength ?? 2048;
@@ -13,18 +13,9 @@ async function generateKeyPair(alg, options) {
   let algorithm;
   if (entry.resolve) {
     const crv = options?.crv ?? "P-256";
-    switch (crv) {
-      case "P-256":
-      case "P-384":
-      case "P-521":
-        algorithm = { name: "ECDH", namedCurve: crv };
-        break;
-      case "X25519":
-        algorithm = { name: "X25519" };
-        break;
-      default:
-        throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
-    }
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
   } else {
     if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
       throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);

package/node_modules/jose/dist/webapi/key/generate_secret.js

@@ -1,5 +1,5 @@
 import { unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
-import { validateExtractableOption } from "../lib/key_options.js";
+import { validateExtractableOption } from "../lib/key.js";
 async function generateSecret(alg, options) {
   const extractable = validateExtractableOption(options?.extractable);
   let length, algorithm, keyUsages;

package/node_modules/jose/dist/webapi/key/import.js

@@ -1,11 +1,9 @@
 import { decode as decodeBase64URL } from "../util/base64url.js";
 import { fromSPKI, fromPKCS8, fromX509 } from "../lib/asn1.js";
-import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwkToKey, validateExtractableOption, normalizeJwk } from "../lib/key.js";
 import { keyAlgorithm } from "../lib/key_algorithm.js";
 import { JOSENotSupported } from "../util/errors.js";
-import { isObject } from "../lib/type_checks.js";
-import { validateExtractableOption } from "../lib/key_options.js";
-import { normalizeJwk } from "../lib/jwk_metadata.js";
+import { isObject } from "../lib/validate.js";
 async function importSPKI(spki, alg, options) {
   if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
     throw new TypeError('"spki" must be SPKI formatted string');
@@ -25,9 +23,7 @@ async function importJWK(jwk, alg, options) {
   if (!isObject(jwk))
     throw new TypeError("JWK must be an object");
   const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
-  alg ??= jwkAlg;
-  const ext = extractable ?? normalized.ext;
-  if (normalized.kty !== "oct" && !alg)
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
   switch (normalized.kty) {
     case "oct":
@@ -39,12 +35,12 @@ async function importJWK(jwk, alg, options) {
         throw new TypeError('missing "alg" (Algorithm) Parameter value');
       if (alg !== jwkAlg)
         throw new TypeError("JWK alg and alg option value mismatch");
-      return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
     }
     case "RSA":
     case "EC":
     case "OKP":
-      return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
     default:
       throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
   }

package/node_modules/jose/dist/webapi/lib/asn1.js

@@ -1,9 +1,7 @@
-import { invalidKeyInput } from "./invalid_key_input.js";
-import { encodeBase64, decodeBase64 } from "../lib/base64.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject, validateExtractableOption } from "./key.js";
+import { encodeBase64, decodeBase64 } from "./buffer_utils.js";
 import { JOSENotSupported } from "../util/errors.js";
 import { keyAlgorithm, unsupportedAlg, algArgument } from "./key_algorithm.js";
-import { isCryptoKey, isKeyObject } from "./is_key_like.js";
-import { validateExtractableOption } from "./key_options.js";
 const formatPEM = (b64, descriptor) => {
   const newlined = (b64.match(/.{1,64}/g) || []).join(`
 `);

package/node_modules/jose/dist/webapi/lib/buffer_utils.js

@@ -19,7 +19,13 @@ function uint32be(value) {
   const buf = new Uint8Array(4);
   return writeUInt32BE(buf, value), buf;
 }
+const NON_ASCII = /[^\x00-\x7f]/;
 function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
   const bytes = new Uint8Array(string.length);
   for (let i = 0; i < string.length; i++) {
     const code = string.charCodeAt(i);
@@ -29,10 +35,39 @@ function encode(string) {
   }
   return bytes;
 }
+function encodeBase64(input, url = !1) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = !1) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
 export {
   concat,
+  decodeBase64,
   decoder,
+  digest,
   encode,
+  encodeBase64,
   encoder,
   strictDecoder,
   uint32be,

package/node_modules/jose/dist/webapi/lib/content_encryption.js

@@ -1,8 +1,6 @@
 import { concat, uint64be } from "./buffer_utils.js";
-import { checkCryptoKey } from "./crypto_key.js";
-import { invalidKeyInput } from "./invalid_key_input.js";
+import { rawKey, invalidKeyInput, isCryptoKey } from "./key.js";
 import { JWEDecryptionFailed, JWEInvalid } from "../util/errors.js";
-import { isCryptoKey } from "./is_key_like.js";
 const generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
 function checkCekLength(cek, expected) {
   const actual = cek.byteLength << 3;
@@ -46,21 +44,31 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
   }
   throw new JWEDecryptionFailed();
 }
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-  const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", !1, [
-    "encrypt"
-  ]) : (checkCryptoKey(cek, enc.subtle, "encrypt"), cek), encrypted = new Uint8Array(await crypto.subtle.encrypt({
+async function encrypt(enc, plaintext, cek, iv, aad) {
+  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+  if (iv ? checkIvLength(enc, iv) : iv = generateIv(enc), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+    return cbcEncrypt(enc, plaintext, cek, iv, aad);
+  const encKey = await rawKey(cek, enc.subtle, "encrypt"), encrypted = new Uint8Array(await crypto.subtle.encrypt({
     additionalData: aad,
     iv,
     name: "AES-GCM",
     tagLength: 128
-  }, encKey, plaintext)), tag = encrypted.slice(-16);
-  return { ciphertext: encrypted.slice(0, -16), tag, iv };
+  }, encKey, plaintext));
+  return { ciphertext: encrypted.subarray(0, -16), tag: encrypted.subarray(-16), iv };
 }
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-  const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", !1, [
-    "decrypt"
-  ]) : (checkCryptoKey(cek, enc.subtle, "decrypt"), cek);
+async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
+  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+  if (!iv)
+    throw new JWEInvalid("JWE Initialization Vector missing");
+  if (!tag)
+    throw new JWEInvalid("JWE Authentication Tag missing");
+  if (!enc.cbc && tag.length !== 16)
+    throw new JWEInvalid("Invalid Authentication Tag length");
+  if (checkIvLength(enc, iv), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+    return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+  const encKey = await rawKey(cek, enc.subtle, "decrypt");
   try {
     return new Uint8Array(await crypto.subtle.decrypt({
       additionalData: aad,
@@ -72,22 +80,6 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     throw new JWEDecryptionFailed();
   }
 }
-async function encrypt(enc, plaintext, cek, iv, aad) {
-  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
-    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
-  return iv ? checkIvLength(enc, iv) : iv = generateIv(enc), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc ? cbcEncrypt(enc, plaintext, cek, iv, aad) : gcmEncrypt(enc, plaintext, cek, iv, aad);
-}
-async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
-  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
-    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
-  if (!iv)
-    throw new JWEInvalid("JWE Initialization Vector missing");
-  if (!tag)
-    throw new JWEInvalid("JWE Authentication Tag missing");
-  if (!enc.cbc && tag.length !== 16)
-    throw new JWEInvalid("Invalid Authentication Tag length");
-  return checkIvLength(enc, iv), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc ? cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) : gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-}
 export {
   checkCekLength,
   checkIvLength,

package/node_modules/jose/dist/webapi/lib/deflate.js

@@ -10,30 +10,14 @@ function supported(name) {
   if (typeof globalThis[name] > "u")
     throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`);
 }
-async function compress(input) {
-  supported("CompressionStream");
-  const cs = new CompressionStream("deflate-raw"), writer = cs.writable.getWriter();
-  writer.write(input).catch(() => {
-  }), writer.close().catch(() => {
-  });
-  const chunks = [], reader = cs.readable.getReader();
-  for (; ; ) {
-    const { value, done } = await reader.read();
-    if (done)
-      break;
-    chunks.push(value);
-  }
-  return concat(...chunks);
-}
-async function decompress(input, maxLength) {
-  supported("DecompressionStream");
-  const ds = new DecompressionStream("deflate-raw"), writer = ds.writable.getWriter();
+async function transform(stream, input, maxLength = 1 / 0) {
+  const writer = stream.writable.getWriter();
   writer.write(input).catch(() => {
   }), writer.close().catch(() => {
   });
   const chunks = [];
   let length = 0;
-  const reader = ds.readable.getReader();
+  const reader = stream.readable.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done)
@@ -43,6 +27,12 @@ async function decompress(input, maxLength) {
   }
   return concat(...chunks);
 }
+async function compress(input) {
+  return supported("CompressionStream"), transform(new CompressionStream("deflate-raw"), input);
+}
+async function decompress(input, maxLength) {
+  return supported("DecompressionStream"), transform(new DecompressionStream("deflate-raw"), input, maxLength);
+}
 export {
   compress,
   decompress,

package/node_modules/jose/dist/webapi/lib/jwe_algorithms.js

@@ -105,15 +105,11 @@ function jweAlgorithm(alg) {
 function isJWECEKTransport(algorithm) {
   return algorithm.mode === "key-wrapping" || algorithm.mode === "key-encryption" || algorithm.mode === "key-agreement-with-key-wrapping";
 }
-function invalidJWEKeyManagementMode(_mode) {
-  throw new TypeError("Invalid JWE key management mode");
-}
 function jweEncryption(enc) {
   return (typeof enc == "string" ? ENC[enc] : void 0) ?? unsupported("enc", "Encryption Algorithm");
 }
 export {
   JWE,
-  invalidJWEKeyManagementMode,
   isJWECEKTransport,
   jweAlgorithm,
   jweEncryption