@psnext/slingcli 3.1.20260904-1 → 3.3.20260911-1

package/node_modules/jose/dist/webapi/lib/jwe_decrypt.js

@@ -1,12 +1,10 @@
 import { decrypt, generateCek } from "./content_encryption.js";
-import { decodeBase64url, encodeBase64url, parseJoseHeader } from "./helpers.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateCrit, validateAlgorithms, JWE_RECOGNIZED } from "./validate.js";
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from "../util/errors.js";
-import { isDisjoint, isObject } from "./type_checks.js";
 import { decryptKeyManagement } from "./key_management.js";
-import { concat, decoder, encode } from "./buffer_utils.js";
-import { validateCrit, validateAlgorithms, JWE_RECOGNIZED } from "./options.js";
+import { decoder } from "./buffer_utils.js";
 import { prepareKey } from "./key.js";
-import { JWE, invalidJWEKeyManagementMode, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
+import { JWE, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
 import { decompress, validateZip } from "./deflate.js";
 function snapshotSharedJWE(jwe) {
   const { aad, ciphertext, iv, protected: encodedProtected, tag, unprotected } = jwe;
@@ -44,10 +42,6 @@ function snapshotRecipientJWE(recipient) {
       ]));
     } else
       header = inputHeader;
-  } catch (error) {
-    return [void 0, headerAlg, error];
-  }
-  try {
     const { encrypted_key: encryptedKey } = recipient;
     return [{ encrypted_key: encryptedKey, header }, headerAlg];
   } catch (error) {
@@ -66,20 +60,14 @@ function checkRecipient(jwe) {
 function shareJWE(jwe) {
   const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;
   let parsedProt;
-  encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid"));
-  const protectedHeader = encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array();
-  return [
+  return encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid")), [
     parsedProt,
     decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
     iv !== void 0 ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
     tag !== void 0 ? decodeBase64url(tag, "tag", JWEInvalid) : void 0,
-    aad !== void 0 ? concat(protectedHeader, encode("."), encodeBase64url(aad, "aad", JWEInvalid)) : protectedHeader
+    encodeBase64url((encodedProtected ?? "") + (aad !== void 0 ? `.${aad}` : ""), "aad", JWEInvalid)
   ];
 }
-function decryptResult(jwe, decrypted) {
-  const [plaintext, parsedProt, key, resolvedKey] = decrypted, { protected: encodedProtected, aad, unprotected, header } = jwe, result = { plaintext };
-  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), aad !== void 0 && (result.additionalAuthenticatedData = decodeBase64url(aad, "aad", JWEInvalid)), unprotected !== void 0 && (result.sharedUnprotectedHeader = unprotected), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? { ...result, key } : result;
-}
 function prepareDecrypt(options) {
   return [
     options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
@@ -89,8 +77,8 @@ function prepareDecrypt(options) {
     options?.maxDecompressedLength
   ];
 }
-async function decryptRecipient(jwe, token, shared, key) {
-  const [parsedProt] = token, { header, unprotected } = jwe;
+async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
+  const [parsedProt, ciphertext, iv, tag, additionalData] = token, { header, unprotected, aad } = jwe;
   let joseHeader;
   if (header !== void 0 || unprotected !== void 0) {
     if (!isDisjoint(parsedProt, header, unprotected))
@@ -98,10 +86,7 @@ async function decryptRecipient(jwe, token, shared, key) {
     joseHeader = { ...parsedProt, ...header, ...unprotected };
   } else
     joseHeader = parsedProt ?? {};
-  return decryptRecipientCore(jwe, token, shared, key, joseHeader);
-}
-async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
-  const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, [parsedProt, ciphertext, iv, tag, additionalData] = token, { encrypted_key: encodedKey } = jwe;
+  const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, { encrypted_key: encodedKey } = jwe;
   validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader), validateZip(joseHeader, parsedProt);
   const { alg, enc } = joseHeader;
   if (typeof alg != "string" || !alg)
@@ -140,22 +125,7 @@ async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
   typeof key == "function" && (key = await key(parsedProt, jwe), resolvedKey = !0);
   const algEntry = selected ?? jweAlgorithm(alg);
   isJWECEKTransport(algEntry) && encryptedKey === void 0 && (encryptedKey = new Uint8Array());
-  let k;
-  const mode = algEntry.mode;
