@auth-craft/aws-cf-stack 1.6.2 → 1.6.3

package/assets/lambda/index.mjs

@@ -1,3 +1,4 @@
+import{createRequire}from'module';const require=createRequire(import.meta.url);
 var rT=Object.create;var Zl=Object.defineProperty;var nT=Object.getOwnPropertyDescriptor;var iT=Object.getOwnPropertyNames;var sT=Object.getPrototypeOf,oT=Object.prototype.hasOwnProperty;var ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e)=>()=>(t&&(e=t(t=0)),e);var he=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Ba=(t,e)=>{for(var r in e)Zl(t,r,{get:e[r],enumerable:!0})},aT=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of iT(e))!oT.call(t,i)&&i!==r&&Zl(t,i,{get:()=>e[i],enumerable:!(n=nT(e,i))||n.enumerable});return t};var Pf=(t,e,r)=>(r=t!=null?rT(sT(t)):{},aT(e||!t||!t.__esModule?Zl(r,"default",{value:t,enumerable:!0}):r,t));function rt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function su(t,e,r){if(e<0||e>=$a)throw new RangeError(`value must be >= 0 and <= ${$a-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function ou(t){let e=Math.floor(t/$a),r=t%$a,n=new Uint8Array(8);return su(n,e,0),su(n,r,4),n}function Wa(t){let e=new Uint8Array(4);return su(e,t),e}function ze(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var Yn,ct,$a,Tt=Q(()=>{Yn=new TextEncoder,ct=new TextDecoder,$a=2**32});function Zs(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function za(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var au=Q(()=>{});var Ja={};Ba(Ja,{decode:()=>dt,encode:()=>De});function dt(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:ct.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=ct.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return za(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function De(t){let e=t;return typeof e=="string"&&(e=Yn.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Zs(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var pt=Q(()=>{Tt();au()});function dT(t){return parseInt(t.name.slice(4),10)}function Ya(t,e){if(dT(t.hash)!==e)throw Dt(`SHA-${e}`,"algorithm.hash")}function pT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function Lf(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function Mf(t,e,r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Pr(t.algorithm,"HMAC"))throw Dt("HMAC");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"RS256":case"RS384":case"RS512":{if(!Pr(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Dt("RSASSA-PKCS1-v1_5");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"PS256":case"PS384":case"PS512":{if(!Pr(t.algorithm,"RSA-PSS"))throw Dt("RSA-PSS");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"Ed25519":case"EdDSA":{if(!Pr(t.algorithm,"Ed25519"))throw Dt("Ed25519");break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{if(!Pr(t.algorithm,e))throw Dt(e);break}case"ES256":case"ES384":case"ES512":{if(!Pr(t.algorithm,"ECDSA"))throw Dt("ECDSA");let n=pT(e);if(t.algorithm.namedCurve!==n)throw Dt(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}function Jt(t,e,r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Pr(t.algorithm,"AES-GCM"))throw Dt("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Pr(t.algorithm,"AES-KW"))throw Dt("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":break;default:throw Dt("ECDH or X25519")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Pr(t.algorithm,"PBKDF2"))throw Dt("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Pr(t.algorithm,"RSA-OAEP"))throw Dt("RSA-OAEP");Ya(t.algorithm,parseInt(e.slice(9),10)||1);break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}var Dt,Pr,Xn=Q(()=>{Dt=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`),Pr=(t,e)=>t.name===e});function Kf(t,e,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var nr,cu,Qn=Q(()=>{nr=(t,...e)=>Kf("Key must be ",t,...e),cu=(t,e,...r)=>Kf(`Key for the ${t} algorithm must be `,e,...r)});var lu={};Ba(lu,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>nt,JOSENotSupported:()=>re,JWEDecryptionFailed:()=>Zr,JWEInvalid:()=>q,JWKInvalid:()=>eo,JWKSInvalid:()=>Ki,JWKSMultipleMatchingKeys:()=>to,JWKSNoMatchingKey:()=>Zn,JWKSTimeout:()=>ro,JWSInvalid:()=>Ee,JWSSignatureVerificationFailed:()=>ei,JWTClaimValidationFailed:()=>ft,JWTExpired:()=>Mi,JWTInvalid:()=>Xe});var nt,ft,Mi,Tn,re,Zr,q,Ee,Xe,eo,Ki,Zn,to,ro,ei,Te=Q(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Mi=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},re=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Zr=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},q=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},Ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},Xe=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},eo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},Ki=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},Zn=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},to=class extends nt{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ro=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},ei=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function Hi(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,ti,no,In=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ti=t=>t?.