@psnext/slingcli 3.5.20261007-3 → 3.5.20261019-1

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -16,8 +16,8 @@ function secs(str) {
   typeof str != "string" && invalidDuration();
   const matched = REGEX.exec(str);
   (!matched || matched[4] && matched[1]) && invalidDuration();
-  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+  const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -durationSeconds : durationSeconds;
 }
 function validateInput(label, input) {
   if (!Number.isFinite(input))
@@ -39,34 +39,35 @@ const normalizeTyp = (value) => {
   const normalized = value.toLowerCase();
   return value.includes("/") ? normalized : `application/${normalized}`;
 }, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
-function validateNumericDate(payload, claim, required = !1) {
-  const value = payload[claim];
+function validateNumericDate(claimsSet, claim, required = !1) {
+  const value = claimsSet[claim];
   if (!(value === void 0 && !required)) {
     if (typeof value != "number")
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, claimsSet, claim, "invalid");
     return value;
   }
 }
-function unexpectedClaim(payload, claim) {
-  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+function unexpectedClaim(claimsSet, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, claimsSet, claim, checkFailed);
 }
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-  let payload;
+function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
+  let claimsSet;
   try {
-    payload = JSON.parse(strictDecoder.decode(encodedPayload));
-  } catch {
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object", { cause });
   }
-  if (!isObject(payload))
+  if (!isObject(claimsSet))
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   const { typ } = options;
   if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
-    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', claimsSet, "typ", checkFailed);
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
   maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
   for (const claim of new Set(presenceCheck.reverse()))
-    if (!Object.hasOwn(payload, claim))
-      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+    if (!Object.hasOwn(claimsSet, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claimsSet, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, "iss"), subject !== void 0 && claimsSet.sub !== subject && unexpectedClaim(claimsSet, "sub"), audience !== void 0 && !checkAudiencePresence(claimsSet.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(claimsSet, "aud");
   const { clockTolerance } = options;
   let tolerance = 0;
   if (typeof clockTolerance == "string")
@@ -77,70 +78,70 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     tolerance = clockTolerance;
   }
   validateInput("clockTolerance option", tolerance);
-  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
-    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-  const exp = validateNumericDate(payload, "exp");
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);
+  const exp = validateNumericDate(claimsSet, "exp");
   if (exp !== void 0 && exp <= now - tolerance)
-    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    throw new JWTExpired('"exp" claim timestamp check failed', claimsSet, "exp", checkFailed);
   if (maxTokenAge !== void 0) {
     const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max)
-      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', claimsSet, "iat", checkFailed);
     if (age < -tolerance)
-      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', claimsSet, "iat", checkFailed);
   }
-  return payload;
+  return claimsSet;
 }
-let producerPayloads;
-function producerPayload(producer) {
-  return producerPayloads.get(producer);
+let producerClaimsSets;
+function producerClaimsSet(producer) {
+  return producerClaimsSets.get(producer);
 }
-function jwtData(producer) {
-  const payload = producerPayload(producer);
+function jwtClaimsSetBytes(producer) {
+  const claimsSet = producerClaimsSet(producer);
   for (const claim of ["iat", "nbf", "exp"]) {
-    const value = payload[claim];
+    const value = claimsSet[claim];
     if (typeof value == "number" && !Number.isFinite(value))
       throw new TypeError(`"${claim}" claim must be a finite number`);
   }
-  return encoder.encode(JSON.stringify(payload));
+  return encoder.encode(JSON.stringify(claimsSet));
 }
 function jwtClaim(producer, claim) {
-  return producerPayload(producer)[claim];
+  return producerClaimsSet(producer)[claim];
 }
 class JWTClaimsBuilder {
-  constructor(payload = {}) {
-    if (!isObject(payload))
+  constructor(claimsSet = {}) {
+    if (!isObject(claimsSet))
       throw new TypeError("JWT Claims Set MUST be an object");
-    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+    (producerClaimsSets ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(claimsSet));
   }
   setIssuer(value) {
-    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+    return validateStringClaim("iss", value), producerClaimsSet(this).iss = value, this;
   }
   setSubject(value) {
-    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+    return validateStringClaim("sub", value), producerClaimsSet(this).sub = value, this;
   }
   setAudience(value) {
-    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+    return validateAudienceClaim(value), producerClaimsSet(this).aud = value, this;
   }
   setJti(value) {
-    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+    return validateStringClaim("jti", value), producerClaimsSet(this).jti = value, this;
   }
   setNotBefore(value) {
-    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+    return producerClaimsSet(this).nbf = numericDate(value, "setNotBefore"), this;
   }
   setExpirationTime(value) {
-    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+    return producerClaimsSet(this).exp = numericDate(value, "setExpirationTime"), this;
   }
   setIssuedAt(value) {
-    const payload = producerPayload(this);
-    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+    const claimsSet = producerClaimsSet(this);
+    return value === void 0 ? claimsSet.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? claimsSet.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : claimsSet.iat = numericDate(value, "setIssuedAt"), this;
   }
 }
 export {
   JWTClaimsBuilder,
   jwtClaim,
-  jwtData,
+  jwtClaimsSetBytes,
   secs,
   validateClaimsSet
 };

package/node_modules/jose/dist/webapi/lib/key.js

@@ -17,15 +17,15 @@ const tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage)
   }
 };
 async function prepareKey(entry, key, usage) {
-  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  const { alg, secret } = entry, requiresPrivateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return key;
   let normalized, keyObject;
   if (isObject(key)) {
     if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
       throw invalidKeyType(alg, key, secret);
-    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
-      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (requiresPrivateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? "private" : "public"} JWK`);
     if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
       return decode(normalized.k);
     if (!Object.isFrozen(key)) {
@@ -35,7 +35,7 @@ async function prepareKey(entry, key, usage) {
   } else {
     if (!isKeyLike(key))
       throw invalidKeyType(alg, key, secret);
-    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    const expectedType = secret ? "secret" : requiresPrivateKey ? "private" : "public";
     if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
       throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
     if (isCryptoKey(key))

package/node_modules/jose/dist/webapi/lib/key_management.js

@@ -26,32 +26,32 @@ async function deriveKey(p2s, alg, p2c, key) {
     throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");
   if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1)
     throw new JWEInvalid("PBES2 Count Input must be a positive integer");
-  const salt = concat(encode(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {
+  const salt = concat(encode(alg), Uint8Array.of(0), p2s), keyLengthBits = parseInt(alg.slice(13, 16), 10), subtleAlg = {
     hash: `SHA-${alg.slice(8, 11)}`,
     iterations: p2c,
     name: "PBKDF2",
     salt
   }, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "deriveBits");
-  return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+  return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keyLengthBits));
 }
 function lengthAndInput(input) {
   return concat(uint32be(input.length), input);
 }
-async function concatKdf(Z, L, OtherInfo) {
-  const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
+async function concatKdf(Z, keyDataLength, OtherInfo) {
+  const dkLen = keyDataLength >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
   for (let i = 1; i <= reps; i++) {
     const hashResult = await digest("sha256", concat(uint32be(i), Z, OtherInfo));
     dk.set(hashResult, (i - 1) * hashLen);
   }
   return dk.slice(0, dkLen);
 }
-async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
+async function ecdhesDeriveKey(publicKey, privateKey, algorithmId, keyDataLength, apu = new Uint8Array(), apv = new Uint8Array()) {
   checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, "deriveBits");
-  const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({
+  const otherInfo = concat(lengthAndInput(encode(algorithmId)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyDataLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({
     name: publicKey.algorithm.name,
     public: publicKey
   }, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
-  return concatKdf(Z, keyLength, otherInfo);
+  return concatKdf(Z, keyDataLength, otherInfo);
 }
 function assertEcdhKey(key) {
   assertCryptoKey(key);
@@ -100,10 +100,10 @@ async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, m
       assertEcdhKey(key);
       const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, "apu"), partyVInfo = partyInfo(joseHeader, "apv");
       checkPartyInfo(partyUInfo, partyVInfo);
-      const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+      const derivedKey = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
       if (direct)
-        return sharedSecret;
-      key = sharedSecret;
+        return derivedKey;
+      key = derivedKey;
       break;
     }
     case "RSA-OAEP":
@@ -153,19 +153,19 @@ async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCe
       providedApu !== void 0 && assertUint8Array(providedApu, '"apu"'), providedApv !== void 0 && assertUint8Array(providedApv, '"apv"');
       const apu = providedApu ?? partyInfo(joseHeader, "apu"), apv = providedApv ?? partyInfo(joseHeader, "apv");
       checkPartyInfo(apu, apv);
-      let ephemeralKey;
-      providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
+      let ephemeralPrivateKey;
+      providedParameters.epk !== void 0 ? ephemeralPrivateKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralPrivateKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
       const subtle = crypto.subtle;
-      let exportableEpk = ephemeralKey;
+      let exportableEpk = ephemeralPrivateKey;
       if (!exportableEpk.extractable) {
         if (typeof subtle.getPublicKey != "function")
           throw new TypeError('CryptoKey for "epk" must be extractable');
-        exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+        exportableEpk = await subtle.getPublicKey(ephemeralPrivateKey, []);
       }
-      const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };
+      const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", derivedKey = await ecdhesDeriveKey(key, ephemeralPrivateKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };
       if (kty === "EC" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = b64u(providedApu)), providedApv !== void 0 && (parameters.apv = b64u(providedApv)), direct)
-        return [sharedSecret, void 0, parameters];
-      key = sharedSecret;
+        return [derivedKey, void 0, parameters];
+      key = derivedKey;
       break;
     }
     case "RSA-OAEP": {

package/node_modules/jose/dist/webapi/lib/validate.js

@@ -32,23 +32,23 @@ function assertNotSet(value, name) {
 function decodeBase64url(value, label, ErrorClass) {
   try {
     return decode(value);
-  } catch {
-    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  } catch (cause) {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });
   }
 }
-function encodeBase64url(value, label, ErrorClass) {
+function encodeAsciiMember(value, label, ErrorClass) {
   try {
     return encode(value);
-  } catch {
-    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  } catch (cause) {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });
   }
 }
-function parseJoseHeader(b64, ErrorClass, message) {
+function parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {
   let parsed;
   try {
-    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-  } catch {
-    throw new ErrorClass(message);
+    parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));
+  } catch (cause) {
+    throw new ErrorClass(message, { cause });
   }
   if (!isObject(parsed))
     throw new ErrorClass(message);
@@ -109,7 +109,7 @@ export {
   assertNotSet,
   assertUint8Array,
   decodeBase64url,
-  encodeBase64url,
+  encodeAsciiMember,
   isDisjoint,
   isJwkSet,
   isObject,

package/node_modules/jose/dist/webapi/util/decode_jwt.js

@@ -5,28 +5,28 @@ import { JWTInvalid } from "./errors.js";
 function decodeJwt(jwt) {
   if (typeof jwt != "string")
     throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
-  const { 1: payload, length } = jwt.split(".");
+  const { 1: encodedPayload, length } = jwt.split(".");
   if (length === 5)
     throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
   if (length !== 3)
     throw new JWTInvalid("Invalid JWT");
-  if (!payload)
+  if (!encodedPayload)
     throw new JWTInvalid("JWTs must contain a payload");
-  let decoded;
+  let claimsSetBytes;
   try {
-    decoded = b64u(payload);
-  } catch {
-    throw new JWTInvalid("Failed to base64url decode the payload");
+    claimsSetBytes = b64u(encodedPayload);
+  } catch (cause) {
+    throw new JWTInvalid("Failed to base64url decode the payload", { cause });
   }
-  let result;
+  let claimsSet;
   try {
-    result = JSON.parse(strictDecoder.decode(decoded));
-  } catch {
-    throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+    claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));
+  } catch (cause) {
+    throw new JWTInvalid("Failed to parse the decoded payload as JSON", { cause });
   }
-  if (!isObject(result))
+  if (!isObject(claimsSet))
     throw new JWTInvalid("Invalid JWT Claims Set");
-  return result;
+  return claimsSet;
 }
 export {
   decodeJwt

package/node_modules/jose/dist/webapi/util/decode_protected_header.js

@@ -1,18 +1,18 @@
 import { parseJoseHeader } from "../lib/validate.js";
 function decodeProtectedHeader(token) {
-  let protectedB64u;
+  let encodedProtectedHeader;
   if (typeof token == "string") {
     const parts = token.split(".");
-    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+    (parts.length === 3 || parts.length === 5) && ([encodedProtectedHeader] = parts);
   } else if (typeof token == "object" && token)
     if ("protected" in token)
-      protectedB64u = token.protected;
+      encodedProtectedHeader = token.protected;
     else
       throw new TypeError("Token does not contain a Protected Header");
   const invalid = "Invalid Token or Protected Header formatting";
-  if (typeof protectedB64u != "string" || !protectedB64u)
+  if (typeof encodedProtectedHeader != "string" || !encodedProtectedHeader)
     throw new TypeError(invalid);
-  return parseJoseHeader(protectedB64u, TypeError, invalid);
+  return parseJoseHeader(encodedProtectedHeader, TypeError, invalid);
 }
 export {
   decodeProtectedHeader

package/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.12",
+  "version": "6.2.13",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking
 

package/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,41 @@
+## **6.16.1**
+ - [Fix] `parse`: do not mutate an object input
+ - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+ - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+ - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+ - [Fix] `stringify`: ignore inherited array format names (#622)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+ - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+ - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+ - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+ - [Perf] `decode`: skip decoders when there is no percent sign (#583)
+ - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+ - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
+ - [Docs] document that `qs` and flat parsers disagree about parameter names
+ - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+ - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+ - [meta] fix changelog indents
+ - [actions] set least-privilege `cache-mode`
+ - [Tests] `utils`: `decode`: add missing cases
+ - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+ - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +53,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text

package/node_modules/qs/README.md

@@ -85,6 +85,23 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
+
+Because of that bracket grammar,
+**qs** does not agree with `URLSearchParams`,
+`node:querystring`, or any other flat parser about what the "name" of a parameter is,
+and it never has.
+`URLSearchParams` reads `'foo[bar]=baz'` as one flat name `foo[bar]`;
+**qs** reads it as the path `foo.bar`.
+Text that **qs**'s grammar cannot place,
+such as the `extra` in `'foo[bar]extra=baz'`,
+is currently dropped, so several distinct flat names can resolve to the same **qs** path
+(see [#619](https://github.com/ljharb/qs/issues/619)).
+
+So validating, authorizing, filtering,
+or signing a query string with one parser and then consuming it with another is unsafe: a deny list or signature computed over `URLSearchParams` names does not constrain what **qs** will produce from the same string.
+Parse the input once, with **qs**, and apply your checks to the resulting object.
+
 By default, when nesting objects **qs** will only parse up to 5 children deep.
 This means if you attempt to parse a string like `'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
 
@@ -135,7 +152,7 @@ var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever the a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -147,7 +164,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -293,6 +310,8 @@ assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
 Any array members with an index of `20` or greater will instead be converted to an object with the index as the key.
 This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
 
+Since v6.14.1 and v6.15.2, the arrayLimit now applies to arrays specified using both the `[]` and `[0]` syntaxes.
+
 ```javascript
 var withMaxIndex = qs.parse('a[100]=b');
 assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
@@ -317,7 +336,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -361,6 +380,15 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
+With `[]` or index notation, the values from each comma-separated group stay together as one element of the array, while repeated plain keys flatten into one array:
+```javascript
+var nestedGroups = qs.parse('a[]=b,c&a[]=d', { comma: true });
+assert.deepEqual(nestedGroups, { a: [['b', 'c'], 'd'] });
+
+var flatGroups = qs.parse('a=b,c&a=d', { comma: true });
+assert.deepEqual(flatGroups, { a: ['b', 'c', 'd'] });
+```
+
 ### Parsing primitive/scalar values (numbers, booleans, null, etc)
 
 By default, all values are parsed as strings.