-  switch (mode) {
-    case "direct-encryption":
-      k = await prepareKey(encEntry, key, "decrypt");
-      break;
-    case "direct-key-agreement":
-    case "key-wrapping":
-    case "key-encryption":
-    case "key-agreement-with-key-wrapping":
-    case "integrated-encryption":
-      k = await prepareKey(algEntry, key, "decrypt");
-      break;
-    default:
-      invalidJWEKeyManagementMode(mode);
-  }
+  const k = await prepareKey(algEntry.mode === "direct-encryption" ? encEntry : algEntry, key, "decrypt");
   let plaintext;
   if (algEntry.mode === "integrated-encryption")
     plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalData, parsedProt, joseHeader);
@@ -181,10 +151,16 @@ async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
       throw cause instanceof JWEInvalid ? cause : new JWEInvalid("Failed to decompress plaintext", { cause });
     });
   }
-  return [plaintext, parsedProt, k, resolvedKey];
-}
-async function decryptJWE(jwe, shared, key) {
-  return decryptRecipient(jwe, shareJWE(jwe), shared, key);
+  return {
+    plaintext,
+    ...parsedProt && { protectedHeader: parsedProt },
+    ...aad !== void 0 && {
+      additionalAuthenticatedData: decodeBase64url(aad, "aad", JWEInvalid)
+    },
+    ...unprotected && { sharedUnprotectedHeader: unprotected },
+    ...header && { unprotectedHeader: header },
+    ...resolvedKey && { key: k }
+  };
 }
 async function decryptCompact(jwe, shared, key) {
   if (jwe instanceof Uint8Array && (jwe = decoder.decode(jwe)), typeof jwe != "string")
@@ -192,27 +168,18 @@ async function decryptCompact(jwe, shared, key) {
   const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length } = jwe.split(".");
   if (length !== 5)
     throw new JWEInvalid("Invalid Compact JWE");
-  const flattened = {
+  return decryptJWE({
     ciphertext,
     iv: iv || void 0,
     protected: protectedHeader,
     tag: tag || void 0,
     encrypted_key: encryptedKey || void 0
-  }, parsedProt = parseJoseHeader(protectedHeader, JWEInvalid, "JWE Protected Header is invalid"), protectedBytes = encode(protectedHeader), token = [
-    parsedProt,
-    decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
-    iv ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
-    tag ? decodeBase64url(tag, "tag", JWEInvalid) : void 0,
-    protectedBytes
-  ];
-  return decryptRecipientCore(flattened, token, shared, key, parsedProt);
+  }, shared, key);
 }
 export {
   checkRecipient,
   decryptCompact,
   decryptJWE,
-  decryptRecipient,
-  decryptResult,
   prepareDecrypt,
   shareJWE,
   snapshotRecipientJWE,

package/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -1,21 +1,22 @@
 import { encode as b64u } from "../util/base64url.js";
-import { checkCekLength, encrypt, generateCek } from "./content_encryption.js";
+import { encrypt } from "./content_encryption.js";
 import { encryptKeyManagement } from "./key_management.js";
 import { JWEInvalid } from "../util/errors.js";
-import { assertUint8Array, isDisjoint, isObject } from "./type_checks.js";
-import { concat, encode } from "./buffer_utils.js";
-import { serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED } from "./options.js";
+import { assertUint8Array, isDisjoint, isObject, serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED } from "./validate.js";
+import { encode } from "./buffer_utils.js";
 import { prepareKey } from "./key.js";
-import { JWE, invalidJWEKeyManagementMode, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
+import { JWE, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
 import { compress, validateZip } from "./deflate.js";
-import { unprotected } from "./helpers.js";
 function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
   if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader))
     throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
 }
-function checkEncryptHeaders(input) {
+function checkEncryptHeaders(input, options, sharedHeadersNormalized = !1) {
+  if (!input[1] && !input[2] && !input[3])
+    throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
+  options !== void 0 && (input[8] = options?.crit);
   let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
-  if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))
+  if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), !sharedHeadersNormalized && sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))
     throw new TypeError("JWE Key Management Parameters must be an object");
   checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
   const joseHeader = {
@@ -27,82 +28,48 @@ function checkEncryptHeaders(input) {
   const { alg, enc } = joseHeader;
   if (typeof alg != "string" || !alg)
     throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
-  if (JWE[alg]?.mode === "integrated-encryption") {
+  const algEntry = JWE[alg];
+  if (algEntry?.mode === "integrated-encryption") {
     if (enc !== void 0)
       throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
     if (cek !== void 0)
       throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
     if (iv !== void 0)
       throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
-    return [joseHeader, alg, void 0, void 0];
+    return [joseHeader, void 0, algEntry];
   }
   if (typeof enc != "string" || !enc)
     throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
-  return [joseHeader, alg, enc, jweEncryption(enc)];
-}
-function checkProducedEncryptedKey(encryptedKey) {
-  if (!(encryptedKey instanceof Uint8Array) || !encryptedKey.byteLength)
-    throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");
-}
-async function transportCek(algEntry, encEntry, key, providedCek, joseHeader, providedParameters) {
-  const preparedKey = await prepareKey(algEntry, key, "encrypt"), cek = providedCek ?? generateCek(encEntry);
-  checkCekLength(cek, encEntry.cekBits);
-  const [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, preparedKey, joseHeader, cek, providedParameters);
-  return checkProducedEncryptedKey(encryptedKey), [cek, encryptedKey, parameters];
+  return [joseHeader, jweEncryption(enc), algEntry];
 }
-async function encryptJWE(input, checked, key, resolvedAlgEntry) {
-  const [joseHeader, alg, , encEntry] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
+async function encryptJWE(input, checked, key) {
+  const [joseHeader, encEntry, selected] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
   let protectedHeader = inputProtectedHeader, unprotectedHeader = inputUnprotectedHeader;
-  const algEntry = resolvedAlgEntry ?? jweAlgorithm(alg);
-  if (providedCek !== void 0 && !isJWECEKTransport(algEntry))
-    throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
-  let encryptedKey, parameters, cek, integratedKey;
-  const mode = algEntry.mode;
-  switch (mode) {
-    case "direct-encryption":
-      cek = await prepareKey(encEntry, key, "encrypt");
-      break;
-    case "direct-key-agreement": {
-      const preparedKey = await prepareKey(algEntry, key, "encrypt");
-      [cek, , parameters] = await encryptKeyManagement(algEntry, encEntry, preparedKey, joseHeader, void 0, keyManagementParameters);
-      break;
-    }
-    case "key-wrapping":
-    case "key-encryption":
-    case "key-agreement-with-key-wrapping":
-      [cek, encryptedKey, parameters] = await transportCek(algEntry, encEntry, key, providedCek, joseHeader, keyManagementParameters);
-      break;
-    case "integrated-encryption":
-      integratedKey = await prepareKey(algEntry, key, "encrypt");
-      break;
-    default:
-      invalidJWEKeyManagementMode(mode);
-  }
-  parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
-  let protectedHeaderS, protectedHeaderB;
-  protectedHeader ? (protectedHeaderS = b64u(JSON.stringify(protectedHeader)), protectedHeaderB = encode(protectedHeaderS)) : (protectedHeaderS = "", protectedHeaderB = new Uint8Array());
-  let additionalData, aadMember;
-  aad?.byteLength ? (aadMember = b64u(aad), additionalData = concat(protectedHeaderB, encode("."), encode(aadMember))) : additionalData = protectedHeaderB;
+  const algEntry = selected ?? jweAlgorithm(joseHeader.alg);
+  let encryptedKey, parameters, cek;
+  algEntry.mode === "integrated-encryption" ? cek = await prepareKey(algEntry, key, "encrypt") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
+  const protectedHeaderS = protectedHeader ? b64u(JSON.stringify(protectedHeader)) : "", aadMember = aad?.byteLength ? b64u(aad) : void 0, additionalData = encode(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);
   let plaintext = inputPlaintext;
   joseHeader.zip === "DEF" && (plaintext = await compress(plaintext).catch((cause) => {
     throw new JWEInvalid("Failed to compress plaintext", { cause });
   }));
   let ciphertext, tag, iv;
-  algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(integratedKey, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
+  algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
   const jwe = {
     ciphertext: b64u(ciphertext)
   };
   return iv && (jwe.iv = b64u(iv)), tag && (jwe.tag = b64u(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = b64u(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
 }
 async function createJWE(input, key, options) {
-  if (!input[1] && !input[2] && !input[3])
-    throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
-  return options !== void 0 && (input[8] = options?.crit, input[9] = options ? unprotected in options : !1), encryptJWE(input, checkEncryptHeaders(input), key);
+  return encryptJWE(input, checkEncryptHeaders(input, options), key);
+}
+function compactJWE(jwe) {
+  return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
 }
 export {
   checkDisjoint,
   checkEncryptHeaders,
+  compactJWE,
   createJWE,
-  encryptJWE,
-  transportCek
+  encryptJWE
 };

package/node_modules/jose/dist/webapi/lib/jws_sign.js

@@ -1,58 +1,44 @@
 import { encode as b64u } from "../util/base64url.js";
-import { sign } from "./signing.js";
 import { jwsAlgorithm } from "./jws_algorithms.js";
-import { isDisjoint } from "./type_checks.js";
+import { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from "./validate.js";
 import { JWSInvalid } from "../util/errors.js";
-import { concat, encode } from "./buffer_utils.js";
-import { serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from "./options.js";
-import { prepareKey } from "./key.js";
-function serializeProtectedHeader(protectedHeader) {
-  if (protectedHeader === void 0)
-    return [void 0, ""];
-  const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-  return [normalized[0], b64u(normalized[1])];
-}
-function validateSignatureHeader(protectedHeader, joseHeader, crit) {
-  return validateCritDuplicates(JWSInvalid, protectedHeader), validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-}
-function signatureAlgorithm(joseHeader) {
-  const alg = joseHeader.alg;
-  if (typeof alg != "string" || !alg)
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  return jwsAlgorithm(alg);
-}
-async function signSignature(protectedHeader, payload, entry, key) {
-  const data = concat(encode(protectedHeader), encode("."), payload), k = await prepareKey(entry, key, "sign");
-  return b64u(await sign(entry, k, data));
-}
-async function createSignature(input, key, assertB64) {
-  let { protectedHeader, unprotectedHeader } = input, protectedHeaderString;
-  if ([protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+import { concat, encode, encoder } from "./buffer_utils.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
     throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
   if (!isDisjoint(protectedHeader, unprotectedHeader))
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const joseHeader = { ...protectedHeader, ...unprotectedHeader }, b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
-  assertB64?.(b64);
-  const entry = signatureAlgorithm(joseHeader);
-  let payloadS, payloadB;
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
   if (b64) {
-    const encoded = input.encoded ??= [];
-    encoded[0] ??= b64u(input.payload), encoded[1] ??= encode(encoded[0]), payloadS = encoded[0], payloadB = encoded[1];
-  } else
-    payloadB = input.payload, payloadS = "";
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
   const jws = {
-    signature: await signSignature(protectedHeaderString, payloadB, entry, key),
+    signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
     payload: payloadS
   };
   return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
 }
-async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
-  const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
-  if (!protectedHeader)
-    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-  validateSignatureHeader(protectedHeader, protectedHeader, inputCrit) || rejectUnencoded();
-  const entry = signatureAlgorithm(protectedHeader), encodedPayload = b64u(payload), signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
-  return `${protectedHeaderString}.${encodedPayload}.${signature}`;
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
 }
 export {
   createCompactSignature,

package/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -1,46 +1,30 @@
-import { verify } from "./signing.js";
 import { jwsAlgorithm } from "./jws_algorithms.js";
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from "../util/errors.js";
 import { concat, decoder, encoder, encode } from "./buffer_utils.js";
-import { decodeBase64url, encodeBase64url, parseJoseHeader } from "./helpers.js";
-import { isDisjoint, isObject } from "./type_checks.js";
-import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from "./options.js";
-import { prepareKey } from "./key.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from "./validate.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
 function snapshotJws(jws, sharedPayload) {
   const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
   let payload = sharedPayload ? sharedPayload[0] : jws.payload;
   !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));
   const signature = jws.signature, snapshot = { payload, signature };
-  return encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), snapshot;
-}
-function verifyResult(jws, verified) {
-  const [payload, parsedProt, , key, resolvedKey] = verified, result = { payload };
-  return jws.protected !== void 0 && (result.protectedHeader = parsedProt), jws.header !== void 0 && (result.unprotectedHeader = jws.header), resolvedKey ? { ...result, key } : result;
+  if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)
+    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+  if (encodedProtected !== void 0 && typeof encodedProtected != "string")
+    throw new JWSInvalid("JWS Protected Header incorrect type");
+  if (payload === void 0)
+    throw new JWSInvalid("JWS Payload missing");
+  if (typeof signature != "string")
+    throw new JWSInvalid("JWS Signature missing or incorrect type");
+  if (header !== void 0 && !isObject(header))
+    throw new JWSInvalid("JWS Unprotected Header incorrect type");
+  return snapshot;
 }
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
-  return parsedProtected;
-}
-function validateJwsHeaders(parsedProt, joseHeader, shared) {
-  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), alg = joseHeader.alg;
-  if (typeof alg != "string" || !alg)
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (shared[0] && !shared[0].has(alg))
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-  return [b64, alg];
-}
-function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
-  const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
-  let joseHeader;
-  if (header !== void 0) {
-    if (!isDisjoint(parsedProt, header))
-      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-    joseHeader = { ...parsedProt, ...header };
-  } else
-    joseHeader = parsedProt;
-  return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
 }
 function encodeJsonUnencodedPayload(payload) {
   const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
@@ -55,23 +39,34 @@ function encodeCompactUnencodedPayload(payload) {
     throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
   }
 }
-async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
-  let resolvedKey = !1;
-  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
-  const b64 = typeof signingPayload == "string", entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify");
-  if (!await verify(entry, k, signature, data))
-    throw new JWSSignatureVerificationFailed();
-  return [b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload, parsedProt, b64, k, resolvedKey];
-}
 async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws, [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
   if (b64) {
     if (typeof inputPayload != "string")
       throw new JWSInvalid("JWS Payload must be a string");
   } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
     throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-  return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
+  let resolvedKey = !1;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = !1;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
@@ -79,16 +74,13 @@ async function verifyCompact(jws, shared, key) {
   const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
   if (length !== 3)
     throw new JWSInvalid("Invalid Compact JWS");
-  const compactJws = { payload, protected: protectedHeader, signature }, parsedProt = parseProtectedHeader(protectedHeader), [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared), signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
-  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
 }
 export {
   encodeJsonUnencodedPayload,
-  parseJwsHeaders,
   parseProtectedHeader,
   prepareVerify,
   snapshotJws,
   verifyCompact,
-  verifyResult,
   verifySignature
 };

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -1,6 +1,6 @@
 import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "../util/errors.js";
 import { encoder, strictDecoder } from "./buffer_utils.js";
-import { isObject } from "./type_checks.js";
+import { isObject } from "./validate.js";
 const epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
   s: 1,
   m: 60,