[Symbol.toStringTag]==="KeyObject",no=t=>hr(t)||ti(t)});function Qa(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Xa(t,e){let r=t.byteLength<<3;if(r!==e)throw new q(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Hf(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Ff(t,e){if(e.length<<3!==Hf(t))throw new q("Invalid Initialization Vector length")}async function Vf(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(nr(e,"Uint8Array"));let n=parseInt(t.slice(1,4),10),i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return{encKey:i,macKey:s,keySize:n}}async function Bf(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function mT(t,e,r,n,i){let{encKey:s,macKey:o,keySize:a}=await Vf(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=rt(i,n,c,ou(i.length<<3)),d=await Bf(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function hT(t,e){if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign(r,n,t)),s=new Uint8Array(await crypto.subtle.sign(r,n,e)),o=0,a=-1;for(;++a<32;)o|=i[a]^s[a];return o===0}async function ET(t,e,r,n,i,s){let{encKey:o,macKey:a,keySize:c}=await Vf(t,e,"decrypt"),l=rt(s,n,r,ou(s.length<<3)),d=await Bf(a,l,c),p;try{p=await hT(i,d)}catch{}if(!p)throw new Zr;let m;try{m=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!m)throw new Zr;return m}async function yT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Jt(r,t,"encrypt"),s=r);let o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function gT(t,e,r,n,i,s){let o;e instanceof Uint8Array?o=await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Jt(e,t,"decrypt"),o=e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,rt(r,i)))}catch{throw new Zr}}async function Za(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(nr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));switch(n?Ff(t,n):n=fT(t),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(-3),10)),mT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(1,4),10)),yT(t,e,r,n,i);default:throw new re(qf)}}async function ec(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(nr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new q("JWE Initialization Vector missing");if(!i)throw new q("JWE Authentication Tag missing");switch(Ff(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(-3),10)),ET(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(1,4),10)),gT(t,e,r,n,i,s);default:throw new re(qf)}}var Ur,fT,qf,ri=Q(()=>{Tt();Xn();Qn();Te();In();Ur=t=>crypto.getRandomValues(new Uint8Array(Qa(t)>>3));fT=t=>crypto.getRandomValues(new Uint8Array(Hf(t)>>3));qf="Unsupported JWE Content Encryption Algorithm"});function Ge(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function Pt(t,e,r){try{return dt(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}async function rc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var tc,Er=Q(()=>{pt();tc=Symbol()});function be(t){if(!vT(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function Lr(...t){let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0}var vT,ni,jf,Gf,$f,Qe=Q(()=>{vT=t=>typeof t=="object"&&t!==null;ni=t=>be(t)&&typeof t.kty=="string",jf=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Gf=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,$f=t=>t.kty==="oct"&&typeof t.k=="string"});function Wf(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function zf(t,e,r){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):(Jt(t,e,r),t)}async function io(t,e,r){let n=await zf(e,t,"wrapKey");Wf(n,t);let i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function so(t,e,r){let n=await zf(e,t,"unwrapKey");Wf(n,t);let i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}var uu=Q(()=>{Xn()});function du(t){return rt(Wa(t.length),t)}async function TT(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=new Uint8Array(4+t.length+r.length);c.set(Wa(a),0),c.set(t,4),c.set(r,4+t.length);let l=await rc("sha256",c);o.set(l,(a-1)*i)}return o.slice(0,n)}async function pu(t,e,r,n,i=new Uint8Array,s=new Uint8Array){Jt(t,"ECDH"),Jt(e,"ECDH","deriveBits");let o=du(ze(r)),a=du(i),c=du(s),l=Wa(n),d=new Uint8Array,p=rt(o,a,c,l,d),m=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,IT(t)));return TT(m,n,p)}function IT(t){return t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3}function fu(t){switch(t.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return t.algorithm.name==="X25519"}}var Yf=Q(()=>{Tt();Xn();Er()});function xT(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Jt(t,e,"deriveBits"),t)}async function Xf(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new q("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new q("PBES2 Count Input must be a positive integer");let i=bT(e,t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await xT(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}async function Qf(t,e,r,n=2048,i=crypto.getRandomValues(new Uint8Array(16))){let s=await Xf(i,t,n,e);return{encryptedKey:await io(t.slice(-6),s,r),p2c:n,p2s:De(i)}}async function Zf(t,e,r,n,i){let s=await Xf(i,t,n,e);return so(t.slice(-6),s,r)}var bT,em=Q(()=>{pt();uu();Xn();Tt();Te();bT=(t,e)=>rt(ze(t),Uint8Array.of(0),e)});function oo(t,e){if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}}function tm(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:parseInt(t.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:t};default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}async function rm(t,e,r){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(nr(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}return Mf(e,t,r),e}async function nm(t,e,r){let n=await rm(t,e,"sign");oo(t,n);let i=await crypto.subtle.sign(tm(t,n.algorithm),n,r);return new Uint8Array(i)}async function im(t,e,r,n){let i=await rm(t,e,"verify");oo(t,i);let s=tm(t,i.algorithm);try{return await crypto.subtle.verify(s,i,r,n)}catch{return!1}}var nc=Q(()=>{Te();Xn();Qn()});async function om(t,e,r){return Jt(e,t,"encrypt"),oo(t,e),new Uint8Array(await crypto.subtle.encrypt(sm(t),e,r))}async function am(t,e,r){return Jt(e,t,"decrypt"),oo(t,e),new Uint8Array(await crypto.subtle.decrypt(sm(t),e,r))}var sm,cm=Q(()=>{Xn();nc();Te();sm=t=>{switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}});function wT(t){let e,r;switch(t.kty){case"AKP":{switch(t.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:t.alg},r=t.priv?["sign"]:["verify"];break;default:throw new re(ic)}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new re(ic)}break}case"EC":{switch(t.alg){case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t.alg]},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}case"OKP":{switch(t.alg){case"Ed25519":case"EdDSA":e={name:"Ed25519"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}default:throw new re('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}async function Fi(t){if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:e,keyUsages:r}=wT(t),n={...t};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,e,t.ext??!(t.d||t.priv),t.key_ops??r)}var ic,mu=Q(()=>{Te();ic='Invalid or unsupported JWK "alg" (Algorithm) Parameter value'});async function ir(t,e){if(t instanceof Uint8Array||hr(t))return t;if(ti(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return RT(t,e)}catch(n){if(n instanceof TypeError)throw n}let r=t.export({format:"jwk"});return lm(t,r,e)}if(ni(t))return t.k?dt(t.k):lm(t,t,e,!0);throw new Error("unreachable")}var Vi,Bi,lm,RT,ii=Q(()=>{Qe();pt();mu();In();Vi="given KeyObject instance cannot be used for this algorithm",lm=async(t,e,r,n=!1)=>{Bi||=new WeakMap;let i=Bi.get(t);if(i?.[r])return i[r];let s=await Fi({...e,alg:r});return n&&Object.freeze(t),i?i[r]=s:Bi.set(t,{[r]:s}),s},RT=(t,e)=>{Bi||=new WeakMap;let r=Bi.get(t);if(r?.[e])return r[e];let n=t.type==="public",i=!!n,s;if(t.asymmetricKeyType==="x25519"){switch(e){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Vi)}s=t.toCryptoKey(t.asymmetricKeyType,i,n?[]:["deriveBits"])}if(t.asymmetricKeyType==="ed25519"){if(e!=="EdDSA"&&e!=="Ed25519")throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}switch(t.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":{if(e!==t.asymmetricKeyType.toUpperCase())throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}}if(t.asymmetricKeyType==="rsa"){let o;switch(e){case"RSA-OAEP":o="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":o="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":o="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError(Vi)}if(e.startsWith("RSA-OAEP"))return t.toCryptoKey({name:"RSA-OAEP",hash:o},i,n?["encrypt"]:["decrypt"]);s=t.toCryptoKey({name:e.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},i,[n?"verify":"sign"])}if(t.asymmetricKeyType==="ec"){let a=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(t.asymmetricKeyDetails?.namedCurve);if(!a)throw new TypeError(Vi);let c={ES256:"P-256",ES384:"P-384",ES512:"P-521"};c[e]&&a===c[e]&&(s=t.toCryptoKey({name:"ECDSA",namedCurve:a},i,[n?"verify":"sign"])),e.startsWith("ECDH-ES")&&(s=t.toCryptoKey({name:"ECDH",namedCurve:a},i,n?[]:["deriveBits"]))}if(!s)throw new TypeError(Vi);return r?r[e]=s:Bi.set(t,{[e]:s}),s}});function kT(t){Mr(t,48,"Invalid PKCS#8 structure"),yr(t),Mr(t,2,"Expected version field");let e=yr(t);t.pos+=e,Mr(t,48,"Expected algorithm identifier");let r=yr(t);return{algIdStart:t.pos,algIdLength:r}}function CT(t){Mr(t,48,"Invalid SPKI structure"),yr(t),Mr(t,48,"Expected algorithm identifier");let e=yr(t);return{algIdStart:t.pos,algIdLength:e}}function DT(t){let e=yu(t);Mr(e,48,"Invalid certificate structure"),yr(e),Mr(e,48,"Invalid tbsCertificate structure"),yr(e),t[e.pos]===160?Eu(e,6):Eu(e,5);let r=e.pos;Mr(e,48,"Invalid SPKI structure");let n=yr(e);return t.subarray(r,r+n+(e.pos-r))}function PT(t){let e=gu(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);return DT(e)}var um,dm,pm,fm,hu,yu,yr,Eu,Mr,mm,OT,hm,Em,gu,ym,vu,gm,Au=Q(()=>{Qn();au();Te();In();um=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
 `);return`-----BEGIN ${e}-----
 ${r}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {