@collective-intelligence/external-apps-server-sdk 0.1.4 → 0.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +157 -6
  2. package/dist/admin.d.ts +12 -0
  3. package/dist/auth/federated.d.ts +4 -0
  4. package/dist/auth/federated.js +1 -1
  5. package/dist/gateway.js +1 -1
  6. package/dist/index.d.ts +124 -0
  7. package/dist/index.js +1 -1
  8. package/dist/persistence/drizzle.d.ts +4 -0
  9. package/dist/persistence/drizzle.js +1 -1
  10. package/dist/runtime/effect.js +1 -1
  11. package/dist/tools/ai-sdk.js +1 -1
  12. package/package.json +1 -1
package/dist/auth/federated.js CHANGED
@@ -5,4 +5,4 @@ var __create=Object.create;var __getProtoOf=Object.getPrototypeOf;var __defProp=
5
5
  || ${dataType} === "boolean" || ${data} === null`).assign(coerced,(0,codegen_1._)`[${data}]`)}}}function assignParentData({gen,parentData,parentDataProperty},expr){gen.if((0,codegen_1._)`${parentData} !== undefined`,()=>gen.assign((0,codegen_1._)`${parentData}[${parentDataProperty}]`,expr))}function checkDataType(dataType,data,strictNums,correct=DataType.Correct){const EQ=correct===DataType.Correct?codegen_1.operators.EQ:codegen_1.operators.NEQ;let cond;switch(dataType){case"null":return(0,codegen_1._)`${data} ${EQ} null`;case"array":cond=(0,codegen_1._)`Array.isArray(${data})`;break;case"object":cond=(0,codegen_1._)`${data} && typeof ${data} == "object" && !Array.isArray(${data})`;break;case"integer":cond=numCond((0,codegen_1._)`!(${data} % 1) && !isNaN(${data})`);break;case"number":cond=numCond();break;default:return(0,codegen_1._)`typeof ${data} ${EQ} ${dataType}`}return correct===DataType.Correct?cond:(0,codegen_1.not)(cond);function numCond(_cond=codegen_1.nil){return(0,codegen_1.and)((0,codegen_1._)`typeof ${data} == "number"`,_cond,strictNums?(0,codegen_1._)`isFinite(${data})`:codegen_1.nil)}}exports.checkDataType=checkDataType;function checkDataTypes(dataTypes,data,strictNums,correct){if(dataTypes.length===1){return checkDataType(dataTypes[0],data,strictNums,correct)}let cond;const types=(0,util_1.toHash)(dataTypes);if(types.array&&types.object){const notObj=(0,codegen_1._)`typeof ${data} != "object"`;cond=types.null?notObj:(0,codegen_1._)`!${data} || ${notObj}`;delete types.null;delete types.array;delete types.object}else{cond=codegen_1.nil}if(types.number)delete types.integer;for(const t in types)cond=(0,codegen_1.and)(cond,checkDataType(t,data,strictNums,correct));return cond}exports.checkDataTypes=checkDataTypes;var typeError={message:({schema})=>`must be ${schema}`,params:({schema,schemaValue})=>typeof schema=="string"?(0,codegen_1._)`{type: ${schema}}`:(0,codegen_1._)`{type: ${schemaValue}}`};function reportTypeError(it){const cxt=getTypeErrorContext(it);(0,errors_1.reportError)(cxt,typeError)}exports.reportTypeError=reportTypeError;function getTypeErrorContext(it){const{gen,data,schema}=it;const schemaCode=(0,util_1.schemaRefOrVal)(it,schema,"type");return{gen,keyword:"type",data,schema:schema.type,schemaCode,schemaValue:schemaCode,parentSchema:schema,params:{},it}}});var require_defaults=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.assignDefaults=undefined;var codegen_1=require_codegen();var util_1=require_util();function assignDefaults(it,ty){const{properties,items}=it.schema;if(ty==="object"&&properties){for(const key in properties){assignDefault(it,key,properties[key].default)}}else if(ty==="array"&&Array.isArray(items)){items.forEach((sch,i)=>assignDefault(it,i,sch.default))}}exports.assignDefaults=assignDefaults;function assignDefault(it,prop,defaultValue){const{gen,compositeRule,data,opts}=it;if(defaultValue===undefined)return;const childData=(0,codegen_1._)`${data}${(0,codegen_1.getProperty)(prop)}`;if(compositeRule){(0,util_1.checkStrictMode)(it,`default is ignored for: ${childData}`);return}let condition=(0,codegen_1._)`${childData} === undefined`;if(opts.useDefaults==="empty"){condition=(0,codegen_1._)`${condition} || ${childData} === null || ${childData} === ""`}gen.if(condition,(0,codegen_1._)`${childData} = ${(0,codegen_1.stringify)(defaultValue)}`)}});var require_code2=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.validateUnion=exports.validateArray=exports.usePattern=exports.callValidateCode=exports.schemaProperties=exports.allSchemaProperties=exports.noPropertyInData=exports.propertyInData=exports.isOwnProperty=exports.hasPropFunc=exports.reportMissingProp=exports.checkMissingProp=exports.checkReportMissingProp=undefined;var codegen_1=require_codegen();var util_1=require_util();var names_1=require_names();var util_2=require_util();function checkReportMissingProp(cxt,prop){const{gen,data,it}=cxt;gen.if(noPropertyInData(gen,data,prop,it.opts.ownProperties),()=>{cxt.setParams({missingProperty:(0,codegen_1._)`${prop}`},true);cxt.error()})}exports.checkReportMissingProp=checkReportMissingProp;function checkMissingProp({gen,data,it:{opts}},properties,missing){return(0,codegen_1.or)(...properties.map((prop)=>(0,codegen_1.and)(noPropertyInData(gen,data,prop,opts.ownProperties),(0,codegen_1._)`${missing} = ${prop}`)))}exports.checkMissingProp=checkMissingProp;function reportMissingProp(cxt,missing){cxt.setParams({missingProperty:missing},true);cxt.error()}exports.reportMissingProp=reportMissingProp;function hasPropFunc(gen){return gen.scopeValue("func",{ref:Object.prototype.hasOwnProperty,code:(0,codegen_1._)`Object.prototype.hasOwnProperty`})}exports.hasPropFunc=hasPropFunc;function isOwnProperty(gen,data,property){return(0,codegen_1._)`${hasPropFunc(gen)}.call(${data}, ${property})`}exports.isOwnProperty=isOwnProperty;function propertyInData(gen,data,property,ownProperties){const cond=(0,codegen_1._)`${data}${(0,codegen_1.getProperty)(property)} !== undefined`;return ownProperties?(0,codegen_1._)`${cond} && ${isOwnProperty(gen,data,property)}`:cond}exports.propertyInData=propertyInData;function noPropertyInData(gen,data,property,ownProperties){const cond=(0,codegen_1._)`${data}${(0,codegen_1.getProperty)(property)} === undefined`;return ownProperties?(0,codegen_1.or)(cond,(0,codegen_1.not)(isOwnProperty(gen,data,property))):cond}exports.noPropertyInData=noPropertyInData;function allSchemaProperties(schemaMap){return schemaMap?Object.keys(schemaMap).filter((p)=>p!=="__proto__"):[]}exports.allSchemaProperties=allSchemaProperties;function schemaProperties(it,schemaMap){return allSchemaProperties(schemaMap).filter((p)=>!(0,util_1.alwaysValidSchema)(it,schemaMap[p]))}exports.schemaProperties=schemaProperties;function callValidateCode({schemaCode,data,it:{gen,topSchemaRef,schemaPath,errorPath},it},func,context,passSchema){const dataAndSchema=passSchema?(0,codegen_1._)`${schemaCode}, ${data}, ${topSchemaRef}${schemaPath}`:data;const valCxt=[[names_1.default.instancePath,(0,codegen_1.strConcat)(names_1.default.instancePath,errorPath)],[names_1.default.parentData,it.parentData],[names_1.default.parentDataProperty,it.parentDataProperty],[names_1.default.rootData,names_1.default.rootData]];if(it.opts.dynamicRef)valCxt.push([names_1.default.dynamicAnchors,names_1.default.dynamicAnchors]);const args=(0,codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;return context!==codegen_1.nil?(0,codegen_1._)`${func}.call(${context}, ${args})`:(0,codegen_1._)`${func}(${args})`}exports.callValidateCode=callValidateCode;var newRegExp=(0,codegen_1._)`new RegExp`;function usePattern({gen,it:{opts}},pattern){const u=opts.unicodeRegExp?"u":"";const{regExp}=opts.code;const rx=regExp(pattern,u);return gen.scopeValue("pattern",{key:rx.toString(),ref:rx,code:(0,codegen_1._)`${regExp.code==="new RegExp"?newRegExp:(0,util_2.useFunc)(gen,regExp)}(${pattern}, ${u})`})}exports.usePattern=usePattern;function validateArray(cxt){const{gen,data,keyword,it}=cxt;const valid=gen.name("valid");if(it.allErrors){const validArr=gen.let("valid",true);validateItems(()=>gen.assign(validArr,false));return validArr}gen.var(valid,true);validateItems(()=>gen.break());return valid;function validateItems(notValid){const len=gen.const("len",(0,codegen_1._)`${data}.length`);gen.forRange("i",0,len,(i)=>{cxt.subschema({keyword,dataProp:i,dataPropType:util_1.Type.Num},valid);gen.if((0,codegen_1.not)(valid),notValid)})}}exports.validateArray=validateArray;function validateUnion(cxt){const{gen,schema,keyword,it}=cxt;if(!Array.isArray(schema))throw new Error("ajv implementation error");const alwaysValid=schema.some((sch)=>(0,util_1.alwaysValidSchema)(it,sch));if(alwaysValid&&!it.opts.unevaluated)return;const valid=gen.let("valid",false);const schValid=gen.name("_valid");gen.block(()=>schema.forEach((_sch,i)=>{const schCxt=cxt.subschema({keyword,schemaProp:i,compositeRule:true},schValid);gen.assign(valid,(0,codegen_1._)`${valid} || ${schValid}`);const merged=cxt.mergeValidEvaluated(schCxt,schValid);if(!merged)gen.if((0,codegen_1.not)(valid))}));cxt.result(valid,()=>cxt.reset(),()=>cxt.error(true))}exports.validateUnion=validateUnion});var require_keyword=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.validateKeywordUsage=exports.validSchemaType=exports.funcKeywordCode=exports.macroKeywordCode=undefined;var codegen_1=require_codegen();var names_1=require_names();var code_1=require_code2();var errors_1=require_errors();function macroKeywordCode(cxt,def){const{gen,keyword,schema,parentSchema,it}=cxt;const macroSchema=def.macro.call(it.self,schema,parentSchema,it);const schemaRef=useKeyword(gen,keyword,macroSchema);if(it.opts.validateSchema!==false)it.self.validateSchema(macroSchema,true);const valid=gen.name("valid");cxt.subschema({schema:macroSchema,schemaPath:codegen_1.nil,errSchemaPath:`${it.errSchemaPath}/${keyword}`,topSchemaRef:schemaRef,compositeRule:true},valid);cxt.pass(valid,()=>cxt.error(true))}exports.macroKeywordCode=macroKeywordCode;function funcKeywordCode(cxt,def){var _a;const{gen,keyword,schema,parentSchema,$data,it}=cxt;checkAsyncKeyword(it,def);const validate=!$data&&def.compile?def.compile.call(it.self,schema,parentSchema,it):def.validate;const validateRef=useKeyword(gen,keyword,validate);const valid=gen.let("valid");cxt.block$data(valid,validateKeyword);cxt.ok((_a=def.valid)!==null&&_a!==undefined?_a:valid);function validateKeyword(){if(def.errors===false){assignValid();if(def.modifying)modifyData(cxt);reportErrs(()=>cxt.error())}else{const ruleErrs=def.async?validateAsync():validateSync();if(def.modifying)modifyData(cxt);reportErrs(()=>addErrs(cxt,ruleErrs))}}function validateAsync(){const ruleErrs=gen.let("ruleErrs",null);gen.try(()=>assignValid((0,codegen_1._)`await `),(e)=>gen.assign(valid,false).if((0,codegen_1._)`${e} instanceof ${it.ValidationError}`,()=>gen.assign(ruleErrs,(0,codegen_1._)`${e}.errors`),()=>gen.throw(e)));return ruleErrs}function validateSync(){const validateErrs=(0,codegen_1._)`${validateRef}.errors`;gen.assign(validateErrs,null);assignValid(codegen_1.nil);return validateErrs}function assignValid(_await=def.async?(0,codegen_1._)`await `:codegen_1.nil){const passCxt=it.opts.passContext?names_1.default.this:names_1.default.self;const passSchema=!(("compile"in def)&&!$data||def.schema===false);gen.assign(valid,(0,codegen_1._)`${_await}${(0,code_1.callValidateCode)(cxt,validateRef,passCxt,passSchema)}`,def.modifying)}function reportErrs(errors){var _a;gen.if((0,codegen_1.not)((_a=def.valid)!==null&&_a!==undefined?_a:valid),errors)}}exports.funcKeywordCode=funcKeywordCode;function modifyData(cxt){const{gen,data,it}=cxt;gen.if(it.parentData,()=>gen.assign(data,(0,codegen_1._)`${it.parentData}[${it.parentDataProperty}]`))}function addErrs(cxt,errs){const{gen}=cxt;gen.if((0,codegen_1._)`Array.isArray(${errs})`,()=>{gen.assign(names_1.default.vErrors,(0,codegen_1._)`${names_1.default.vErrors} === null ? ${errs} : ${names_1.default.vErrors}.concat(${errs})`).assign(names_1.default.errors,(0,codegen_1._)`${names_1.default.vErrors}.length`);(0,errors_1.extendErrors)(cxt)},()=>cxt.error())}function checkAsyncKeyword({schemaEnv},def){if(def.async&&!schemaEnv.$async)throw new Error("async keyword in sync schema")}function useKeyword(gen,keyword,result){if(result===undefined)throw new Error(`keyword "${keyword}" failed to compile`);return gen.scopeValue("keyword",typeof result=="function"?{ref:result}:{ref:result,code:(0,codegen_1.stringify)(result)})}function validSchemaType(schema,schemaType,allowUndefined=false){return!schemaType.length||schemaType.some((st)=>st==="array"?Array.isArray(schema):st==="object"?schema&&typeof schema=="object"&&!Array.isArray(schema):typeof schema==st||allowUndefined&&typeof schema=="undefined")}exports.validSchemaType=validSchemaType;function validateKeywordUsage({schema,opts,self,errSchemaPath},def,keyword){if(Array.isArray(def.keyword)?!def.keyword.includes(keyword):def.keyword!==keyword){throw new Error("ajv implementation error")}const deps=def.dependencies;if(deps===null||deps===undefined?undefined:deps.some((kwd)=>!Object.prototype.hasOwnProperty.call(schema,kwd))){throw new Error(`parent schema must have dependencies of ${keyword}: ${deps.join(",")}`)}if(def.validateSchema){const valid=def.validateSchema(schema[keyword]);if(!valid){const msg=`keyword "${keyword}" value is invalid at path "${errSchemaPath}": `+self.errorsText(def.validateSchema.errors);if(opts.validateSchema==="log")self.logger.error(msg);else throw new Error(msg)}}}exports.validateKeywordUsage=validateKeywordUsage});var require_subschema=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.extendSubschemaMode=exports.extendSubschemaData=exports.getSubschema=undefined;var codegen_1=require_codegen();var util_1=require_util();function getSubschema(it,{keyword,schemaProp,schema,schemaPath,errSchemaPath,topSchemaRef}){if(keyword!==undefined&&schema!==undefined){throw new Error('both "keyword" and "schema" passed, only one allowed')}if(keyword!==undefined){const sch=it.schema[keyword];return schemaProp===undefined?{schema:sch,schemaPath:(0,codegen_1._)`${it.schemaPath}${(0,codegen_1.getProperty)(keyword)}`,errSchemaPath:`${it.errSchemaPath}/${keyword}`}:{schema:sch[schemaProp],schemaPath:(0,codegen_1._)`${it.schemaPath}${(0,codegen_1.getProperty)(keyword)}${(0,codegen_1.getProperty)(schemaProp)}`,errSchemaPath:`${it.errSchemaPath}/${keyword}/${(0,util_1.escapeFragment)(schemaProp)}`}}if(schema!==undefined){if(schemaPath===undefined||errSchemaPath===undefined||topSchemaRef===undefined){throw new Error('"schemaPath", "errSchemaPath" and "topSchemaRef" are required with "schema"')}return{schema,schemaPath,topSchemaRef,errSchemaPath}}throw new Error('either "keyword" or "schema" must be passed')}exports.getSubschema=getSubschema;function extendSubschemaData(subschema,it,{dataProp,dataPropType:dpType,data,dataTypes,propertyName}){if(data!==undefined&&dataProp!==undefined){throw new Error('both "data" and "dataProp" passed, only one allowed')}const{gen}=it;if(dataProp!==undefined){const{errorPath,dataPathArr,opts}=it;const nextData=gen.let("data",(0,codegen_1._)`${it.data}${(0,codegen_1.getProperty)(dataProp)}`,true);dataContextProps(nextData);subschema.errorPath=(0,codegen_1.str)`${errorPath}${(0,util_1.getErrorPath)(dataProp,dpType,opts.jsPropertySyntax)}`;subschema.parentDataProperty=(0,codegen_1._)`${dataProp}`;subschema.dataPathArr=[...dataPathArr,subschema.parentDataProperty]}if(data!==undefined){const nextData=data instanceof codegen_1.Name?data:gen.let("data",data,true);dataContextProps(nextData);if(propertyName!==undefined)subschema.propertyName=propertyName}if(dataTypes)subschema.dataTypes=dataTypes;function dataContextProps(_nextData){subschema.data=_nextData;subschema.dataLevel=it.dataLevel+1;subschema.dataTypes=[];it.definedProperties=new Set;subschema.parentData=it.data;subschema.dataNames=[...it.dataNames,_nextData]}}exports.extendSubschemaData=extendSubschemaData;function extendSubschemaMode(subschema,{jtdDiscriminator,jtdMetadata,compositeRule,createErrors,allErrors}){if(compositeRule!==undefined)subschema.compositeRule=compositeRule;if(createErrors!==undefined)subschema.createErrors=createErrors;if(allErrors!==undefined)subschema.allErrors=allErrors;subschema.jtdDiscriminator=jtdDiscriminator;subschema.jtdMetadata=jtdMetadata}exports.extendSubschemaMode=extendSubschemaMode});var require_fast_deep_equal=__commonJS(function(exports,module){module.exports=function equal(a,b){if(a===b)return true;if(a&&b&&typeof a=="object"&&typeof b=="object"){if(a.constructor!==b.constructor)return false;var length,i,keys;if(Array.isArray(a)){length=a.length;if(length!=b.length)return false;for(i=length;i--!==0;)if(!equal(a[i],b[i]))return false;return true}if(a.constructor===RegExp)return a.source===b.source&&a.flags===b.flags;if(a.valueOf!==Object.prototype.valueOf)return a.valueOf()===b.valueOf();if(a.toString!==Object.prototype.toString)return a.toString()===b.toString();keys=Object.keys(a);length=keys.length;if(length!==Object.keys(b).length)return false;for(i=length;i--!==0;)if(!Object.prototype.hasOwnProperty.call(b,keys[i]))return false;for(i=length;i--!==0;){var key=keys[i];if(!equal(a[key],b[key]))return false}return true}return a!==a&&b!==b}});var require_json_schema_traverse=__commonJS(function(exports,module){var traverse=module.exports=function(schema,opts,cb){if(typeof opts=="function"){cb=opts;opts={}}cb=opts.cb||cb;var pre=typeof cb=="function"?cb:cb.pre||function(){};var post=cb.post||function(){};_traverse(opts,pre,post,schema,"",schema)};traverse.keywords={additionalItems:true,items:true,contains:true,additionalProperties:true,propertyNames:true,not:true,if:true,then:true,else:true};traverse.arrayKeywords={items:true,allOf:true,anyOf:true,oneOf:true};traverse.propsKeywords={$defs:true,definitions:true,properties:true,patternProperties:true,dependencies:true};traverse.skipKeywords={default:true,enum:true,const:true,required:true,maximum:true,minimum:true,exclusiveMaximum:true,exclusiveMinimum:true,multipleOf:true,maxLength:true,minLength:true,pattern:true,format:true,maxItems:true,minItems:true,uniqueItems:true,maxProperties:true,minProperties:true};function _traverse(opts,pre,post,schema,jsonPtr,rootSchema,parentJsonPtr,parentKeyword,parentSchema,keyIndex){if(schema&&typeof schema=="object"&&!Array.isArray(schema)){pre(schema,jsonPtr,rootSchema,parentJsonPtr,parentKeyword,parentSchema,keyIndex);for(var key in schema){var sch=schema[key];if(Array.isArray(sch)){if(key in traverse.arrayKeywords){for(var i=0;i<sch.length;i++)_traverse(opts,pre,post,sch[i],jsonPtr+"/"+key+"/"+i,rootSchema,jsonPtr,key,schema,i)}}else if(key in traverse.propsKeywords){if(sch&&typeof sch=="object"){for(var prop in sch)_traverse(opts,pre,post,sch[prop],jsonPtr+"/"+key+"/"+escapeJsonPtr(prop),rootSchema,jsonPtr,key,schema,prop)}}else if(key in traverse.keywords||opts.allKeys&&!(key in traverse.skipKeywords)){_traverse(opts,pre,post,sch,jsonPtr+"/"+key,rootSchema,jsonPtr,key,schema)}}post(schema,jsonPtr,rootSchema,parentJsonPtr,parentKeyword,parentSchema,keyIndex)}}function escapeJsonPtr(str){return str.replace(/~/g,"~0").replace(/\//g,"~1")}});var require_resolve=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.getSchemaRefs=exports.resolveUrl=exports.normalizeId=exports._getFullPath=exports.getFullPath=exports.inlineRef=undefined;var util_1=require_util();var equal=require_fast_deep_equal();var traverse=require_json_schema_traverse();var SIMPLE_INLINED=new Set(["type","format","pattern","maxLength","minLength","maxProperties","minProperties","maxItems","minItems","maximum","minimum","uniqueItems","multipleOf","required","enum","const"]);function inlineRef(schema,limit=true){if(typeof schema=="boolean")return true;if(limit===true)return!hasRef(schema);if(!limit)return false;return countKeys(schema)<=limit}exports.inlineRef=inlineRef;var REF_KEYWORDS=new Set(["$ref","$recursiveRef","$recursiveAnchor","$dynamicRef","$dynamicAnchor"]);function hasRef(schema){for(const key in schema){if(REF_KEYWORDS.has(key))return true;const sch=schema[key];if(Array.isArray(sch)&&sch.some(hasRef))return true;if(typeof sch=="object"&&hasRef(sch))return true}return false}function countKeys(schema){let count=0;for(const key in schema){if(key==="$ref")return Infinity;count++;if(SIMPLE_INLINED.has(key))continue;if(typeof schema[key]=="object"){(0,util_1.eachItem)(schema[key],(sch)=>count+=countKeys(sch))}if(count===Infinity)return Infinity}return count}function getFullPath(resolver,id="",normalize){if(normalize!==false)id=normalizeId(id);const p=resolver.parse(id);return _getFullPath(resolver,p)}exports.getFullPath=getFullPath;function _getFullPath(resolver,p){const serialized=resolver.serialize(p);return serialized.split("#")[0]+"#"}exports._getFullPath=_getFullPath;var TRAILING_SLASH_HASH=/#\/?$/;function normalizeId(id){return id?id.replace(TRAILING_SLASH_HASH,""):""}exports.normalizeId=normalizeId;function resolveUrl(resolver,baseId,id){id=normalizeId(id);return resolver.resolve(baseId,id)}exports.resolveUrl=resolveUrl;var ANCHOR=/^[a-z_][-a-z0-9._]*$/i;function getSchemaRefs(schema,baseId){if(typeof schema=="boolean")return{};const{schemaId,uriResolver}=this.opts;const schId=normalizeId(schema[schemaId]||baseId);const baseIds={"":schId};const pathPrefix=getFullPath(uriResolver,schId,false);const localRefs={};const schemaRefs=new Set;traverse(schema,{allKeys:true},(sch,jsonPtr,_,parentJsonPtr)=>{if(parentJsonPtr===undefined)return;const fullPath=pathPrefix+jsonPtr;let innerBaseId=baseIds[parentJsonPtr];if(typeof sch[schemaId]=="string")innerBaseId=addRef.call(this,sch[schemaId]);addAnchor.call(this,sch.$anchor);addAnchor.call(this,sch.$dynamicAnchor);baseIds[jsonPtr]=innerBaseId;function addRef(ref){const _resolve=this.opts.uriResolver.resolve;ref=normalizeId(innerBaseId?_resolve(innerBaseId,ref):ref);if(schemaRefs.has(ref))throw ambiguos(ref);schemaRefs.add(ref);let schOrRef=this.refs[ref];if(typeof schOrRef=="string")schOrRef=this.refs[schOrRef];if(typeof schOrRef=="object"){checkAmbiguosRef(sch,schOrRef.schema,ref)}else if(ref!==normalizeId(fullPath)){if(ref[0]==="#"){checkAmbiguosRef(sch,localRefs[ref],ref);localRefs[ref]=sch}else{this.refs[ref]=fullPath}}return ref}function addAnchor(anchor){if(typeof anchor=="string"){if(!ANCHOR.test(anchor))throw new Error(`invalid anchor "${anchor}"`);addRef.call(this,`#${anchor}`)}}});return localRefs;function checkAmbiguosRef(sch1,sch2,ref){if(sch2!==undefined&&!equal(sch1,sch2))throw ambiguos(ref)}function ambiguos(ref){return new Error(`reference "${ref}" resolves to more than one schema`)}}exports.getSchemaRefs=getSchemaRefs});var require_validate=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.getData=exports.KeywordCxt=exports.validateFunctionCode=undefined;var boolSchema_1=require_boolSchema();var dataType_1=require_dataType();var applicability_1=require_applicability();var dataType_2=require_dataType();var defaults_1=require_defaults();var keyword_1=require_keyword();var subschema_1=require_subschema();var codegen_1=require_codegen();var names_1=require_names();var resolve_1=require_resolve();var util_1=require_util();var errors_1=require_errors();function validateFunctionCode(it){if(isSchemaObj(it)){checkKeywords(it);if(schemaCxtHasRules(it)){topSchemaObjCode(it);return}}validateFunction(it,()=>(0,boolSchema_1.topBoolOrEmptySchema)(it))}exports.validateFunctionCode=validateFunctionCode;function validateFunction({gen,validateName,schema,schemaEnv,opts},body){if(opts.code.es5){gen.func(validateName,(0,codegen_1._)`${names_1.default.data}, ${names_1.default.valCxt}`,schemaEnv.$async,()=>{gen.code((0,codegen_1._)`"use strict"; ${funcSourceUrl(schema,opts)}`);destructureValCxtES5(gen,opts);gen.code(body)})}else{gen.func(validateName,(0,codegen_1._)`${names_1.default.data}, ${destructureValCxt(opts)}`,schemaEnv.$async,()=>gen.code(funcSourceUrl(schema,opts)).code(body))}}function destructureValCxt(opts){return(0,codegen_1._)`{${names_1.default.instancePath}="", ${names_1.default.parentData}, ${names_1.default.parentDataProperty}, ${names_1.default.rootData}=${names_1.default.data}${opts.dynamicRef?(0,codegen_1._)`, ${names_1.default.dynamicAnchors}={}`:codegen_1.nil}}={}`}function destructureValCxtES5(gen,opts){gen.if(names_1.default.valCxt,()=>{gen.var(names_1.default.instancePath,(0,codegen_1._)`${names_1.default.valCxt}.${names_1.default.instancePath}`);gen.var(names_1.default.parentData,(0,codegen_1._)`${names_1.default.valCxt}.${names_1.default.parentData}`);gen.var(names_1.default.parentDataProperty,(0,codegen_1._)`${names_1.default.valCxt}.${names_1.default.parentDataProperty}`);gen.var(names_1.default.rootData,(0,codegen_1._)`${names_1.default.valCxt}.${names_1.default.rootData}`);if(opts.dynamicRef)gen.var(names_1.default.dynamicAnchors,(0,codegen_1._)`${names_1.default.valCxt}.${names_1.default.dynamicAnchors}`)},()=>{gen.var(names_1.default.instancePath,(0,codegen_1._)`""`);gen.var(names_1.default.parentData,(0,codegen_1._)`undefined`);gen.var(names_1.default.parentDataProperty,(0,codegen_1._)`undefined`);gen.var(names_1.default.rootData,names_1.default.data);if(opts.dynamicRef)gen.var(names_1.default.dynamicAnchors,(0,codegen_1._)`{}`)})}function topSchemaObjCode(it){const{schema,opts,gen}=it;validateFunction(it,()=>{if(opts.$comment&&schema.$comment)commentKeyword(it);checkNoDefault(it);gen.let(names_1.default.vErrors,null);gen.let(names_1.default.errors,0);if(opts.unevaluated)resetEvaluated(it);typeAndKeywords(it);returnResults(it)});return}function resetEvaluated(it){const{gen,validateName}=it;it.evaluated=gen.const("evaluated",(0,codegen_1._)`${validateName}.evaluated`);gen.if((0,codegen_1._)`${it.evaluated}.dynamicProps`,()=>gen.assign((0,codegen_1._)`${it.evaluated}.props`,(0,codegen_1._)`undefined`));gen.if((0,codegen_1._)`${it.evaluated}.dynamicItems`,()=>gen.assign((0,codegen_1._)`${it.evaluated}.items`,(0,codegen_1._)`undefined`))}function funcSourceUrl(schema,opts){const schId=typeof schema=="object"&&schema[opts.schemaId];return schId&&(opts.code.source||opts.code.process)?(0,codegen_1._)`/*# sourceURL=${schId} */`:codegen_1.nil}function subschemaCode(it,valid){if(isSchemaObj(it)){checkKeywords(it);if(schemaCxtHasRules(it)){subSchemaObjCode(it,valid);return}}(0,boolSchema_1.boolOrEmptySchema)(it,valid)}function schemaCxtHasRules({schema,self}){if(typeof schema=="boolean")return!schema;for(const key in schema)if(self.RULES.all[key])return true;return false}function isSchemaObj(it){return typeof it.schema!="boolean"}function subSchemaObjCode(it,valid){const{schema,gen,opts}=it;if(opts.$comment&&schema.$comment)commentKeyword(it);updateContext(it);checkAsyncSchema(it);const errsCount=gen.const("_errs",names_1.default.errors);typeAndKeywords(it,errsCount);gen.var(valid,(0,codegen_1._)`${errsCount} === ${names_1.default.errors}`)}function checkKeywords(it){(0,util_1.checkUnknownRules)(it);checkRefsAndKeywords(it)}function typeAndKeywords(it,errsCount){if(it.opts.jtd)return schemaKeywords(it,[],false,errsCount);const types=(0,dataType_1.getSchemaTypes)(it.schema);const checkedTypes=(0,dataType_1.coerceAndCheckDataType)(it,types);schemaKeywords(it,types,!checkedTypes,errsCount)}function checkRefsAndKeywords(it){const{schema,errSchemaPath,opts,self}=it;if(schema.$ref&&opts.ignoreKeywordsWithRef&&(0,util_1.schemaHasRulesButRef)(schema,self.RULES)){self.logger.warn(`$ref: keywords ignored in schema at path "${errSchemaPath}"`)}}function checkNoDefault(it){const{schema,opts}=it;if(schema.default!==undefined&&opts.useDefaults&&opts.strictSchema){(0,util_1.checkStrictMode)(it,"default is ignored in the schema root")}}function updateContext(it){const schId=it.schema[it.opts.schemaId];if(schId)it.baseId=(0,resolve_1.resolveUrl)(it.opts.uriResolver,it.baseId,schId)}function checkAsyncSchema(it){if(it.schema.$async&&!it.schemaEnv.$async)throw new Error("async schema in sync schema")}function commentKeyword({gen,schemaEnv,schema,errSchemaPath,opts}){const msg=schema.$comment;if(opts.$comment===true){gen.code((0,codegen_1._)`${names_1.default.self}.logger.log(${msg})`)}else if(typeof opts.$comment=="function"){const schemaPath=(0,codegen_1.str)`${errSchemaPath}/$comment`;const rootName=gen.scopeValue("root",{ref:schemaEnv.root});gen.code((0,codegen_1._)`${names_1.default.self}.opts.$comment(${msg}, ${schemaPath}, ${rootName}.schema)`)}}function returnResults(it){const{gen,schemaEnv,validateName,ValidationError,opts}=it;if(schemaEnv.$async){gen.if((0,codegen_1._)`${names_1.default.errors} === 0`,()=>gen.return(names_1.default.data),()=>gen.throw((0,codegen_1._)`new ${ValidationError}(${names_1.default.vErrors})`))}else{gen.assign((0,codegen_1._)`${validateName}.errors`,names_1.default.vErrors);if(opts.unevaluated)assignEvaluated(it);gen.return((0,codegen_1._)`${names_1.default.errors} === 0`)}}function assignEvaluated({gen,evaluated,props,items}){if(props instanceof codegen_1.Name)gen.assign((0,codegen_1._)`${evaluated}.props`,props);if(items instanceof codegen_1.Name)gen.assign((0,codegen_1._)`${evaluated}.items`,items)}function schemaKeywords(it,types,typeErrors,errsCount){const{gen,schema,data,allErrors,opts,self}=it;const{RULES}=self;if(schema.$ref&&(opts.ignoreKeywordsWithRef||!(0,util_1.schemaHasRulesButRef)(schema,RULES))){gen.block(()=>keywordCode(it,"$ref",RULES.all.$ref.definition));return}if(!opts.jtd)checkStrictTypes(it,types);gen.block(()=>{for(const group of RULES.rules)groupKeywords(group);groupKeywords(RULES.post)});function groupKeywords(group){if(!(0,applicability_1.shouldUseGroup)(schema,group))return;if(group.type){gen.if((0,dataType_2.checkDataType)(group.type,data,opts.strictNumbers));iterateKeywords(it,group);if(types.length===1&&types[0]===group.type&&typeErrors){gen.else();(0,dataType_2.reportTypeError)(it)}gen.endIf()}else{iterateKeywords(it,group)}if(!allErrors)gen.if((0,codegen_1._)`${names_1.default.errors} === ${errsCount||0}`)}}function iterateKeywords(it,group){const{gen,schema,opts:{useDefaults}}=it;if(useDefaults)(0,defaults_1.assignDefaults)(it,group.type);gen.block(()=>{for(const rule of group.rules){if((0,applicability_1.shouldUseRule)(schema,rule)){keywordCode(it,rule.keyword,rule.definition,group.type)}}})}function checkStrictTypes(it,types){if(it.schemaEnv.meta||!it.opts.strictTypes)return;checkContextTypes(it,types);if(!it.opts.allowUnionTypes)checkMultipleTypes(it,types);checkKeywordTypes(it,it.dataTypes)}function checkContextTypes(it,types){if(!types.length)return;if(!it.dataTypes.length){it.dataTypes=types;return}types.forEach((t)=>{if(!includesType(it.dataTypes,t)){strictTypesError(it,`type "${t}" not allowed by context "${it.dataTypes.join(",")}"`)}});narrowSchemaTypes(it,types)}function checkMultipleTypes(it,ts){if(ts.length>1&&!(ts.length===2&&ts.includes("null"))){strictTypesError(it,"use allowUnionTypes to allow union type keyword")}}function checkKeywordTypes(it,ts){const rules=it.self.RULES.all;for(const keyword in rules){const rule=rules[keyword];if(typeof rule=="object"&&(0,applicability_1.shouldUseRule)(it.schema,rule)){const{type}=rule.definition;if(type.length&&!type.some((t)=>hasApplicableType(ts,t))){strictTypesError(it,`missing type "${type.join(",")}" for keyword "${keyword}"`)}}}}function hasApplicableType(schTs,kwdT){return schTs.includes(kwdT)||kwdT==="number"&&schTs.includes("integer")}function includesType(ts,t){return ts.includes(t)||t==="integer"&&ts.includes("number")}function narrowSchemaTypes(it,withTypes){const ts=[];for(const t of it.dataTypes){if(includesType(withTypes,t))ts.push(t);else if(withTypes.includes("integer")&&t==="number")ts.push("integer")}it.dataTypes=ts}function strictTypesError(it,msg){const schemaPath=it.schemaEnv.baseId+it.errSchemaPath;msg+=` at "${schemaPath}" (strictTypes)`;(0,util_1.checkStrictMode)(it,msg,it.opts.strictTypes)}class KeywordCxt{constructor(it,def,keyword){(0,keyword_1.validateKeywordUsage)(it,def,keyword);this.gen=it.gen;this.allErrors=it.allErrors;this.keyword=keyword;this.data=it.data;this.schema=it.schema[keyword];this.$data=def.$data&&it.opts.$data&&this.schema&&this.schema.$data;this.schemaValue=(0,util_1.schemaRefOrVal)(it,this.schema,keyword,this.$data);this.schemaType=def.schemaType;this.parentSchema=it.schema;this.params={};this.it=it;this.def=def;if(this.$data){this.schemaCode=it.gen.const("vSchema",getData(this.$data,it))}else{this.schemaCode=this.schemaValue;if(!(0,keyword_1.validSchemaType)(this.schema,def.schemaType,def.allowUndefined)){throw new Error(`${keyword} value must be ${JSON.stringify(def.schemaType)}`)}}if("code"in def?def.trackErrors:def.errors!==false){this.errsCount=it.gen.const("_errs",names_1.default.errors)}}result(condition,successAction,failAction){this.failResult((0,codegen_1.not)(condition),successAction,failAction)}failResult(condition,successAction,failAction){this.gen.if(condition);if(failAction)failAction();else this.error();if(successAction){this.gen.else();successAction();if(this.allErrors)this.gen.endIf()}else{if(this.allErrors)this.gen.endIf();else this.gen.else()}}pass(condition,failAction){this.failResult((0,codegen_1.not)(condition),undefined,failAction)}fail(condition){if(condition===undefined){this.error();if(!this.allErrors)this.gen.if(false);return}this.gen.if(condition);this.error();if(this.allErrors)this.gen.endIf();else this.gen.else()}fail$data(condition){if(!this.$data)return this.fail(condition);const{schemaCode}=this;this.fail((0,codegen_1._)`${schemaCode} !== undefined && (${(0,codegen_1.or)(this.invalid$data(),condition)})`)}error(append,errorParams,errorPaths){if(errorParams){this.setParams(errorParams);this._error(append,errorPaths);this.setParams({});return}this._error(append,errorPaths)}_error(append,errorPaths){(append?errors_1.reportExtraError:errors_1.reportError)(this,this.def.error,errorPaths)}$dataError(){(0,errors_1.reportError)(this,this.def.$dataError||errors_1.keyword$DataError)}reset(){if(this.errsCount===undefined)throw new Error('add "trackErrors" to keyword definition');(0,errors_1.resetErrorsCount)(this.gen,this.errsCount)}ok(cond){if(!this.allErrors)this.gen.if(cond)}setParams(obj,assign){if(assign)Object.assign(this.params,obj);else this.params=obj}block$data(valid,codeBlock,$dataValid=codegen_1.nil){this.gen.block(()=>{this.check$data(valid,$dataValid);codeBlock()})}check$data(valid=codegen_1.nil,$dataValid=codegen_1.nil){if(!this.$data)return;const{gen,schemaCode,schemaType,def}=this;gen.if((0,codegen_1.or)((0,codegen_1._)`${schemaCode} === undefined`,$dataValid));if(valid!==codegen_1.nil)gen.assign(valid,true);if(schemaType.length||def.validateSchema){gen.elseIf(this.invalid$data());this.$dataError();if(valid!==codegen_1.nil)gen.assign(valid,false)}gen.else()}invalid$data(){const{gen,schemaCode,schemaType,def,it}=this;return(0,codegen_1.or)(wrong$DataType(),invalid$DataSchema());function wrong$DataType(){if(schemaType.length){if(!(schemaCode instanceof codegen_1.Name))throw new Error("ajv implementation error");const st=Array.isArray(schemaType)?schemaType:[schemaType];return(0,codegen_1._)`${(0,dataType_2.checkDataTypes)(st,schemaCode,it.opts.strictNumbers,dataType_2.DataType.Wrong)}`}return codegen_1.nil}function invalid$DataSchema(){if(def.validateSchema){const validateSchemaRef=gen.scopeValue("validate$data",{ref:def.validateSchema});return(0,codegen_1._)`!${validateSchemaRef}(${schemaCode})`}return codegen_1.nil}}subschema(appl,valid){const subschema=(0,subschema_1.getSubschema)(this.it,appl);(0,subschema_1.extendSubschemaData)(subschema,this.it,appl);(0,subschema_1.extendSubschemaMode)(subschema,appl);const nextContext={...this.it,...subschema,items:undefined,props:undefined};subschemaCode(nextContext,valid);return nextContext}mergeEvaluated(schemaCxt,toName){const{it,gen}=this;if(!it.opts.unevaluated)return;if(it.props!==true&&schemaCxt.props!==undefined){it.props=util_1.mergeEvaluated.props(gen,schemaCxt.props,it.props,toName)}if(it.items!==true&&schemaCxt.items!==undefined){it.items=util_1.mergeEvaluated.items(gen,schemaCxt.items,it.items,toName)}}mergeValidEvaluated(schemaCxt,valid){const{it,gen}=this;if(it.opts.unevaluated&&(it.props!==true||it.items!==true)){gen.if(valid,()=>this.mergeEvaluated(schemaCxt,codegen_1.Name));return true}}}exports.KeywordCxt=KeywordCxt;function keywordCode(it,keyword,def,ruleType){const cxt=new KeywordCxt(it,def,keyword);if("code"in def){def.code(cxt,ruleType)}else if(cxt.$data&&def.validate){(0,keyword_1.funcKeywordCode)(cxt,def)}else if("macro"in def){(0,keyword_1.macroKeywordCode)(cxt,def)}else if(def.compile||def.validate){(0,keyword_1.funcKeywordCode)(cxt,def)}}var JSON_POINTER=/^\/(?:[^~]|~0|~1)*$/;var RELATIVE_JSON_POINTER=/^([0-9]+)(#|\/(?:[^~]|~0|~1)*)?$/;function getData($data,{dataLevel,dataNames,dataPathArr}){let jsonPointer;let data;if($data==="")return names_1.default.rootData;if($data[0]==="/"){if(!JSON_POINTER.test($data))throw new Error(`Invalid JSON-pointer: ${$data}`);jsonPointer=$data;data=names_1.default.rootData}else{const matches=RELATIVE_JSON_POINTER.exec($data);if(!matches)throw new Error(`Invalid JSON-pointer: ${$data}`);const up=+matches[1];jsonPointer=matches[2];if(jsonPointer==="#"){if(up>=dataLevel)throw new Error(errorMsg("property/index",up));return dataPathArr[dataLevel-up]}if(up>dataLevel)throw new Error(errorMsg("data",up));data=dataNames[dataLevel-up];if(!jsonPointer)return data}let expr=data;const segments=jsonPointer.split("/");for(const segment of segments){if(segment){data=(0,codegen_1._)`${data}${(0,codegen_1.getProperty)((0,util_1.unescapeJsonPointer)(segment))}`;expr=(0,codegen_1._)`${expr} && ${data}`}}return expr;function errorMsg(pointerType,up){return`Cannot access ${pointerType} ${up} levels up, current level is ${dataLevel}`}}exports.getData=getData});var require_validation_error=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});class ValidationError extends Error{constructor(errors){super("validation failed");this.errors=errors;this.ajv=this.validation=true}}exports.default=ValidationError});var require_ref_error=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var resolve_1=require_resolve();class MissingRefError extends Error{constructor(resolver,baseId,ref,msg){super(msg||`can't resolve reference ${ref} from id ${baseId}`);this.missingRef=(0,resolve_1.resolveUrl)(resolver,baseId,ref);this.missingSchema=(0,resolve_1.normalizeId)((0,resolve_1.getFullPath)(resolver,this.missingRef))}}exports.default=MissingRefError});var require_compile=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.resolveSchema=exports.getCompilingSchema=exports.resolveRef=exports.compileSchema=exports.SchemaEnv=undefined;var codegen_1=require_codegen();var validation_error_1=require_validation_error();var names_1=require_names();var resolve_1=require_resolve();var util_1=require_util();var validate_1=require_validate();class SchemaEnv{constructor(env){var _a;this.refs={};this.dynamicAnchors={};let schema;if(typeof env.schema=="object")schema=env.schema;this.schema=env.schema;this.schemaId=env.schemaId;this.root=env.root||this;this.baseId=(_a=env.baseId)!==null&&_a!==undefined?_a:(0,resolve_1.normalizeId)(schema===null||schema===undefined?undefined:schema[env.schemaId||"$id"]);this.schemaPath=env.schemaPath;this.localRefs=env.localRefs;this.meta=env.meta;this.$async=schema===null||schema===undefined?undefined:schema.$async;this.refs={}}}exports.SchemaEnv=SchemaEnv;function compileSchema(sch){const _sch=getCompilingSchema.call(this,sch);if(_sch)return _sch;const rootId=(0,resolve_1.getFullPath)(this.opts.uriResolver,sch.root.baseId);const{es5,lines}=this.opts.code;const{ownProperties}=this.opts;const gen=new codegen_1.CodeGen(this.scope,{es5,lines,ownProperties});let _ValidationError;if(sch.$async){_ValidationError=gen.scopeValue("Error",{ref:validation_error_1.default,code:(0,codegen_1._)`require("ajv/dist/runtime/validation_error").default`})}const validateName=gen.scopeName("validate");sch.validateName=validateName;const schemaCxt={gen,allErrors:this.opts.allErrors,data:names_1.default.data,parentData:names_1.default.parentData,parentDataProperty:names_1.default.parentDataProperty,dataNames:[names_1.default.data],dataPathArr:[codegen_1.nil],dataLevel:0,dataTypes:[],definedProperties:new Set,topSchemaRef:gen.scopeValue("schema",this.opts.code.source===true?{ref:sch.schema,code:(0,codegen_1.stringify)(sch.schema)}:{ref:sch.schema}),validateName,ValidationError:_ValidationError,schema:sch.schema,schemaEnv:sch,rootId,baseId:sch.baseId||rootId,schemaPath:codegen_1.nil,errSchemaPath:sch.schemaPath||(this.opts.jtd?"":"#"),errorPath:(0,codegen_1._)`""`,opts:this.opts,self:this};let sourceCode;try{this._compilations.add(sch);(0,validate_1.validateFunctionCode)(schemaCxt);gen.optimize(this.opts.code.optimize);const validateCode=gen.toString();sourceCode=`${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`;if(this.opts.code.process)sourceCode=this.opts.code.process(sourceCode,sch);const makeValidate=new Function(`${names_1.default.self}`,`${names_1.default.scope}`,sourceCode);const validate=makeValidate(this,this.scope.get());this.scope.value(validateName,{ref:validate});validate.errors=null;validate.schema=sch.schema;validate.schemaEnv=sch;if(sch.$async)validate.$async=true;if(this.opts.code.source===true){validate.source={validateName,validateCode,scopeValues:gen._values}}if(this.opts.unevaluated){const{props,items}=schemaCxt;validate.evaluated={props:props instanceof codegen_1.Name?undefined:props,items:items instanceof codegen_1.Name?undefined:items,dynamicProps:props instanceof codegen_1.Name,dynamicItems:items instanceof codegen_1.Name};if(validate.source)validate.source.evaluated=(0,codegen_1.stringify)(validate.evaluated)}sch.validate=validate;return sch}catch(e){delete sch.validate;delete sch.validateName;if(sourceCode)this.logger.error("Error compiling schema, function code:",sourceCode);throw e}finally{this._compilations.delete(sch)}}exports.compileSchema=compileSchema;function resolveRef(root,baseId,ref){var _a;ref=(0,resolve_1.resolveUrl)(this.opts.uriResolver,baseId,ref);const schOrFunc=root.refs[ref];if(schOrFunc)return schOrFunc;let _sch=resolve.call(this,root,ref);if(_sch===undefined){const schema=(_a=root.localRefs)===null||_a===undefined?undefined:_a[ref];const{schemaId}=this.opts;if(schema)_sch=new SchemaEnv({schema,schemaId,root,baseId})}if(_sch===undefined)return;return root.refs[ref]=inlineOrCompile.call(this,_sch)}exports.resolveRef=resolveRef;function inlineOrCompile(sch){if((0,resolve_1.inlineRef)(sch.schema,this.opts.inlineRefs))return sch.schema;return sch.validate?sch:compileSchema.call(this,sch)}function getCompilingSchema(schEnv){for(const sch of this._compilations){if(sameSchemaEnv(sch,schEnv))return sch}}exports.getCompilingSchema=getCompilingSchema;function sameSchemaEnv(s1,s2){return s1.schema===s2.schema&&s1.root===s2.root&&s1.baseId===s2.baseId}function resolve(root,ref){let sch;while(typeof(sch=this.refs[ref])=="string")ref=sch;return sch||this.schemas[ref]||resolveSchema.call(this,root,ref)}function resolveSchema(root,ref){const p=this.opts.uriResolver.parse(ref);const refPath=(0,resolve_1._getFullPath)(this.opts.uriResolver,p);let baseId=(0,resolve_1.getFullPath)(this.opts.uriResolver,root.baseId,undefined);if(Object.keys(root.schema).length>0&&refPath===baseId){return getJsonPointer.call(this,p,root)}const id=(0,resolve_1.normalizeId)(refPath);const schOrRef=this.refs[id]||this.schemas[id];if(typeof schOrRef=="string"){const sch=resolveSchema.call(this,root,schOrRef);if(typeof(sch===null||sch===undefined?undefined:sch.schema)!=="object")return;return getJsonPointer.call(this,p,sch)}if(typeof(schOrRef===null||schOrRef===undefined?undefined:schOrRef.schema)!=="object")return;if(!schOrRef.validate)compileSchema.call(this,schOrRef);if(id===(0,resolve_1.normalizeId)(ref)){const{schema}=schOrRef;const{schemaId}=this.opts;const schId=schema[schemaId];if(schId)baseId=(0,resolve_1.resolveUrl)(this.opts.uriResolver,baseId,schId);return new SchemaEnv({schema,schemaId,root,baseId})}return getJsonPointer.call(this,p,schOrRef)}exports.resolveSchema=resolveSchema;var PREVENT_SCOPE_CHANGE=new Set(["properties","patternProperties","enum","dependencies","definitions"]);function getJsonPointer(parsedRef,{baseId,schema,root}){var _a;if(((_a=parsedRef.fragment)===null||_a===undefined?undefined:_a[0])!=="/")return;for(const part of parsedRef.fragment.slice(1).split("/")){if(typeof schema==="boolean")return;const partSchema=schema[(0,util_1.unescapeFragment)(part)];if(partSchema===undefined)return;schema=partSchema;const schId=typeof schema==="object"&&schema[this.opts.schemaId];if(!PREVENT_SCOPE_CHANGE.has(part)&&schId){baseId=(0,resolve_1.resolveUrl)(this.opts.uriResolver,baseId,schId)}}let env;if(typeof schema!="boolean"&&schema.$ref&&!(0,util_1.schemaHasRulesButRef)(schema,this.RULES)){const $ref=(0,resolve_1.resolveUrl)(this.opts.uriResolver,baseId,schema.$ref);env=resolveSchema.call(this,root,$ref)}const{schemaId}=this.opts;env=env||new SchemaEnv({schema,schemaId,root,baseId});if(env.schema!==env.root.schema)return env;return}});var require_data=__commonJS(function(exports,module){module.exports={$id:"https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#",description:"Meta-schema for $data reference (JSON AnySchema extension proposal)",type:"object",required:["$data"],properties:{$data:{type:"string",anyOf:[{format:"relative-json-pointer"},{format:"json-pointer"}]}},additionalProperties:false}});var require_utils=__commonJS(function(exports,module){var isUUID=RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);var isIPv4=RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);var isPort=RegExp.prototype.test.bind(/^\d*$/u);var isHexPair=RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);var isUnreserved=RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);var isPathCharacter=RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);var isQueryFragmentCharacter=RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);var isUserinfoCharacter=RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);var BYTE_HEX=new Array(256);{const HEX_DIGITS="0123456789ABCDEF";for(let i=0;i<256;i++){BYTE_HEX[i]="%"+HEX_DIGITS[i>>4]+HEX_DIGITS[i&15]}}function percentEncodeNonAscii(cp){if(cp<2048){return BYTE_HEX[192|cp>>6]+BYTE_HEX[128|cp&63]}if(cp<65536){return BYTE_HEX[224|cp>>12]+BYTE_HEX[128|cp>>6&63]+BYTE_HEX[128|cp&63]}return BYTE_HEX[240|cp>>18]+BYTE_HEX[128|cp>>12&63]+BYTE_HEX[128|cp>>6&63]+BYTE_HEX[128|cp&63]}function stringArrayToHexStripped(input){let acc="";let code=0;let i=0;for(i=0;i<input.length;i++){code=input[i].charCodeAt(0);if(code===48){continue}if(!(code>=48&&code<=57||code>=65&&code<=70||code>=97&&code<=102)){return""}acc+=input[i];break}for(i+=1;i<input.length;i++){code=input[i].charCodeAt(0);if(!(code>=48&&code<=57||code>=65&&code<=70||code>=97&&code<=102)){return""}acc+=input[i]}return acc}var isHextet=RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);var isIPvFuture=RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);var isZoneCharacter=RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);var nonSimpleDomain=RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);function isZoneIdentifier(zone){if(zone.length===0)return false;for(let i=0;i<zone.length;i++){if(isZoneCharacter(zone[i]))continue;if(zone[i]==="%"&&i+2<zone.length&&isHexPair(zone.slice(i+1,i+3))){i+=2;continue}return false}return true}function compressIPv6ZeroRun(hextets){let bestStart=-1;let bestLength=0;let runStart=-1;let runLength=0;for(let i=0;i<hextets.length;i++){if(hextets[i]==="0"){if(runStart===-1)runStart=i;runLength++;if(runLength>bestLength){bestLength=runLength;bestStart=runStart}}else{runStart=-1;runLength=0}}if(bestLength<2)return hextets.join(":");const head=hextets.slice(0,bestStart).join(":");const tail=hextets.slice(bestStart+bestLength).join(":");return head+"::"+tail}function normalizeIPv6Address(input){const compression=input.indexOf("::");if(compression!==-1&&input.indexOf("::",compression+1)!==-1)return;const left=compression===-1?input.split(":"):input.slice(0,compression).split(":");const right=compression===-1?[]:input.slice(compression+2).split(":");if(compression!==-1){if(left.length===1&&left[0]==="")left.length=0;if(right.length===1&&right[0]==="")right.length=0}const parts=left.concat(right);let hextetCount=0;for(let i=0;i<parts.length;i++){const part=parts[i];if(part==="")return;if(part.indexOf(".")!==-1){if(i!==parts.length-1||compression!==-1&&right.length===0||!isIPv4(part))return;hextetCount+=2;continue}if(!isHextet(part))return;parts[i]=parseInt(part,16).toString(16);hextetCount++}if(compression===-1){if(hextetCount!==8)return;return compressIPv6ZeroRun(parts)}if(hextetCount>=8)return;const expanded=parts.slice(0,left.length);for(let i=hextetCount;i<8;i++)expanded.push("0");for(let i=left.length;i<parts.length;i++)expanded.push(parts[i]);return compressIPv6ZeroRun(expanded)}function normalizeIPv6(host){const bracketed=host[0]==="["&&host[host.length-1]==="]";const hasBracket=host[0]==="["||host[host.length-1]==="]";if(hasBracket&&!bracketed)return{host,isIPV6:false,error:true};let input=bracketed?host.slice(1,-1):host;if(bracketed&&isIPvFuture(input)){input=input.toLowerCase();return{host:`[${input}]`,escapedHost:input,isIPV6:false,isIPVFuture:true}}if(findToken(input,":")<2){return{host,isIPV6:false,error:bracketed}}let zoneIdentifier="";const zoneSeparator=input.indexOf("%");if(zoneSeparator!==-1){const separatorLength=input.slice(zoneSeparator,zoneSeparator+3).toLowerCase()==="%25"?3:1;zoneIdentifier=input.slice(zoneSeparator+separatorLength);if(!isZoneIdentifier(zoneIdentifier))return{host,isIPV6:false,error:true};input=input.slice(0,zoneSeparator)}const address=normalizeIPv6Address(input);if(address===undefined)return{host,isIPV6:false,error:true};return{host:address+(zoneIdentifier?"%"+zoneIdentifier:""),escapedHost:address+(zoneIdentifier?"%25"+zoneIdentifier:""),isIPV6:true}}function findToken(str,token){let ind=0;for(let i=0;i<str.length;i++){if(str[i]===token)ind++}return ind}function removeDotSegments(path){let input=path;const output=[];let nextSlash=-1;let len=0;while(len=input.length){if(len===1){if(input==="."){break}else if(input==="/"){output.push("/");break}else{output.push(input);break}}else if(len===2){if(input[0]==="."){if(input[1]==="."){break}else if(input[1]==="/"){input=input.slice(2);continue}}else if(input[0]==="/"){if(input[1]==="."||input[1]==="/"){output.push("/");break}}}else if(len===3){if(input==="/.."){if(output.length!==0){output.pop()}output.push("/");break}}if(input[0]==="."){if(input[1]==="."){if(input[2]==="/"){input=input.slice(3);continue}}else if(input[1]==="/"){input=input.slice(2);continue}}else if(input[0]==="/"){if(input[1]==="."){if(input[2]==="/"){input=input.slice(2);continue}else if(input[2]==="."){if(input[3]==="/"){input=input.slice(3);if(output.length!==0){output.pop()}continue}}}}if((nextSlash=input.indexOf("/",1))===-1){output.push(input);break}else{output.push(input.slice(0,nextSlash));input=input.slice(nextSlash)}}return output.join("")}var HOST_DELIMS={"@":"%40","/":"%2F","?":"%3F","#":"%23",":":"%3A"};var HOST_DELIM_RE=/[@/?#:]/g;var HOST_DELIM_NO_COLON_RE=/[@/?#]/g;function reescapeHostDelimiters(host,isIP){const re=isIP?HOST_DELIM_NO_COLON_RE:HOST_DELIM_RE;re.lastIndex=0;return host.replace(re,(ch)=>HOST_DELIMS[ch])}function normalizePercentEncoding(input,decodeUnreserved=false){if(input.indexOf("%")===-1){return input}let output="";for(let i=0;i<input.length;i++){if(input[i]==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){const normalizedHex=hex.toUpperCase();const decoded=String.fromCharCode(parseInt(normalizedHex,16));if(decodeUnreserved&&isUnreserved(decoded)){output+=decoded}else{output+="%"+normalizedHex}i+=2;continue}}output+=input[i]}return output}function normalizePathEncoding(input){let output="";for(let i=0;i<input.length;i++){const ch=input[i];if(ch==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){const normalizedHex=hex.toUpperCase();const decoded=String.fromCharCode(parseInt(normalizedHex,16));if(decoded!=="."&&isUnreserved(decoded)){output+=decoded}else{output+="%"+normalizedHex}i+=2;continue}}if(isPathCharacter(ch)){output+=ch}else{const code=input.charCodeAt(i);if(code<128){output+=isEscapeSafe(code)?ch:BYTE_HEX[code]}else if(code<55296||code>57343){output+=percentEncodeNonAscii(code)}else if(code<=56319&&i+1<input.length){const low=input.charCodeAt(i+1);if(low>=56320&&low<=57343){output+=percentEncodeNonAscii(65536+(code-55296<<10)+(low-56320));i++}else{output+=percentEncodeNonAscii(65533)}}else{output+=percentEncodeNonAscii(65533)}}}return output}function serializePathEncoding(input,pathNoScheme=false){let output="";let firstSegment=pathNoScheme&&input[0]!=="/";for(let i=0;i<input.length;i++){const ch=input[i];if(ch==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){output+="%"+hex.toUpperCase();i+=2;continue}}if(ch==="/"){firstSegment=false}if(isPathCharacter(ch)&&(ch!==":"||!firstSegment)){output+=ch}else{const code=input.charCodeAt(i);if(code<128){output+=BYTE_HEX[code]}else if(code<55296||code>57343){output+=percentEncodeNonAscii(code)}else if(code<=56319&&i+1<input.length){const low=input.charCodeAt(i+1);if(low>=56320&&low<=57343){output+=percentEncodeNonAscii(65536+(code-55296<<10)+(low-56320));i++}else{output+=percentEncodeNonAscii(65533)}}else{output+=percentEncodeNonAscii(65533)}}}return output}function encodeComponent(input,isAllowed){let output="";for(let i=0;i<input.length;i++){const ch=input[i];if(ch==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){output+="%"+hex.toUpperCase();i+=2;continue}}if(isAllowed(ch)){output+=ch}else{const code=input.charCodeAt(i);if(code<128){output+=BYTE_HEX[code]}else if(code<55296||code>57343){output+=percentEncodeNonAscii(code)}else if(code<=56319&&i+1<input.length){const low=input.charCodeAt(i+1);if(low>=56320&&low<=57343){output+=percentEncodeNonAscii(65536+(code-55296<<10)+(low-56320));i++}else{output+=percentEncodeNonAscii(65533)}}else{output+=percentEncodeNonAscii(65533)}}}return output}function encodeUserinfo(input){return encodeComponent(input,isUserinfoCharacter)}function encodeQuery(input){return encodeComponent(input,isQueryFragmentCharacter)}function encodeFragment(input){return encodeComponent(input,isQueryFragmentCharacter)}function isEscapeSafe(cp){return cp>=48&&cp<=57||cp>=65&&cp<=90||cp>=97&&cp<=122||cp===42||cp===43||cp===45||cp===46||cp===47||cp===64||cp===95}function normalizeQueryFragmentEncoding(input){let output="";for(let i=0;i<input.length;i++){const ch=input[i];if(ch==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){const normalizedHex=hex.toUpperCase();const decoded=String.fromCharCode(parseInt(normalizedHex,16));if(isUnreserved(decoded)){output+=decoded}else{output+="%"+normalizedHex}i+=2;continue}}if(isQueryFragmentCharacter(ch)){output+=ch}else{const code=input.charCodeAt(i);if(code<128){output+=isEscapeSafe(code)?ch:BYTE_HEX[code]}else if(code<55296||code>57343){output+=percentEncodeNonAscii(code)}else if(code<=56319&&i+1<input.length){const low=input.charCodeAt(i+1);if(low>=56320&&low<=57343){output+=percentEncodeNonAscii(65536+(code-55296<<10)+(low-56320));i++}else{output+=percentEncodeNonAscii(65533)}}else{output+=percentEncodeNonAscii(65533)}}}return output}function escapePreservingEscapes(input){let output="";for(let i=0;i<input.length;i++){if(input[i]==="%"&&i+2<input.length){const hex=input.slice(i+1,i+3);if(isHexPair(hex)){output+="%"+hex.toUpperCase();i+=2;continue}}output+=escape(input[i])}return output}function recomposeAuthority(component){const uriTokens=[];if(component.userinfo!==undefined){uriTokens.push(encodeUserinfo(component.userinfo));uriTokens.push("@")}if(component.host!==undefined){let host=component.host;if(!isIPv4(host)){let ipV6res=normalizeIPv6(host);if(ipV6res.isIPV6!==true&&ipV6res.isIPVFuture!==true){host=normalizePercentEncoding(host,true);ipV6res=normalizeIPv6(host)}if(ipV6res.isIPV6===true||ipV6res.isIPVFuture===true){host=`[${ipV6res.escapedHost}]`}else{host=reescapeHostDelimiters(host,false)}}uriTokens.push(host)}if(typeof component.port==="number"||typeof component.port==="string"){const port=String(component.port);if(!isPort(port)){throw new TypeError("URI port is malformed.")}uriTokens.push(":");uriTokens.push(port)}return uriTokens.length?uriTokens.join(""):undefined}module.exports={nonSimpleDomain,recomposeAuthority,reescapeHostDelimiters,normalizePercentEncoding,normalizePathEncoding,serializePathEncoding,normalizeQueryFragmentEncoding,encodeUserinfo,encodeQuery,encodeFragment,escapePreservingEscapes,removeDotSegments,isIPv4,isUUID,normalizeIPv6,stringArrayToHexStripped}});var require_schemes=__commonJS(function(exports,module){var{isUUID}=require_utils();var URN_REG=/^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;var supportedSchemeNames=["http","https","ws","wss","urn","urn:uuid"];function isValidSchemeName(name){return supportedSchemeNames.indexOf(name)!==-1}function wsIsSecure(wsComponent){if(wsComponent.secure===true){return true}else if(wsComponent.secure===false){return false}else if(wsComponent.scheme){return wsComponent.scheme.length===3&&(wsComponent.scheme[0]==="w"||wsComponent.scheme[0]==="W")&&(wsComponent.scheme[1]==="s"||wsComponent.scheme[1]==="S")&&(wsComponent.scheme[2]==="s"||wsComponent.scheme[2]==="S")}else{return false}}function httpParse(component){if(!component.host){component.error=component.error||"HTTP URIs must have a host."}return component}function httpSerialize(component){const secure=String(component.scheme).toLowerCase()==="https";if(component.port===(secure?443:80)||component.port===""){component.port=undefined}if(!component.path){component.path="/"}return component}function wsParse(wsComponent){wsComponent.secure=wsIsSecure(wsComponent);wsComponent.resourceName=(wsComponent.path||"/")+(wsComponent.query?"?"+wsComponent.query:"");wsComponent.path=undefined;wsComponent.query=undefined;return wsComponent}function wsSerialize(wsComponent){if(wsComponent.port===(wsIsSecure(wsComponent)?443:80)||wsComponent.port===""){wsComponent.port=undefined}if(typeof wsComponent.secure==="boolean"){wsComponent.scheme=wsComponent.secure?"wss":"ws";wsComponent.secure=undefined}if(wsComponent.resourceName){const queryIndex=wsComponent.resourceName.indexOf("?");const path=queryIndex===-1?wsComponent.resourceName:wsComponent.resourceName.slice(0,queryIndex);wsComponent.path=path&&path!=="/"?path:undefined;wsComponent.query=queryIndex===-1?undefined:wsComponent.resourceName.slice(queryIndex+1);wsComponent.resourceName=undefined}wsComponent.fragment=undefined;return wsComponent}function urnParse(urnComponent,options){if(!urnComponent.path){urnComponent.error="URN can not be parsed";return urnComponent}const matches=urnComponent.path.match(URN_REG);if(matches&&matches[0]===urnComponent.path){const scheme=options.scheme||urnComponent.scheme||"urn";urnComponent.nid=matches[1].toLowerCase();urnComponent.nss=matches[2];const urnScheme=`${scheme}:${options.nid||urnComponent.nid}`;const schemeHandler=getSchemeHandler(urnScheme);urnComponent.path=undefined;if(schemeHandler){urnComponent=schemeHandler.parse(urnComponent,options)}}else{urnComponent.error=urnComponent.error||"URN can not be parsed."}return urnComponent}function urnSerialize(urnComponent,options){if(urnComponent.nid===undefined){throw new Error("URN without nid cannot be serialized")}const scheme=options.scheme||urnComponent.scheme||"urn";const nid=urnComponent.nid.toLowerCase();const urnScheme=`${scheme}:${options.nid||nid}`;const schemeHandler=getSchemeHandler(urnScheme);if(schemeHandler){urnComponent=schemeHandler.serialize(urnComponent,options)}const uriComponent=urnComponent;const nss=urnComponent.nss;uriComponent.path=`${nid||options.nid}:${nss}`;options.skipEscape=true;return uriComponent}function urnuuidParse(urnComponent,options){const uuidComponent=urnComponent;uuidComponent.uuid=uuidComponent.nss;uuidComponent.nss=undefined;if(!options.tolerant&&(!uuidComponent.uuid||!isUUID(uuidComponent.uuid))){uuidComponent.error=uuidComponent.error||"UUID is not valid."}return uuidComponent}function urnuuidSerialize(uuidComponent){const urnComponent=uuidComponent;urnComponent.nss=(uuidComponent.uuid||"").toLowerCase();return urnComponent}var http={scheme:"http",domainHost:true,parse:httpParse,serialize:httpSerialize};var https={scheme:"https",domainHost:http.domainHost,parse:httpParse,serialize:httpSerialize};var ws={scheme:"ws",domainHost:true,parse:wsParse,serialize:wsSerialize};var wss={scheme:"wss",domainHost:ws.domainHost,parse:ws.parse,serialize:ws.serialize};var urn={scheme:"urn",parse:urnParse,serialize:urnSerialize,skipNormalize:true};var urnuuid={scheme:"urn:uuid",parse:urnuuidParse,serialize:urnuuidSerialize,skipNormalize:true};var SCHEMES={http,https,ws,wss,urn,"urn:uuid":urnuuid};Object.setPrototypeOf(SCHEMES,null);function getSchemeHandler(scheme){return scheme&&(SCHEMES[scheme]||SCHEMES[scheme.toLowerCase()])||undefined}module.exports={wsIsSecure,SCHEMES,isValidSchemeName,getSchemeHandler}});var require_fast_uri=__commonJS(function(exports,module){var{normalizeIPv6,removeDotSegments,recomposeAuthority,normalizePercentEncoding,normalizePathEncoding,serializePathEncoding,normalizeQueryFragmentEncoding,encodeQuery,encodeFragment,reescapeHostDelimiters,isIPv4,nonSimpleDomain}=require_utils();var{SCHEMES,getSchemeHandler}=require_schemes();var VALID_SCHEME=/^[A-Za-z][A-Za-z0-9+.-]*$/u;var MALFORMED_SCHEME_ERROR="URI scheme is malformed.";function decodeValidScheme(scheme){const decodedScheme=unescape(String(scheme));if(!VALID_SCHEME.test(decodedScheme)){throw new TypeError(MALFORMED_SCHEME_ERROR)}return decodedScheme}function normalize(uri,options){if(typeof uri==="string"){uri=normalizeString(uri,options)}else if(typeof uri==="object"){uri=parse(serialize(uri,options),options)}return uri}function resolve(baseURI,relativeURI,options){const schemelessOptions=options?Object.assign({scheme:"null"},options):{scheme:"null"};const{parsed:baseParsed,malformedAuthorityOrPort:baseMalformed,malformedPercentEncoding:baseMalformedPercentEncoding,malformedSchemeSpecific:baseMalformedSchemeSpecific,malformedHost:baseMalformedHost,malformedScheme:baseMalformedScheme}=parseWithStatus(baseURI,schemelessOptions);const{parsed:relativeParsed,malformedAuthorityOrPort:relativeMalformed,malformedPercentEncoding:relativeMalformedPercentEncoding,malformedSchemeSpecific:relativeMalformedSchemeSpecific,malformedHost:relativeMalformedHost,malformedScheme:relativeMalformedScheme}=parseWithStatus(relativeURI,schemelessOptions);if(baseMalformed||relativeMalformed||baseMalformedPercentEncoding||relativeMalformedPercentEncoding||baseMalformedSchemeSpecific||relativeMalformedSchemeSpecific||baseMalformedHost||relativeMalformedHost||baseMalformedScheme||relativeMalformedScheme){throw new Error(baseParsed.error||relativeParsed.error||"URI is malformed.")}const resolved=resolveComponent(baseParsed,relativeParsed,schemelessOptions,true);const resolvedSchemeHandler=getSchemeHandler(options&&options.scheme||resolved.scheme);const resolvedHost=resolved.host;const resolvedHostIsIP=resolvedHost!==undefined&&resolvedHost!==""&&(isIPv4(resolvedHost)||normalizeIPv6(resolvedHost).isIPV6);canonicalizeHost(resolved,options||{},resolvedSchemeHandler,resolvedHostIsIP);const encodedASCIIHost=resolvedHost&&resolvedHost.indexOf("%")!==-1&&!/\P{ASCII}/u.test(resolvedHost);if(resolved.error&&!encodedASCIIHost){throw new Error(resolved.error)}schemelessOptions.skipEscape=true;return serialize(resolved,schemelessOptions)}function resolveComponent(base,relative,options,skipNormalization){const target={};if(!skipNormalization){base=parse(serialize(base,options),options);relative=parse(serialize(relative,options),options)}options=options||{};if(!options.tolerant&&relative.scheme){target.scheme=relative.scheme;target.userinfo=relative.userinfo;target.host=relative.host;target.port=relative.port;target.path=removeDotSegments(relative.path||"");target.query=relative.query}else{if(relative.userinfo!==undefined||relative.host!==undefined||relative.port!==undefined){target.userinfo=relative.userinfo;target.host=relative.host;target.port=relative.port;target.path=removeDotSegments(relative.path||"");target.query=relative.query}else{if(!relative.path){target.path=base.path;if(relative.query!==undefined){target.query=relative.query}else{target.query=base.query}}else{if(relative.path[0]==="/"){target.path=removeDotSegments(relative.path)}else{if((base.userinfo!==undefined||base.host!==undefined||base.port!==undefined)&&!base.path){target.path="/"+relative.path}else if(!base.path){target.path=relative.path}else{target.path=base.path.slice(0,base.path.lastIndexOf("/")+1)+relative.path}target.path=removeDotSegments(target.path)}target.query=relative.query}target.userinfo=base.userinfo;target.host=base.host;target.port=base.port}target.scheme=base.scheme}target.fragment=relative.fragment;return target}function equal(uriA,uriB,options){const normalizedA=normalizeComparableURI(uriA,options);const normalizedB=normalizeComparableURI(uriB,options);return normalizedA!==undefined&&normalizedB!==undefined&&normalizedA===normalizedB}function serialize(cmpts,opts){const component={host:cmpts.host,scheme:cmpts.scheme,userinfo:cmpts.userinfo,port:cmpts.port,path:cmpts.path,query:cmpts.query,nid:cmpts.nid,nss:cmpts.nss,uuid:cmpts.uuid,fragment:cmpts.fragment,reference:cmpts.reference,resourceName:cmpts.resourceName,secure:cmpts.secure,error:""};const options=Object.assign({},opts);const uriTokens=[];if(component.scheme){component.scheme=decodeValidScheme(component.scheme)}const schemeHandler=getSchemeHandler(options.scheme||component.scheme);if(schemeHandler&&schemeHandler.serialize)schemeHandler.serialize(component,options);const hasAuthority=component.userinfo!==undefined||component.host!==undefined||component.port!==undefined;const pathNoScheme=!options.skipEscape&&component.scheme===undefined&&!hasAuthority;if(component.path!==undefined){if(!options.skipEscape){component.path=serializePathEncoding(component.path,pathNoScheme)}else{component.path=normalizePercentEncoding(component.path)}}if(options.reference!=="suffix"&&component.scheme){component.scheme=decodeValidScheme(component.scheme);uriTokens.push(component.scheme,":")}const authority=recomposeAuthority(component);if(authority!==undefined){if(options.reference!=="suffix"){uriTokens.push("//")}uriTokens.push(authority);if(component.path&&component.path[0]!=="/"){uriTokens.push("/")}}if(component.path!==undefined){let s=component.path;if(!options.absolutePath&&(!schemeHandler||!schemeHandler.absolutePath)){s=removeDotSegments(s)}if(pathNoScheme){s=serializePathEncoding(s,true)}if(authority===undefined&&s[0]==="/"&&s[1]==="/"){s="/%2F"+s.slice(2)}uriTokens.push(s)}if(component.query!==undefined){uriTokens.push("?",encodeQuery(component.query))}if(component.fragment!==undefined){uriTokens.push("#",encodeFragment(component.fragment))}return uriTokens.join("")}var URI_PARSE=/^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;var AUTHORITY_PREFIX=/^(?:[^#/:?]+:)?\/\/([^/?#]*)/;var AUTHORITY_INTRODUCER_REGION=/^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;function getParseError(parsed,matches){if(matches[2]!==undefined&&parsed.path&&parsed.path[0]!=="/"){return'URI path must start with "/" when authority is present.'}if(typeof parsed.port==="number"&&(parsed.port<0||parsed.port>65535)){return"URI port is malformed."}return}function hasMalformedPercentEncoding(component){if(component===undefined)return false;let percent=component.indexOf("%");while(percent!==-1){if(percent+2>=component.length||!/^[\da-f]{2}$/iu.test(component.slice(percent+1,percent+3))){return true}percent=component.indexOf("%",percent+3)}return false}function isIPLiteral(host){return host[0]==="["&&host[host.length-1]==="]"}function hasMalformedComponentPercentEncoding(matches){const host=matches[4];return hasMalformedPercentEncoding(matches[3])||host!==undefined&&!isIPLiteral(host)&&hasMalformedPercentEncoding(host)||hasMalformedPercentEncoding(matches[6])||hasMalformedPercentEncoding(matches[7])||hasMalformedPercentEncoding(matches[8])}function canonicalizeHost(parsed,options,schemeHandler,isIP){if(!options.unicodeSupport&&(!schemeHandler||!schemeHandler.unicodeSupport)&&parsed.host&&!isIPLiteral(parsed.host)&&(options.domainHost||schemeHandler&&schemeHandler.domainHost)&&isIP===false&&nonSimpleDomain(parsed.host)){try{parsed.host=new URL("http://"+parsed.host).hostname}catch(e){parsed.error=parsed.error||"Host's domain name can not be converted to ASCII: "+e;return true}}return false}function parseWithStatus(uri,opts){const options=Object.assign({},opts);const parsed={scheme:undefined,userinfo:undefined,host:"",port:undefined,path:"",query:undefined,fragment:undefined};let malformedAuthorityOrPort=false;let malformedPercentEncoding=false;let malformedSchemeSpecific=false;let malformedHost=false;let malformedIPLiteral=false;let malformedScheme=false;let isIP=false;if(options.reference==="suffix"){if(options.scheme){uri=options.scheme+":"+uri}else{uri="//"+uri}}const authorityMatch=uri.match(AUTHORITY_PREFIX);if(authorityMatch!==null&&authorityMatch[1].indexOf("\\")!==-1){parsed.error="URI authority must not contain a literal backslash.";malformedAuthorityOrPort=true}const introducerMatch=uri.match(AUTHORITY_INTRODUCER_REGION);if(introducerMatch!==null){const region=introducerMatch[1];const normalizedRegion=region.replace(/[\t\n\r]/g,"");if(normalizedRegion.length>=2){if(normalizedRegion.slice(0,2)!=="//"){parsed.error=parsed.error||"URI authority must not contain a literal backslash.";malformedAuthorityOrPort=true}else if(region.length!==normalizedRegion.length){parsed.error=parsed.error||"URI authority introducer must not contain whitespace.";malformedAuthorityOrPort=true}}}const matches=uri.match(URI_PARSE);if(matches){parsed.scheme=matches[1];parsed.userinfo=matches[3];parsed.host=matches[4];parsed.port=parseInt(matches[5],10);parsed.path=matches[6]||"";parsed.query=matches[7];parsed.fragment=matches[8];if(parsed.scheme!==undefined){const decodedScheme=unescape(parsed.scheme);if(VALID_SCHEME.test(decodedScheme)){parsed.scheme=decodedScheme.toLowerCase()}else{parsed.error=parsed.error||MALFORMED_SCHEME_ERROR;malformedScheme=true}}malformedPercentEncoding=hasMalformedComponentPercentEncoding(matches);if(malformedPercentEncoding){parsed.error=parsed.error||"URI contains malformed percent-encoding."}if(isNaN(parsed.port)){parsed.port=matches[5]}const parseError=getParseError(parsed,matches);if(parseError!==undefined){parsed.error=parsed.error||parseError;malformedAuthorityOrPort=true}if(parsed.host){const ipv4result=isIPv4(parsed.host);if(ipv4result===false){const bracketedIPLiteral=isIPLiteral(parsed.host);const hasIPLiteralBracket=parsed.host.indexOf("[")!==-1||parsed.host.indexOf("]")!==-1;const ipv6result=normalizeIPv6(parsed.host);isIP=ipv6result.isIPV6||ipv6result.isIPVFuture===true;malformedIPLiteral=hasIPLiteralBracket&&(!bracketedIPLiteral||ipv6result.error===true);parsed.host=isIP?ipv6result.host:ipv6result.host.toLowerCase();if(malformedIPLiteral){parsed.error=parsed.error||"URI host is malformed.";malformedAuthorityOrPort=true}}else{isIP=true}}if(parsed.scheme===undefined&&parsed.userinfo===undefined&&parsed.host===undefined&&parsed.port===undefined&&parsed.query===undefined&&!parsed.path){parsed.reference="same-document"}else if(parsed.scheme===undefined){parsed.reference="relative"}else if(parsed.fragment===undefined){parsed.reference="absolute"}else{parsed.reference="uri"}if(options.reference&&options.reference!=="suffix"&&options.reference!==parsed.reference){parsed.error=parsed.error||"URI is not a "+options.reference+" reference."}const schemeHandler=getSchemeHandler(options.scheme||parsed.scheme);if(!malformedIPLiteral){malformedHost=canonicalizeHost(parsed,options,schemeHandler,isIP)}if(!schemeHandler||schemeHandler&&!schemeHandler.skipNormalize){if(uri.indexOf("%")!==-1){if(parsed.host!==undefined&&!malformedIPLiteral){const host=isIP?parsed.host:normalizePercentEncoding(parsed.host,true);parsed.host=reescapeHostDelimiters(host,isIP)}}if(parsed.path){parsed.path=normalizePathEncoding(parsed.path)}if(parsed.query){parsed.query=normalizeQueryFragmentEncoding(parsed.query)}if(parsed.fragment){parsed.fragment=normalizeQueryFragmentEncoding(parsed.fragment)}}if(schemeHandler&&schemeHandler.parse){schemeHandler.parse(parsed,options);if(schemeHandler===SCHEMES.urn&&parsed.nid===undefined){malformedSchemeSpecific=true}}}else{parsed.error=parsed.error||"URI can not be parsed."}return{parsed,malformedAuthorityOrPort,malformedPercentEncoding,malformedSchemeSpecific,malformedHost,malformedScheme}}function parse(uri,opts){return parseWithStatus(uri,opts).parsed}function normalizeString(uri,opts){return normalizeStringWithStatus(uri,opts).normalized}function normalizeStringWithStatus(uri,opts){const{parsed,malformedAuthorityOrPort,malformedPercentEncoding,malformedSchemeSpecific,malformedHost,malformedScheme}=parseWithStatus(uri,opts);return{normalized:malformedAuthorityOrPort||malformedPercentEncoding||malformedSchemeSpecific||malformedHost||malformedScheme?uri:serialize(parsed,opts),malformedAuthorityOrPort,malformedPercentEncoding,malformedSchemeSpecific,malformedHost,malformedScheme}}function normalizeComparableURI(uri,opts){if(typeof uri!=="string"&&typeof uri!=="object"){return}let value;try{value=typeof uri==="string"?uri:serialize(uri,opts)}catch{return}const{normalized,malformedAuthorityOrPort,malformedPercentEncoding,malformedSchemeSpecific,malformedHost,malformedScheme}=normalizeStringWithStatus(value,opts);return malformedAuthorityOrPort||malformedPercentEncoding||malformedSchemeSpecific||malformedHost||malformedScheme?undefined:normalized}var fastUri={SCHEMES,normalize,resolve,resolveComponent,equal,serialize,parse};module.exports=fastUri;module.exports.default=fastUri;module.exports.fastUri=fastUri});var require_uri=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var uri=require_fast_uri();uri.code='require("ajv/dist/runtime/uri").default';exports.default=uri});var require_core=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.CodeGen=exports.Name=exports.nil=exports.stringify=exports.str=exports._=exports.KeywordCxt=undefined;var validate_1=require_validate();Object.defineProperty(exports,"KeywordCxt",{enumerable:true,get:function(){return validate_1.KeywordCxt}});var codegen_1=require_codegen();Object.defineProperty(exports,"_",{enumerable:true,get:function(){return codegen_1._}});Object.defineProperty(exports,"str",{enumerable:true,get:function(){return codegen_1.str}});Object.defineProperty(exports,"stringify",{enumerable:true,get:function(){return codegen_1.stringify}});Object.defineProperty(exports,"nil",{enumerable:true,get:function(){return codegen_1.nil}});Object.defineProperty(exports,"Name",{enumerable:true,get:function(){return codegen_1.Name}});Object.defineProperty(exports,"CodeGen",{enumerable:true,get:function(){return codegen_1.CodeGen}});var validation_error_1=require_validation_error();var ref_error_1=require_ref_error();var rules_1=require_rules();var compile_1=require_compile();var codegen_2=require_codegen();var resolve_1=require_resolve();var dataType_1=require_dataType();var util_1=require_util();var $dataRefSchema=require_data();var uri_1=require_uri();var defaultRegExp=(str,flags)=>new RegExp(str,flags);defaultRegExp.code="new RegExp";var META_IGNORE_OPTIONS=["removeAdditional","useDefaults","coerceTypes"];var EXT_SCOPE_NAMES=new Set(["validate","serialize","parse","wrapper","root","schema","keyword","pattern","formats","validate$data","func","obj","Error"]);var removedOptions={errorDataPath:"",format:"`validateFormats: false` can be used instead.",nullable:'"nullable" keyword is supported by default.',jsonPointers:"Deprecated jsPropertySyntax can be used instead.",extendRefs:"Deprecated ignoreKeywordsWithRef can be used instead.",missingRefs:"Pass empty schema with $id that should be ignored to ajv.addSchema.",processCode:"Use option `code: {process: (code, schemaEnv: object) => string}`",sourceCode:"Use option `code: {source: true}`",strictDefaults:"It is default now, see option `strict`.",strictKeywords:"It is default now, see option `strict`.",uniqueItems:'"uniqueItems" keyword is always validated.',unknownFormats:"Disable strict mode or pass `true` to `ajv.addFormat` (or `formats` option).",cache:"Map is used as cache, schema object as key.",serialize:"Map is used as cache, schema object as key.",ajvErrors:"It is default now."};var deprecatedOptions={ignoreKeywordsWithRef:"",jsPropertySyntax:"",unicode:'"minLength"/"maxLength" account for unicode characters by default.'};var MAX_EXPRESSION=200;function requiredOptions(o){var _a,_b,_c,_d,_e,_f,_g,_h,_j,_k,_l,_m,_o,_p,_q,_r,_s,_t,_u,_v,_w,_x,_y,_z,_0;const s=o.strict;const _optz=(_a=o.code)===null||_a===undefined?undefined:_a.optimize;const optimize=_optz===true||_optz===undefined?1:_optz||0;const regExp=(_c=(_b=o.code)===null||_b===undefined?undefined:_b.regExp)!==null&&_c!==undefined?_c:defaultRegExp;const uriResolver=(_d=o.uriResolver)!==null&&_d!==undefined?_d:uri_1.default;return{strictSchema:(_f=(_e=o.strictSchema)!==null&&_e!==undefined?_e:s)!==null&&_f!==undefined?_f:true,strictNumbers:(_h=(_g=o.strictNumbers)!==null&&_g!==undefined?_g:s)!==null&&_h!==undefined?_h:true,strictTypes:(_k=(_j=o.strictTypes)!==null&&_j!==undefined?_j:s)!==null&&_k!==undefined?_k:"log",strictTuples:(_m=(_l=o.strictTuples)!==null&&_l!==undefined?_l:s)!==null&&_m!==undefined?_m:"log",strictRequired:(_p=(_o=o.strictRequired)!==null&&_o!==undefined?_o:s)!==null&&_p!==undefined?_p:false,code:o.code?{...o.code,optimize,regExp}:{optimize,regExp},loopRequired:(_q=o.loopRequired)!==null&&_q!==undefined?_q:MAX_EXPRESSION,loopEnum:(_r=o.loopEnum)!==null&&_r!==undefined?_r:MAX_EXPRESSION,meta:(_s=o.meta)!==null&&_s!==undefined?_s:true,messages:(_t=o.messages)!==null&&_t!==undefined?_t:true,inlineRefs:(_u=o.inlineRefs)!==null&&_u!==undefined?_u:true,schemaId:(_v=o.schemaId)!==null&&_v!==undefined?_v:"$id",addUsedSchema:(_w=o.addUsedSchema)!==null&&_w!==undefined?_w:true,validateSchema:(_x=o.validateSchema)!==null&&_x!==undefined?_x:true,validateFormats:(_y=o.validateFormats)!==null&&_y!==undefined?_y:true,unicodeRegExp:(_z=o.unicodeRegExp)!==null&&_z!==undefined?_z:true,int32range:(_0=o.int32range)!==null&&_0!==undefined?_0:true,uriResolver}}class Ajv{constructor(opts={}){this.schemas={};this.refs={};this.formats=Object.create(null);this._compilations=new Set;this._loading={};this._cache=new Map;opts=this.opts={...opts,...requiredOptions(opts)};const{es5,lines}=this.opts.code;this.scope=new codegen_2.ValueScope({scope:{},prefixes:EXT_SCOPE_NAMES,es5,lines});this.logger=getLogger(opts.logger);const formatOpt=opts.validateFormats;opts.validateFormats=false;this.RULES=(0,rules_1.getRules)();checkOptions.call(this,removedOptions,opts,"NOT SUPPORTED");checkOptions.call(this,deprecatedOptions,opts,"DEPRECATED","warn");this._metaOpts=getMetaSchemaOptions.call(this);if(opts.formats)addInitialFormats.call(this);this._addVocabularies();this._addDefaultMetaSchema();if(opts.keywords)addInitialKeywords.call(this,opts.keywords);if(typeof opts.meta=="object")this.addMetaSchema(opts.meta);addInitialSchemas.call(this);opts.validateFormats=formatOpt}_addVocabularies(){this.addKeyword("$async")}_addDefaultMetaSchema(){const{$data,meta,schemaId}=this.opts;let _dataRefSchema=$dataRefSchema;if(schemaId==="id"){_dataRefSchema={...$dataRefSchema};_dataRefSchema.id=_dataRefSchema.$id;delete _dataRefSchema.$id}if(meta&&$data)this.addMetaSchema(_dataRefSchema,_dataRefSchema[schemaId],false)}defaultMeta(){const{meta,schemaId}=this.opts;return this.opts.defaultMeta=typeof meta=="object"?meta[schemaId]||meta:undefined}validate(schemaKeyRef,data){let v;if(typeof schemaKeyRef=="string"){v=this.getSchema(schemaKeyRef);if(!v)throw new Error(`no schema with key or ref "${schemaKeyRef}"`)}else{v=this.compile(schemaKeyRef)}const valid=v(data);if(!("$async"in v))this.errors=v.errors;return valid}compile(schema,_meta){const sch=this._addSchema(schema,_meta);return sch.validate||this._compileSchemaEnv(sch)}compileAsync(schema,meta){if(typeof this.opts.loadSchema!="function"){throw new Error("options.loadSchema should be a function")}const{loadSchema}=this.opts;return runCompileAsync.call(this,schema,meta);async function runCompileAsync(_schema,_meta){await loadMetaSchema.call(this,_schema.$schema);const sch=this._addSchema(_schema,_meta);return sch.validate||_compileAsync.call(this,sch)}async function loadMetaSchema($ref){if($ref&&!this.getSchema($ref)){await runCompileAsync.call(this,{$ref},true)}}async function _compileAsync(sch){try{return this._compileSchemaEnv(sch)}catch(e){if(!(e instanceof ref_error_1.default))throw e;checkLoaded.call(this,e);await loadMissingSchema.call(this,e.missingSchema);return _compileAsync.call(this,sch)}}function checkLoaded({missingSchema:ref,missingRef}){if(this.refs[ref]){throw new Error(`AnySchema ${ref} is loaded but ${missingRef} cannot be resolved`)}}async function loadMissingSchema(ref){const _schema=await _loadSchema.call(this,ref);if(!this.refs[ref])await loadMetaSchema.call(this,_schema.$schema);if(!this.refs[ref])this.addSchema(_schema,ref,meta)}async function _loadSchema(ref){const p=this._loading[ref];if(p)return p;try{return await(this._loading[ref]=loadSchema(ref))}finally{delete this._loading[ref]}}}addSchema(schema,key,_meta,_validateSchema=this.opts.validateSchema){if(Array.isArray(schema)){for(const sch of schema)this.addSchema(sch,undefined,_meta,_validateSchema);return this}let id;if(typeof schema==="object"){const{schemaId}=this.opts;id=schema[schemaId];if(id!==undefined&&typeof id!="string"){throw new Error(`schema ${schemaId} must be string`)}}key=(0,resolve_1.normalizeId)(key||id);this._checkUnique(key);this.schemas[key]=this._addSchema(schema,_meta,key,_validateSchema,true);return this}addMetaSchema(schema,key,_validateSchema=this.opts.validateSchema){this.addSchema(schema,key,true,_validateSchema);return this}validateSchema(schema,throwOrLogError){if(typeof schema=="boolean")return true;let $schema;$schema=schema.$schema;if($schema!==undefined&&typeof $schema!="string"){throw new Error("$schema must be a string")}$schema=$schema||this.opts.defaultMeta||this.defaultMeta();if(!$schema){this.logger.warn("meta-schema not available");this.errors=null;return true}const valid=this.validate($schema,schema);if(!valid&&throwOrLogError){const message="schema is invalid: "+this.errorsText();if(this.opts.validateSchema==="log")this.logger.error(message);else throw new Error(message)}return valid}getSchema(keyRef){let sch;while(typeof(sch=getSchEnv.call(this,keyRef))=="string")keyRef=sch;if(sch===undefined){const{schemaId}=this.opts;const root=new compile_1.SchemaEnv({schema:{},schemaId});sch=compile_1.resolveSchema.call(this,root,keyRef);if(!sch)return;this.refs[keyRef]=sch}return sch.validate||this._compileSchemaEnv(sch)}removeSchema(schemaKeyRef){if(schemaKeyRef instanceof RegExp){this._removeAllSchemas(this.schemas,schemaKeyRef);this._removeAllSchemas(this.refs,schemaKeyRef);return this}switch(typeof schemaKeyRef){case"undefined":this._removeAllSchemas(this.schemas);this._removeAllSchemas(this.refs);this._cache.clear();return this;case"string":{const sch=getSchEnv.call(this,schemaKeyRef);if(typeof sch=="object")this._cache.delete(sch.schema);delete this.schemas[schemaKeyRef];delete this.refs[schemaKeyRef];return this}case"object":{const cacheKey=schemaKeyRef;this._cache.delete(cacheKey);let id=schemaKeyRef[this.opts.schemaId];if(id){id=(0,resolve_1.normalizeId)(id);delete this.schemas[id];delete this.refs[id]}return this}default:throw new Error("ajv.removeSchema: invalid parameter")}}addVocabulary(definitions){for(const def of definitions)this.addKeyword(def);return this}addKeyword(kwdOrDef,def){let keyword;if(typeof kwdOrDef=="string"){keyword=kwdOrDef;if(typeof def=="object"){this.logger.warn("these parameters are deprecated, see docs for addKeyword");def.keyword=keyword}}else if(typeof kwdOrDef=="object"&&def===undefined){def=kwdOrDef;keyword=def.keyword;if(Array.isArray(keyword)&&!keyword.length){throw new Error("addKeywords: keyword must be string or non-empty array")}}else{throw new Error("invalid addKeywords parameters")}checkKeyword.call(this,keyword,def);if(!def){(0,util_1.eachItem)(keyword,(kwd)=>addRule.call(this,kwd));return this}keywordMetaschema.call(this,def);const definition={...def,type:(0,dataType_1.getJSONTypes)(def.type),schemaType:(0,dataType_1.getJSONTypes)(def.schemaType)};(0,util_1.eachItem)(keyword,definition.type.length===0?(k)=>addRule.call(this,k,definition):(k)=>definition.type.forEach((t)=>addRule.call(this,k,definition,t)));return this}getKeyword(keyword){const rule=this.RULES.all[keyword];return typeof rule=="object"?rule.definition:!!rule}removeKeyword(keyword){const{RULES}=this;delete RULES.keywords[keyword];delete RULES.all[keyword];for(const group of RULES.rules){const i=group.rules.findIndex((rule)=>rule.keyword===keyword);if(i>=0)group.rules.splice(i,1)}return this}addFormat(name,format){if(typeof format=="string")format=new RegExp(format);this.formats[name]=format;return this}errorsText(errors=this.errors,{separator=", ",dataVar="data"}={}){if(!errors||errors.length===0)return"No errors";return errors.map((e)=>`${dataVar}${e.instancePath} ${e.message}`).reduce((text,msg)=>text+separator+msg)}$dataMetaSchema(metaSchema,keywordsJsonPointers){const rules=this.RULES.all;metaSchema=JSON.parse(JSON.stringify(metaSchema));for(const jsonPointer of keywordsJsonPointers){const segments=jsonPointer.split("/").slice(1);let keywords=metaSchema;for(const seg of segments)keywords=keywords[seg];for(const key in rules){const rule=rules[key];if(typeof rule!="object")continue;const{$data}=rule.definition;const schema=keywords[key];if($data&&schema)keywords[key]=schemaOrData(schema)}}return metaSchema}_removeAllSchemas(schemas,regex){for(const keyRef in schemas){const sch=schemas[keyRef];if(!regex||regex.test(keyRef)){if(typeof sch=="string"){delete schemas[keyRef]}else if(sch&&!sch.meta){this._cache.delete(sch.schema);delete schemas[keyRef]}}}}_addSchema(schema,meta,baseId,validateSchema=this.opts.validateSchema,addSchema=this.opts.addUsedSchema){let id;const{schemaId}=this.opts;if(typeof schema=="object"){id=schema[schemaId]}else{if(this.opts.jtd)throw new Error("schema must be object");else if(typeof schema!="boolean")throw new Error("schema must be object or boolean")}let sch=this._cache.get(schema);if(sch!==undefined)return sch;baseId=(0,resolve_1.normalizeId)(id||baseId);const localRefs=resolve_1.getSchemaRefs.call(this,schema,baseId);sch=new compile_1.SchemaEnv({schema,schemaId,meta,baseId,localRefs});this._cache.set(sch.schema,sch);if(addSchema&&!baseId.startsWith("#")){if(baseId)this._checkUnique(baseId);this.refs[baseId]=sch}if(validateSchema)this.validateSchema(schema,true);return sch}_checkUnique(id){if(this.schemas[id]||this.refs[id]){throw new Error(`schema with key or id "${id}" already exists`)}}_compileSchemaEnv(sch){if(sch.meta)this._compileMetaSchema(sch);else compile_1.compileSchema.call(this,sch);if(!sch.validate)throw new Error("ajv implementation error");return sch.validate}_compileMetaSchema(sch){const currentOpts=this.opts;this.opts=this._metaOpts;try{compile_1.compileSchema.call(this,sch)}finally{this.opts=currentOpts}}}Ajv.ValidationError=validation_error_1.default;Ajv.MissingRefError=ref_error_1.default;exports.default=Ajv;function checkOptions(checkOpts,options,msg,log="error"){for(const key in checkOpts){const opt=key;if(opt in options)this.logger[log](`${msg}: option ${key}. ${checkOpts[opt]}`)}}function getSchEnv(keyRef){keyRef=(0,resolve_1.normalizeId)(keyRef);return this.schemas[keyRef]||this.refs[keyRef]}function addInitialSchemas(){const optsSchemas=this.opts.schemas;if(!optsSchemas)return;if(Array.isArray(optsSchemas))this.addSchema(optsSchemas);else for(const key in optsSchemas)this.addSchema(optsSchemas[key],key)}function addInitialFormats(){for(const name in this.opts.formats){const format=this.opts.formats[name];if(format)this.addFormat(name,format)}}function addInitialKeywords(defs){if(Array.isArray(defs)){this.addVocabulary(defs);return}this.logger.warn("keywords option as map is deprecated, pass array");for(const keyword in defs){const def=defs[keyword];if(!def.keyword)def.keyword=keyword;this.addKeyword(def)}}function getMetaSchemaOptions(){const metaOpts={...this.opts};for(const opt of META_IGNORE_OPTIONS)delete metaOpts[opt];return metaOpts}var noLogs={log(){},warn(){},error(){}};function getLogger(logger){if(logger===false)return noLogs;if(logger===undefined)return console;if(logger.log&&logger.warn&&logger.error)return logger;throw new Error("logger must implement log, warn and error methods")}var KEYWORD_NAME=/^[a-z_$][a-z0-9_$:-]*$/i;function checkKeyword(keyword,def){const{RULES}=this;(0,util_1.eachItem)(keyword,(kwd)=>{if(RULES.keywords[kwd])throw new Error(`Keyword ${kwd} is already defined`);if(!KEYWORD_NAME.test(kwd))throw new Error(`Keyword ${kwd} has invalid name`)});if(!def)return;if(def.$data&&!(("code"in def)||("validate"in def))){throw new Error('$data keyword must have "code" or "validate" function')}}function addRule(keyword,definition,dataType){var _a;const post=definition===null||definition===undefined?undefined:definition.post;if(dataType&&post)throw new Error('keyword with "post" flag cannot have "type"');const{RULES}=this;let ruleGroup=post?RULES.post:RULES.rules.find(({type:t})=>t===dataType);if(!ruleGroup){ruleGroup={type:dataType,rules:[]};RULES.rules.push(ruleGroup)}RULES.keywords[keyword]=true;if(!definition)return;const rule={keyword,definition:{...definition,type:(0,dataType_1.getJSONTypes)(definition.type),schemaType:(0,dataType_1.getJSONTypes)(definition.schemaType)}};if(definition.before)addBeforeRule.call(this,ruleGroup,rule,definition.before);else ruleGroup.rules.push(rule);RULES.all[keyword]=rule;(_a=definition.implements)===null||_a===undefined||_a.forEach((kwd)=>this.addKeyword(kwd))}function addBeforeRule(ruleGroup,rule,before){const i=ruleGroup.rules.findIndex((_rule)=>_rule.keyword===before);if(i>=0){ruleGroup.rules.splice(i,0,rule)}else{ruleGroup.rules.push(rule);this.logger.warn(`rule ${before} is not defined`)}}function keywordMetaschema(def){let{metaSchema}=def;if(metaSchema===undefined)return;if(def.$data&&this.opts.$data)metaSchema=schemaOrData(metaSchema);def.validateSchema=this.compile(metaSchema,true)}var $dataRef={$ref:"https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#"};function schemaOrData(schema){return{anyOf:[schema,$dataRef]}}});var require_id=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var def={keyword:"id",code(){throw new Error('NOT SUPPORTED: keyword "id", use "$id" for schema ID')}};exports.default=def});var require_ref=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.callRef=exports.getValidate=undefined;var ref_error_1=require_ref_error();var code_1=require_code2();var codegen_1=require_codegen();var names_1=require_names();var compile_1=require_compile();var util_1=require_util();var def={keyword:"$ref",schemaType:"string",code(cxt){const{gen,schema:$ref,it}=cxt;const{baseId,schemaEnv:env,validateName,opts,self}=it;const{root}=env;if(($ref==="#"||$ref==="#/")&&baseId===root.baseId)return callRootRef();const schOrEnv=compile_1.resolveRef.call(self,root,baseId,$ref);if(schOrEnv===undefined)throw new ref_error_1.default(it.opts.uriResolver,baseId,$ref);if(schOrEnv instanceof compile_1.SchemaEnv)return callValidate(schOrEnv);return inlineRefSchema(schOrEnv);function callRootRef(){if(env===root)return callRef(cxt,validateName,env,env.$async);const rootName=gen.scopeValue("root",{ref:root});return callRef(cxt,(0,codegen_1._)`${rootName}.validate`,root,root.$async)}function callValidate(sch){const v=getValidate(cxt,sch);callRef(cxt,v,sch,sch.$async)}function inlineRefSchema(sch){const schName=gen.scopeValue("schema",opts.code.source===true?{ref:sch,code:(0,codegen_1.stringify)(sch)}:{ref:sch});const valid=gen.name("valid");const schCxt=cxt.subschema({schema:sch,dataTypes:[],schemaPath:codegen_1.nil,topSchemaRef:schName,errSchemaPath:$ref},valid);cxt.mergeEvaluated(schCxt);cxt.ok(valid)}}};function getValidate(cxt,sch){const{gen}=cxt;return sch.validate?gen.scopeValue("validate",{ref:sch.validate}):(0,codegen_1._)`${gen.scopeValue("wrapper",{ref:sch})}.validate`}exports.getValidate=getValidate;function callRef(cxt,v,sch,$async){const{gen,it}=cxt;const{allErrors,schemaEnv:env,opts}=it;const passCxt=opts.passContext?names_1.default.this:codegen_1.nil;if($async)callAsyncRef();else callSyncRef();function callAsyncRef(){if(!env.$async)throw new Error("async schema referenced by sync schema");const valid=gen.let("valid");gen.try(()=>{gen.code((0,codegen_1._)`await ${(0,code_1.callValidateCode)(cxt,v,passCxt)}`);addEvaluatedFrom(v);if(!allErrors)gen.assign(valid,true)},(e)=>{gen.if((0,codegen_1._)`!(${e} instanceof ${it.ValidationError})`,()=>gen.throw(e));addErrorsFrom(e);if(!allErrors)gen.assign(valid,false)});cxt.ok(valid)}function callSyncRef(){cxt.result((0,code_1.callValidateCode)(cxt,v,passCxt),()=>addEvaluatedFrom(v),()=>addErrorsFrom(v))}function addErrorsFrom(source){const errs=(0,codegen_1._)`${source}.errors`;gen.assign(names_1.default.vErrors,(0,codegen_1._)`${names_1.default.vErrors} === null ? ${errs} : ${names_1.default.vErrors}.concat(${errs})`);gen.assign(names_1.default.errors,(0,codegen_1._)`${names_1.default.vErrors}.length`)}function addEvaluatedFrom(source){var _a;if(!it.opts.unevaluated)return;const schEvaluated=(_a=sch===null||sch===undefined?undefined:sch.validate)===null||_a===undefined?undefined:_a.evaluated;if(it.props!==true){if(schEvaluated&&!schEvaluated.dynamicProps){if(schEvaluated.props!==undefined){it.props=util_1.mergeEvaluated.props(gen,schEvaluated.props,it.props)}}else{const props=gen.var("props",(0,codegen_1._)`${source}.evaluated.props`);it.props=util_1.mergeEvaluated.props(gen,props,it.props,codegen_1.Name)}}if(it.items!==true){if(schEvaluated&&!schEvaluated.dynamicItems){if(schEvaluated.items!==undefined){it.items=util_1.mergeEvaluated.items(gen,schEvaluated.items,it.items)}}else{const items=gen.var("items",(0,codegen_1._)`${source}.evaluated.items`);it.items=util_1.mergeEvaluated.items(gen,items,it.items,codegen_1.Name)}}}}exports.callRef=callRef;exports.default=def});var require_core2=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var id_1=require_id();var ref_1=require_ref();var core=["$schema","$id","$defs","$vocabulary",{keyword:"$comment"},"definitions",id_1.default,ref_1.default];exports.default=core});var require_limitNumber=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var ops=codegen_1.operators;var KWDs={maximum:{okStr:"<=",ok:ops.LTE,fail:ops.GT},minimum:{okStr:">=",ok:ops.GTE,fail:ops.LT},exclusiveMaximum:{okStr:"<",ok:ops.LT,fail:ops.GTE},exclusiveMinimum:{okStr:">",ok:ops.GT,fail:ops.LTE}};var error={message:({keyword,schemaCode})=>(0,codegen_1.str)`must be ${KWDs[keyword].okStr} ${schemaCode}`,params:({keyword,schemaCode})=>(0,codegen_1._)`{comparison: ${KWDs[keyword].okStr}, limit: ${schemaCode}}`};var def={keyword:Object.keys(KWDs),type:"number",schemaType:"number",$data:true,error,code(cxt){const{keyword,data,schemaCode}=cxt;cxt.fail$data((0,codegen_1._)`${data} ${KWDs[keyword].fail} ${schemaCode} || isNaN(${data})`)}};exports.default=def});var require_multipleOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var error={message:({schemaCode})=>(0,codegen_1.str)`must be multiple of ${schemaCode}`,params:({schemaCode})=>(0,codegen_1._)`{multipleOf: ${schemaCode}}`};var def={keyword:"multipleOf",type:"number",schemaType:"number",$data:true,error,code(cxt){const{gen,data,schemaCode,it}=cxt;const prec=it.opts.multipleOfPrecision;const res=gen.let("res");const invalid=prec?(0,codegen_1._)`Math.abs(Math.round(${res}) - ${res}) > 1e-${prec}`:(0,codegen_1._)`${res} !== parseInt(${res})`;cxt.fail$data((0,codegen_1._)`(${schemaCode} === 0 || (${res} = ${data}/${schemaCode}, ${invalid}))`)}};exports.default=def});var require_ucs2length=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});function ucs2length(str){const len=str.length;let length=0;let pos=0;let value;while(pos<len){length++;value=str.charCodeAt(pos++);if(value>=55296&&value<=56319&&pos<len){value=str.charCodeAt(pos);if((value&64512)===56320)pos++}}return length}exports.default=ucs2length;ucs2length.code='require("ajv/dist/runtime/ucs2length").default'});var require_limitLength=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var ucs2length_1=require_ucs2length();var error={message({keyword,schemaCode}){const comp=keyword==="maxLength"?"more":"fewer";return(0,codegen_1.str)`must NOT have ${comp} than ${schemaCode} characters`},params:({schemaCode})=>(0,codegen_1._)`{limit: ${schemaCode}}`};var def={keyword:["maxLength","minLength"],type:"string",schemaType:"number",$data:true,error,code(cxt){const{keyword,data,schemaCode,it}=cxt;const op=keyword==="maxLength"?codegen_1.operators.GT:codegen_1.operators.LT;const len=it.opts.unicode===false?(0,codegen_1._)`${data}.length`:(0,codegen_1._)`${(0,util_1.useFunc)(cxt.gen,ucs2length_1.default)}(${data})`;cxt.fail$data((0,codegen_1._)`${len} ${op} ${schemaCode}`)}};exports.default=def});var require_pattern=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var util_1=require_util();var codegen_1=require_codegen();var error={message:({schemaCode})=>(0,codegen_1.str)`must match pattern "${schemaCode}"`,params:({schemaCode})=>(0,codegen_1._)`{pattern: ${schemaCode}}`};var def={keyword:"pattern",type:"string",schemaType:"string",$data:true,error,code(cxt){const{gen,data,$data,schema,schemaCode,it}=cxt;const u=it.opts.unicodeRegExp?"u":"";if($data){const{regExp}=it.opts.code;const regExpCode=regExp.code==="new RegExp"?(0,codegen_1._)`new RegExp`:(0,util_1.useFunc)(gen,regExp);const valid=gen.let("valid");gen.try(()=>gen.assign(valid,(0,codegen_1._)`${regExpCode}(${schemaCode}, ${u}).test(${data})`),()=>gen.assign(valid,false));cxt.fail$data((0,codegen_1._)`!${valid}`)}else{const regExp=(0,code_1.usePattern)(cxt,schema);cxt.fail$data((0,codegen_1._)`!${regExp}.test(${data})`)}}};exports.default=def});var require_limitProperties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var error={message({keyword,schemaCode}){const comp=keyword==="maxProperties"?"more":"fewer";return(0,codegen_1.str)`must NOT have ${comp} than ${schemaCode} properties`},params:({schemaCode})=>(0,codegen_1._)`{limit: ${schemaCode}}`};var def={keyword:["maxProperties","minProperties"],type:"object",schemaType:"number",$data:true,error,code(cxt){const{keyword,data,schemaCode}=cxt;const op=keyword==="maxProperties"?codegen_1.operators.GT:codegen_1.operators.LT;cxt.fail$data((0,codegen_1._)`Object.keys(${data}).length ${op} ${schemaCode}`)}};exports.default=def});var require_required=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var codegen_1=require_codegen();var util_1=require_util();var error={message:({params:{missingProperty}})=>(0,codegen_1.str)`must have required property '${missingProperty}'`,params:({params:{missingProperty}})=>(0,codegen_1._)`{missingProperty: ${missingProperty}}`};var def={keyword:"required",type:"object",schemaType:"array",$data:true,error,code(cxt){const{gen,schema,schemaCode,data,$data,it}=cxt;const{opts}=it;if(!$data&&schema.length===0)return;const useLoop=schema.length>=opts.loopRequired;if(it.allErrors)allErrorsMode();else exitOnErrorMode();if(opts.strictRequired){const props=cxt.parentSchema.properties;const{definedProperties}=cxt.it;for(const requiredKey of schema){if((props===null||props===undefined?undefined:props[requiredKey])===undefined&&!definedProperties.has(requiredKey)){const schemaPath=it.schemaEnv.baseId+it.errSchemaPath;const msg=`required property "${requiredKey}" is not defined at "${schemaPath}" (strictRequired)`;(0,util_1.checkStrictMode)(it,msg,it.opts.strictRequired)}}}function allErrorsMode(){if(useLoop||$data){cxt.block$data(codegen_1.nil,loopAllRequired)}else{for(const prop of schema){(0,code_1.checkReportMissingProp)(cxt,prop)}}}function exitOnErrorMode(){const missing=gen.let("missing");if(useLoop||$data){const valid=gen.let("valid",true);cxt.block$data(valid,()=>loopUntilMissing(missing,valid));cxt.ok(valid)}else{gen.if((0,code_1.checkMissingProp)(cxt,schema,missing));(0,code_1.reportMissingProp)(cxt,missing);gen.else()}}function loopAllRequired(){gen.forOf("prop",schemaCode,(prop)=>{cxt.setParams({missingProperty:prop});gen.if((0,code_1.noPropertyInData)(gen,data,prop,opts.ownProperties),()=>cxt.error())})}function loopUntilMissing(missing,valid){cxt.setParams({missingProperty:missing});gen.forOf(missing,schemaCode,()=>{gen.assign(valid,(0,code_1.propertyInData)(gen,data,missing,opts.ownProperties));gen.if((0,codegen_1.not)(valid),()=>{cxt.error();gen.break()})},codegen_1.nil)}}};exports.default=def});var require_limitItems=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var error={message({keyword,schemaCode}){const comp=keyword==="maxItems"?"more":"fewer";return(0,codegen_1.str)`must NOT have ${comp} than ${schemaCode} items`},params:({schemaCode})=>(0,codegen_1._)`{limit: ${schemaCode}}`};var def={keyword:["maxItems","minItems"],type:"array",schemaType:"number",$data:true,error,code(cxt){const{keyword,data,schemaCode}=cxt;const op=keyword==="maxItems"?codegen_1.operators.GT:codegen_1.operators.LT;cxt.fail$data((0,codegen_1._)`${data}.length ${op} ${schemaCode}`)}};exports.default=def});var require_equal=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var equal=require_fast_deep_equal();equal.code='require("ajv/dist/runtime/equal").default';exports.default=equal});var require_uniqueItems=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var dataType_1=require_dataType();var codegen_1=require_codegen();var util_1=require_util();var equal_1=require_equal();var error={message:({params:{i,j}})=>(0,codegen_1.str)`must NOT have duplicate items (items ## ${j} and ${i} are identical)`,params:({params:{i,j}})=>(0,codegen_1._)`{i: ${i}, j: ${j}}`};var def={keyword:"uniqueItems",type:"array",schemaType:"boolean",$data:true,error,code(cxt){const{gen,data,$data,schema,parentSchema,schemaCode,it}=cxt;if(!$data&&!schema)return;const valid=gen.let("valid");const itemTypes=parentSchema.items?(0,dataType_1.getSchemaTypes)(parentSchema.items):[];cxt.block$data(valid,validateUniqueItems,(0,codegen_1._)`${schemaCode} === false`);cxt.ok(valid);function validateUniqueItems(){const i=gen.let("i",(0,codegen_1._)`${data}.length`);const j=gen.let("j");cxt.setParams({i,j});gen.assign(valid,true);gen.if((0,codegen_1._)`${i} > 1`,()=>(canOptimize()?loopN:loopN2)(i,j))}function canOptimize(){return itemTypes.length>0&&!itemTypes.some((t)=>t==="object"||t==="array")}function loopN(i,j){const item=gen.name("item");const wrongType=(0,dataType_1.checkDataTypes)(itemTypes,item,it.opts.strictNumbers,dataType_1.DataType.Wrong);const indices=gen.const("indices",(0,codegen_1._)`{}`);gen.for((0,codegen_1._)`;${i}--;`,()=>{gen.let(item,(0,codegen_1._)`${data}[${i}]`);gen.if(wrongType,(0,codegen_1._)`continue`);if(itemTypes.length>1)gen.if((0,codegen_1._)`typeof ${item} == "string"`,(0,codegen_1._)`${item} += "_"`);gen.if((0,codegen_1._)`typeof ${indices}[${item}] == "number"`,()=>{gen.assign(j,(0,codegen_1._)`${indices}[${item}]`);cxt.error();gen.assign(valid,false).break()}).code((0,codegen_1._)`${indices}[${item}] = ${i}`)})}function loopN2(i,j){const eql=(0,util_1.useFunc)(gen,equal_1.default);const outer=gen.name("outer");gen.label(outer).for((0,codegen_1._)`;${i}--;`,()=>gen.for((0,codegen_1._)`${j} = ${i}; ${j}--;`,()=>gen.if((0,codegen_1._)`${eql}(${data}[${i}], ${data}[${j}])`,()=>{cxt.error();gen.assign(valid,false).break(outer)})))}}};exports.default=def});var require_const=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var equal_1=require_equal();var error={message:"must be equal to constant",params:({schemaCode})=>(0,codegen_1._)`{allowedValue: ${schemaCode}}`};var def={keyword:"const",$data:true,error,code(cxt){const{gen,data,$data,schemaCode,schema}=cxt;if($data||schema&&typeof schema=="object"){cxt.fail$data((0,codegen_1._)`!${(0,util_1.useFunc)(gen,equal_1.default)}(${data}, ${schemaCode})`)}else{cxt.fail((0,codegen_1._)`${schema} !== ${data}`)}}};exports.default=def});var require_enum=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var equal_1=require_equal();var error={message:"must be equal to one of the allowed values",params:({schemaCode})=>(0,codegen_1._)`{allowedValues: ${schemaCode}}`};var def={keyword:"enum",schemaType:"array",$data:true,error,code(cxt){const{gen,data,$data,schema,schemaCode,it}=cxt;if(!$data&&schema.length===0)throw new Error("enum must have non-empty array");const useLoop=schema.length>=it.opts.loopEnum;let eql;const getEql=()=>eql!==null&&eql!==undefined?eql:eql=(0,util_1.useFunc)(gen,equal_1.default);let valid;if(useLoop||$data){valid=gen.let("valid");cxt.block$data(valid,loopEnum)}else{if(!Array.isArray(schema))throw new Error("ajv implementation error");const vSchema=gen.const("vSchema",schemaCode);valid=(0,codegen_1.or)(...schema.map((_x,i)=>equalCode(vSchema,i)))}cxt.pass(valid);function loopEnum(){gen.assign(valid,false);gen.forOf("v",schemaCode,(v)=>gen.if((0,codegen_1._)`${getEql()}(${data}, ${v})`,()=>gen.assign(valid,true).break()))}function equalCode(vSchema,i){const sch=schema[i];return typeof sch==="object"&&sch!==null?(0,codegen_1._)`${getEql()}(${data}, ${vSchema}[${i}])`:(0,codegen_1._)`${data} === ${sch}`}}};exports.default=def});var require_validation=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var limitNumber_1=require_limitNumber();var multipleOf_1=require_multipleOf();var limitLength_1=require_limitLength();var pattern_1=require_pattern();var limitProperties_1=require_limitProperties();var required_1=require_required();var limitItems_1=require_limitItems();var uniqueItems_1=require_uniqueItems();var const_1=require_const();var enum_1=require_enum();var validation=[limitNumber_1.default,multipleOf_1.default,limitLength_1.default,pattern_1.default,limitProperties_1.default,required_1.default,limitItems_1.default,uniqueItems_1.default,{keyword:"type",schemaType:["string","array"]},{keyword:"nullable",schemaType:"boolean"},const_1.default,enum_1.default];exports.default=validation});var require_additionalItems=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.validateAdditionalItems=undefined;var codegen_1=require_codegen();var util_1=require_util();var error={message:({params:{len}})=>(0,codegen_1.str)`must NOT have more than ${len} items`,params:({params:{len}})=>(0,codegen_1._)`{limit: ${len}}`};var def={keyword:"additionalItems",type:"array",schemaType:["boolean","object"],before:"uniqueItems",error,code(cxt){const{parentSchema,it}=cxt;const{items}=parentSchema;if(!Array.isArray(items)){(0,util_1.checkStrictMode)(it,'"additionalItems" is ignored when "items" is not an array of schemas');return}validateAdditionalItems(cxt,items)}};function validateAdditionalItems(cxt,items){const{gen,schema,data,keyword,it}=cxt;it.items=true;const len=gen.const("len",(0,codegen_1._)`${data}.length`);if(schema===false){cxt.setParams({len:items.length});cxt.pass((0,codegen_1._)`${len} <= ${items.length}`)}else if(typeof schema=="object"&&!(0,util_1.alwaysValidSchema)(it,schema)){const valid=gen.var("valid",(0,codegen_1._)`${len} <= ${items.length}`);gen.if((0,codegen_1.not)(valid),()=>validateItems(valid));cxt.ok(valid)}function validateItems(valid){gen.forRange("i",items.length,len,(i)=>{cxt.subschema({keyword,dataProp:i,dataPropType:util_1.Type.Num},valid);if(!it.allErrors)gen.if((0,codegen_1.not)(valid),()=>gen.break())})}}exports.validateAdditionalItems=validateAdditionalItems;exports.default=def});var require_items=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.validateTuple=undefined;var codegen_1=require_codegen();var util_1=require_util();var code_1=require_code2();var def={keyword:"items",type:"array",schemaType:["object","array","boolean"],before:"uniqueItems",code(cxt){const{schema,it}=cxt;if(Array.isArray(schema))return validateTuple(cxt,"additionalItems",schema);it.items=true;if((0,util_1.alwaysValidSchema)(it,schema))return;cxt.ok((0,code_1.validateArray)(cxt))}};function validateTuple(cxt,extraItems,schArr=cxt.schema){const{gen,parentSchema,data,keyword,it}=cxt;checkStrictTuple(parentSchema);if(it.opts.unevaluated&&schArr.length&&it.items!==true){it.items=util_1.mergeEvaluated.items(gen,schArr.length,it.items)}const valid=gen.name("valid");const len=gen.const("len",(0,codegen_1._)`${data}.length`);schArr.forEach((sch,i)=>{if((0,util_1.alwaysValidSchema)(it,sch))return;gen.if((0,codegen_1._)`${len} > ${i}`,()=>cxt.subschema({keyword,schemaProp:i,dataProp:i},valid));cxt.ok(valid)});function checkStrictTuple(sch){const{opts,errSchemaPath}=it;const l=schArr.length;const fullTuple=l===sch.minItems&&(l===sch.maxItems||sch[extraItems]===false);if(opts.strictTuples&&!fullTuple){const msg=`"${keyword}" is ${l}-tuple, but minItems or maxItems/${extraItems} are not specified or different at path "${errSchemaPath}"`;(0,util_1.checkStrictMode)(it,msg,opts.strictTuples)}}}exports.validateTuple=validateTuple;exports.default=def});var require_prefixItems=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var items_1=require_items();var def={keyword:"prefixItems",type:"array",schemaType:["array"],before:"uniqueItems",code:(cxt)=>(0,items_1.validateTuple)(cxt,"items")};exports.default=def});var require_items2020=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var code_1=require_code2();var additionalItems_1=require_additionalItems();var error={message:({params:{len}})=>(0,codegen_1.str)`must NOT have more than ${len} items`,params:({params:{len}})=>(0,codegen_1._)`{limit: ${len}}`};var def={keyword:"items",type:"array",schemaType:["object","boolean"],before:"uniqueItems",error,code(cxt){const{schema,parentSchema,it}=cxt;const{prefixItems}=parentSchema;it.items=true;if((0,util_1.alwaysValidSchema)(it,schema))return;if(prefixItems)(0,additionalItems_1.validateAdditionalItems)(cxt,prefixItems);else cxt.ok((0,code_1.validateArray)(cxt))}};exports.default=def});var require_contains=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:({params:{min,max}})=>max===undefined?(0,codegen_1.str)`must contain at least ${min} valid item(s)`:(0,codegen_1.str)`must contain at least ${min} and no more than ${max} valid item(s)`,params:({params:{min,max}})=>max===undefined?(0,codegen_1._)`{minContains: ${min}}`:(0,codegen_1._)`{minContains: ${min}, maxContains: ${max}}`};var def={keyword:"contains",type:"array",schemaType:["object","boolean"],before:"uniqueItems",trackErrors:true,error,code(cxt){const{gen,schema,parentSchema,data,it}=cxt;let min;let max;const{minContains,maxContains}=parentSchema;if(it.opts.next){min=minContains===undefined?1:minContains;max=maxContains}else{min=1}const len=gen.const("len",(0,codegen_1._)`${data}.length`);cxt.setParams({min,max});if(max===undefined&&min===0){(0,util_1.checkStrictMode)(it,`"minContains" == 0 without "maxContains": "contains" keyword ignored`);return}if(max!==undefined&&min>max){(0,util_1.checkStrictMode)(it,`"minContains" > "maxContains" is always invalid`);cxt.fail();return}if((0,util_1.alwaysValidSchema)(it,schema)){let cond=(0,codegen_1._)`${len} >= ${min}`;if(max!==undefined)cond=(0,codegen_1._)`${cond} && ${len} <= ${max}`;cxt.pass(cond);return}it.items=true;const valid=gen.name("valid");if(max===undefined&&min===1){validateItems(valid,()=>gen.if(valid,()=>gen.break()))}else if(min===0){gen.let(valid,true);if(max!==undefined)gen.if((0,codegen_1._)`${data}.length > 0`,validateItemsWithCount)}else{gen.let(valid,false);validateItemsWithCount()}cxt.result(valid,()=>cxt.reset());function validateItemsWithCount(){const schValid=gen.name("_valid");const count=gen.let("count",0);validateItems(schValid,()=>gen.if(schValid,()=>checkLimits(count)))}function validateItems(_valid,block){gen.forRange("i",0,len,(i)=>{cxt.subschema({keyword:"contains",dataProp:i,dataPropType:util_1.Type.Num,compositeRule:true},_valid);block()})}function checkLimits(count){gen.code((0,codegen_1._)`${count}++`);if(max===undefined){gen.if((0,codegen_1._)`${count} >= ${min}`,()=>gen.assign(valid,true).break())}else{gen.if((0,codegen_1._)`${count} > ${max}`,()=>gen.assign(valid,false).break());if(min===1)gen.assign(valid,true);else gen.if((0,codegen_1._)`${count} >= ${min}`,()=>gen.assign(valid,true))}}}};exports.default=def});var require_dependencies=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.validateSchemaDeps=exports.validatePropertyDeps=exports.error=undefined;var codegen_1=require_codegen();var util_1=require_util();var code_1=require_code2();exports.error={message:({params:{property,depsCount,deps}})=>{const property_ies=depsCount===1?"property":"properties";return(0,codegen_1.str)`must have ${property_ies} ${deps} when property ${property} is present`},params:({params:{property,depsCount,deps,missingProperty}})=>(0,codegen_1._)`{property: ${property},
6
6
  missingProperty: ${missingProperty},
7
7
  depsCount: ${depsCount},
8
- deps: ${deps}}`};var def={keyword:"dependencies",type:"object",schemaType:"object",error:exports.error,code(cxt){const[propDeps,schDeps]=splitDependencies(cxt);validatePropertyDeps(cxt,propDeps);validateSchemaDeps(cxt,schDeps)}};function splitDependencies({schema}){const propertyDeps={};const schemaDeps={};for(const key in schema){if(key==="__proto__")continue;const deps=Array.isArray(schema[key])?propertyDeps:schemaDeps;deps[key]=schema[key]}return[propertyDeps,schemaDeps]}function validatePropertyDeps(cxt,propertyDeps=cxt.schema){const{gen,data,it}=cxt;if(Object.keys(propertyDeps).length===0)return;const missing=gen.let("missing");for(const prop in propertyDeps){const deps=propertyDeps[prop];if(deps.length===0)continue;const hasProperty=(0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties);cxt.setParams({property:prop,depsCount:deps.length,deps:deps.join(", ")});if(it.allErrors){gen.if(hasProperty,()=>{for(const depProp of deps){(0,code_1.checkReportMissingProp)(cxt,depProp)}})}else{gen.if((0,codegen_1._)`${hasProperty} && (${(0,code_1.checkMissingProp)(cxt,deps,missing)})`);(0,code_1.reportMissingProp)(cxt,missing);gen.else()}}}exports.validatePropertyDeps=validatePropertyDeps;function validateSchemaDeps(cxt,schemaDeps=cxt.schema){const{gen,data,keyword,it}=cxt;const valid=gen.name("valid");for(const prop in schemaDeps){if((0,util_1.alwaysValidSchema)(it,schemaDeps[prop]))continue;gen.if((0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties),()=>{const schCxt=cxt.subschema({keyword,schemaProp:prop},valid);cxt.mergeValidEvaluated(schCxt,valid)},()=>gen.var(valid,true));cxt.ok(valid)}}exports.validateSchemaDeps=validateSchemaDeps;exports.default=def});var require_propertyNames=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:"property name must be valid",params:({params})=>(0,codegen_1._)`{propertyName: ${params.propertyName}}`};var def={keyword:"propertyNames",type:"object",schemaType:["object","boolean"],error,code(cxt){const{gen,schema,data,it}=cxt;if((0,util_1.alwaysValidSchema)(it,schema))return;const valid=gen.name("valid");gen.forIn("key",data,(key)=>{cxt.setParams({propertyName:key});cxt.subschema({keyword:"propertyNames",data:key,dataTypes:["string"],propertyName:key,compositeRule:true},valid);gen.if((0,codegen_1.not)(valid),()=>{cxt.error(true);if(!it.allErrors)gen.break()})});cxt.ok(valid)}};exports.default=def});var require_additionalProperties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var codegen_1=require_codegen();var names_1=require_names();var util_1=require_util();var error={message:"must NOT have additional properties",params:({params})=>(0,codegen_1._)`{additionalProperty: ${params.additionalProperty}}`};var def={keyword:"additionalProperties",type:["object"],schemaType:["boolean","object"],allowUndefined:true,trackErrors:true,error,code(cxt){const{gen,schema,parentSchema,data,errsCount,it}=cxt;if(!errsCount)throw new Error("ajv implementation error");const{allErrors,opts}=it;it.props=true;if(opts.removeAdditional!=="all"&&(0,util_1.alwaysValidSchema)(it,schema))return;const props=(0,code_1.allSchemaProperties)(parentSchema.properties);const patProps=(0,code_1.allSchemaProperties)(parentSchema.patternProperties);checkAdditionalProperties();cxt.ok((0,codegen_1._)`${errsCount} === ${names_1.default.errors}`);function checkAdditionalProperties(){gen.forIn("key",data,(key)=>{if(!props.length&&!patProps.length)additionalPropertyCode(key);else gen.if(isAdditional(key),()=>additionalPropertyCode(key))})}function isAdditional(key){let definedProp;if(props.length>8){const propsSchema=(0,util_1.schemaRefOrVal)(it,parentSchema.properties,"properties");definedProp=(0,code_1.isOwnProperty)(gen,propsSchema,key)}else if(props.length){definedProp=(0,codegen_1.or)(...props.map((p)=>(0,codegen_1._)`${key} === ${p}`))}else{definedProp=codegen_1.nil}if(patProps.length){definedProp=(0,codegen_1.or)(definedProp,...patProps.map((p)=>(0,codegen_1._)`${(0,code_1.usePattern)(cxt,p)}.test(${key})`))}return(0,codegen_1.not)(definedProp)}function deleteAdditional(key){gen.code((0,codegen_1._)`delete ${data}[${key}]`)}function additionalPropertyCode(key){if(opts.removeAdditional==="all"||opts.removeAdditional&&schema===false){deleteAdditional(key);return}if(schema===false){cxt.setParams({additionalProperty:key});cxt.error();if(!allErrors)gen.break();return}if(typeof schema=="object"&&!(0,util_1.alwaysValidSchema)(it,schema)){const valid=gen.name("valid");if(opts.removeAdditional==="failing"){applyAdditionalSchema(key,valid,false);gen.if((0,codegen_1.not)(valid),()=>{cxt.reset();deleteAdditional(key)})}else{applyAdditionalSchema(key,valid);if(!allErrors)gen.if((0,codegen_1.not)(valid),()=>gen.break())}}}function applyAdditionalSchema(key,valid,errors){const subschema={keyword:"additionalProperties",dataProp:key,dataPropType:util_1.Type.Str};if(errors===false){Object.assign(subschema,{compositeRule:true,createErrors:false,allErrors:false})}cxt.subschema(subschema,valid)}}};exports.default=def});var require_properties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var validate_1=require_validate();var code_1=require_code2();var util_1=require_util();var additionalProperties_1=require_additionalProperties();var def={keyword:"properties",type:"object",schemaType:"object",code(cxt){const{gen,schema,parentSchema,data,it}=cxt;if(it.opts.removeAdditional==="all"&&parentSchema.additionalProperties===undefined){additionalProperties_1.default.code(new validate_1.KeywordCxt(it,additionalProperties_1.default,"additionalProperties"))}const allProps=(0,code_1.allSchemaProperties)(schema);for(const prop of allProps){it.definedProperties.add(prop)}if(it.opts.unevaluated&&allProps.length&&it.props!==true){it.props=util_1.mergeEvaluated.props(gen,(0,util_1.toHash)(allProps),it.props)}const properties=allProps.filter((p)=>!(0,util_1.alwaysValidSchema)(it,schema[p]));if(properties.length===0)return;const valid=gen.name("valid");for(const prop of properties){if(hasDefault(prop)){applyPropertySchema(prop)}else{gen.if((0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties));applyPropertySchema(prop);if(!it.allErrors)gen.else().var(valid,true);gen.endIf()}cxt.it.definedProperties.add(prop);cxt.ok(valid)}function hasDefault(prop){return it.opts.useDefaults&&!it.compositeRule&&schema[prop].default!==undefined}function applyPropertySchema(prop){cxt.subschema({keyword:"properties",schemaProp:prop,dataProp:prop},valid)}}};exports.default=def});var require_patternProperties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var codegen_1=require_codegen();var util_1=require_util();var util_2=require_util();var def={keyword:"patternProperties",type:"object",schemaType:"object",code(cxt){const{gen,schema,data,parentSchema,it}=cxt;const{opts}=it;const patterns=(0,code_1.allSchemaProperties)(schema);const alwaysValidPatterns=patterns.filter((p)=>(0,util_1.alwaysValidSchema)(it,schema[p]));if(patterns.length===0||alwaysValidPatterns.length===patterns.length&&(!it.opts.unevaluated||it.props===true)){return}const checkProperties=opts.strictSchema&&!opts.allowMatchingProperties&&parentSchema.properties;const valid=gen.name("valid");if(it.props!==true&&!(it.props instanceof codegen_1.Name)){it.props=(0,util_2.evaluatedPropsToName)(gen,it.props)}const{props}=it;validatePatternProperties();function validatePatternProperties(){for(const pat of patterns){if(checkProperties)checkMatchingProperties(pat);if(it.allErrors){validateProperties(pat)}else{gen.var(valid,true);validateProperties(pat);gen.if(valid)}}}function checkMatchingProperties(pat){for(const prop in checkProperties){if(new RegExp(pat).test(prop)){(0,util_1.checkStrictMode)(it,`property ${prop} matches pattern ${pat} (use allowMatchingProperties)`)}}}function validateProperties(pat){gen.forIn("key",data,(key)=>{gen.if((0,codegen_1._)`${(0,code_1.usePattern)(cxt,pat)}.test(${key})`,()=>{const alwaysValid=alwaysValidPatterns.includes(pat);if(!alwaysValid){cxt.subschema({keyword:"patternProperties",schemaProp:pat,dataProp:key,dataPropType:util_2.Type.Str},valid)}if(it.opts.unevaluated&&props!==true){gen.assign((0,codegen_1._)`${props}[${key}]`,true)}else if(!alwaysValid&&!it.allErrors){gen.if((0,codegen_1.not)(valid),()=>gen.break())}})})}}};exports.default=def});var require_not=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:"not",schemaType:["object","boolean"],trackErrors:true,code(cxt){const{gen,schema,it}=cxt;if((0,util_1.alwaysValidSchema)(it,schema)){cxt.fail();return}const valid=gen.name("valid");cxt.subschema({keyword:"not",compositeRule:true,createErrors:false,allErrors:false},valid);cxt.failResult(valid,()=>cxt.reset(),()=>cxt.error())},error:{message:"must NOT be valid"}};exports.default=def});var require_anyOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var def={keyword:"anyOf",schemaType:"array",trackErrors:true,code:code_1.validateUnion,error:{message:"must match a schema in anyOf"}};exports.default=def});var require_oneOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:"must match exactly one schema in oneOf",params:({params})=>(0,codegen_1._)`{passingSchemas: ${params.passing}}`};var def={keyword:"oneOf",schemaType:"array",trackErrors:true,error,code(cxt){const{gen,schema,parentSchema,it}=cxt;if(!Array.isArray(schema))throw new Error("ajv implementation error");if(it.opts.discriminator&&parentSchema.discriminator)return;const schArr=schema;const valid=gen.let("valid",false);const passing=gen.let("passing",null);const schValid=gen.name("_valid");cxt.setParams({passing});gen.block(validateOneOf);cxt.result(valid,()=>cxt.reset(),()=>cxt.error(true));function validateOneOf(){schArr.forEach((sch,i)=>{let schCxt;if((0,util_1.alwaysValidSchema)(it,sch)){gen.var(schValid,true)}else{schCxt=cxt.subschema({keyword:"oneOf",schemaProp:i,compositeRule:true},schValid)}if(i>0){gen.if((0,codegen_1._)`${schValid} && ${valid}`).assign(valid,false).assign(passing,(0,codegen_1._)`[${passing}, ${i}]`).else()}gen.if(schValid,()=>{gen.assign(valid,true);gen.assign(passing,i);if(schCxt)cxt.mergeEvaluated(schCxt,codegen_1.Name)})})}}};exports.default=def});var require_allOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:"allOf",schemaType:"array",code(cxt){const{gen,schema,it}=cxt;if(!Array.isArray(schema))throw new Error("ajv implementation error");const valid=gen.name("valid");schema.forEach((sch,i)=>{if((0,util_1.alwaysValidSchema)(it,sch))return;const schCxt=cxt.subschema({keyword:"allOf",schemaProp:i},valid);cxt.ok(valid);cxt.mergeEvaluated(schCxt)})}};exports.default=def});var require_if=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:({params})=>(0,codegen_1.str)`must match "${params.ifClause}" schema`,params:({params})=>(0,codegen_1._)`{failingKeyword: ${params.ifClause}}`};var def={keyword:"if",schemaType:["object","boolean"],trackErrors:true,error,code(cxt){const{gen,parentSchema,it}=cxt;if(parentSchema.then===undefined&&parentSchema.else===undefined){(0,util_1.checkStrictMode)(it,'"if" without "then" and "else" is ignored')}const hasThen=hasSchema(it,"then");const hasElse=hasSchema(it,"else");if(!hasThen&&!hasElse)return;const valid=gen.let("valid",true);const schValid=gen.name("_valid");validateIf();cxt.reset();if(hasThen&&hasElse){const ifClause=gen.let("ifClause");cxt.setParams({ifClause});gen.if(schValid,validateClause("then",ifClause),validateClause("else",ifClause))}else if(hasThen){gen.if(schValid,validateClause("then"))}else{gen.if((0,codegen_1.not)(schValid),validateClause("else"))}cxt.pass(valid,()=>cxt.error(true));function validateIf(){const schCxt=cxt.subschema({keyword:"if",compositeRule:true,createErrors:false,allErrors:false},schValid);cxt.mergeEvaluated(schCxt)}function validateClause(keyword,ifClause){return()=>{const schCxt=cxt.subschema({keyword},schValid);gen.assign(valid,schValid);cxt.mergeValidEvaluated(schCxt,valid);if(ifClause)gen.assign(ifClause,(0,codegen_1._)`${keyword}`);else cxt.setParams({ifClause:keyword})}}}};function hasSchema(it,keyword){const schema=it.schema[keyword];return schema!==undefined&&!(0,util_1.alwaysValidSchema)(it,schema)}exports.default=def});var require_thenElse=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:["then","else"],schemaType:["object","boolean"],code({keyword,parentSchema,it}){if(parentSchema.if===undefined)(0,util_1.checkStrictMode)(it,`"${keyword}" without "if" is ignored`)}};exports.default=def});var require_applicator=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var additionalItems_1=require_additionalItems();var prefixItems_1=require_prefixItems();var items_1=require_items();var items2020_1=require_items2020();var contains_1=require_contains();var dependencies_1=require_dependencies();var propertyNames_1=require_propertyNames();var additionalProperties_1=require_additionalProperties();var properties_1=require_properties();var patternProperties_1=require_patternProperties();var not_1=require_not();var anyOf_1=require_anyOf();var oneOf_1=require_oneOf();var allOf_1=require_allOf();var if_1=require_if();var thenElse_1=require_thenElse();function getApplicator(draft2020=false){const applicator=[not_1.default,anyOf_1.default,oneOf_1.default,allOf_1.default,if_1.default,thenElse_1.default,propertyNames_1.default,additionalProperties_1.default,dependencies_1.default,properties_1.default,patternProperties_1.default];if(draft2020)applicator.push(prefixItems_1.default,items2020_1.default);else applicator.push(additionalItems_1.default,items_1.default);applicator.push(contains_1.default);return applicator}exports.default=getApplicator});var require_format=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var error={message:({schemaCode})=>(0,codegen_1.str)`must match format "${schemaCode}"`,params:({schemaCode})=>(0,codegen_1._)`{format: ${schemaCode}}`};var def={keyword:"format",type:["number","string"],schemaType:"string",$data:true,error,code(cxt,ruleType){const{gen,data,$data,schema,schemaCode,it}=cxt;const{opts,errSchemaPath,schemaEnv,self}=it;if(!opts.validateFormats)return;if($data)validate$DataFormat();else validateFormat();function validate$DataFormat(){const fmts=gen.scopeValue("formats",{ref:self.formats,code:opts.code.formats});const fDef=gen.const("fDef",(0,codegen_1._)`${fmts}[${schemaCode}]`);const fType=gen.let("fType");const format=gen.let("format");gen.if((0,codegen_1._)`typeof ${fDef} == "object" && !(${fDef} instanceof RegExp)`,()=>gen.assign(fType,(0,codegen_1._)`${fDef}.type || "string"`).assign(format,(0,codegen_1._)`${fDef}.validate`),()=>gen.assign(fType,(0,codegen_1._)`"string"`).assign(format,fDef));cxt.fail$data((0,codegen_1.or)(unknownFmt(),invalidFmt()));function unknownFmt(){if(opts.strictSchema===false)return codegen_1.nil;return(0,codegen_1._)`${schemaCode} && !${format}`}function invalidFmt(){const callFormat=schemaEnv.$async?(0,codegen_1._)`(${fDef}.async ? await ${format}(${data}) : ${format}(${data}))`:(0,codegen_1._)`${format}(${data})`;const validData=(0,codegen_1._)`(typeof ${format} == "function" ? ${callFormat} : ${format}.test(${data}))`;return(0,codegen_1._)`${format} && ${format} !== true && ${fType} === ${ruleType} && !${validData}`}}function validateFormat(){const formatDef=self.formats[schema];if(!formatDef){unknownFormat();return}if(formatDef===true)return;const[fmtType,format,fmtRef]=getFormat(formatDef);if(fmtType===ruleType)cxt.pass(validCondition());function unknownFormat(){if(opts.strictSchema===false){self.logger.warn(unknownMsg());return}throw new Error(unknownMsg());function unknownMsg(){return`unknown format "${schema}" ignored in schema at path "${errSchemaPath}"`}}function getFormat(fmtDef){const code=fmtDef instanceof RegExp?(0,codegen_1.regexpCode)(fmtDef):opts.code.formats?(0,codegen_1._)`${opts.code.formats}${(0,codegen_1.getProperty)(schema)}`:undefined;const fmt=gen.scopeValue("formats",{key:schema,ref:fmtDef,code});if(typeof fmtDef=="object"&&!(fmtDef instanceof RegExp)){return[fmtDef.type||"string",fmtDef.validate,(0,codegen_1._)`${fmt}.validate`]}return["string",fmtDef,fmt]}function validCondition(){if(typeof formatDef=="object"&&!(formatDef instanceof RegExp)&&formatDef.async){if(!schemaEnv.$async)throw new Error("async format in sync schema");return(0,codegen_1._)`await ${fmtRef}(${data})`}return typeof format=="function"?(0,codegen_1._)`${fmtRef}(${data})`:(0,codegen_1._)`${fmtRef}.test(${data})`}}}};exports.default=def});var require_format2=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var format_1=require_format();var format=[format_1.default];exports.default=format});var require_metadata=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.contentVocabulary=exports.metadataVocabulary=undefined;exports.metadataVocabulary=["title","description","default","deprecated","readOnly","writeOnly","examples"];exports.contentVocabulary=["contentMediaType","contentEncoding","contentSchema"]});var require_draft7=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var core_1=require_core2();var validation_1=require_validation();var applicator_1=require_applicator();var format_1=require_format2();var metadata_1=require_metadata();var draft7Vocabularies=[core_1.default,validation_1.default,(0,applicator_1.default)(),format_1.default,metadata_1.metadataVocabulary,metadata_1.contentVocabulary];exports.default=draft7Vocabularies});var require_types=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.DiscrError=undefined;var DiscrError;(function(DiscrError){DiscrError["Tag"]="tag";DiscrError["Mapping"]="mapping"})(DiscrError||(exports.DiscrError=DiscrError={}))});var require_discriminator=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var types_1=require_types();var compile_1=require_compile();var ref_error_1=require_ref_error();var util_1=require_util();var error={message:({params:{discrError,tagName}})=>discrError===types_1.DiscrError.Tag?`tag "${tagName}" must be string`:`value of tag "${tagName}" must be in oneOf`,params:({params:{discrError,tag,tagName}})=>(0,codegen_1._)`{error: ${discrError}, tag: ${tagName}, tagValue: ${tag}}`};var def={keyword:"discriminator",type:"object",schemaType:"object",error,code(cxt){const{gen,data,schema,parentSchema,it}=cxt;const{oneOf}=parentSchema;if(!it.opts.discriminator){throw new Error("discriminator: requires discriminator option")}const tagName=schema.propertyName;if(typeof tagName!="string")throw new Error("discriminator: requires propertyName");if(schema.mapping)throw new Error("discriminator: mapping is not supported");if(!oneOf)throw new Error("discriminator: requires oneOf keyword");const valid=gen.let("valid",false);const tag=gen.const("tag",(0,codegen_1._)`${data}${(0,codegen_1.getProperty)(tagName)}`);gen.if((0,codegen_1._)`typeof ${tag} == "string"`,()=>validateMapping(),()=>cxt.error(false,{discrError:types_1.DiscrError.Tag,tag,tagName}));cxt.ok(valid);function validateMapping(){const mapping=getMapping();gen.if(false);for(const tagValue in mapping){gen.elseIf((0,codegen_1._)`${tag} === ${tagValue}`);gen.assign(valid,applyTagSchema(mapping[tagValue]))}gen.else();cxt.error(false,{discrError:types_1.DiscrError.Mapping,tag,tagName});gen.endIf()}function applyTagSchema(schemaProp){const _valid=gen.name("valid");const schCxt=cxt.subschema({keyword:"oneOf",schemaProp},_valid);cxt.mergeEvaluated(schCxt,codegen_1.Name);return _valid}function getMapping(){var _a;const oneOfMapping={};const topRequired=hasRequired(parentSchema);let tagRequired=true;for(let i=0;i<oneOf.length;i++){let sch=oneOf[i];if((sch===null||sch===undefined?undefined:sch.$ref)&&!(0,util_1.schemaHasRulesButRef)(sch,it.self.RULES)){const ref=sch.$ref;sch=compile_1.resolveRef.call(it.self,it.schemaEnv.root,it.baseId,ref);if(sch instanceof compile_1.SchemaEnv)sch=sch.schema;if(sch===undefined)throw new ref_error_1.default(it.opts.uriResolver,it.baseId,ref)}const propSch=(_a=sch===null||sch===undefined?undefined:sch.properties)===null||_a===undefined?undefined:_a[tagName];if(typeof propSch!="object"){throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${tagName}"`)}tagRequired=tagRequired&&(topRequired||hasRequired(sch));addMappings(propSch,i)}if(!tagRequired)throw new Error(`discriminator: "${tagName}" must be required`);return oneOfMapping;function hasRequired({required}){return Array.isArray(required)&&required.includes(tagName)}function addMappings(sch,i){if(sch.const){addMapping(sch.const,i)}else if(sch.enum){for(const tagValue of sch.enum){addMapping(tagValue,i)}}else{throw new Error(`discriminator: "properties/${tagName}" must have "const" or "enum"`)}}function addMapping(tagValue,i){if(typeof tagValue!="string"||tagValue in oneOfMapping){throw new Error(`discriminator: "${tagName}" values must be unique strings`)}oneOfMapping[tagValue]=i}}}};exports.default=def});var require_json_schema_draft_07=__commonJS(function(exports,module){module.exports={$schema:"http://json-schema.org/draft-07/schema#",$id:"http://json-schema.org/draft-07/schema#",title:"Core schema meta-schema",definitions:{schemaArray:{type:"array",minItems:1,items:{$ref:"#"}},nonNegativeInteger:{type:"integer",minimum:0},nonNegativeIntegerDefault0:{allOf:[{$ref:"#/definitions/nonNegativeInteger"},{default:0}]},simpleTypes:{enum:["array","boolean","integer","null","number","object","string"]},stringArray:{type:"array",items:{type:"string"},uniqueItems:true,default:[]}},type:["object","boolean"],properties:{$id:{type:"string",format:"uri-reference"},$schema:{type:"string",format:"uri"},$ref:{type:"string",format:"uri-reference"},$comment:{type:"string"},title:{type:"string"},description:{type:"string"},default:true,readOnly:{type:"boolean",default:false},examples:{type:"array",items:true},multipleOf:{type:"number",exclusiveMinimum:0},maximum:{type:"number"},exclusiveMaximum:{type:"number"},minimum:{type:"number"},exclusiveMinimum:{type:"number"},maxLength:{$ref:"#/definitions/nonNegativeInteger"},minLength:{$ref:"#/definitions/nonNegativeIntegerDefault0"},pattern:{type:"string",format:"regex"},additionalItems:{$ref:"#"},items:{anyOf:[{$ref:"#"},{$ref:"#/definitions/schemaArray"}],default:true},maxItems:{$ref:"#/definitions/nonNegativeInteger"},minItems:{$ref:"#/definitions/nonNegativeIntegerDefault0"},uniqueItems:{type:"boolean",default:false},contains:{$ref:"#"},maxProperties:{$ref:"#/definitions/nonNegativeInteger"},minProperties:{$ref:"#/definitions/nonNegativeIntegerDefault0"},required:{$ref:"#/definitions/stringArray"},additionalProperties:{$ref:"#"},definitions:{type:"object",additionalProperties:{$ref:"#"},default:{}},properties:{type:"object",additionalProperties:{$ref:"#"},default:{}},patternProperties:{type:"object",additionalProperties:{$ref:"#"},propertyNames:{format:"regex"},default:{}},dependencies:{type:"object",additionalProperties:{anyOf:[{$ref:"#"},{$ref:"#/definitions/stringArray"}]}},propertyNames:{$ref:"#"},const:true,enum:{type:"array",items:true,minItems:1,uniqueItems:true},type:{anyOf:[{$ref:"#/definitions/simpleTypes"},{type:"array",items:{$ref:"#/definitions/simpleTypes"},minItems:1,uniqueItems:true}]},format:{type:"string"},contentMediaType:{type:"string"},contentEncoding:{type:"string"},if:{$ref:"#"},then:{$ref:"#"},else:{$ref:"#"},allOf:{$ref:"#/definitions/schemaArray"},anyOf:{$ref:"#/definitions/schemaArray"},oneOf:{$ref:"#/definitions/schemaArray"},not:{$ref:"#"}},default:true}});var require_ajv=__commonJS(function(exports,module){Object.defineProperty(exports,"__esModule",{value:true});exports.MissingRefError=exports.ValidationError=exports.CodeGen=exports.Name=exports.nil=exports.stringify=exports.str=exports._=exports.KeywordCxt=exports.Ajv=undefined;var core_1=require_core();var draft7_1=require_draft7();var discriminator_1=require_discriminator();var draft7MetaSchema=require_json_schema_draft_07();var META_SUPPORT_DATA=["/properties"];var META_SCHEMA_ID="http://json-schema.org/draft-07/schema";class Ajv extends core_1.default{_addVocabularies(){super._addVocabularies();draft7_1.default.forEach((v)=>this.addVocabulary(v));if(this.opts.discriminator)this.addKeyword(discriminator_1.default)}_addDefaultMetaSchema(){super._addDefaultMetaSchema();if(!this.opts.meta)return;const metaSchema=this.opts.$data?this.$dataMetaSchema(draft7MetaSchema,META_SUPPORT_DATA):draft7MetaSchema;this.addMetaSchema(metaSchema,META_SCHEMA_ID,false);this.refs["http://json-schema.org/schema"]=META_SCHEMA_ID}defaultMeta(){return this.opts.defaultMeta=super.defaultMeta()||(this.getSchema(META_SCHEMA_ID)?META_SCHEMA_ID:undefined)}}exports.Ajv=Ajv;module.exports=exports=Ajv;module.exports.Ajv=Ajv;Object.defineProperty(exports,"__esModule",{value:true});exports.default=Ajv;var validate_1=require_validate();Object.defineProperty(exports,"KeywordCxt",{enumerable:true,get:function(){return validate_1.KeywordCxt}});var codegen_1=require_codegen();Object.defineProperty(exports,"_",{enumerable:true,get:function(){return codegen_1._}});Object.defineProperty(exports,"str",{enumerable:true,get:function(){return codegen_1.str}});Object.defineProperty(exports,"stringify",{enumerable:true,get:function(){return codegen_1.stringify}});Object.defineProperty(exports,"nil",{enumerable:true,get:function(){return codegen_1.nil}});Object.defineProperty(exports,"Name",{enumerable:true,get:function(){return codegen_1.Name}});Object.defineProperty(exports,"CodeGen",{enumerable:true,get:function(){return codegen_1.CodeGen}});var validation_error_1=require_validation_error();Object.defineProperty(exports,"ValidationError",{enumerable:true,get:function(){return validation_error_1.default}});var ref_error_1=require_ref_error();Object.defineProperty(exports,"MissingRefError",{enumerable:true,get:function(){return ref_error_1.default}})});var exports_authorization={};__export(exports_authorization,{authorizeWithUserAuth:()=>authorizeWithUserAuth});var exports_contracts={};__export(exports_contracts,{ApplicationUserAuthUnavailableError:()=>ApplicationUserAuthUnavailableError});var exports_access_token={};__export(exports_access_token,{createAccessTokenVerifier:()=>createAccessTokenVerifier,readCurrentIdentity:()=>readCurrentIdentity,verifyAccessTokenClaims:()=>verifyAccessTokenClaims});var exports_errors2={};__export(exports_errors2,{FederatedAuthRejectedError:()=>FederatedAuthRejectedError});var exports_enrollment_env={};__export(exports_enrollment_env,{readApplicationEnrollment:()=>readApplicationEnrollment});var exports_service={};__export(exports_service,{createFederatedAuth:()=>createFederatedAuth});var exports_session_request={};__export(exports_session_request,{sessionRequest:()=>sessionRequest});var unauthenticated=()=>Response.json({error:"authentication_required"},{headers:{"cache-control":"no-store"},status:401});var forbidden=()=>Response.json({error:"forbidden"},{status:403});var isReadOperation=(operation)=>operation===undefined||operation==="get"||operation==="list";var authorizeWithUserAuth=(auth,policy)=>(resourceId)=>async(request,operation="get")=>{const context=await auth.getEntityContext(request,resourceId);if(context===null){return unauthenticated()}const scope=isReadOperation(operation)?policy.readScope:policy.writeScope;return context.scopes.includes(scope)?context:forbidden()};var unavailableBrand=Symbol.for("@collective-intelligence/external-apps-server-sdk/ApplicationUserAuthUnavailableError");class ApplicationUserAuthUnavailableError extends Error{[unavailableBrand]=true;code="user_auth_unavailable";static[Symbol.hasInstance](value){return value instanceof Error&&unavailableBrand in value&&value[unavailableBrand]===true&&"code"in value&&value.code==="user_auth_unavailable"}constructor(cause){super("Application user authentication is unavailable",{cause});this.name="ApplicationUserAuthUnavailableError"}}var import_ajv=__toESM(require_ajv(),1);var encoder=new TextEncoder;var decoder=new TextDecoder;var strictDecoder=new TextDecoder("utf-8",{fatal:true});var MAX_INT32=2**32;function concat(...buffers){const size=buffers.reduce((acc,{length})=>acc+length,0);const buf=new Uint8Array(size);let i=0;for(const buffer of buffers){buf.set(buffer,i);i+=buffer.length}return buf}function writeUInt32BE(buf,value,offset){if(value<0||value>=MAX_INT32){throw new RangeError(`value must be >= 0 and <= ${MAX_INT32-1}. Received ${value}`)}buf.set([value>>>24,value>>>16,value>>>8,value&255],offset)}function uint64be(value){const high=Math.floor(value/MAX_INT32);const low=value%MAX_INT32;const buf=new Uint8Array(8);writeUInt32BE(buf,high,0);writeUInt32BE(buf,low,4);return buf}function uint32be(value){const buf=new Uint8Array(4);writeUInt32BE(buf,value);return buf}function encode(string){const bytes=new Uint8Array(string.length);for(let i=0;i<string.length;i++){const code=string.charCodeAt(i);if(code>127){throw new TypeError("non-ASCII string encountered in encode()")}bytes[i]=code}return bytes}var unusable=(name,prop="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);function checkUsage(key,usage){if(usage&&!key.usages.includes(usage)){throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`)}}function checkModulusLength(alg,key){const{modulusLength}=key.algorithm;if(typeof modulusLength!=="number"||modulusLength<2048){throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}}function checkCryptoKey(key,expected,usage){const algorithm=key.algorithm;if(algorithm.name!==expected.name){throw unusable(expected.name)}if(expected.hash&&algorithm.hash?.name!==expected.hash){throw unusable(expected.hash,"algorithm.hash")}if(expected.namedCurve&&algorithm.namedCurve!==expected.namedCurve){throw unusable(expected.namedCurve,"algorithm.namedCurve")}if(expected.length!==undefined&&algorithm.length!==expected.length){throw unusable(expected.length,"algorithm.length")}checkUsage(key,usage)}function message(msg,actual,...types){if(types.length>2){const last=types.pop();msg+=`one of type ${types.join(", ")}, or ${last}.`}else if(types.length===2){msg+=`one of type ${types[0]} or ${types[1]}.`}else{msg+=`of type ${types[0]}.`}if(actual==null){msg+=` Received ${actual}`}else if(typeof actual==="function"&&actual.name){msg+=` Received function ${actual.name}`}else if(typeof actual==="object"&&actual!=null){if(actual.constructor?.name){msg+=` Received an instance of ${actual.constructor.name}`}}return msg}var invalidKeyInput=(actual,...types)=>message("Key must be ",actual,...types);var withAlg=(alg,actual,...types)=>message(`Key for the ${alg} algorithm must be `,actual,...types);class JOSEError extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message,options){super(message,options);this.name=this.constructor.name;Error.captureStackTrace?.(this,this.constructor)}}class JWTClaimValidationFailed extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}});this.claim=claim;this.reason=reason;this.payload=payload}}class JWTExpired extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}});this.claim=claim;this.reason=reason;this.payload=payload}}class JOSEAlgNotAllowed extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class JOSENotSupported extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class JWEDecryptionFailed extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message="decryption operation failed",options){super(message,options)}}class JWEInvalid extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class JWSInvalid extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class JWTInvalid extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class JWKSInvalid extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class JWKSNoMatchingKey extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message="no applicable key found in the JSON Web Key Set",options){super(message,options)}}class JWKSMultipleMatchingKeys extends JOSEError{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message="multiple matching keys found in the JSON Web Key Set",options){super(message,options)}}class JWKSTimeout extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message="request timed out",options){super(message,options)}}class JWSSignatureVerificationFailed extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message="signature verification failed",options){super(message,options)}}function assertCryptoKey(key){if(!isCryptoKey(key)){throw new Error("CryptoKey instance expected")}}var isCryptoKey=(key)=>{if(key?.[Symbol.toStringTag]==="CryptoKey")return true;try{return key instanceof CryptoKey}catch{return false}};var isKeyObject=(key)=>key?.[Symbol.toStringTag]==="KeyObject";var isKeyLike=(key)=>isCryptoKey(key)||isKeyObject(key);var generateCek=(enc)=>crypto.getRandomValues(new Uint8Array(enc.cekBits>>3));function checkCekLength(cek,expected){const actual=cek.byteLength<<3;if(actual!==expected){throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`)}}var generateIv=(enc)=>crypto.getRandomValues(new Uint8Array(enc.ivBits>>3));function checkIvLength(enc,iv){if(iv.length<<3!==enc.ivBits){throw new JWEInvalid("Invalid Initialization Vector length")}}async function cbcKeySetup(enc,cek,usage){if(!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"Uint8Array"))}const keySize=enc.cekBits>>1;const encKey=await crypto.subtle.importKey("raw",cek.subarray(keySize>>3),"AES-CBC",false,[usage]);const macKey=await crypto.subtle.importKey("raw",cek.subarray(0,keySize>>3),{hash:`SHA-${keySize<<1}`,name:"HMAC"},false,["sign"]);return[encKey,macKey,keySize]}async function cbcHmacTag(macKey,macData,keySize){return new Uint8Array((await crypto.subtle.sign("HMAC",macKey,macData)).slice(0,keySize>>3))}async function cbcEncrypt(enc,plaintext,cek,iv,aad){const[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"encrypt");const ciphertext=new Uint8Array(await crypto.subtle.encrypt({iv,name:"AES-CBC"},encKey,plaintext));const macData=concat(aad,iv,ciphertext,uint64be(aad.length*8));const tag=await cbcHmacTag(macKey,macData,keySize);return{ciphertext,tag,iv}}async function timingSafeEqual(a,b){const algorithm={name:"HMAC",hash:"SHA-256"};const key=await crypto.subtle.generateKey(algorithm,false,["sign","verify"]);const aHmac=await crypto.subtle.sign(algorithm,key,a);return crypto.subtle.verify(algorithm,key,aHmac,b)}async function cbcDecrypt(enc,cek,ciphertext,iv,tag,aad){const[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"decrypt");const macData=concat(aad,iv,ciphertext,uint64be(aad.length*8));const expectedTag=await cbcHmacTag(macKey,macData,keySize);let macCheckPassed;try{macCheckPassed=await timingSafeEqual(tag,expectedTag)}catch{}if(!macCheckPassed){throw new JWEDecryptionFailed}let plaintext;try{plaintext=new Uint8Array(await crypto.subtle.decrypt({iv,name:"AES-CBC"},encKey,ciphertext))}catch{}if(!plaintext){throw new JWEDecryptionFailed}return plaintext}async function gcmEncrypt(enc,plaintext,cek,iv,aad){const encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",false,["encrypt"]):(checkCryptoKey(cek,enc.subtle,"encrypt"),cek);const encrypted=new Uint8Array(await crypto.subtle.encrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,plaintext));const tag=encrypted.slice(-16);const ciphertext=encrypted.slice(0,-16);return{ciphertext,tag,iv}}async function gcmDecrypt(enc,cek,ciphertext,iv,tag,aad){const encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",false,["decrypt"]):(checkCryptoKey(cek,enc.subtle,"decrypt"),cek);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,concat(ciphertext,tag)))}catch{throw new JWEDecryptionFailed}}async function encrypt(enc,plaintext,cek,iv,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"))}if(iv){checkIvLength(enc,iv)}else{iv=generateIv(enc)}if(cek instanceof Uint8Array){checkCekLength(cek,enc.cekBits)}return enc.cbc?cbcEncrypt(enc,plaintext,cek,iv,aad):gcmEncrypt(enc,plaintext,cek,iv,aad)}async function decrypt(enc,cek,ciphertext,iv,tag,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"))}if(!iv){throw new JWEInvalid("JWE Initialization Vector missing")}if(!tag){throw new JWEInvalid("JWE Authentication Tag missing")}checkIvLength(enc,iv);if(cek instanceof Uint8Array){checkCekLength(cek,enc.cekBits)}return enc.cbc?cbcDecrypt(enc,cek,ciphertext,iv,tag,aad):gcmDecrypt(enc,cek,ciphertext,iv,tag,aad)}function encodeBase64(input){if(Uint8Array.prototype.toBase64){return input.toBase64()}const CHUNK_SIZE=32768;const arr=[];for(let i=0;i<input.length;i+=CHUNK_SIZE){arr.push(String.fromCharCode.apply(null,input.subarray(i,i+CHUNK_SIZE)))}return btoa(arr.join(""))}function decodeBase64(encoded){if(Uint8Array.fromBase64){return Uint8Array.fromBase64(encoded)}const binary=atob(encoded);const bytes=new Uint8Array(binary.length);for(let i=0;i<binary.length;i++){bytes[i]=binary.charCodeAt(i)}return bytes}var invalid="The input to be decoded is not correctly encoded.";function decode(input){if(Uint8Array.fromBase64){try{return Uint8Array.fromBase64(typeof input==="string"?input:decoder.decode(input),{alphabet:"base64url"})}catch(cause){throw new TypeError(invalid,{cause})}}let encoded=input;if(encoded instanceof Uint8Array){encoded=decoder.decode(encoded)}if(encoded.includes("+")||encoded.includes("/")){throw new TypeError(invalid)}encoded=encoded.replace(/-/g,"+").replace(/_/g,"/");try{return decodeBase64(encoded)}catch{throw new TypeError(invalid)}}function encode2(input){let unencoded=input;if(typeof unencoded==="string"){unencoded=encoder.encode(unencoded)}if(Uint8Array.prototype.toBase64){return unencoded.toBase64({alphabet:"base64url",omitPadding:true})}return encodeBase64(unencoded).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function isObject(input){if(typeof input!=="object"||input===null||Object.prototype.toString.call(input)!=="[object Object]"){return false}const prototype=Object.getPrototypeOf(input);if(prototype===null){return true}let proto=prototype;while(Object.getPrototypeOf(proto)!==null){proto=Object.getPrototypeOf(proto)}return prototype===proto}function isDisjoint(...headers){const parameters=new Set;for(const header of headers){if(!header)continue;for(const parameter of Object.keys(header)){if(parameters.has(parameter)){return false}parameters.add(parameter)}}return true}var isJWK=(key)=>isObject(key)&&typeof key.kty==="string";var isPrivateJWK=(key)=>key.kty!=="oct"&&(key.kty==="AKP"&&typeof key.priv==="string"||typeof key.d==="string");var isPublicJWK=(key)=>key.kty!=="oct"&&key.d===undefined&&key.priv===undefined;var isSecretJWK=(key)=>key.kty==="oct"&&typeof key.k==="string";var unprotected=Symbol();function assertNotSet(value,name){if(value){throw new TypeError(`${name} can only be called once`)}}function decodeBase64url(value,label,ErrorClass){try{return decode(value)}catch{throw new ErrorClass(`Failed to base64url decode the ${label}`)}}function encodeBase64url(value,label,ErrorClass){try{return encode(value)}catch{throw new ErrorClass(`The ${label} is not a valid base64url string`)}}async function digest(algorithm,data){const subtleDigest=`SHA-${algorithm.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(subtleDigest,data))}function parseJoseHeader(b64,ErrorClass,message){let parsed;try{parsed=JSON.parse(strictDecoder.decode(decode(b64)))}catch{throw new ErrorClass(message)}if(!isObject(parsed)){throw new ErrorClass(message)}return parsed}async function jwkToKey(entry,jwk){if(jwk.kty==="RSA"&&"oth"in jwk&&jwk.oth!==undefined){throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported')}if(!entry.kty.includes(jwk.kty)){throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}const algorithm=entry.resolve?.({kty:jwk.kty,crv:jwk.crv})??entry.subtle;const isPrivate=!!(jwk.d||jwk.priv);const keyData={...jwk};if(keyData.kty!=="AKP"){delete keyData.alg}delete keyData.use;return crypto.subtle.importKey("jwk",keyData,algorithm,jwk.ext??!isPrivate,jwk.key_ops??entry.usages[isPrivate?1:0])}var tag=(key)=>key[Symbol.toStringTag];var jwkMatchesOp=(entry,key,usage)=>{const{alg}=entry;if(key.use!==undefined){const expected=usage==="sign"||usage==="verify"?"sig":"enc";if(key.use!==expected){throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`)}}if(key.alg!==undefined&&key.alg!==alg){throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`)}if(Array.isArray(key.key_ops)){const expectedKeyOp=usage==="encrypt"||usage==="decrypt"?entry.ops?.[usage==="encrypt"?0:1]:usage;if(expectedKeyOp&&!key.key_ops.includes(expectedKeyOp)){throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`)}}};function checkKeyType(entry,key,usage){const{alg,secret}=entry;const privateKey=usage==="decrypt"||usage==="sign";if(secret&&key instanceof Uint8Array)return[BYTES,key];if(isJWK(key)){if(secret?!isSecretJWK(key):!(privateKey?isPrivateJWK(key):isPublicJWK(key))){throw new TypeError(secret?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${privateKey?"private":"public"} JWK`)}jwkMatchesOp(entry,key,usage);return[JWK,key]}if(!isKeyLike(key)){throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"))}if(secret){if(key.type!=="secret"){throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}}else{if(key.type==="secret"){throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`)}const expectedType=privateKey?"private":"public";if((key.type==="public"||key.type==="private")&&key.type!==expectedType){const operation=usage==="sign"?"signing":usage==="verify"?"verifying":`${usage.slice(0,-1)}tion`;throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`)}}return isCryptoKey(key)?[CRYPTO,key]:[KEYOBJECT,key]}var BYTES=0;var CRYPTO=1;var KEYOBJECT=2;var JWK=3;var cache;var nist={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function cached(key,alg,value){cache||=new WeakMap;const entry=cache.get(key);if(value){if(entry){entry[alg]=value}else{cache.set(key,{__proto__:null,[alg]:value})}}return value??entry?.[alg]}var handleJWK=async(key,jwk,entry)=>cached(key,entry.alg)??cached(key,entry.alg,await jwkToKey(entry,{...jwk,alg:entry.alg}));var handleKeyObject=(keyObject,entry)=>{const hit=cached(keyObject,entry.alg);if(hit)return hit;const isPublic=keyObject.type==="public";const usages=entry.usages[isPublic?0:1];const{asymmetricKeyType}=keyObject;const crv=nist[keyObject.asymmetricKeyDetails?.namedCurve];const params=entry.resolve?.({crv,asymmetricKeyType})??entry.subtle;return cached(keyObject,entry.alg,keyObject.toCryptoKey(params,isPublic,usages))};async function prepareKey(entry,key,usage){const tagged=checkKeyType(entry,key,usage);switch(tagged[0]){case BYTES:case CRYPTO:return tagged[1];case JWK:{const key=tagged[1];if(key.k){return decode(key.k)}if(!Object.isFrozen(key)){const{key_ops}=key;if(Array.isArray(key_ops))Object.freeze(key_ops);Object.freeze(key)}return handleJWK(key,key,entry)}case KEYOBJECT:{const keyObject=tagged[1];if(keyObject.type==="secret"){return keyObject.export()}if("toCryptoKey"in keyObject&&typeof keyObject.toCryptoKey==="function"){return handleKeyObject(keyObject,entry)}return handleJWK(keyObject,keyObject.export({format:"jwk"}),entry)}}}function table(entries){const out={__proto__:null};for(const alg in entries){out[alg]={...entries[alg],alg}}return out}var wrap=[["encrypt","wrapKey"],["decrypt","unwrapKey"]];var derive=[[],["deriveBits"]];var none=[[],[]];function rsaes(bits){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${bits}`},usages:wrap,ops:["wrapKey","unwrapKey"]}}function ecdh(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty,crv,asymmetricKeyType})=>{if(crv==="X25519"||asymmetricKeyType==="x25519"){return{name:"X25519"}}if(kty==="OKP"){throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return{name:"ECDH",namedCurve:crv}},usages:derive,ops:[undefined,"deriveBits"]}}function aeskw(bits,gcm=false){return{kty:["oct"],secret:true,subtle:{name:gcm?"AES-GCM":"AES-KW",length:bits},usages:none,ops:gcm?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function pbes2(){return{kty:["oct"],secret:true,subtle:{name:"PBKDF2"},usages:none,ops:["deriveBits","deriveBits"]}}var JWE=table({dir:{kty:["oct"],secret:true,subtle:{name:"AES-GCM"},usages:none,ops:["encrypt","decrypt"]},"RSA-OAEP":rsaes(1),"RSA-OAEP-256":rsaes(256),"RSA-OAEP-384":rsaes(384),"RSA-OAEP-512":rsaes(512),"ECDH-ES":ecdh(),"ECDH-ES+A128KW":ecdh(),"ECDH-ES+A192KW":ecdh(),"ECDH-ES+A256KW":ecdh(),A128KW:aeskw(128),A192KW:aeskw(192),A256KW:aeskw(256),A128GCMKW:aeskw(128,true),A192GCMKW:aeskw(192,true),A256GCMKW:aeskw(256,true),"PBES2-HS256+A128KW":pbes2(),"PBES2-HS384+A192KW":pbes2(),"PBES2-HS512+A256KW":pbes2()});var contentOps=["encrypt","decrypt"];function contentEncryption(bits,cbc=false){return{kty:["oct"],secret:true,subtle:{name:cbc?"AES-CBC":"AES-GCM",length:bits},usages:none,ops:contentOps,cekBits:bits,ivBits:cbc?128:96,cbc}}var ENC=table({A128GCM:contentEncryption(128),A192GCM:contentEncryption(192),A256GCM:contentEncryption(256),"A128CBC-HS256":contentEncryption(256,true),"A192CBC-HS384":contentEncryption(384,true),"A256CBC-HS512":contentEncryption(512,true)});function unsupported(parameter,name){throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`)}function jweAlgorithm(alg){return(typeof alg==="string"?JWE[alg]:undefined)??unsupported("alg","Algorithm")}function jweEncryption(enc){return(typeof enc==="string"?ENC[enc]:undefined)??unsupported("enc","Encryption Algorithm")}function checkEcdhCryptoKey(key,usage){if(key.algorithm.name!=="ECDH"&&key.algorithm.name!=="X25519"){throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519")}checkUsage(key,usage)}async function aeskwCryptoKey(key,alg,usage){const expected=jweAlgorithm(alg).subtle;const cryptoKey=key instanceof Uint8Array?await crypto.subtle.importKey("raw",key,"AES-KW",true,[usage]):key;checkCryptoKey(cryptoKey,expected,usage);return cryptoKey}async function aeskwWrap(alg,key,cek){const cryptoKey=await aeskwCryptoKey(key,alg,"wrapKey");const cryptoKeyCek=await crypto.subtle.importKey("raw",cek,{hash:"SHA-256",name:"HMAC"},true,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",cryptoKeyCek,cryptoKey,"AES-KW"))}async function aeskwUnwrap(alg,key,encryptedKey){const cryptoKey=await aeskwCryptoKey(key,alg,"unwrapKey");const cryptoKeyCek=await crypto.subtle.unwrapKey("raw",encryptedKey,cryptoKey,"AES-KW",{hash:"SHA-256",name:"HMAC"},true,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",cryptoKeyCek))}function checkRsaKey(alg,key,usage){checkCryptoKey(key,jweAlgorithm(alg).subtle,usage);checkModulusLength(alg,key)}function pbes2CryptoKey(key,alg){if(key instanceof Uint8Array){return crypto.subtle.importKey("raw",key,"PBKDF2",false,["deriveBits"])}checkCryptoKey(key,jweAlgorithm(alg).subtle,"deriveBits");return key}async function deriveKey(p2s,alg,p2c,key){if(!(p2s instanceof Uint8Array)||p2s.length<8){throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets")}if(!Number.isSafeInteger(p2c)||Math.sign(p2c)!==1){throw new JWEInvalid("PBES2 Count Input must be a positive integer")}const salt=concat(encode(alg),Uint8Array.of(0),p2s);const keylen=parseInt(alg.slice(13,16),10);const subtleAlg={hash:`SHA-${alg.slice(8,11)}`,iterations:p2c,name:"PBKDF2",salt};const cryptoKey=await pbes2CryptoKey(key,alg);return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg,cryptoKey,keylen))}function lengthAndInput(input){return concat(uint32be(input.length),input)}async function concatKdf(Z,L,OtherInfo){const dkLen=L>>3;const hashLen=32;const reps=Math.ceil(dkLen/hashLen);const dk=new Uint8Array(reps*hashLen);for(let i=1;i<=reps;i++){const hashResult=await digest("sha256",concat(uint32be(i),Z,OtherInfo));dk.set(hashResult,(i-1)*hashLen)}return dk.slice(0,dkLen)}async function ecdhesDeriveKey(publicKey,privateKey,algorithm,keyLength,apu=new Uint8Array,apv=new Uint8Array){checkEcdhCryptoKey(publicKey);checkEcdhCryptoKey(privateKey,"deriveBits");const otherInfo=concat(lengthAndInput(encode(algorithm)),lengthAndInput(apu),lengthAndInput(apv),uint32be(keyLength));const Z=new Uint8Array(await crypto.subtle.deriveBits({name:publicKey.algorithm.name,public:publicKey},privateKey,publicKey.algorithm.name==="X25519"?256:Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3),10)/8)<<3));return concatKdf(Z,keyLength,otherInfo)}function assertEcdhKey(key){assertCryptoKey(key);const curve=key.algorithm.namedCurve;if(curve!=="P-256"&&curve!=="P-384"&&curve!=="P-521"&&key.algorithm.name!=="X25519"){throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime")}}function assertEncryptedKey(encryptedKey){if(encryptedKey===undefined)throw new JWEInvalid("JWE Encrypted Key missing")}function assertNoEncryptedKey(encryptedKey){if(encryptedKey!==undefined)throw new JWEInvalid("Encountered unexpected JWE Encrypted Key")}async function decryptKeyManagement(alg,enc,key,encryptedKey,joseHeader,options){const entry=jweAlgorithm(alg);if(alg==="dir"){assertNoEncryptedKey(encryptedKey);return key}switch(entry.subtle.name){case"ECDH":{if(alg==="ECDH-ES")assertNoEncryptedKey(encryptedKey);if(!isObject(joseHeader.epk))throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);assertEcdhKey(key);const epk=await jwkToKey(entry,joseHeader.epk);let partyUInfo;let partyVInfo;if(joseHeader.apu!==undefined){if(typeof joseHeader.apu!=="string")throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);partyUInfo=decodeBase64url(joseHeader.apu,"apu",JWEInvalid)}if(joseHeader.apv!==undefined){if(typeof joseHeader.apv!=="string")throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);partyVInfo=decodeBase64url(joseHeader.apv,"apv",JWEInvalid)}const sharedSecret=await ecdhesDeriveKey(epk,key,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),partyUInfo,partyVInfo);if(alg==="ECDH-ES")return sharedSecret;assertEncryptedKey(encryptedKey);return aeskwUnwrap(alg.slice(-6),sharedSecret,encryptedKey)}case"RSA-OAEP":{assertEncryptedKey(encryptedKey);assertCryptoKey(key);checkRsaKey(alg,key,"decrypt");return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",key,encryptedKey))}case"PBKDF2":{assertEncryptedKey(encryptedKey);if(typeof joseHeader.p2c!=="number")throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);const p2cLimit=options?.maxPBES2Count||1e4;if(joseHeader.p2c>p2cLimit)throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);if(typeof joseHeader.p2s!=="string")throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);const p2s=decodeBase64url(joseHeader.p2s,"p2s",JWEInvalid);const derived=await deriveKey(p2s,alg,joseHeader.p2c,key);return aeskwUnwrap(alg.slice(-6),derived,encryptedKey)}case"AES-KW":{assertEncryptedKey(encryptedKey);return aeskwUnwrap(alg,key,encryptedKey)}case"AES-GCM":{assertEncryptedKey(encryptedKey);if(typeof joseHeader.iv!=="string")throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);if(typeof joseHeader.tag!=="string")throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);let iv;iv=decodeBase64url(joseHeader.iv,"iv",JWEInvalid);let tag;tag=decodeBase64url(joseHeader.tag,"tag",JWEInvalid);return decrypt(jweEncryption(alg.slice(0,-2)),key,encryptedKey,iv,tag,new Uint8Array)}}}async function encryptKeyManagement(alg,enc,key,providedCek,providedParameters={}){let encryptedKey;let parameters;let cek;const entry=jweAlgorithm(alg);if(alg==="dir")return[key,undefined,undefined];switch(entry.subtle.name){case"ECDH":{assertEcdhKey(key);const{apu,apv}=providedParameters;let ephemeralKey;if(providedParameters.epk){ephemeralKey=await prepareKey(entry,providedParameters.epk,"decrypt")}else{ephemeralKey=(await crypto.subtle.generateKey(key.algorithm,true,["deriveBits"])).privateKey}const subtle=crypto.subtle;let exportableEpk=ephemeralKey;if(!exportableEpk.extractable){if(typeof subtle.getPublicKey!=="function"){throw new TypeError('CryptoKey for "epk" must be extractable')}exportableEpk=await subtle.getPublicKey(ephemeralKey,[])}const{x,y,crv,kty}=await subtle.exportKey("jwk",exportableEpk);const sharedSecret=await ecdhesDeriveKey(key,ephemeralKey,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),apu,apv);parameters={epk:{x,crv,kty}};if(kty==="EC")parameters.epk.y=y;if(apu)parameters.apu=encode2(apu);if(apv)parameters.apv=encode2(apv);if(alg==="ECDH-ES"){cek=sharedSecret;break}cek=providedCek||generateCek(enc);const kwAlg=alg.slice(-6);encryptedKey=await aeskwWrap(kwAlg,sharedSecret,cek);break}case"RSA-OAEP":{cek=providedCek||generateCek(enc);assertCryptoKey(key);checkRsaKey(alg,key,"encrypt");encryptedKey=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",key,cek));break}case"PBKDF2":{cek=providedCek||generateCek(enc);const{p2c=2048,p2s=crypto.getRandomValues(new Uint8Array(16))}=providedParameters;const derived=await deriveKey(p2s,alg,p2c,key);encryptedKey=await aeskwWrap(alg.slice(-6),derived,cek);parameters={p2c,p2s:encode2(p2s)};break}case"AES-KW":{cek=providedCek||generateCek(enc);encryptedKey=await aeskwWrap(alg,key,cek);break}case"AES-GCM":{cek=providedCek||generateCek(enc);const{iv}=providedParameters;const wrapped=await encrypt(jweEncryption(alg.slice(0,-2)),cek,key,iv,new Uint8Array);encryptedKey=wrapped.ciphertext;parameters={iv:encode2(wrapped.iv),tag:encode2(wrapped.tag)};break}}return[cek,encryptedKey,parameters]}var JWS_RECOGNIZED={__proto__:null,b64:true};var JWE_RECOGNIZED={__proto__:null};function validateAlgorithms(option,algorithms){if(algorithms!==undefined&&(!Array.isArray(algorithms)||algorithms.some((s)=>typeof s!=="string"))){throw new TypeError(`"${option}" option must be an array of strings`)}if(!algorithms){return}return new Set(algorithms)}function validateCritDuplicates(Err,protectedHeader){const{crit}=protectedHeader??{};if(Array.isArray(crit)&&new Set(crit).size!==crit.length){throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}}function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==undefined&&protectedHeader?.crit===undefined){throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected')}if(!protectedHeader||protectedHeader.crit===undefined){return[]}if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some((input)=>typeof input!=="string"||input.length===0)){throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present')}const recognized=recognizedOption===undefined?recognizedDefault:{__proto__:null,...recognizedOption,...recognizedDefault};for(const parameter of protectedHeader.crit){if(!(parameter in recognized)){throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`)}if(!Object.hasOwn(joseHeader,parameter)||joseHeader[parameter]===undefined){throw new Err(`Extension Header Parameter "${parameter}" is missing`)}if(recognized[parameter]&&(!Object.hasOwn(protectedHeader,parameter)||protectedHeader[parameter]===undefined)){throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}}return protectedHeader.crit}function supported(name){if(typeof globalThis[name]==="undefined"){throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`)}}async function compress(input){supported("CompressionStream");const cs=new CompressionStream("deflate-raw");const writer=cs.writable.getWriter();writer.write(input).catch(()=>{});writer.close().catch(()=>{});const chunks=[];const reader=cs.readable.getReader();for(;;){const{value,done}=await reader.read();if(done)break;chunks.push(value)}return concat(...chunks)}async function decompress(input,maxLength){supported("DecompressionStream");const ds=new DecompressionStream("deflate-raw");const writer=ds.writable.getWriter();writer.write(input).catch(()=>{});writer.close().catch(()=>{});const chunks=[];let length=0;const reader=ds.readable.getReader();for(;;){const{value,done}=await reader.read();if(done)break;chunks.push(value);length+=value.byteLength;if(maxLength!==Infinity&&length>maxLength){throw new JWEInvalid("Decompressed plaintext exceeded the configured limit")}}return concat(...chunks)}function shareJWE(jwe){const{protected:encodedProtected,ciphertext,iv,tag,aad}=jwe;let parsedProt;if(encodedProtected){parsedProt=parseJoseHeader(encodedProtected,JWEInvalid,"JWE Protected Header is invalid")}const protectedHeader=encodedProtected!==undefined?encode(encodedProtected):new Uint8Array;return[parsedProt,decodeBase64url(ciphertext,"ciphertext",JWEInvalid),iv!==undefined?decodeBase64url(iv,"iv",JWEInvalid):undefined,tag!==undefined?decodeBase64url(tag,"tag",JWEInvalid):undefined,aad!==undefined?concat(protectedHeader,encode("."),encodeBase64url(aad,"aad",JWEInvalid)):protectedHeader]}function prepareDecrypt(options){return[options&&validateAlgorithms("keyManagementAlgorithms",options.keyManagementAlgorithms),options&&validateAlgorithms("contentEncryptionAlgorithms",options.contentEncryptionAlgorithms),options]}async function decryptRecipient(jwe,token,shared,key){const[keyManagementAlgorithms,contentEncryptionAlgorithms,options]=shared;const[parsedProt,ciphertext,iv,tag,additionalData]=token;const{encrypted_key:encodedKey,header,unprotected}=jwe;let joseHeader;if(header!==undefined||unprotected!==undefined){if(!isDisjoint(parsedProt,header,unprotected)){throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint")}joseHeader={...parsedProt,...header,...unprotected}}else{joseHeader=parsedProt??{}}validateCrit(JWEInvalid,JWE_RECOGNIZED,options?.crit,parsedProt,joseHeader);if(joseHeader.zip!==undefined&&joseHeader.zip!=="DEF"){throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.')}if(joseHeader.zip!==undefined&&!parsedProt?.zip){throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}const{alg,enc}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header")}if(typeof enc!=="string"||!enc){throw new JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header")}if(keyManagementAlgorithms&&!keyManagementAlgorithms.has(alg)||!keyManagementAlgorithms&&alg.startsWith("PBES2")){throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed')}if(contentEncryptionAlgorithms&&!contentEncryptionAlgorithms.has(enc)){throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed')}const encEntry=jweEncryption(enc);let encryptedKey;if(encodedKey!==undefined){encryptedKey=decodeBase64url(encodedKey,"encrypted_key",JWEInvalid)}let resolvedKey=false;if(typeof key==="function"){key=await key(parsedProt,jwe);resolvedKey=true}const algEntry=jweAlgorithm(alg);const k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"decrypt");let cek;try{cek=await decryptKeyManagement(alg,encEntry,k,encryptedKey,joseHeader,options)}catch(err){if(err instanceof TypeError||err instanceof JWEInvalid||err instanceof JOSENotSupported){throw err}cek=generateCek(encEntry)}let plaintext=await decrypt(encEntry,cek,ciphertext,iv,tag,additionalData);if(joseHeader.zip==="DEF"){const maxDecompressedLength=options?.maxDecompressedLength??250000;if(maxDecompressedLength===0){throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.')}if(maxDecompressedLength!==Infinity&&(!Number.isSafeInteger(maxDecompressedLength)||maxDecompressedLength<1)){throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity")}plaintext=await decompress(plaintext,maxDecompressedLength).catch((cause)=>{if(cause instanceof JWEInvalid)throw cause;throw new JWEInvalid("Failed to decompress plaintext",{cause})})}return[plaintext,parsedProt,k,resolvedKey]}async function decryptJWE(jwe,shared,key){return decryptRecipient(jwe,shareJWE(jwe),shared,key)}async function decryptCompact(jwe,shared,key){if(jwe instanceof Uint8Array){jwe=decoder.decode(jwe)}if(typeof jwe!=="string"){throw new JWEInvalid("Compact JWE must be a string or Uint8Array")}const{0:protectedHeader,1:encryptedKey,2:iv,3:ciphertext,4:tag,length}=jwe.split(".");if(length!==5){throw new JWEInvalid("Invalid Compact JWE")}return decryptJWE({ciphertext,iv:iv||undefined,protected:protectedHeader,tag:tag||undefined,encrypted_key:encryptedKey||undefined},shared,key)}async function compactDecrypt(jwe,key,options){const decrypted=await decryptCompact(jwe,prepareDecrypt(options),key);const result={plaintext:decrypted[0],protectedHeader:decrypted[1]};if(typeof key==="function"){return{...result,key:decrypted[2]}}return result}function checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader){if(!isDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader)){throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}}function checkEncryptHeaders(input){const[,protectedHeader,unprotectedHeader,sharedUnprotectedHeader,,,,,crit]=input;checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader);const joseHeader={...protectedHeader,...unprotectedHeader,...sharedUnprotectedHeader};validateCrit(JWEInvalid,JWE_RECOGNIZED,crit,protectedHeader,joseHeader);if(joseHeader.zip!==undefined&&joseHeader.zip!=="DEF"){throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.')}if(joseHeader.zip!==undefined&&!protectedHeader?.zip){throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}const{alg,enc}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid')}if(typeof enc!=="string"||!enc){throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid')}return[joseHeader,alg,enc,jweEncryption(enc)]}async function encryptJWE(input,checked,key){const[joseHeader,alg,,encEntry]=checked;const[inputPlaintext,inputProtectedHeader,inputUnprotectedHeader,sharedUnprotectedHeader,aad,providedCek,inputIv,keyManagementParameters,,unprotectedParameters]=input;let protectedHeader=inputProtectedHeader;let unprotectedHeader=inputUnprotectedHeader;if(providedCek&&(alg==="dir"||alg==="ECDH-ES")){throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`)}const algEntry=jweAlgorithm(alg);const k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"encrypt");const[cek,encryptedKey,parameters]=await encryptKeyManagement(alg,encEntry,k,providedCek,keyManagementParameters);if(parameters){if(unprotectedParameters){unprotectedHeader=unprotectedHeader?{...unprotectedHeader,...parameters}:parameters}else{protectedHeader=protectedHeader?{...protectedHeader,...parameters}:parameters}checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader)}let protectedHeaderS;let protectedHeaderB;if(protectedHeader){protectedHeaderS=encode2(JSON.stringify(protectedHeader));protectedHeaderB=encode(protectedHeaderS)}else{protectedHeaderS="";protectedHeaderB=new Uint8Array}let additionalData;let aadMember;if(aad?.byteLength){aadMember=encode2(aad);additionalData=concat(protectedHeaderB,encode("."),encode(aadMember))}else{additionalData=protectedHeaderB}let plaintext=inputPlaintext;if(joseHeader.zip==="DEF"){plaintext=await compress(plaintext).catch((cause)=>{throw new JWEInvalid("Failed to compress plaintext",{cause})})}const{ciphertext,tag,iv}=await encrypt(encEntry,plaintext,cek,inputIv,additionalData);const jwe={ciphertext:encode2(ciphertext)};if(iv){jwe.iv=encode2(iv)}if(tag){jwe.tag=encode2(tag)}if(encryptedKey){jwe.encrypted_key=encode2(encryptedKey)}if(aadMember){jwe.aad=aadMember}if(protectedHeader){jwe.protected=protectedHeaderS}if(sharedUnprotectedHeader){jwe.unprotected=sharedUnprotectedHeader}if(unprotectedHeader){jwe.header=unprotectedHeader}return jwe}async function createJWE(input,key){return encryptJWE(input,checkEncryptHeaders(input),key)}class FlattenedEncrypt{#plaintext;#protectedHeader;#sharedUnprotectedHeader;#unprotectedHeader;#aad;#cek;#iv;#keyManagementParameters;constructor(plaintext){if(!(plaintext instanceof Uint8Array)){throw new TypeError("plaintext must be an instance of Uint8Array")}this.#plaintext=plaintext}setKeyManagementParameters(parameters){assertNotSet(this.#keyManagementParameters,"setKeyManagementParameters");this.#keyManagementParameters=parameters;return this}setProtectedHeader(protectedHeader){assertNotSet(this.#protectedHeader,"setProtectedHeader");this.#protectedHeader=protectedHeader;return this}setSharedUnprotectedHeader(sharedUnprotectedHeader){assertNotSet(this.#sharedUnprotectedHeader,"setSharedUnprotectedHeader");this.#sharedUnprotectedHeader=sharedUnprotectedHeader;return this}setUnprotectedHeader(unprotectedHeader){assertNotSet(this.#unprotectedHeader,"setUnprotectedHeader");this.#unprotectedHeader=unprotectedHeader;return this}setAdditionalAuthenticatedData(aad){this.#aad=aad;return this}setContentEncryptionKey(cek){assertNotSet(this.#cek,"setContentEncryptionKey");this.#cek=cek;return this}setInitializationVector(iv){assertNotSet(this.#iv,"setInitializationVector");this.#iv=iv;return this}async encrypt(key,options){if(!this.#protectedHeader&&!this.#unprotectedHeader&&!this.#sharedUnprotectedHeader){throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()")}validateCritDuplicates(JWEInvalid,this.#protectedHeader);return createJWE([this.#plaintext,this.#protectedHeader,this.#unprotectedHeader,this.#sharedUnprotectedHeader,this.#aad,this.#cek,this.#iv,this.#keyManagementParameters,options?.crit,options?unprotected in options:false],key)}}async function getSigKey(entry,key,usage){if(key instanceof Uint8Array){return crypto.subtle.importKey("raw",key,entry.subtle,false,[usage])}checkCryptoKey(key,entry.subtle,usage);if(entry.minRsaBits)checkModulusLength(entry.alg,key);return key}async function verify(entry,key,signature,data){const cryptoKey=await getSigKey(entry,key,"verify");try{return await crypto.subtle.verify(entry.signing,cryptoKey,signature,data)}catch{return false}}var sig=[["verify"],["sign"]];function hmac(bits){const subtle={name:"HMAC",hash:`SHA-${bits}`};return{kty:["oct"],secret:true,subtle,signing:subtle,usages:sig}}function rsa(bits,saltLength){const name=saltLength?"RSA-PSS":"RSASSA-PKCS1-v1_5";const subtle={name,hash:`SHA-${bits}`};return{kty:["RSA"],subtle,signing:saltLength?{...subtle,saltLength}:subtle,usages:sig,minRsaBits:2048}}function ecdsa(crv,bits){return{kty:["EC"],crv,subtle:{name:"ECDSA",namedCurve:crv},signing:{name:"ECDSA",hash:`SHA-${bits}`},usages:sig}}function eddsa(){const subtle={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle,signing:subtle,usages:sig}}function mldsa(bits){const name=`ML-DSA-${bits}`;const subtle={name};return{kty:["AKP"],subtle,signing:subtle,usages:sig}}var JWS=table({HS256:hmac(256),HS384:hmac(384),HS512:hmac(512),RS256:rsa(256),RS384:rsa(384),RS512:rsa(512),PS256:rsa(256,32),PS384:rsa(384,48),PS512:rsa(512,64),ES256:ecdsa("P-256",256),ES384:ecdsa("P-384",384),ES512:ecdsa("P-521",512),EdDSA:eddsa(),Ed25519:eddsa(),"ML-DSA-44":mldsa(44),"ML-DSA-65":mldsa(65),"ML-DSA-87":mldsa(87)});function jwsAlgorithm(alg){const entry=typeof alg==="string"?JWS[alg]:undefined;if(!entry){throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`)}return entry}function prepareVerify(options){return[options&&validateAlgorithms("algorithms",options.algorithms),options?.crit]}async function verifySignature(jws,shared,key){const{protected:encodedProtected,header,payload:inputPayload}=jws;let parsedProt={};if(encodedProtected){parsedProt=parseJoseHeader(encodedProtected,JWSInvalid,"JWS Protected Header is invalid")}let joseHeader;if(header!==undefined){if(!isDisjoint(parsedProt,header)){throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint")}joseHeader={...parsedProt,...header}}else{joseHeader=parsedProt}const extensions=validateCrit(JWSInvalid,JWS_RECOGNIZED,shared[1],parsedProt,joseHeader);let b64=true;if(extensions.includes("b64")){b64=parsedProt.b64;if(typeof b64!=="boolean"){throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean')}}const{alg}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid')}if(shared[0]&&!shared[0].has(alg)){throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed')}if(b64){if(typeof inputPayload!=="string"){throw new JWSInvalid("JWS Payload must be a string")}}else if(typeof inputPayload!=="string"&&!(inputPayload instanceof Uint8Array)){throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance")}let resolvedKey=false;if(typeof key==="function"){key=await key(parsedProt,jws);resolvedKey=true}const entry=jwsAlgorithm(alg);const data=concat(encodedProtected!==undefined?encode(encodedProtected):new Uint8Array,encode("."),typeof inputPayload==="string"?b64?shared[2]??=encodeBase64url(inputPayload,"payload",JWSInvalid):encoder.encode(inputPayload):inputPayload);const signature=decodeBase64url(jws.signature,"signature",JWSInvalid);const k=await prepareKey(entry,key,"verify");const verified=await verify(entry,k,signature,data);if(!verified){throw new JWSSignatureVerificationFailed}let payload;if(b64){payload=decodeBase64url(inputPayload,"payload",JWSInvalid)}else if(typeof inputPayload==="string"){payload=encoder.encode(inputPayload)}else{payload=inputPayload}return[payload,parsedProt,b64,k,resolvedKey]}async function verifyCompact(jws,shared,key){if(jws instanceof Uint8Array){jws=decoder.decode(jws)}if(typeof jws!=="string"){throw new JWSInvalid("Compact JWS must be a string or Uint8Array")}const{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3){throw new JWSInvalid("Invalid Compact JWS")}return verifySignature({payload,protected:protectedHeader,signature},shared,key)}var epoch=(date)=>Math.floor(date.getTime()/1000);var multipliers={s:1,m:60,h:3600,d:86400,w:604800,y:31557600};var REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;var checkFailed="check_failed";function secs(str){const matched=REGEX.exec(str);if(!matched||matched[4]&&matched[1]){throw new TypeError("Invalid time period format")}const value=parseFloat(matched[2]);const numericDate=Math.round(value*multipliers[matched[3][0].toLowerCase()]);if(matched[1]==="-"||matched[4]==="ago"){return-numericDate}return numericDate}function validateInput(label,input){if(!Number.isFinite(input)){throw new TypeError(`Invalid ${label} input`)}return input}var normalizeTyp=(value)=>{if(value.includes("/")){return value.toLowerCase()}return`application/${value.toLowerCase()}`};var checkAudiencePresence=(audPayload,audOption)=>{if(typeof audPayload==="string"){return audOption.includes(audPayload)}if(Array.isArray(audPayload)){return audOption.some((aud)=>audPayload.includes(aud))}return false};function validateNumericDate(payload,claim,required=false){const value=payload[claim];if(value===undefined&&!required)return;if(typeof value!=="number"){throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`,payload,claim,"invalid")}return value}function unexpectedClaim(payload,claim){throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`,payload,claim,checkFailed)}function validateClaimsSet(protectedHeader,encodedPayload,options={}){let payload;try{payload=JSON.parse(strictDecoder.decode(encodedPayload))}catch{}if(!isObject(payload)){throw new JWTInvalid("JWT Claims Set must be a top-level JSON object")}const{typ}=options;if(typ&&(typeof protectedHeader.typ!=="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ))){throw new JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ",checkFailed)}const{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options;const presenceCheck=[...requiredClaims];if(maxTokenAge!==undefined)presenceCheck.push("iat");if(audience!==undefined)presenceCheck.push("aud");if(subject!==undefined)presenceCheck.push("sub");if(issuer!==undefined)presenceCheck.push("iss");for(const claim of new Set(presenceCheck.reverse())){if(!Object.hasOwn(payload,claim)){throw new JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing")}}if(issuer!==undefined&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss)){unexpectedClaim(payload,"iss")}if(subject!==undefined&&payload.sub!==subject){unexpectedClaim(payload,"sub")}if(audience!==undefined&&!checkAudiencePresence(payload.aud,typeof audience==="string"?[audience]:audience)){unexpectedClaim(payload,"aud")}const{clockTolerance}=options;let tolerance=0;if(typeof clockTolerance==="string"){tolerance=secs(clockTolerance)}else if(clockTolerance!==undefined){if(typeof clockTolerance!=="number"){throw new TypeError("Invalid clockTolerance option type")}tolerance=clockTolerance}validateInput("clockTolerance option",tolerance);const{currentDate}=options;const now=validateInput("currentDate option",epoch(currentDate||new Date));const iat=validateNumericDate(payload,"iat",maxTokenAge!==undefined);const nbf=validateNumericDate(payload,"nbf");if(nbf!==undefined){if(nbf>now+tolerance){throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf",checkFailed)}}const exp=validateNumericDate(payload,"exp");if(exp!==undefined){if(exp<=now-tolerance){throw new JWTExpired('"exp" claim timestamp check failed',payload,"exp",checkFailed)}}if(maxTokenAge!==undefined){const age=now-iat;const max=typeof maxTokenAge==="number"?maxTokenAge:secs(maxTokenAge);if(age-tolerance>max){throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat",checkFailed)}if(age<0-tolerance){throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat",checkFailed)}}return payload}async function jwtVerify(jwt,key,options){const verified=await verifyCompact(jwt,prepareVerify(options),key);if(!verified[2]){throw new JWTInvalid("JWTs MUST NOT use unencoded payload")}const payload=validateClaimsSet(verified[1],verified[0],options);const result={payload,protectedHeader:verified[1]};if(typeof key==="function"){return{...result,key:verified[3]}}return result}class CompactEncrypt{#flattened;constructor(plaintext){this.#flattened=new FlattenedEncrypt(plaintext)}setContentEncryptionKey(cek){this.#flattened.setContentEncryptionKey(cek);return this}setInitializationVector(iv){this.#flattened.setInitializationVector(iv);return this}setProtectedHeader(protectedHeader){this.#flattened.setProtectedHeader(protectedHeader);return this}setKeyManagementParameters(parameters){this.#flattened.setKeyManagementParameters(parameters);return this}async encrypt(key,options){const jwe=await this.#flattened.encrypt(key,options);return[jwe.protected,jwe.encrypted_key,jwe.iv,jwe.ciphertext,jwe.tag].join(".")}}function signatureAlgorithm(alg){const entry=typeof alg==="string"?JWS[alg]:undefined;if(!entry||entry.secret){throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set')}return entry}function isJWKSLike(jwks){if(!jwks||typeof jwks!=="object"){return false}const{keys}=jwks;return Array.isArray(keys)&&keys.every(isObject)}class LocalJWKSetImpl{#jwks;#cached=new WeakMap;constructor(jwks){if(!isJWKSLike(jwks)){throw new JWKSInvalid("JSON Web Key Set malformed")}this.#jwks=structuredClone(jwks)}jwks(){return this.#jwks}async getKey(protectedHeader,token){const{alg,kid}={...protectedHeader,...token?.header};const entry=signatureAlgorithm(alg);const candidates=this.#jwks.keys.filter((jwk)=>entry.kty.includes(jwk.kty)&&(typeof kid!=="string"||kid===jwk.kid)&&(!(typeof jwk.alg==="string"||jwk.kty==="AKP")||alg===jwk.alg)&&(typeof jwk.use!=="string"||jwk.use==="sig")&&(!Array.isArray(jwk.key_ops)||jwk.key_ops.includes("verify"))&&(!entry.crv||jwk.crv===entry.crv));const{0:jwk,length}=candidates;if(length===0){throw new JWKSNoMatchingKey}if(length!==1){const error=new JWKSMultipleMatchingKeys;const _cached=this.#cached;error[Symbol.asyncIterator]=async function*(){for(const jwk of candidates){try{yield await importWithAlgCache(_cached,jwk,entry)}catch{}}};throw error}return importWithAlgCache(this.#cached,jwk,entry)}}async function importWithAlgCache(cache,jwk,entry){const cached=cache.get(jwk)||cache.set(jwk,{__proto__:null}).get(jwk);if(cached[entry.alg]===undefined){const key=await jwkToKey(entry,{...jwk,alg:entry.alg,ext:true});if(key.type!=="public"){throw new JWKSInvalid("JSON Web Key Set members must be public keys")}cached[entry.alg]=key}return cached[entry.alg]}function createLocalJWKSet(jwks){const set=new LocalJWKSetImpl(jwks);const localJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);Object.defineProperty(localJWKSet,"jwks",{value:()=>structuredClone(set.jwks())});return localJWKSet}function isCloudflareWorkers(){return typeof WebSocketPair!=="undefined"||typeof navigator!=="undefined"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime!=="undefined"&&EdgeRuntime==="vercel"}var USER_AGENT;if(typeof navigator==="undefined"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 ")){const NAME="jose";const VERSION="v6.2.9";USER_AGENT=`${NAME}/${VERSION}`}var customFetch=Symbol();async function fetchJwks(url,headers,signal,fetchImpl=fetch){const response=await fetchImpl(url,{method:"GET",signal,redirect:"manual",headers}).catch((err)=>{if(err.name==="TimeoutError"){throw new JWKSTimeout}throw err});if(response.status!==200){throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response")}try{return await response.json()}catch{throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var jwksCache=Symbol();function isFreshJwksCache(input,cacheMaxAge){if(typeof input!=="object"||input===null){return false}if(!("uat"in input)||typeof input.uat!=="number"||Date.now()-input.uat>=cacheMaxAge){return false}if(!("jwks"in input)||!isObject(input.jwks)||!Array.isArray(input.jwks.keys)||!Array.prototype.every.call(input.jwks.keys,isObject)){return false}return true}class RemoteJWKSetImpl{#url;#timeoutDuration;#cooldownDuration;#cacheMaxAge;#jwksTimestamp;#pendingFetch;#headers;#customFetch;#local;#cache;constructor(url,options){if(!(url instanceof URL)){throw new TypeError("url must be an instance of URL")}this.#url=new URL(url.href);const opts=options??{};this.#timeoutDuration=typeof opts.timeoutDuration==="number"?opts.timeoutDuration:5000;this.#cooldownDuration=typeof opts.cooldownDuration==="number"?opts.cooldownDuration:30000;this.#cacheMaxAge=typeof opts.cacheMaxAge==="number"?opts.cacheMaxAge:600000;this.#headers=new Headers(opts.headers);if(USER_AGENT&&!this.#headers.has("User-Agent")){this.#headers.set("User-Agent",USER_AGENT)}if(!this.#headers.has("accept")){this.#headers.set("accept","application/json");this.#headers.append("accept","application/jwk-set+json")}this.#customFetch=opts[customFetch];const cache=opts[jwksCache];if(cache!==undefined){this.#cache=cache;if(isFreshJwksCache(cache,this.#cacheMaxAge)){this.#jwksTimestamp=this.#cache.uat;this.#local=createLocalJWKSet(this.#cache.jwks)}}}pendingFetch(){return!!this.#pendingFetch}#validFor(duration){return typeof this.#jwksTimestamp==="number"&&Date.now()<this.#jwksTimestamp+duration}coolingDown(){return this.#validFor(this.#cooldownDuration)}fresh(){return this.#validFor(this.#cacheMaxAge)}jwks(){return this.#local?.jwks()}async getKey(protectedHeader,token){if(!this.#local||!this.fresh()){await this.reload()}try{return await this.#local(protectedHeader,token)}catch(err){if(err instanceof JWKSNoMatchingKey){if(this.coolingDown()===false){await this.reload();return this.#local(protectedHeader,token)}}throw err}}async reload(){if(this.#pendingFetch&&isCloudflareWorkers()){this.#pendingFetch=undefined}this.#pendingFetch||=fetchJwks(this.#url.href,this.#headers,AbortSignal.timeout(this.#timeoutDuration),this.#customFetch).then((json)=>{this.#local=createLocalJWKSet(json);if(this.#cache){this.#cache.uat=Date.now();this.#cache.jwks=json}this.#jwksTimestamp=Date.now()}).finally(()=>{this.#pendingFetch=undefined});await this.#pendingFetch}}function createRemoteJWKSet(url,options){const set=new RemoteJWKSetImpl(url,options);const remoteJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);Object.defineProperties(remoteJWKSet,{coolingDown:{get:()=>set.coolingDown(),enumerable:true},fresh:{get:()=>set.fresh(),enumerable:true},reload:{value:()=>set.reload(),enumerable:true},reloading:{get:()=>set.pendingFetch(),enumerable:true},jwks:{value:()=>set.jwks(),enumerable:true}});return remoteJWKSet}var loopbackHostname=/^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\])$/u;var requireTenantOrigin=(value,name)=>{let url;try{url=new URL(value)}catch{throw new TypeError(`${name} must contain only an HTTPS origin or a loopback HTTP origin`)}const allowedScheme=url.protocol==="https:"||url.protocol==="http:"&&loopbackHostname.test(url.hostname);if(!allowedScheme||url.origin!==value){throw new TypeError(`${name} must contain only an HTTPS origin or a loopback HTTP origin`)}return url.origin};class FederatedAuthRejectedError extends Error{code;constructor(code){super("Federated application authentication was rejected");this.name="FederatedAuthRejectedError";this.code=code}}var createCiTransport=(issuer,fetch2=globalThis.fetch)=>{const request=async(path,init,signal)=>{const url=new URL(path,issuer);if(url.origin!==issuer){throw new FederatedAuthRejectedError("invalid_identity")}try{const response=await fetch2(url,{...init,redirect:"manual",signal:signal===undefined?AbortSignal.timeout(1e4):AbortSignal.any([signal,AbortSignal.timeout(1e4)])});if(response.status>=500||response.status>=300&&response.status<400){throw new ApplicationUserAuthUnavailableError(new Error("CI authority unavailable"))}return response}catch(error){signal?.throwIfAborted();if(error instanceof ApplicationUserAuthUnavailableError){throw error}throw new ApplicationUserAuthUnavailableError(error)}};const keys=createRemoteJWKSet(new URL("/oauth/jwks",issuer),{[customFetch]:async(url,init)=>await request(url,init),cacheMaxAge:300000});return{keys,request}};var readJson=async(response,validate,signal)=>{let text;try{text=await response.text()}catch(error){signal?.throwIfAborted();throw new ApplicationUserAuthUnavailableError(error)}try{if(new TextEncoder().encode(text).byteLength>1048576){throw new Error("CI response too large")}const value=JSON.parse(text);if(!validate(value)){throw new FederatedAuthRejectedError("invalid_identity")}return value}catch{throw new FederatedAuthRejectedError("invalid_identity")}};var ajv=new import_ajv.default;var nonempty={minLength:1,type:"string"};var claimsSchema=ajv.compile({properties:{app_id:nonempty,client_id:nonempty,exp:{type:"integer"},iat:{type:"integer"},org_id:nonempty,scope:nonempty,sid:nonempty,sub:nonempty},required:["app_id","client_id","exp","iat","org_id","scope","sid","sub"],type:"object"});var identitySchema=ajv.compile({properties:{applicationId:nonempty,audience:nonempty,clientId:nonempty,expiresAt:nonempty,groupIds:{items:nonempty,type:"array"},issuer:nonempty,organizationId:nonempty,roles:{items:nonempty,type:"array"},scopes:{items:nonempty,type:"array"},user:{properties:{email:{type:["string","null"]},id:nonempty,name:{type:["string","null"]}},required:["id","email","name"],type:"object"}},required:["applicationId","audience","clientId","expiresAt","issuer","organizationId","scopes","user"],type:"object"});var verifyAccessTokenClaims=async(token,keys,policy)=>{try{const{payload}=await jwtVerify(token,keys,{algorithms:["ES256"],audience:policy.audience,currentDate:new Date(policy.now()),issuer:policy.issuer});if(!claimsSchema(payload)||payload.iat*1000>policy.now()){throw new FederatedAuthRejectedError("invalid_identity")}return payload}catch(error){if(error instanceof ApplicationUserAuthUnavailableError){throw error}if(error instanceof JWKSTimeout){throw new ApplicationUserAuthUnavailableError(error)}throw new FederatedAuthRejectedError("invalid_identity")}};var readCurrentIdentity=async(request,token,claims,policy,signal)=>{const response=await request("/oauth/identity",{headers:{authorization:`Bearer ${token}`}},signal);if(response.status===401||response.status===403){return null}const value=await readJson(response,identitySchema,signal);const granted=claims.scope.split(" ");if(response.status!==200||value.issuer!==policy.issuer||value.audience!==policy.audience||value.applicationId!==claims.app_id||value.clientId!==claims.client_id||value.organizationId!==claims.org_id||value.user.id!==claims.sub||Date.parse(value.expiresAt)!==claims.exp*1000||!value.scopes.every((scope)=>granted.includes(scope))){throw new FederatedAuthRejectedError("invalid_identity")}return value};var verified=(claims,scopes)=>({applicationId:claims.app_id,clientId:claims.client_id,expiresAt:new Date(claims.exp*1000),organizationId:claims.org_id,scopes,sessionId:claims.sid,userId:claims.sub});var createAccessTokenVerifier=(options)=>{const issuer=requireTenantOrigin(options.issuer,"issuer");if(options.audience===""||options.applicationId===""||options.clientId===""||options.organizationId===""||options.applicationId===undefined&&options.clientId===undefined){throw new TypeError("Access token verification requires an audience and an applicationId or clientId")}const policy={audience:options.audience,issuer,now:options.now??Date.now};const{keys,request}=createCiTransport(issuer,options.fetch);const claimsOf=async(token)=>{const claims=await verifyAccessTokenClaims(token,keys,policy);if(options.applicationId!==undefined&&claims.app_id!==options.applicationId||options.clientId!==undefined&&claims.client_id!==options.clientId||options.organizationId!==undefined&&claims.org_id!==options.organizationId){throw new FederatedAuthRejectedError("invalid_identity")}return claims};return{identity:async(token,{signal}={})=>{const claims=await claimsOf(token);const current=await readCurrentIdentity(request,token,claims,policy,signal);if(current===null){throw new FederatedAuthRejectedError("invalid_identity")}return{...verified(claims,current.scopes),groupIds:current.groupIds,roles:current.roles,user:current.user}},verify:async(token)=>{const claims=await claimsOf(token);return verified(claims,claims.scope.split(" ").filter(Boolean))}}};var readApplicationEnrollment=(env,prefix="CI_")=>{const missing=[];const required=(key)=>{const value=env[`${prefix}${key}`]??"";if(value===""){missing.push(`${prefix}${key}`)}return value};const enrollment={applicationId:required("APPLICATION_ID"),audience:required("AUDIENCE"),clientId:required("CLIENT_ID"),issuer:required("ISSUER"),organizationId:required("ORGANIZATION_ID"),scopes:required("SCOPES").split(" ").filter(Boolean)};if(missing.length>0){throw new TypeError(`CI enrollment is incomplete: ${missing.join(", ")} not set. Run \`ci apps enroll --env-file <path>\`.`)}const clientSecret=env[`${prefix}CLIENT_SECRET`]??"";return clientSecret===""?enrollment:{...enrollment,clientSecret}};var credential=Symbol.for("@collective-intelligence/external-apps-server-sdk/ci-entity-invocation");var bindCiEntityCredential=(context,accessToken)=>{Object.defineProperty(context,credential,{value:(candidate)=>candidate===context?accessToken:undefined});return Object.freeze(context)};var secureScope={attributes:"Path=/; HttpOnly; Secure; SameSite=Lax",name:"__Host-ci-federated"};var loopbackScope={attributes:"Path=/; HttpOnly; SameSite=Lax",name:"ci-federated"};var cookieScope=(request)=>new URL(request.url).protocol==="https:"?secureScope:loopbackScope;var base64=(value)=>btoa(String.fromCodePoint(...value)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"");var randomValue=()=>base64(globalThis.crypto.getRandomValues(new Uint8Array(32)));var digest2=async(value)=>base64(new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",new TextEncoder().encode(value))));var sessionCookie=(request)=>{const{name:cookieName}=cookieScope(request);const values=(request.headers.get("cookie")??"").split(";").map((cookie)=>cookie.trim()).filter((cookie)=>cookie.startsWith(`${cookieName}=`));if(values.length!==1){return null}const value=values[0]?.slice(cookieName.length+1)??"";return/^[\w-]{43}$/u.test(value)?value:null};var cookieHeader=(request,value,maxAge)=>{const scope=cookieScope(request);return`${scope.name}=${value}; ${scope.attributes}; Max-Age=${maxAge}`};var returnTarget=(value,origin)=>{if(value.length>2048||/[\u0000-\u0020\\]/u.test(value)){throw new TypeError("Invalid return target")}const target=new URL(value,origin);if(target.origin!==origin||target.username!==""||target.password!==""){throw new TypeError("Invalid return target")}return`${target.pathname}${target.search}${target.hash}`};var noStoreHeaders={"cache-control":"no-store","referrer-policy":"no-referrer"};var redirect=(location,cookie)=>{const headers=new Headers({...noStoreHeaders,location});if(cookie!==undefined){headers.set("set-cookie",cookie)}return new Response(null,{headers,status:302})};var import_ajv2=__toESM(require_ajv(),1);var ajv2=new import_ajv2.default;var nonempty2={minLength:1,type:"string"};var tokenSchema=ajv2.compile({properties:{access_token:nonempty2,expires_in:{exclusiveMinimum:0,type:"integer"},token_type:{const:"Bearer",type:"string"}},required:["access_token","expires_in","token_type"],type:"object"});var metadataSchema=ajv2.compile({properties:{authorization_endpoint:nonempty2,issuer:nonempty2,jwks_uri:nonempty2,token_endpoint:nonempty2},required:["issuer","authorization_endpoint","token_endpoint","jwks_uri"],type:"object"});var createCiAuthClient=(options,now)=>{const{keys,request}=createCiTransport(options.issuer,options.fetch);const policy={audience:options.audience,issuer:options.issuer,now};const identity=async(grant)=>{if(grant.expiresAt<=now()){return null}const claims=await verifyAccessTokenClaims(grant.accessToken,keys,policy);if(claims.client_id!==options.clientId||claims.org_id!==options.organizationId){throw new FederatedAuthRejectedError("invalid_identity")}const value=await readCurrentIdentity(request,grant.accessToken,claims,policy);if(value===null){return null}if(!options.scopes.every((scope)=>value.scopes.includes(scope))){throw new FederatedAuthRejectedError("invalid_identity")}const expiresAt=Math.min(grant.expiresAt,Date.parse(value.expiresAt));if(expiresAt<=now()){return null}return{applicationId:value.applicationId,expiresAt:new Date(expiresAt),groupIds:value.groupIds,identity:{email:value.user.email,id:value.user.id,issuer:value.issuer,kind:"ci_user",name:value.user.name,organizationId:value.organizationId},roles:value.roles,scopes:value.scopes}};const revoke=async(grant)=>{const response=await request("/oauth/logout",{headers:{authorization:`Bearer ${grant.accessToken}`},method:"POST"});if(response.status!==200&&response.status!==401){throw new ApplicationUserAuthUnavailableError(new Error("CI grant revocation failed"))}};return{exchange:async({callback,code,verifier})=>{const discovery=await request("/.well-known/oauth-authorization-server");const metadata=await readJson(discovery,metadataSchema);if(discovery.status!==200||metadata.issuer!==options.issuer||metadata.authorization_endpoint!==`${options.issuer}/oauth/authorize`||metadata.token_endpoint!==`${options.issuer}/oauth/token`||metadata.jwks_uri!==`${options.issuer}/oauth/jwks`){throw new FederatedAuthRejectedError("invalid_identity")}const body=new URLSearchParams({client_id:options.clientId,code,code_verifier:verifier,grant_type:"authorization_code",redirect_uri:callback});if(options.clientSecret!==undefined){body.set("client_secret",options.clientSecret)}const response=await request("/oauth/token",{body,headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST"});const token=await readJson(response,tokenSchema);if(response.status!==200){throw new FederatedAuthRejectedError("authorization_failed")}const grant={accessToken:token.access_token,expiresAt:now()+token.expires_in*1000};try{const session=await identity(grant);if(session===null){throw new FederatedAuthRejectedError("invalid_identity")}return{accessToken:grant.accessToken,expiresAt:session.expiresAt.getTime()}}catch(error){await revoke(grant);throw error}},identity,revoke}};var import_ajv3=__toESM(require_ajv(),1);var chunkBytes=3500;var maxChunks=8;var encoder2=new TextEncoder;var decoder2=new TextDecoder;var ajv3=new import_ajv3.default;var nonempty3={minLength:1,type:"string"};var sessionRecordSchema=ajv3.compile({properties:{expiresAt:{type:"integer"},grant:{nullable:true,properties:{accessToken:nonempty3,expiresAt:{type:"integer"}},required:["accessToken","expiresAt"],type:"object"},login:{oneOf:[{additionalProperties:false,properties:{status:{const:"idle"}},required:["status"],type:"object"},{additionalProperties:false,properties:{expiresAt:{type:"integer"},returnTo:nonempty3,state:nonempty3,status:{enum:["pending","exchanging"]},verifier:nonempty3},required:["expiresAt","returnTo","state","status","verifier"],type:"object"}]},revision:nonempty3},required:["expiresAt","grant","login","revision"],type:"object"});var chunkName=(scope,index)=>index===0?scope.name:`${scope.name}.${String(index)}`;var chunkCookie=(scope,index,value,maxAge)=>`${chunkName(scope,index)}=${value}; ${scope.attributes}; Max-Age=${String(maxAge)}`;var keyFor=async(secret)=>new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",encoder2.encode(secret)));var encryptRecord=async(record,secret)=>await new CompactEncrypt(encoder2.encode(JSON.stringify(record))).setProtectedHeader({alg:"dir",enc:"A256GCM"}).encrypt(await keyFor(secret));var parseSessionRecord=(validate,text)=>{try{const value=JSON.parse(text);return validate(value)?value:null}catch{return null}};var decryptRecord=async(token,secrets)=>{const keys=await Promise.all(secrets.map(keyFor));const attempts=await Promise.allSettled(keys.map(async(key)=>{const{plaintext}=await compactDecrypt(token,key);return parseSessionRecord(sessionRecordSchema,decoder2.decode(plaintext))}));for(const attempt of attempts){if(attempt.status==="fulfilled"&&attempt.value!==null){return attempt.value}}return null};var readCookieMap=(request)=>{const cookies=new Map;for(const part of(request.headers.get("cookie")??"").split(";")){const trimmed=part.trim();const separator=trimmed.indexOf("=");if(separator<=0){continue}cookies.set(trimmed.slice(0,separator),trimmed.slice(separator+1))}return cookies};var readSealedSession=async(request,secrets)=>{const scope=cookieScope(request);const cookies=readCookieMap(request);const first=cookies.get(chunkName(scope,0));if(first===undefined){return null}const separator=first.indexOf(".");const declared=Math.trunc(Number(first.slice(0,separator)));if(separator<=0||!Number.isSafeInteger(declared)||declared<1||declared>maxChunks){return null}const chunks=[first.slice(separator+1)];for(let index=1;index<declared;index+=1){const chunk=cookies.get(chunkName(scope,index));if(chunk===undefined){return null}chunks.push(chunk)}return await decryptRecord(chunks.join(""),secrets)};var sealedSessionCookies=async(request,record,secrets,maxAge)=>{const scope=cookieScope(request);const[current]=secrets;if(current===undefined||current.length===0){throw new TypeError("sealed-cookie session requires a rotatable secret")}const headers=[];if(record===null){for(let index=0;index<maxChunks;index+=1){headers.push(chunkCookie(scope,index,"",0))}return headers}const token=await encryptRecord(record,current);const chunks=[];for(let offset=0;offset<token.length;offset+=chunkBytes){chunks.push(token.slice(offset,offset+chunkBytes))}if(chunks.length>maxChunks){throw new TypeError("Sealed session cookie exceeds the browser size limit")}headers.push(chunkCookie(scope,0,`${String(chunks.length)}.${chunks[0]??""}`,maxAge));for(let index=1;index<chunks.length;index+=1){headers.push(chunkCookie(scope,index,chunks[index]??"",maxAge))}for(let index=chunks.length;index<maxChunks;index+=1){headers.push(chunkCookie(scope,index,"",0))}return headers};var appendCookies=(headers,cookies)=>{const next=new Headers(headers);for(const cookie of cookies){next.append("set-cookie",cookie)}return next};var redirectWithCookies=(location,cookies)=>{const headers=appendCookies(new Headers({...noStoreHeaders,location}),cookies);return new Response(null,{headers,status:302})};var storage=async(action)=>{try{return await action()}catch(error){throw new ApplicationUserAuthUnavailableError(error)}};var federatedBasePath=(basePath)=>{if(!/^\/[\w/-]+$/u.test(basePath)||basePath.endsWith("/")){throw new TypeError("basePath must be an absolute path without a trailing slash")}return basePath};var applicationOrigins=(value)=>{const origins=new Set([value].flat().map((origin)=>requireTenantOrigin(origin,"applicationOrigin")));if(origins.size===0){throw new TypeError("applicationOrigin must list at least one origin")}return origins};var listedOrigin=(context,url)=>context.origins.has(url.origin)?url.origin:null;var callbackFor=(context,origin)=>`${origin}${context.basePath}/callback`;var requireFederatedConfiguration=(ttl,options)=>{if(!Number.isSafeInteger(ttl)||ttl<300||ttl>604800||options.clientId===""||options.audience===""||options.organizationId===""||options.scopes.length===0){throw new TypeError("Federated authentication configuration is invalid")}};var federatedSessionSources=(options)=>{const sealed=options.session?.kind==="sealed_cookie"?options.session:undefined;const store=options.session?.kind==="store"?options.session.store:options.store;if(sealed===undefined&&store===undefined){throw new TypeError("Federated authentication requires a session store or sealed-cookie secrets")}if(sealed!==undefined&&(sealed.secrets.length===0||sealed.secrets.some((secret)=>secret.length===0))){throw new TypeError("sealed-cookie session requires a rotatable secret")}return{sealed,store}};var requireStore=(store)=>{if(store===undefined){throw new ApplicationUserAuthUnavailableError(new Error("Federated session store is required"))}return store};var pendingSession=(now,ttl,returnTo,grant)=>({expiresAt:now()+ttl*1000,grant,login:{expiresAt:now()+600000,returnTo,state:randomValue(),status:"pending",verifier:randomValue()},revision:randomValue()});var idleSession=(now,ttl,grant)=>({expiresAt:now()+ttl*1000,grant,login:{status:"idle"},revision:randomValue()});var authorizationHref=async(context,origin,login)=>{const url=new URL("/oauth/authorize",context.issuer);url.search=new URLSearchParams({client_id:context.options.clientId,code_challenge:await digest2(login.verifier),code_challenge_method:"S256",organization_id:context.options.organizationId,redirect_uri:callbackFor(context,origin),response_type:"code",scope:context.options.scopes.join(" "),state:login.state}).toString();return url.href};var requireCallbackQuery=(url)=>{if(url.searchParams.getAll("state").length!==1||url.searchParams.getAll("code").length!==1||url.searchParams.has("error")){throw new FederatedAuthRejectedError("invalid_state")}};var isPendingSession=(record)=>record.login.status==="pending";var requirePendingLogin=(record,nowMs,state)=>{if(record===null||!isPendingSession(record)){throw new FederatedAuthRejectedError("invalid_state")}if(record.expiresAt<=nowMs||record.login.expiresAt<=nowMs||record.login.state!==state){throw new FederatedAuthRejectedError("invalid_state")}return record};var requireCallbackCode=(url)=>{const code=url.searchParams.get("code")??"";if(code===""){throw new FederatedAuthRejectedError("invalid_state")}return code};var beginSealed=async(context,secrets,request,origin,returnTo)=>{const existing=await readSealedSession(request,secrets);const record=pendingSession(context.now,context.ttl,returnTo,existing?.grant??null);return redirectWithCookies(await authorizationHref(context,origin,record.login),await sealedSessionCookies(request,record,secrets,context.ttl))};var beginStored=async(context,store,request,origin,returnTo)=>{const existingCookie=sessionCookie(request);const existingId=existingCookie===null?null:await digest2(existingCookie);const existing=existingId===null?null:await storage(async()=>await store.read(existingId));const cookie=existing===null?randomValue():existingCookie??randomValue();const id=await digest2(cookie);const record=pendingSession(context.now,context.ttl,returnTo,existing?.grant??null);const saved=existing===null?await storage(async()=>await store.create(id,record)):await storage(async()=>await store.replace(id,existing.revision,record));if(!saved){return Response.json({error:"login_conflict"},{headers:noStoreHeaders,status:409})}return redirect(await authorizationHref(context,origin,record.login),cookieHeader(request,cookie,context.ttl))};var beginLogin=async(context,request,url,origin)=>{const returnTo=returnTarget(url.searchParams.get("returnTo")??"/",origin);if(context.sealed!==undefined){return await beginSealed(context,context.sealed.secrets,request,origin,returnTo)}return await beginStored(context,requireStore(context.store),request,origin,returnTo)};var completeSealed=async(context,secrets,request,url,origin)=>{const pending=requirePendingLogin(await readSealedSession(request,secrets),context.now(),url.searchParams.get("state"));const grant=await context.ci.exchange({callback:callbackFor(context,origin),code:requireCallbackCode(url),verifier:pending.login.verifier});try{if(pending.grant!==null){await context.ci.revoke(pending.grant)}return redirectWithCookies(pending.login.returnTo,await sealedSessionCookies(request,idleSession(context.now,context.ttl,grant),secrets,context.ttl))}catch(error){await context.ci.revoke(grant);throw error}};var completeStored=async(context,store,request,url,origin)=>{const cookie=sessionCookie(request);if(cookie===null){throw new FederatedAuthRejectedError("invalid_state")}const id=await digest2(cookie);const record=await storage(async()=>await store.read(id));const pending=requirePendingLogin(record,context.now(),url.searchParams.get("state"));const exchanging={...pending,login:{...pending.login,status:"exchanging"},revision:randomValue()};if(!await storage(async()=>await store.replace(id,pending.revision,exchanging))){throw new FederatedAuthRejectedError("invalid_state")}const grant=await context.ci.exchange({callback:callbackFor(context,origin),code:requireCallbackCode(url),verifier:pending.login.verifier});try{if(pending.grant!==null){await context.ci.revoke(pending.grant)}const authenticated=idleSession(context.now,context.ttl,grant);if(!await storage(async()=>await store.replace(id,exchanging.revision,authenticated))){throw new FederatedAuthRejectedError("invalid_state")}}catch(error){await context.ci.revoke(grant);throw error}return redirect(pending.login.returnTo,cookieHeader(request,cookie,context.ttl))};var completeLogin=async(context,request,url,origin)=>{requireCallbackQuery(url);if(context.sealed!==undefined){return await completeSealed(context,context.sealed.secrets,request,url,origin)}return await completeStored(context,requireStore(context.store),request,url,origin)};var sessionFromGrant=async(context,grant,recordExpiresAt)=>{const session=await context.ci.identity(grant);if(session===null){return null}const expiresAt=Math.min(session.expiresAt.getTime(),recordExpiresAt);if(expiresAt<=context.now()){return null}return{...session,accessToken:grant.accessToken,expiresAt:new Date(expiresAt)}};var verifiedSealed=async(context,secrets,request)=>{const record=await readSealedSession(request,secrets);if(record===null||record.expiresAt<=context.now()||record.grant===null){return null}try{return await sessionFromGrant(context,record.grant,record.expiresAt)}catch(error){if(!(error instanceof FederatedAuthRejectedError)){throw error}return null}};var replaceClearedGrant=async(store,id,record)=>{await storage(async()=>await store.replace(id,record.revision,{...record,grant:null,revision:randomValue()}))};var verifiedStored=async(context,store,request)=>{const cookie=sessionCookie(request);if(cookie===null){return null}const id=await digest2(cookie);const record=await storage(async()=>await store.read(id));if(record===null||record.expiresAt<=context.now()||record.grant===null){return null}try{const session=await context.ci.identity(record.grant);if(session===null){await replaceClearedGrant(store,id,record);return null}const current=await storage(async()=>await store.read(id));const expiresAt=Math.min(session.expiresAt.getTime(),record.expiresAt);if(expiresAt<=context.now()){return null}return current?.revision===record.revision?{...session,accessToken:record.grant.accessToken,expiresAt:new Date(expiresAt)}:null}catch(error){if(!(error instanceof FederatedAuthRejectedError)){throw error}await replaceClearedGrant(store,id,record);return null}};var getVerifiedSession=async(context,request)=>{if(listedOrigin(context,new URL(request.url))===null){return null}if(context.sealed!==undefined){return await verifiedSealed(context,context.sealed.secrets,request)}if(context.store===undefined){return null}return await verifiedStored(context,context.store,request)};var entityContext=async(context,request,resourceId)=>{const origin=listedOrigin(context,new URL(request.url));if(origin===null||resourceId.trim()===""||request.headers.get("sec-fetch-site")==="cross-site"||request.headers.has("origin")&&request.headers.get("origin")!==origin){return null}const verified=await getVerifiedSession(context,request);if(verified===null||verified.roles===undefined||verified.groupIds===undefined){return null}return bindCiEntityCredential({applicationId:verified.applicationId,groupIds:verified.groupIds,issuer:context.issuer,organizationId:context.options.organizationId,resourceId,roles:verified.roles,scopes:verified.scopes,user:verified.identity},verified.accessToken)};var logoutSealed=async(context,secrets,request)=>{const record=await readSealedSession(request,secrets);const cookies=await sealedSessionCookies(request,null,secrets,0);const headers=appendCookies(new Headers(noStoreHeaders),cookies);try{if(record?.grant!==null&&record?.grant!==undefined){await context.ci.revoke(record.grant)}return Response.json({revoked:true},{headers})}catch(error){if(!(error instanceof ApplicationUserAuthUnavailableError)){throw error}return Response.json({error:error.code},{headers,status:503})}};var logoutStored=async(context,store,request)=>{const cookie=sessionCookie(request);const id=cookie===null?null:await digest2(cookie);const record=id===null?null:await storage(async()=>await store.remove(id));const headers={...noStoreHeaders,"set-cookie":cookieHeader(request,"",0)};try{if(record?.grant!==null&&record?.grant!==undefined){await context.ci.revoke(record.grant)}return Response.json({revoked:true},{headers})}catch(error){if(!(error instanceof ApplicationUserAuthUnavailableError)){throw error}return Response.json({error:error.code},{headers,status:503})}};var logoutSession=async(context,request,origin)=>{if(request.headers.get("origin")!==origin||request.headers.get("sec-fetch-site")==="cross-site"){return Response.json({error:"invalid_origin"},{headers:noStoreHeaders,status:403})}if(context.sealed!==undefined){return await logoutSealed(context,context.sealed.secrets,request)}return await logoutStored(context,requireStore(context.store),request)};var handleFederatedRequest=async(context,request)=>{try{const url=new URL(request.url);const origin=listedOrigin(context,url);if(origin===null||url.hash!==""){throw new FederatedAuthRejectedError("invalid_request")}if(url.pathname===`${context.basePath}/login`&&request.method==="GET"){return await beginLogin(context,request,url,origin)}if(url.pathname===`${context.basePath}/callback`&&request.method==="GET"){return await completeLogin(context,request,url,origin)}if(url.pathname===`${context.basePath}/logout`&&request.method==="POST"){return await logoutSession(context,request,origin)}if(url.pathname===`${context.basePath}/session`&&request.method==="GET"){const verified=await getVerifiedSession(context,request);const session=verified===null?null:{expiresAt:verified.expiresAt,identity:verified.identity};return Response.json(session,{headers:noStoreHeaders,status:session===null?401:200})}return new Response(null,{headers:noStoreHeaders,status:404})}catch(error){if(error instanceof ApplicationUserAuthUnavailableError){return Response.json({error:error.code},{headers:noStoreHeaders,status:503})}if(error instanceof FederatedAuthRejectedError||error instanceof TypeError){return Response.json({error:error instanceof FederatedAuthRejectedError?error.code:"invalid_request"},{headers:noStoreHeaders,status:400})}throw error}};var createFederatedAuth=(options)=>{const origins=applicationOrigins(options.applicationOrigin);const issuer=requireTenantOrigin(options.issuer,"issuer");const basePath=federatedBasePath(options.basePath??"/api/auth");const now=options.now??Date.now;const ttl=options.sessionTtlSeconds??86400;requireFederatedConfiguration(ttl,options);const sources=federatedSessionSources(options);const context={basePath,ci:createCiAuthClient(options,now),issuer,now,options,origins,sealed:sources.sealed,store:sources.store,ttl};return{getAccessToken:async(request)=>{const verified=await getVerifiedSession(context,request);return verified?.accessToken??null},getEntityContext:async(request,resourceId)=>await entityContext(context,request,resourceId),getSession:async(request)=>{const verified=await getVerifiedSession(context,request);return verified===null?null:{expiresAt:verified.expiresAt,identity:verified.identity}},handler:async(request)=>await handleFederatedRequest(context,request),mode:"federated"}};var sessionRequest=(headers,applicationOrigin)=>new Request(new URL("/",applicationOrigin),{headers:{cookie:headers.get("cookie")??""}});var{authorizeWithUserAuth:authorizeWithUserAuth2}=exports_authorization;var{createAccessTokenVerifier:createAccessTokenVerifier2}=exports_access_token;var{readApplicationEnrollment:readApplicationEnrollment2}=exports_enrollment_env;var{sessionRequest:sessionRequest2}=exports_session_request;var{ApplicationUserAuthUnavailableError:ApplicationUserAuthUnavailableError2}=exports_contracts;var{createFederatedAuth:createFederatedAuth2}=exports_service;var{FederatedAuthRejectedError:FederatedAuthRejectedError2}=exports_errors2;var ApplicationUserAuthUnavailableError3=ApplicationUserAuthUnavailableError2;var authorizeWithUserAuth3=authorizeWithUserAuth2;var createAccessTokenVerifier3=createAccessTokenVerifier2;var createFederatedAuth3=createFederatedAuth2;var FederatedAuthRejectedError3=FederatedAuthRejectedError2;var readApplicationEnrollment3=readApplicationEnrollment2;var sessionRequest3=sessionRequest2;export{ApplicationUserAuthUnavailableError3 as ApplicationUserAuthUnavailableError,FederatedAuthRejectedError3 as FederatedAuthRejectedError,authorizeWithUserAuth3 as authorizeWithUserAuth,createAccessTokenVerifier3 as createAccessTokenVerifier,createFederatedAuth3 as createFederatedAuth,readApplicationEnrollment3 as readApplicationEnrollment,sessionRequest3 as sessionRequest};
8
+ deps: ${deps}}`};var def={keyword:"dependencies",type:"object",schemaType:"object",error:exports.error,code(cxt){const[propDeps,schDeps]=splitDependencies(cxt);validatePropertyDeps(cxt,propDeps);validateSchemaDeps(cxt,schDeps)}};function splitDependencies({schema}){const propertyDeps={};const schemaDeps={};for(const key in schema){if(key==="__proto__")continue;const deps=Array.isArray(schema[key])?propertyDeps:schemaDeps;deps[key]=schema[key]}return[propertyDeps,schemaDeps]}function validatePropertyDeps(cxt,propertyDeps=cxt.schema){const{gen,data,it}=cxt;if(Object.keys(propertyDeps).length===0)return;const missing=gen.let("missing");for(const prop in propertyDeps){const deps=propertyDeps[prop];if(deps.length===0)continue;const hasProperty=(0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties);cxt.setParams({property:prop,depsCount:deps.length,deps:deps.join(", ")});if(it.allErrors){gen.if(hasProperty,()=>{for(const depProp of deps){(0,code_1.checkReportMissingProp)(cxt,depProp)}})}else{gen.if((0,codegen_1._)`${hasProperty} && (${(0,code_1.checkMissingProp)(cxt,deps,missing)})`);(0,code_1.reportMissingProp)(cxt,missing);gen.else()}}}exports.validatePropertyDeps=validatePropertyDeps;function validateSchemaDeps(cxt,schemaDeps=cxt.schema){const{gen,data,keyword,it}=cxt;const valid=gen.name("valid");for(const prop in schemaDeps){if((0,util_1.alwaysValidSchema)(it,schemaDeps[prop]))continue;gen.if((0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties),()=>{const schCxt=cxt.subschema({keyword,schemaProp:prop},valid);cxt.mergeValidEvaluated(schCxt,valid)},()=>gen.var(valid,true));cxt.ok(valid)}}exports.validateSchemaDeps=validateSchemaDeps;exports.default=def});var require_propertyNames=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:"property name must be valid",params:({params})=>(0,codegen_1._)`{propertyName: ${params.propertyName}}`};var def={keyword:"propertyNames",type:"object",schemaType:["object","boolean"],error,code(cxt){const{gen,schema,data,it}=cxt;if((0,util_1.alwaysValidSchema)(it,schema))return;const valid=gen.name("valid");gen.forIn("key",data,(key)=>{cxt.setParams({propertyName:key});cxt.subschema({keyword:"propertyNames",data:key,dataTypes:["string"],propertyName:key,compositeRule:true},valid);gen.if((0,codegen_1.not)(valid),()=>{cxt.error(true);if(!it.allErrors)gen.break()})});cxt.ok(valid)}};exports.default=def});var require_additionalProperties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var codegen_1=require_codegen();var names_1=require_names();var util_1=require_util();var error={message:"must NOT have additional properties",params:({params})=>(0,codegen_1._)`{additionalProperty: ${params.additionalProperty}}`};var def={keyword:"additionalProperties",type:["object"],schemaType:["boolean","object"],allowUndefined:true,trackErrors:true,error,code(cxt){const{gen,schema,parentSchema,data,errsCount,it}=cxt;if(!errsCount)throw new Error("ajv implementation error");const{allErrors,opts}=it;it.props=true;if(opts.removeAdditional!=="all"&&(0,util_1.alwaysValidSchema)(it,schema))return;const props=(0,code_1.allSchemaProperties)(parentSchema.properties);const patProps=(0,code_1.allSchemaProperties)(parentSchema.patternProperties);checkAdditionalProperties();cxt.ok((0,codegen_1._)`${errsCount} === ${names_1.default.errors}`);function checkAdditionalProperties(){gen.forIn("key",data,(key)=>{if(!props.length&&!patProps.length)additionalPropertyCode(key);else gen.if(isAdditional(key),()=>additionalPropertyCode(key))})}function isAdditional(key){let definedProp;if(props.length>8){const propsSchema=(0,util_1.schemaRefOrVal)(it,parentSchema.properties,"properties");definedProp=(0,code_1.isOwnProperty)(gen,propsSchema,key)}else if(props.length){definedProp=(0,codegen_1.or)(...props.map((p)=>(0,codegen_1._)`${key} === ${p}`))}else{definedProp=codegen_1.nil}if(patProps.length){definedProp=(0,codegen_1.or)(definedProp,...patProps.map((p)=>(0,codegen_1._)`${(0,code_1.usePattern)(cxt,p)}.test(${key})`))}return(0,codegen_1.not)(definedProp)}function deleteAdditional(key){gen.code((0,codegen_1._)`delete ${data}[${key}]`)}function additionalPropertyCode(key){if(opts.removeAdditional==="all"||opts.removeAdditional&&schema===false){deleteAdditional(key);return}if(schema===false){cxt.setParams({additionalProperty:key});cxt.error();if(!allErrors)gen.break();return}if(typeof schema=="object"&&!(0,util_1.alwaysValidSchema)(it,schema)){const valid=gen.name("valid");if(opts.removeAdditional==="failing"){applyAdditionalSchema(key,valid,false);gen.if((0,codegen_1.not)(valid),()=>{cxt.reset();deleteAdditional(key)})}else{applyAdditionalSchema(key,valid);if(!allErrors)gen.if((0,codegen_1.not)(valid),()=>gen.break())}}}function applyAdditionalSchema(key,valid,errors){const subschema={keyword:"additionalProperties",dataProp:key,dataPropType:util_1.Type.Str};if(errors===false){Object.assign(subschema,{compositeRule:true,createErrors:false,allErrors:false})}cxt.subschema(subschema,valid)}}};exports.default=def});var require_properties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var validate_1=require_validate();var code_1=require_code2();var util_1=require_util();var additionalProperties_1=require_additionalProperties();var def={keyword:"properties",type:"object",schemaType:"object",code(cxt){const{gen,schema,parentSchema,data,it}=cxt;if(it.opts.removeAdditional==="all"&&parentSchema.additionalProperties===undefined){additionalProperties_1.default.code(new validate_1.KeywordCxt(it,additionalProperties_1.default,"additionalProperties"))}const allProps=(0,code_1.allSchemaProperties)(schema);for(const prop of allProps){it.definedProperties.add(prop)}if(it.opts.unevaluated&&allProps.length&&it.props!==true){it.props=util_1.mergeEvaluated.props(gen,(0,util_1.toHash)(allProps),it.props)}const properties=allProps.filter((p)=>!(0,util_1.alwaysValidSchema)(it,schema[p]));if(properties.length===0)return;const valid=gen.name("valid");for(const prop of properties){if(hasDefault(prop)){applyPropertySchema(prop)}else{gen.if((0,code_1.propertyInData)(gen,data,prop,it.opts.ownProperties));applyPropertySchema(prop);if(!it.allErrors)gen.else().var(valid,true);gen.endIf()}cxt.it.definedProperties.add(prop);cxt.ok(valid)}function hasDefault(prop){return it.opts.useDefaults&&!it.compositeRule&&schema[prop].default!==undefined}function applyPropertySchema(prop){cxt.subschema({keyword:"properties",schemaProp:prop,dataProp:prop},valid)}}};exports.default=def});var require_patternProperties=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var codegen_1=require_codegen();var util_1=require_util();var util_2=require_util();var def={keyword:"patternProperties",type:"object",schemaType:"object",code(cxt){const{gen,schema,data,parentSchema,it}=cxt;const{opts}=it;const patterns=(0,code_1.allSchemaProperties)(schema);const alwaysValidPatterns=patterns.filter((p)=>(0,util_1.alwaysValidSchema)(it,schema[p]));if(patterns.length===0||alwaysValidPatterns.length===patterns.length&&(!it.opts.unevaluated||it.props===true)){return}const checkProperties=opts.strictSchema&&!opts.allowMatchingProperties&&parentSchema.properties;const valid=gen.name("valid");if(it.props!==true&&!(it.props instanceof codegen_1.Name)){it.props=(0,util_2.evaluatedPropsToName)(gen,it.props)}const{props}=it;validatePatternProperties();function validatePatternProperties(){for(const pat of patterns){if(checkProperties)checkMatchingProperties(pat);if(it.allErrors){validateProperties(pat)}else{gen.var(valid,true);validateProperties(pat);gen.if(valid)}}}function checkMatchingProperties(pat){for(const prop in checkProperties){if(new RegExp(pat).test(prop)){(0,util_1.checkStrictMode)(it,`property ${prop} matches pattern ${pat} (use allowMatchingProperties)`)}}}function validateProperties(pat){gen.forIn("key",data,(key)=>{gen.if((0,codegen_1._)`${(0,code_1.usePattern)(cxt,pat)}.test(${key})`,()=>{const alwaysValid=alwaysValidPatterns.includes(pat);if(!alwaysValid){cxt.subschema({keyword:"patternProperties",schemaProp:pat,dataProp:key,dataPropType:util_2.Type.Str},valid)}if(it.opts.unevaluated&&props!==true){gen.assign((0,codegen_1._)`${props}[${key}]`,true)}else if(!alwaysValid&&!it.allErrors){gen.if((0,codegen_1.not)(valid),()=>gen.break())}})})}}};exports.default=def});var require_not=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:"not",schemaType:["object","boolean"],trackErrors:true,code(cxt){const{gen,schema,it}=cxt;if((0,util_1.alwaysValidSchema)(it,schema)){cxt.fail();return}const valid=gen.name("valid");cxt.subschema({keyword:"not",compositeRule:true,createErrors:false,allErrors:false},valid);cxt.failResult(valid,()=>cxt.reset(),()=>cxt.error())},error:{message:"must NOT be valid"}};exports.default=def});var require_anyOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var code_1=require_code2();var def={keyword:"anyOf",schemaType:"array",trackErrors:true,code:code_1.validateUnion,error:{message:"must match a schema in anyOf"}};exports.default=def});var require_oneOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:"must match exactly one schema in oneOf",params:({params})=>(0,codegen_1._)`{passingSchemas: ${params.passing}}`};var def={keyword:"oneOf",schemaType:"array",trackErrors:true,error,code(cxt){const{gen,schema,parentSchema,it}=cxt;if(!Array.isArray(schema))throw new Error("ajv implementation error");if(it.opts.discriminator&&parentSchema.discriminator)return;const schArr=schema;const valid=gen.let("valid",false);const passing=gen.let("passing",null);const schValid=gen.name("_valid");cxt.setParams({passing});gen.block(validateOneOf);cxt.result(valid,()=>cxt.reset(),()=>cxt.error(true));function validateOneOf(){schArr.forEach((sch,i)=>{let schCxt;if((0,util_1.alwaysValidSchema)(it,sch)){gen.var(schValid,true)}else{schCxt=cxt.subschema({keyword:"oneOf",schemaProp:i,compositeRule:true},schValid)}if(i>0){gen.if((0,codegen_1._)`${schValid} && ${valid}`).assign(valid,false).assign(passing,(0,codegen_1._)`[${passing}, ${i}]`).else()}gen.if(schValid,()=>{gen.assign(valid,true);gen.assign(passing,i);if(schCxt)cxt.mergeEvaluated(schCxt,codegen_1.Name)})})}}};exports.default=def});var require_allOf=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:"allOf",schemaType:"array",code(cxt){const{gen,schema,it}=cxt;if(!Array.isArray(schema))throw new Error("ajv implementation error");const valid=gen.name("valid");schema.forEach((sch,i)=>{if((0,util_1.alwaysValidSchema)(it,sch))return;const schCxt=cxt.subschema({keyword:"allOf",schemaProp:i},valid);cxt.ok(valid);cxt.mergeEvaluated(schCxt)})}};exports.default=def});var require_if=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var util_1=require_util();var error={message:({params})=>(0,codegen_1.str)`must match "${params.ifClause}" schema`,params:({params})=>(0,codegen_1._)`{failingKeyword: ${params.ifClause}}`};var def={keyword:"if",schemaType:["object","boolean"],trackErrors:true,error,code(cxt){const{gen,parentSchema,it}=cxt;if(parentSchema.then===undefined&&parentSchema.else===undefined){(0,util_1.checkStrictMode)(it,'"if" without "then" and "else" is ignored')}const hasThen=hasSchema(it,"then");const hasElse=hasSchema(it,"else");if(!hasThen&&!hasElse)return;const valid=gen.let("valid",true);const schValid=gen.name("_valid");validateIf();cxt.reset();if(hasThen&&hasElse){const ifClause=gen.let("ifClause");cxt.setParams({ifClause});gen.if(schValid,validateClause("then",ifClause),validateClause("else",ifClause))}else if(hasThen){gen.if(schValid,validateClause("then"))}else{gen.if((0,codegen_1.not)(schValid),validateClause("else"))}cxt.pass(valid,()=>cxt.error(true));function validateIf(){const schCxt=cxt.subschema({keyword:"if",compositeRule:true,createErrors:false,allErrors:false},schValid);cxt.mergeEvaluated(schCxt)}function validateClause(keyword,ifClause){return()=>{const schCxt=cxt.subschema({keyword},schValid);gen.assign(valid,schValid);cxt.mergeValidEvaluated(schCxt,valid);if(ifClause)gen.assign(ifClause,(0,codegen_1._)`${keyword}`);else cxt.setParams({ifClause:keyword})}}}};function hasSchema(it,keyword){const schema=it.schema[keyword];return schema!==undefined&&!(0,util_1.alwaysValidSchema)(it,schema)}exports.default=def});var require_thenElse=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var util_1=require_util();var def={keyword:["then","else"],schemaType:["object","boolean"],code({keyword,parentSchema,it}){if(parentSchema.if===undefined)(0,util_1.checkStrictMode)(it,`"${keyword}" without "if" is ignored`)}};exports.default=def});var require_applicator=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var additionalItems_1=require_additionalItems();var prefixItems_1=require_prefixItems();var items_1=require_items();var items2020_1=require_items2020();var contains_1=require_contains();var dependencies_1=require_dependencies();var propertyNames_1=require_propertyNames();var additionalProperties_1=require_additionalProperties();var properties_1=require_properties();var patternProperties_1=require_patternProperties();var not_1=require_not();var anyOf_1=require_anyOf();var oneOf_1=require_oneOf();var allOf_1=require_allOf();var if_1=require_if();var thenElse_1=require_thenElse();function getApplicator(draft2020=false){const applicator=[not_1.default,anyOf_1.default,oneOf_1.default,allOf_1.default,if_1.default,thenElse_1.default,propertyNames_1.default,additionalProperties_1.default,dependencies_1.default,properties_1.default,patternProperties_1.default];if(draft2020)applicator.push(prefixItems_1.default,items2020_1.default);else applicator.push(additionalItems_1.default,items_1.default);applicator.push(contains_1.default);return applicator}exports.default=getApplicator});var require_format=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var error={message:({schemaCode})=>(0,codegen_1.str)`must match format "${schemaCode}"`,params:({schemaCode})=>(0,codegen_1._)`{format: ${schemaCode}}`};var def={keyword:"format",type:["number","string"],schemaType:"string",$data:true,error,code(cxt,ruleType){const{gen,data,$data,schema,schemaCode,it}=cxt;const{opts,errSchemaPath,schemaEnv,self}=it;if(!opts.validateFormats)return;if($data)validate$DataFormat();else validateFormat();function validate$DataFormat(){const fmts=gen.scopeValue("formats",{ref:self.formats,code:opts.code.formats});const fDef=gen.const("fDef",(0,codegen_1._)`${fmts}[${schemaCode}]`);const fType=gen.let("fType");const format=gen.let("format");gen.if((0,codegen_1._)`typeof ${fDef} == "object" && !(${fDef} instanceof RegExp)`,()=>gen.assign(fType,(0,codegen_1._)`${fDef}.type || "string"`).assign(format,(0,codegen_1._)`${fDef}.validate`),()=>gen.assign(fType,(0,codegen_1._)`"string"`).assign(format,fDef));cxt.fail$data((0,codegen_1.or)(unknownFmt(),invalidFmt()));function unknownFmt(){if(opts.strictSchema===false)return codegen_1.nil;return(0,codegen_1._)`${schemaCode} && !${format}`}function invalidFmt(){const callFormat=schemaEnv.$async?(0,codegen_1._)`(${fDef}.async ? await ${format}(${data}) : ${format}(${data}))`:(0,codegen_1._)`${format}(${data})`;const validData=(0,codegen_1._)`(typeof ${format} == "function" ? ${callFormat} : ${format}.test(${data}))`;return(0,codegen_1._)`${format} && ${format} !== true && ${fType} === ${ruleType} && !${validData}`}}function validateFormat(){const formatDef=self.formats[schema];if(!formatDef){unknownFormat();return}if(formatDef===true)return;const[fmtType,format,fmtRef]=getFormat(formatDef);if(fmtType===ruleType)cxt.pass(validCondition());function unknownFormat(){if(opts.strictSchema===false){self.logger.warn(unknownMsg());return}throw new Error(unknownMsg());function unknownMsg(){return`unknown format "${schema}" ignored in schema at path "${errSchemaPath}"`}}function getFormat(fmtDef){const code=fmtDef instanceof RegExp?(0,codegen_1.regexpCode)(fmtDef):opts.code.formats?(0,codegen_1._)`${opts.code.formats}${(0,codegen_1.getProperty)(schema)}`:undefined;const fmt=gen.scopeValue("formats",{key:schema,ref:fmtDef,code});if(typeof fmtDef=="object"&&!(fmtDef instanceof RegExp)){return[fmtDef.type||"string",fmtDef.validate,(0,codegen_1._)`${fmt}.validate`]}return["string",fmtDef,fmt]}function validCondition(){if(typeof formatDef=="object"&&!(formatDef instanceof RegExp)&&formatDef.async){if(!schemaEnv.$async)throw new Error("async format in sync schema");return(0,codegen_1._)`await ${fmtRef}(${data})`}return typeof format=="function"?(0,codegen_1._)`${fmtRef}(${data})`:(0,codegen_1._)`${fmtRef}.test(${data})`}}}};exports.default=def});var require_format2=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var format_1=require_format();var format=[format_1.default];exports.default=format});var require_metadata=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.contentVocabulary=exports.metadataVocabulary=undefined;exports.metadataVocabulary=["title","description","default","deprecated","readOnly","writeOnly","examples"];exports.contentVocabulary=["contentMediaType","contentEncoding","contentSchema"]});var require_draft7=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var core_1=require_core2();var validation_1=require_validation();var applicator_1=require_applicator();var format_1=require_format2();var metadata_1=require_metadata();var draft7Vocabularies=[core_1.default,validation_1.default,(0,applicator_1.default)(),format_1.default,metadata_1.metadataVocabulary,metadata_1.contentVocabulary];exports.default=draft7Vocabularies});var require_types=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});exports.DiscrError=undefined;var DiscrError;(function(DiscrError){DiscrError["Tag"]="tag";DiscrError["Mapping"]="mapping"})(DiscrError||(exports.DiscrError=DiscrError={}))});var require_discriminator=__commonJS(function(exports){Object.defineProperty(exports,"__esModule",{value:true});var codegen_1=require_codegen();var types_1=require_types();var compile_1=require_compile();var ref_error_1=require_ref_error();var util_1=require_util();var error={message:({params:{discrError,tagName}})=>discrError===types_1.DiscrError.Tag?`tag "${tagName}" must be string`:`value of tag "${tagName}" must be in oneOf`,params:({params:{discrError,tag,tagName}})=>(0,codegen_1._)`{error: ${discrError}, tag: ${tagName}, tagValue: ${tag}}`};var def={keyword:"discriminator",type:"object",schemaType:"object",error,code(cxt){const{gen,data,schema,parentSchema,it}=cxt;const{oneOf}=parentSchema;if(!it.opts.discriminator){throw new Error("discriminator: requires discriminator option")}const tagName=schema.propertyName;if(typeof tagName!="string")throw new Error("discriminator: requires propertyName");if(schema.mapping)throw new Error("discriminator: mapping is not supported");if(!oneOf)throw new Error("discriminator: requires oneOf keyword");const valid=gen.let("valid",false);const tag=gen.const("tag",(0,codegen_1._)`${data}${(0,codegen_1.getProperty)(tagName)}`);gen.if((0,codegen_1._)`typeof ${tag} == "string"`,()=>validateMapping(),()=>cxt.error(false,{discrError:types_1.DiscrError.Tag,tag,tagName}));cxt.ok(valid);function validateMapping(){const mapping=getMapping();gen.if(false);for(const tagValue in mapping){gen.elseIf((0,codegen_1._)`${tag} === ${tagValue}`);gen.assign(valid,applyTagSchema(mapping[tagValue]))}gen.else();cxt.error(false,{discrError:types_1.DiscrError.Mapping,tag,tagName});gen.endIf()}function applyTagSchema(schemaProp){const _valid=gen.name("valid");const schCxt=cxt.subschema({keyword:"oneOf",schemaProp},_valid);cxt.mergeEvaluated(schCxt,codegen_1.Name);return _valid}function getMapping(){var _a;const oneOfMapping={};const topRequired=hasRequired(parentSchema);let tagRequired=true;for(let i=0;i<oneOf.length;i++){let sch=oneOf[i];if((sch===null||sch===undefined?undefined:sch.$ref)&&!(0,util_1.schemaHasRulesButRef)(sch,it.self.RULES)){const ref=sch.$ref;sch=compile_1.resolveRef.call(it.self,it.schemaEnv.root,it.baseId,ref);if(sch instanceof compile_1.SchemaEnv)sch=sch.schema;if(sch===undefined)throw new ref_error_1.default(it.opts.uriResolver,it.baseId,ref)}const propSch=(_a=sch===null||sch===undefined?undefined:sch.properties)===null||_a===undefined?undefined:_a[tagName];if(typeof propSch!="object"){throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${tagName}"`)}tagRequired=tagRequired&&(topRequired||hasRequired(sch));addMappings(propSch,i)}if(!tagRequired)throw new Error(`discriminator: "${tagName}" must be required`);return oneOfMapping;function hasRequired({required}){return Array.isArray(required)&&required.includes(tagName)}function addMappings(sch,i){if(sch.const){addMapping(sch.const,i)}else if(sch.enum){for(const tagValue of sch.enum){addMapping(tagValue,i)}}else{throw new Error(`discriminator: "properties/${tagName}" must have "const" or "enum"`)}}function addMapping(tagValue,i){if(typeof tagValue!="string"||tagValue in oneOfMapping){throw new Error(`discriminator: "${tagName}" values must be unique strings`)}oneOfMapping[tagValue]=i}}}};exports.default=def});var require_json_schema_draft_07=__commonJS(function(exports,module){module.exports={$schema:"http://json-schema.org/draft-07/schema#",$id:"http://json-schema.org/draft-07/schema#",title:"Core schema meta-schema",definitions:{schemaArray:{type:"array",minItems:1,items:{$ref:"#"}},nonNegativeInteger:{type:"integer",minimum:0},nonNegativeIntegerDefault0:{allOf:[{$ref:"#/definitions/nonNegativeInteger"},{default:0}]},simpleTypes:{enum:["array","boolean","integer","null","number","object","string"]},stringArray:{type:"array",items:{type:"string"},uniqueItems:true,default:[]}},type:["object","boolean"],properties:{$id:{type:"string",format:"uri-reference"},$schema:{type:"string",format:"uri"},$ref:{type:"string",format:"uri-reference"},$comment:{type:"string"},title:{type:"string"},description:{type:"string"},default:true,readOnly:{type:"boolean",default:false},examples:{type:"array",items:true},multipleOf:{type:"number",exclusiveMinimum:0},maximum:{type:"number"},exclusiveMaximum:{type:"number"},minimum:{type:"number"},exclusiveMinimum:{type:"number"},maxLength:{$ref:"#/definitions/nonNegativeInteger"},minLength:{$ref:"#/definitions/nonNegativeIntegerDefault0"},pattern:{type:"string",format:"regex"},additionalItems:{$ref:"#"},items:{anyOf:[{$ref:"#"},{$ref:"#/definitions/schemaArray"}],default:true},maxItems:{$ref:"#/definitions/nonNegativeInteger"},minItems:{$ref:"#/definitions/nonNegativeIntegerDefault0"},uniqueItems:{type:"boolean",default:false},contains:{$ref:"#"},maxProperties:{$ref:"#/definitions/nonNegativeInteger"},minProperties:{$ref:"#/definitions/nonNegativeIntegerDefault0"},required:{$ref:"#/definitions/stringArray"},additionalProperties:{$ref:"#"},definitions:{type:"object",additionalProperties:{$ref:"#"},default:{}},properties:{type:"object",additionalProperties:{$ref:"#"},default:{}},patternProperties:{type:"object",additionalProperties:{$ref:"#"},propertyNames:{format:"regex"},default:{}},dependencies:{type:"object",additionalProperties:{anyOf:[{$ref:"#"},{$ref:"#/definitions/stringArray"}]}},propertyNames:{$ref:"#"},const:true,enum:{type:"array",items:true,minItems:1,uniqueItems:true},type:{anyOf:[{$ref:"#/definitions/simpleTypes"},{type:"array",items:{$ref:"#/definitions/simpleTypes"},minItems:1,uniqueItems:true}]},format:{type:"string"},contentMediaType:{type:"string"},contentEncoding:{type:"string"},if:{$ref:"#"},then:{$ref:"#"},else:{$ref:"#"},allOf:{$ref:"#/definitions/schemaArray"},anyOf:{$ref:"#/definitions/schemaArray"},oneOf:{$ref:"#/definitions/schemaArray"},not:{$ref:"#"}},default:true}});var require_ajv=__commonJS(function(exports,module){Object.defineProperty(exports,"__esModule",{value:true});exports.MissingRefError=exports.ValidationError=exports.CodeGen=exports.Name=exports.nil=exports.stringify=exports.str=exports._=exports.KeywordCxt=exports.Ajv=undefined;var core_1=require_core();var draft7_1=require_draft7();var discriminator_1=require_discriminator();var draft7MetaSchema=require_json_schema_draft_07();var META_SUPPORT_DATA=["/properties"];var META_SCHEMA_ID="http://json-schema.org/draft-07/schema";class Ajv extends core_1.default{_addVocabularies(){super._addVocabularies();draft7_1.default.forEach((v)=>this.addVocabulary(v));if(this.opts.discriminator)this.addKeyword(discriminator_1.default)}_addDefaultMetaSchema(){super._addDefaultMetaSchema();if(!this.opts.meta)return;const metaSchema=this.opts.$data?this.$dataMetaSchema(draft7MetaSchema,META_SUPPORT_DATA):draft7MetaSchema;this.addMetaSchema(metaSchema,META_SCHEMA_ID,false);this.refs["http://json-schema.org/schema"]=META_SCHEMA_ID}defaultMeta(){return this.opts.defaultMeta=super.defaultMeta()||(this.getSchema(META_SCHEMA_ID)?META_SCHEMA_ID:undefined)}}exports.Ajv=Ajv;module.exports=exports=Ajv;module.exports.Ajv=Ajv;Object.defineProperty(exports,"__esModule",{value:true});exports.default=Ajv;var validate_1=require_validate();Object.defineProperty(exports,"KeywordCxt",{enumerable:true,get:function(){return validate_1.KeywordCxt}});var codegen_1=require_codegen();Object.defineProperty(exports,"_",{enumerable:true,get:function(){return codegen_1._}});Object.defineProperty(exports,"str",{enumerable:true,get:function(){return codegen_1.str}});Object.defineProperty(exports,"stringify",{enumerable:true,get:function(){return codegen_1.stringify}});Object.defineProperty(exports,"nil",{enumerable:true,get:function(){return codegen_1.nil}});Object.defineProperty(exports,"Name",{enumerable:true,get:function(){return codegen_1.Name}});Object.defineProperty(exports,"CodeGen",{enumerable:true,get:function(){return codegen_1.CodeGen}});var validation_error_1=require_validation_error();Object.defineProperty(exports,"ValidationError",{enumerable:true,get:function(){return validation_error_1.default}});var ref_error_1=require_ref_error();Object.defineProperty(exports,"MissingRefError",{enumerable:true,get:function(){return ref_error_1.default}})});var exports_authorization={};__export(exports_authorization,{authorizeWithUserAuth:()=>authorizeWithUserAuth});var exports_contracts={};__export(exports_contracts,{ApplicationUserAuthUnavailableError:()=>ApplicationUserAuthUnavailableError});var exports_access_token={};__export(exports_access_token,{createAccessTokenVerifier:()=>createAccessTokenVerifier,readCurrentIdentity:()=>readCurrentIdentity,verifyAccessTokenClaims:()=>verifyAccessTokenClaims});var exports_errors2={};__export(exports_errors2,{FederatedAuthRejectedError:()=>FederatedAuthRejectedError});var exports_enrollment_env={};__export(exports_enrollment_env,{readApplicationEnrollment:()=>readApplicationEnrollment});var exports_service={};__export(exports_service,{createFederatedAuth:()=>createFederatedAuth});var exports_session_request={};__export(exports_session_request,{sessionRequest:()=>sessionRequest});var unauthenticated=()=>Response.json({error:"authentication_required"},{headers:{"cache-control":"no-store"},status:401});var forbidden=()=>Response.json({error:"forbidden"},{status:403});var isReadOperation=(operation)=>operation===undefined||operation==="get"||operation==="list";var authorizeWithUserAuth=(auth,policy)=>(resourceId)=>async(request,operation="get")=>{const context=await auth.getEntityContext(request,resourceId);if(context===null){return unauthenticated()}const scope=isReadOperation(operation)?policy.readScope:policy.writeScope;return context.scopes.includes(scope)?context:forbidden()};var unavailableBrand=Symbol.for("@collective-intelligence/external-apps-server-sdk/ApplicationUserAuthUnavailableError");class ApplicationUserAuthUnavailableError extends Error{[unavailableBrand]=true;code="user_auth_unavailable";static[Symbol.hasInstance](value){return value instanceof Error&&unavailableBrand in value&&value[unavailableBrand]===true&&"code"in value&&value.code==="user_auth_unavailable"}constructor(cause){super("Application user authentication is unavailable",{cause});this.name="ApplicationUserAuthUnavailableError"}}var import_ajv=__toESM(require_ajv(),1);var encoder=new TextEncoder;var decoder=new TextDecoder;var strictDecoder=new TextDecoder("utf-8",{fatal:true});var MAX_INT32=2**32;function concat(...buffers){const size=buffers.reduce((acc,{length})=>acc+length,0);const buf=new Uint8Array(size);let i=0;for(const buffer of buffers){buf.set(buffer,i);i+=buffer.length}return buf}function writeUInt32BE(buf,value,offset){if(value<0||value>=MAX_INT32){throw new RangeError(`value must be >= 0 and <= ${MAX_INT32-1}. Received ${value}`)}buf.set([value>>>24,value>>>16,value>>>8,value&255],offset)}function uint64be(value){const high=Math.floor(value/MAX_INT32);const low=value%MAX_INT32;const buf=new Uint8Array(8);writeUInt32BE(buf,high,0);writeUInt32BE(buf,low,4);return buf}function uint32be(value){const buf=new Uint8Array(4);writeUInt32BE(buf,value);return buf}function encode(string){const bytes=new Uint8Array(string.length);for(let i=0;i<string.length;i++){const code=string.charCodeAt(i);if(code>127){throw new TypeError("non-ASCII string encountered in encode()")}bytes[i]=code}return bytes}var unusable=(name,prop="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);function checkUsage(key,usage){if(usage&&!key.usages.includes(usage)){throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`)}}function checkModulusLength(alg,key){const{modulusLength}=key.algorithm;if(typeof modulusLength!=="number"||modulusLength<2048){throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}}function checkCryptoKey(key,expected,usage){const algorithm=key.algorithm;if(algorithm.name!==expected.name){throw unusable(expected.name)}if(expected.hash&&algorithm.hash?.name!==expected.hash){throw unusable(expected.hash,"algorithm.hash")}if(expected.namedCurve&&algorithm.namedCurve!==expected.namedCurve){throw unusable(expected.namedCurve,"algorithm.namedCurve")}if(expected.length!==undefined&&algorithm.length!==expected.length){throw unusable(expected.length,"algorithm.length")}checkUsage(key,usage)}function message(msg,actual,...types){if(types.length>2){const last=types.pop();msg+=`one of type ${types.join(", ")}, or ${last}.`}else if(types.length===2){msg+=`one of type ${types[0]} or ${types[1]}.`}else{msg+=`of type ${types[0]}.`}if(actual==null){msg+=` Received ${actual}`}else if(typeof actual==="function"&&actual.name){msg+=` Received function ${actual.name}`}else if(typeof actual==="object"&&actual!=null){if(actual.constructor?.name){msg+=` Received an instance of ${actual.constructor.name}`}}return msg}var invalidKeyInput=(actual,...types)=>message("Key must be ",actual,...types);var withAlg=(alg,actual,...types)=>message(`Key for the ${alg} algorithm must be `,actual,...types);class JOSEError extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message,options){super(message,options);this.name=this.constructor.name;Error.captureStackTrace?.(this,this.constructor)}}class JWTClaimValidationFailed extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}});this.claim=claim;this.reason=reason;this.payload=payload}}class JWTExpired extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}});this.claim=claim;this.reason=reason;this.payload=payload}}class JOSEAlgNotAllowed extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class JOSENotSupported extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class JWEDecryptionFailed extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message="decryption operation failed",options){super(message,options)}}class JWEInvalid extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class JWSInvalid extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class JWTInvalid extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class JWKSInvalid extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class JWKSNoMatchingKey extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message="no applicable key found in the JSON Web Key Set",options){super(message,options)}}class JWKSMultipleMatchingKeys extends JOSEError{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message="multiple matching keys found in the JSON Web Key Set",options){super(message,options)}}class JWKSTimeout extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message="request timed out",options){super(message,options)}}class JWSSignatureVerificationFailed extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message="signature verification failed",options){super(message,options)}}function assertCryptoKey(key){if(!isCryptoKey(key)){throw new Error("CryptoKey instance expected")}}var isCryptoKey=(key)=>{if(key?.[Symbol.toStringTag]==="CryptoKey")return true;try{return key instanceof CryptoKey}catch{return false}};var isKeyObject=(key)=>key?.[Symbol.toStringTag]==="KeyObject";var isKeyLike=(key)=>isCryptoKey(key)||isKeyObject(key);var generateCek=(enc)=>crypto.getRandomValues(new Uint8Array(enc.cekBits>>3));function checkCekLength(cek,expected){const actual=cek.byteLength<<3;if(actual!==expected){throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`)}}var generateIv=(enc)=>crypto.getRandomValues(new Uint8Array(enc.ivBits>>3));function checkIvLength(enc,iv){if(iv.length<<3!==enc.ivBits){throw new JWEInvalid("Invalid Initialization Vector length")}}async function cbcKeySetup(enc,cek,usage){if(!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"Uint8Array"))}const keySize=enc.cekBits>>1;const encKey=await crypto.subtle.importKey("raw",cek.subarray(keySize>>3),"AES-CBC",false,[usage]);const macKey=await crypto.subtle.importKey("raw",cek.subarray(0,keySize>>3),{hash:`SHA-${keySize<<1}`,name:"HMAC"},false,["sign"]);return[encKey,macKey,keySize]}async function cbcHmacTag(macKey,macData,keySize){return new Uint8Array((await crypto.subtle.sign("HMAC",macKey,macData)).slice(0,keySize>>3))}async function cbcEncrypt(enc,plaintext,cek,iv,aad){const[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"encrypt");const ciphertext=new Uint8Array(await crypto.subtle.encrypt({iv,name:"AES-CBC"},encKey,plaintext));const macData=concat(aad,iv,ciphertext,uint64be(aad.length*8));const tag=await cbcHmacTag(macKey,macData,keySize);return{ciphertext,tag,iv}}async function timingSafeEqual(a,b){const algorithm={name:"HMAC",hash:"SHA-256"};const key=await crypto.subtle.generateKey(algorithm,false,["sign","verify"]);const aHmac=await crypto.subtle.sign(algorithm,key,a);return crypto.subtle.verify(algorithm,key,aHmac,b)}async function cbcDecrypt(enc,cek,ciphertext,iv,tag,aad){const[encKey,macKey,keySize]=await cbcKeySetup(enc,cek,"decrypt");const macData=concat(aad,iv,ciphertext,uint64be(aad.length*8));const expectedTag=await cbcHmacTag(macKey,macData,keySize);let macCheckPassed;try{macCheckPassed=await timingSafeEqual(tag,expectedTag)}catch{}if(!macCheckPassed){throw new JWEDecryptionFailed}let plaintext;try{plaintext=new Uint8Array(await crypto.subtle.decrypt({iv,name:"AES-CBC"},encKey,ciphertext))}catch{}if(!plaintext){throw new JWEDecryptionFailed}return plaintext}async function gcmEncrypt(enc,plaintext,cek,iv,aad){const encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",false,["encrypt"]):(checkCryptoKey(cek,enc.subtle,"encrypt"),cek);const encrypted=new Uint8Array(await crypto.subtle.encrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,plaintext));const tag=encrypted.slice(-16);const ciphertext=encrypted.slice(0,-16);return{ciphertext,tag,iv}}async function gcmDecrypt(enc,cek,ciphertext,iv,tag,aad){const encKey=cek instanceof Uint8Array?await crypto.subtle.importKey("raw",cek,"AES-GCM",false,["decrypt"]):(checkCryptoKey(cek,enc.subtle,"decrypt"),cek);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:aad,iv,name:"AES-GCM",tagLength:128},encKey,concat(ciphertext,tag)))}catch{throw new JWEDecryptionFailed}}async function encrypt(enc,plaintext,cek,iv,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"))}if(iv){checkIvLength(enc,iv)}else{iv=generateIv(enc)}if(cek instanceof Uint8Array){checkCekLength(cek,enc.cekBits)}return enc.cbc?cbcEncrypt(enc,plaintext,cek,iv,aad):gcmEncrypt(enc,plaintext,cek,iv,aad)}async function decrypt(enc,cek,ciphertext,iv,tag,aad){if(!isCryptoKey(cek)&&!(cek instanceof Uint8Array)){throw new TypeError(invalidKeyInput(cek,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"))}if(!iv){throw new JWEInvalid("JWE Initialization Vector missing")}if(!tag){throw new JWEInvalid("JWE Authentication Tag missing")}checkIvLength(enc,iv);if(cek instanceof Uint8Array){checkCekLength(cek,enc.cekBits)}return enc.cbc?cbcDecrypt(enc,cek,ciphertext,iv,tag,aad):gcmDecrypt(enc,cek,ciphertext,iv,tag,aad)}function encodeBase64(input){if(Uint8Array.prototype.toBase64){return input.toBase64()}const CHUNK_SIZE=32768;const arr=[];for(let i=0;i<input.length;i+=CHUNK_SIZE){arr.push(String.fromCharCode.apply(null,input.subarray(i,i+CHUNK_SIZE)))}return btoa(arr.join(""))}function decodeBase64(encoded){if(Uint8Array.fromBase64){return Uint8Array.fromBase64(encoded)}const binary=atob(encoded);const bytes=new Uint8Array(binary.length);for(let i=0;i<binary.length;i++){bytes[i]=binary.charCodeAt(i)}return bytes}var invalid="The input to be decoded is not correctly encoded.";function decode(input){if(Uint8Array.fromBase64){try{return Uint8Array.fromBase64(typeof input==="string"?input:decoder.decode(input),{alphabet:"base64url"})}catch(cause){throw new TypeError(invalid,{cause})}}let encoded=input;if(encoded instanceof Uint8Array){encoded=decoder.decode(encoded)}if(encoded.includes("+")||encoded.includes("/")){throw new TypeError(invalid)}encoded=encoded.replace(/-/g,"+").replace(/_/g,"/");try{return decodeBase64(encoded)}catch{throw new TypeError(invalid)}}function encode2(input){let unencoded=input;if(typeof unencoded==="string"){unencoded=encoder.encode(unencoded)}if(Uint8Array.prototype.toBase64){return unencoded.toBase64({alphabet:"base64url",omitPadding:true})}return encodeBase64(unencoded).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function isObject(input){if(typeof input!=="object"||input===null||Object.prototype.toString.call(input)!=="[object Object]"){return false}const prototype=Object.getPrototypeOf(input);if(prototype===null){return true}let proto=prototype;while(Object.getPrototypeOf(proto)!==null){proto=Object.getPrototypeOf(proto)}return prototype===proto}function isDisjoint(...headers){const parameters=new Set;for(const header of headers){if(!header)continue;for(const parameter of Object.keys(header)){if(parameters.has(parameter)){return false}parameters.add(parameter)}}return true}var isJWK=(key)=>isObject(key)&&typeof key.kty==="string";var isPrivateJWK=(key)=>key.kty!=="oct"&&(key.kty==="AKP"&&typeof key.priv==="string"||typeof key.d==="string");var isPublicJWK=(key)=>key.kty!=="oct"&&key.d===undefined&&key.priv===undefined;var isSecretJWK=(key)=>key.kty==="oct"&&typeof key.k==="string";var unprotected=Symbol();function assertNotSet(value,name){if(value){throw new TypeError(`${name} can only be called once`)}}function decodeBase64url(value,label,ErrorClass){try{return decode(value)}catch{throw new ErrorClass(`Failed to base64url decode the ${label}`)}}function encodeBase64url(value,label,ErrorClass){try{return encode(value)}catch{throw new ErrorClass(`The ${label} is not a valid base64url string`)}}async function digest(algorithm,data){const subtleDigest=`SHA-${algorithm.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(subtleDigest,data))}function parseJoseHeader(b64,ErrorClass,message){let parsed;try{parsed=JSON.parse(strictDecoder.decode(decode(b64)))}catch{throw new ErrorClass(message)}if(!isObject(parsed)){throw new ErrorClass(message)}return parsed}async function jwkToKey(entry,jwk){if(jwk.kty==="RSA"&&"oth"in jwk&&jwk.oth!==undefined){throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported')}if(!entry.kty.includes(jwk.kty)){throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}const algorithm=entry.resolve?.({kty:jwk.kty,crv:jwk.crv})??entry.subtle;const isPrivate=!!(jwk.d||jwk.priv);const keyData={...jwk};if(keyData.kty!=="AKP"){delete keyData.alg}delete keyData.use;return crypto.subtle.importKey("jwk",keyData,algorithm,jwk.ext??!isPrivate,jwk.key_ops??entry.usages[isPrivate?1:0])}var tag=(key)=>key[Symbol.toStringTag];var jwkMatchesOp=(entry,key,usage)=>{const{alg}=entry;if(key.use!==undefined){const expected=usage==="sign"||usage==="verify"?"sig":"enc";if(key.use!==expected){throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`)}}if(key.alg!==undefined&&key.alg!==alg){throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`)}if(Array.isArray(key.key_ops)){const expectedKeyOp=usage==="encrypt"||usage==="decrypt"?entry.ops?.[usage==="encrypt"?0:1]:usage;if(expectedKeyOp&&!key.key_ops.includes(expectedKeyOp)){throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`)}}};function checkKeyType(entry,key,usage){const{alg,secret}=entry;const privateKey=usage==="decrypt"||usage==="sign";if(secret&&key instanceof Uint8Array)return[BYTES,key];if(isJWK(key)){if(secret?!isSecretJWK(key):!(privateKey?isPrivateJWK(key):isPublicJWK(key))){throw new TypeError(secret?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${privateKey?"private":"public"} JWK`)}jwkMatchesOp(entry,key,usage);return[JWK,key]}if(!isKeyLike(key)){throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"))}if(secret){if(key.type!=="secret"){throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}}else{if(key.type==="secret"){throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`)}const expectedType=privateKey?"private":"public";if((key.type==="public"||key.type==="private")&&key.type!==expectedType){const operation=usage==="sign"?"signing":usage==="verify"?"verifying":`${usage.slice(0,-1)}tion`;throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`)}}return isCryptoKey(key)?[CRYPTO,key]:[KEYOBJECT,key]}var BYTES=0;var CRYPTO=1;var KEYOBJECT=2;var JWK=3;var cache;var nist={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function cached(key,alg,value){cache||=new WeakMap;const entry=cache.get(key);if(value){if(entry){entry[alg]=value}else{cache.set(key,{__proto__:null,[alg]:value})}}return value??entry?.[alg]}var handleJWK=async(key,jwk,entry)=>cached(key,entry.alg)??cached(key,entry.alg,await jwkToKey(entry,{...jwk,alg:entry.alg}));var handleKeyObject=(keyObject,entry)=>{const hit=cached(keyObject,entry.alg);if(hit)return hit;const isPublic=keyObject.type==="public";const usages=entry.usages[isPublic?0:1];const{asymmetricKeyType}=keyObject;const crv=nist[keyObject.asymmetricKeyDetails?.namedCurve];const params=entry.resolve?.({crv,asymmetricKeyType})??entry.subtle;return cached(keyObject,entry.alg,keyObject.toCryptoKey(params,isPublic,usages))};async function prepareKey(entry,key,usage){const tagged=checkKeyType(entry,key,usage);switch(tagged[0]){case BYTES:case CRYPTO:return tagged[1];case JWK:{const key=tagged[1];if(key.k){return decode(key.k)}if(!Object.isFrozen(key)){const{key_ops}=key;if(Array.isArray(key_ops))Object.freeze(key_ops);Object.freeze(key)}return handleJWK(key,key,entry)}case KEYOBJECT:{const keyObject=tagged[1];if(keyObject.type==="secret"){return keyObject.export()}if("toCryptoKey"in keyObject&&typeof keyObject.toCryptoKey==="function"){return handleKeyObject(keyObject,entry)}return handleJWK(keyObject,keyObject.export({format:"jwk"}),entry)}}}function table(entries){const out={__proto__:null};for(const alg in entries){out[alg]={...entries[alg],alg}}return out}var wrap=[["encrypt","wrapKey"],["decrypt","unwrapKey"]];var derive=[[],["deriveBits"]];var none=[[],[]];function rsaes(bits){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${bits}`},usages:wrap,ops:["wrapKey","unwrapKey"]}}function ecdh(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty,crv,asymmetricKeyType})=>{if(crv==="X25519"||asymmetricKeyType==="x25519"){return{name:"X25519"}}if(kty==="OKP"){throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return{name:"ECDH",namedCurve:crv}},usages:derive,ops:[undefined,"deriveBits"]}}function aeskw(bits,gcm=false){return{kty:["oct"],secret:true,subtle:{name:gcm?"AES-GCM":"AES-KW",length:bits},usages:none,ops:gcm?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function pbes2(){return{kty:["oct"],secret:true,subtle:{name:"PBKDF2"},usages:none,ops:["deriveBits","deriveBits"]}}var JWE=table({dir:{kty:["oct"],secret:true,subtle:{name:"AES-GCM"},usages:none,ops:["encrypt","decrypt"]},"RSA-OAEP":rsaes(1),"RSA-OAEP-256":rsaes(256),"RSA-OAEP-384":rsaes(384),"RSA-OAEP-512":rsaes(512),"ECDH-ES":ecdh(),"ECDH-ES+A128KW":ecdh(),"ECDH-ES+A192KW":ecdh(),"ECDH-ES+A256KW":ecdh(),A128KW:aeskw(128),A192KW:aeskw(192),A256KW:aeskw(256),A128GCMKW:aeskw(128,true),A192GCMKW:aeskw(192,true),A256GCMKW:aeskw(256,true),"PBES2-HS256+A128KW":pbes2(),"PBES2-HS384+A192KW":pbes2(),"PBES2-HS512+A256KW":pbes2()});var contentOps=["encrypt","decrypt"];function contentEncryption(bits,cbc=false){return{kty:["oct"],secret:true,subtle:{name:cbc?"AES-CBC":"AES-GCM",length:bits},usages:none,ops:contentOps,cekBits:bits,ivBits:cbc?128:96,cbc}}var ENC=table({A128GCM:contentEncryption(128),A192GCM:contentEncryption(192),A256GCM:contentEncryption(256),"A128CBC-HS256":contentEncryption(256,true),"A192CBC-HS384":contentEncryption(384,true),"A256CBC-HS512":contentEncryption(512,true)});function unsupported(parameter,name){throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`)}function jweAlgorithm(alg){return(typeof alg==="string"?JWE[alg]:undefined)??unsupported("alg","Algorithm")}function jweEncryption(enc){return(typeof enc==="string"?ENC[enc]:undefined)??unsupported("enc","Encryption Algorithm")}function checkEcdhCryptoKey(key,usage){if(key.algorithm.name!=="ECDH"&&key.algorithm.name!=="X25519"){throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519")}checkUsage(key,usage)}async function aeskwCryptoKey(key,alg,usage){const expected=jweAlgorithm(alg).subtle;const cryptoKey=key instanceof Uint8Array?await crypto.subtle.importKey("raw",key,"AES-KW",true,[usage]):key;checkCryptoKey(cryptoKey,expected,usage);return cryptoKey}async function aeskwWrap(alg,key,cek){const cryptoKey=await aeskwCryptoKey(key,alg,"wrapKey");const cryptoKeyCek=await crypto.subtle.importKey("raw",cek,{hash:"SHA-256",name:"HMAC"},true,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",cryptoKeyCek,cryptoKey,"AES-KW"))}async function aeskwUnwrap(alg,key,encryptedKey){const cryptoKey=await aeskwCryptoKey(key,alg,"unwrapKey");const cryptoKeyCek=await crypto.subtle.unwrapKey("raw",encryptedKey,cryptoKey,"AES-KW",{hash:"SHA-256",name:"HMAC"},true,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",cryptoKeyCek))}function checkRsaKey(alg,key,usage){checkCryptoKey(key,jweAlgorithm(alg).subtle,usage);checkModulusLength(alg,key)}function pbes2CryptoKey(key,alg){if(key instanceof Uint8Array){return crypto.subtle.importKey("raw",key,"PBKDF2",false,["deriveBits"])}checkCryptoKey(key,jweAlgorithm(alg).subtle,"deriveBits");return key}async function deriveKey(p2s,alg,p2c,key){if(!(p2s instanceof Uint8Array)||p2s.length<8){throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets")}if(!Number.isSafeInteger(p2c)||Math.sign(p2c)!==1){throw new JWEInvalid("PBES2 Count Input must be a positive integer")}const salt=concat(encode(alg),Uint8Array.of(0),p2s);const keylen=parseInt(alg.slice(13,16),10);const subtleAlg={hash:`SHA-${alg.slice(8,11)}`,iterations:p2c,name:"PBKDF2",salt};const cryptoKey=await pbes2CryptoKey(key,alg);return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg,cryptoKey,keylen))}function lengthAndInput(input){return concat(uint32be(input.length),input)}async function concatKdf(Z,L,OtherInfo){const dkLen=L>>3;const hashLen=32;const reps=Math.ceil(dkLen/hashLen);const dk=new Uint8Array(reps*hashLen);for(let i=1;i<=reps;i++){const hashResult=await digest("sha256",concat(uint32be(i),Z,OtherInfo));dk.set(hashResult,(i-1)*hashLen)}return dk.slice(0,dkLen)}async function ecdhesDeriveKey(publicKey,privateKey,algorithm,keyLength,apu=new Uint8Array,apv=new Uint8Array){checkEcdhCryptoKey(publicKey);checkEcdhCryptoKey(privateKey,"deriveBits");const otherInfo=concat(lengthAndInput(encode(algorithm)),lengthAndInput(apu),lengthAndInput(apv),uint32be(keyLength));const Z=new Uint8Array(await crypto.subtle.deriveBits({name:publicKey.algorithm.name,public:publicKey},privateKey,publicKey.algorithm.name==="X25519"?256:Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3),10)/8)<<3));return concatKdf(Z,keyLength,otherInfo)}function assertEcdhKey(key){assertCryptoKey(key);const curve=key.algorithm.namedCurve;if(curve!=="P-256"&&curve!=="P-384"&&curve!=="P-521"&&key.algorithm.name!=="X25519"){throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime")}}function assertEncryptedKey(encryptedKey){if(encryptedKey===undefined)throw new JWEInvalid("JWE Encrypted Key missing")}function assertNoEncryptedKey(encryptedKey){if(encryptedKey!==undefined)throw new JWEInvalid("Encountered unexpected JWE Encrypted Key")}async function decryptKeyManagement(alg,enc,key,encryptedKey,joseHeader,options){const entry=jweAlgorithm(alg);if(alg==="dir"){assertNoEncryptedKey(encryptedKey);return key}switch(entry.subtle.name){case"ECDH":{if(alg==="ECDH-ES")assertNoEncryptedKey(encryptedKey);if(!isObject(joseHeader.epk))throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);assertEcdhKey(key);const epk=await jwkToKey(entry,joseHeader.epk);let partyUInfo;let partyVInfo;if(joseHeader.apu!==undefined){if(typeof joseHeader.apu!=="string")throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);partyUInfo=decodeBase64url(joseHeader.apu,"apu",JWEInvalid)}if(joseHeader.apv!==undefined){if(typeof joseHeader.apv!=="string")throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);partyVInfo=decodeBase64url(joseHeader.apv,"apv",JWEInvalid)}const sharedSecret=await ecdhesDeriveKey(epk,key,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),partyUInfo,partyVInfo);if(alg==="ECDH-ES")return sharedSecret;assertEncryptedKey(encryptedKey);return aeskwUnwrap(alg.slice(-6),sharedSecret,encryptedKey)}case"RSA-OAEP":{assertEncryptedKey(encryptedKey);assertCryptoKey(key);checkRsaKey(alg,key,"decrypt");return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",key,encryptedKey))}case"PBKDF2":{assertEncryptedKey(encryptedKey);if(typeof joseHeader.p2c!=="number")throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);const p2cLimit=options?.maxPBES2Count||1e4;if(joseHeader.p2c>p2cLimit)throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);if(typeof joseHeader.p2s!=="string")throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);const p2s=decodeBase64url(joseHeader.p2s,"p2s",JWEInvalid);const derived=await deriveKey(p2s,alg,joseHeader.p2c,key);return aeskwUnwrap(alg.slice(-6),derived,encryptedKey)}case"AES-KW":{assertEncryptedKey(encryptedKey);return aeskwUnwrap(alg,key,encryptedKey)}case"AES-GCM":{assertEncryptedKey(encryptedKey);if(typeof joseHeader.iv!=="string")throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);if(typeof joseHeader.tag!=="string")throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);let iv;iv=decodeBase64url(joseHeader.iv,"iv",JWEInvalid);let tag;tag=decodeBase64url(joseHeader.tag,"tag",JWEInvalid);return decrypt(jweEncryption(alg.slice(0,-2)),key,encryptedKey,iv,tag,new Uint8Array)}}}async function encryptKeyManagement(alg,enc,key,providedCek,providedParameters={}){let encryptedKey;let parameters;let cek;const entry=jweAlgorithm(alg);if(alg==="dir")return[key,undefined,undefined];switch(entry.subtle.name){case"ECDH":{assertEcdhKey(key);const{apu,apv}=providedParameters;let ephemeralKey;if(providedParameters.epk){ephemeralKey=await prepareKey(entry,providedParameters.epk,"decrypt")}else{ephemeralKey=(await crypto.subtle.generateKey(key.algorithm,true,["deriveBits"])).privateKey}const subtle=crypto.subtle;let exportableEpk=ephemeralKey;if(!exportableEpk.extractable){if(typeof subtle.getPublicKey!=="function"){throw new TypeError('CryptoKey for "epk" must be extractable')}exportableEpk=await subtle.getPublicKey(ephemeralKey,[])}const{x,y,crv,kty}=await subtle.exportKey("jwk",exportableEpk);const sharedSecret=await ecdhesDeriveKey(key,ephemeralKey,alg==="ECDH-ES"?enc.alg:alg,alg==="ECDH-ES"?enc.cekBits:parseInt(alg.slice(-5,-2),10),apu,apv);parameters={epk:{x,crv,kty}};if(kty==="EC")parameters.epk.y=y;if(apu)parameters.apu=encode2(apu);if(apv)parameters.apv=encode2(apv);if(alg==="ECDH-ES"){cek=sharedSecret;break}cek=providedCek||generateCek(enc);const kwAlg=alg.slice(-6);encryptedKey=await aeskwWrap(kwAlg,sharedSecret,cek);break}case"RSA-OAEP":{cek=providedCek||generateCek(enc);assertCryptoKey(key);checkRsaKey(alg,key,"encrypt");encryptedKey=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",key,cek));break}case"PBKDF2":{cek=providedCek||generateCek(enc);const{p2c=2048,p2s=crypto.getRandomValues(new Uint8Array(16))}=providedParameters;const derived=await deriveKey(p2s,alg,p2c,key);encryptedKey=await aeskwWrap(alg.slice(-6),derived,cek);parameters={p2c,p2s:encode2(p2s)};break}case"AES-KW":{cek=providedCek||generateCek(enc);encryptedKey=await aeskwWrap(alg,key,cek);break}case"AES-GCM":{cek=providedCek||generateCek(enc);const{iv}=providedParameters;const wrapped=await encrypt(jweEncryption(alg.slice(0,-2)),cek,key,iv,new Uint8Array);encryptedKey=wrapped.ciphertext;parameters={iv:encode2(wrapped.iv),tag:encode2(wrapped.tag)};break}}return[cek,encryptedKey,parameters]}var JWS_RECOGNIZED={__proto__:null,b64:true};var JWE_RECOGNIZED={__proto__:null};function validateAlgorithms(option,algorithms){if(algorithms!==undefined&&(!Array.isArray(algorithms)||algorithms.some((s)=>typeof s!=="string"))){throw new TypeError(`"${option}" option must be an array of strings`)}if(!algorithms){return}return new Set(algorithms)}function validateCritDuplicates(Err,protectedHeader){const{crit}=protectedHeader??{};if(Array.isArray(crit)&&new Set(crit).size!==crit.length){throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}}function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==undefined&&protectedHeader?.crit===undefined){throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected')}if(!protectedHeader||protectedHeader.crit===undefined){return[]}if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some((input)=>typeof input!=="string"||input.length===0)){throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present')}const recognized=recognizedOption===undefined?recognizedDefault:{__proto__:null,...recognizedOption,...recognizedDefault};for(const parameter of protectedHeader.crit){if(!(parameter in recognized)){throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`)}if(!Object.hasOwn(joseHeader,parameter)||joseHeader[parameter]===undefined){throw new Err(`Extension Header Parameter "${parameter}" is missing`)}if(recognized[parameter]&&(!Object.hasOwn(protectedHeader,parameter)||protectedHeader[parameter]===undefined)){throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}}return protectedHeader.crit}function supported(name){if(typeof globalThis[name]==="undefined"){throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`)}}async function compress(input){supported("CompressionStream");const cs=new CompressionStream("deflate-raw");const writer=cs.writable.getWriter();writer.write(input).catch(()=>{});writer.close().catch(()=>{});const chunks=[];const reader=cs.readable.getReader();for(;;){const{value,done}=await reader.read();if(done)break;chunks.push(value)}return concat(...chunks)}async function decompress(input,maxLength){supported("DecompressionStream");const ds=new DecompressionStream("deflate-raw");const writer=ds.writable.getWriter();writer.write(input).catch(()=>{});writer.close().catch(()=>{});const chunks=[];let length=0;const reader=ds.readable.getReader();for(;;){const{value,done}=await reader.read();if(done)break;chunks.push(value);length+=value.byteLength;if(maxLength!==Infinity&&length>maxLength){throw new JWEInvalid("Decompressed plaintext exceeded the configured limit")}}return concat(...chunks)}function shareJWE(jwe){const{protected:encodedProtected,ciphertext,iv,tag,aad}=jwe;let parsedProt;if(encodedProtected){parsedProt=parseJoseHeader(encodedProtected,JWEInvalid,"JWE Protected Header is invalid")}const protectedHeader=encodedProtected!==undefined?encode(encodedProtected):new Uint8Array;return[parsedProt,decodeBase64url(ciphertext,"ciphertext",JWEInvalid),iv!==undefined?decodeBase64url(iv,"iv",JWEInvalid):undefined,tag!==undefined?decodeBase64url(tag,"tag",JWEInvalid):undefined,aad!==undefined?concat(protectedHeader,encode("."),encodeBase64url(aad,"aad",JWEInvalid)):protectedHeader]}function prepareDecrypt(options){return[options&&validateAlgorithms("keyManagementAlgorithms",options.keyManagementAlgorithms),options&&validateAlgorithms("contentEncryptionAlgorithms",options.contentEncryptionAlgorithms),options]}async function decryptRecipient(jwe,token,shared,key){const[keyManagementAlgorithms,contentEncryptionAlgorithms,options]=shared;const[parsedProt,ciphertext,iv,tag,additionalData]=token;const{encrypted_key:encodedKey,header,unprotected}=jwe;let joseHeader;if(header!==undefined||unprotected!==undefined){if(!isDisjoint(parsedProt,header,unprotected)){throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint")}joseHeader={...parsedProt,...header,...unprotected}}else{joseHeader=parsedProt??{}}validateCrit(JWEInvalid,JWE_RECOGNIZED,options?.crit,parsedProt,joseHeader);if(joseHeader.zip!==undefined&&joseHeader.zip!=="DEF"){throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.')}if(joseHeader.zip!==undefined&&!parsedProt?.zip){throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}const{alg,enc}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header")}if(typeof enc!=="string"||!enc){throw new JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header")}if(keyManagementAlgorithms&&!keyManagementAlgorithms.has(alg)||!keyManagementAlgorithms&&alg.startsWith("PBES2")){throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed')}if(contentEncryptionAlgorithms&&!contentEncryptionAlgorithms.has(enc)){throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed')}const encEntry=jweEncryption(enc);let encryptedKey;if(encodedKey!==undefined){encryptedKey=decodeBase64url(encodedKey,"encrypted_key",JWEInvalid)}let resolvedKey=false;if(typeof key==="function"){key=await key(parsedProt,jwe);resolvedKey=true}const algEntry=jweAlgorithm(alg);const k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"decrypt");let cek;try{cek=await decryptKeyManagement(alg,encEntry,k,encryptedKey,joseHeader,options)}catch(err){if(err instanceof TypeError||err instanceof JWEInvalid||err instanceof JOSENotSupported){throw err}cek=generateCek(encEntry)}let plaintext=await decrypt(encEntry,cek,ciphertext,iv,tag,additionalData);if(joseHeader.zip==="DEF"){const maxDecompressedLength=options?.maxDecompressedLength??250000;if(maxDecompressedLength===0){throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.')}if(maxDecompressedLength!==Infinity&&(!Number.isSafeInteger(maxDecompressedLength)||maxDecompressedLength<1)){throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity")}plaintext=await decompress(plaintext,maxDecompressedLength).catch((cause)=>{if(cause instanceof JWEInvalid)throw cause;throw new JWEInvalid("Failed to decompress plaintext",{cause})})}return[plaintext,parsedProt,k,resolvedKey]}async function decryptJWE(jwe,shared,key){return decryptRecipient(jwe,shareJWE(jwe),shared,key)}async function decryptCompact(jwe,shared,key){if(jwe instanceof Uint8Array){jwe=decoder.decode(jwe)}if(typeof jwe!=="string"){throw new JWEInvalid("Compact JWE must be a string or Uint8Array")}const{0:protectedHeader,1:encryptedKey,2:iv,3:ciphertext,4:tag,length}=jwe.split(".");if(length!==5){throw new JWEInvalid("Invalid Compact JWE")}return decryptJWE({ciphertext,iv:iv||undefined,protected:protectedHeader,tag:tag||undefined,encrypted_key:encryptedKey||undefined},shared,key)}async function compactDecrypt(jwe,key,options){const decrypted=await decryptCompact(jwe,prepareDecrypt(options),key);const result={plaintext:decrypted[0],protectedHeader:decrypted[1]};if(typeof key==="function"){return{...result,key:decrypted[2]}}return result}function checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader){if(!isDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader)){throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}}function checkEncryptHeaders(input){const[,protectedHeader,unprotectedHeader,sharedUnprotectedHeader,,,,,crit]=input;checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader);const joseHeader={...protectedHeader,...unprotectedHeader,...sharedUnprotectedHeader};validateCrit(JWEInvalid,JWE_RECOGNIZED,crit,protectedHeader,joseHeader);if(joseHeader.zip!==undefined&&joseHeader.zip!=="DEF"){throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.')}if(joseHeader.zip!==undefined&&!protectedHeader?.zip){throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}const{alg,enc}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid')}if(typeof enc!=="string"||!enc){throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid')}return[joseHeader,alg,enc,jweEncryption(enc)]}async function encryptJWE(input,checked,key){const[joseHeader,alg,,encEntry]=checked;const[inputPlaintext,inputProtectedHeader,inputUnprotectedHeader,sharedUnprotectedHeader,aad,providedCek,inputIv,keyManagementParameters,,unprotectedParameters]=input;let protectedHeader=inputProtectedHeader;let unprotectedHeader=inputUnprotectedHeader;if(providedCek&&(alg==="dir"||alg==="ECDH-ES")){throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`)}const algEntry=jweAlgorithm(alg);const k=await prepareKey(alg==="dir"?encEntry:algEntry,key,"encrypt");const[cek,encryptedKey,parameters]=await encryptKeyManagement(alg,encEntry,k,providedCek,keyManagementParameters);if(parameters){if(unprotectedParameters){unprotectedHeader=unprotectedHeader?{...unprotectedHeader,...parameters}:parameters}else{protectedHeader=protectedHeader?{...protectedHeader,...parameters}:parameters}checkDisjoint(protectedHeader,unprotectedHeader,sharedUnprotectedHeader)}let protectedHeaderS;let protectedHeaderB;if(protectedHeader){protectedHeaderS=encode2(JSON.stringify(protectedHeader));protectedHeaderB=encode(protectedHeaderS)}else{protectedHeaderS="";protectedHeaderB=new Uint8Array}let additionalData;let aadMember;if(aad?.byteLength){aadMember=encode2(aad);additionalData=concat(protectedHeaderB,encode("."),encode(aadMember))}else{additionalData=protectedHeaderB}let plaintext=inputPlaintext;if(joseHeader.zip==="DEF"){plaintext=await compress(plaintext).catch((cause)=>{throw new JWEInvalid("Failed to compress plaintext",{cause})})}const{ciphertext,tag,iv}=await encrypt(encEntry,plaintext,cek,inputIv,additionalData);const jwe={ciphertext:encode2(ciphertext)};if(iv){jwe.iv=encode2(iv)}if(tag){jwe.tag=encode2(tag)}if(encryptedKey){jwe.encrypted_key=encode2(encryptedKey)}if(aadMember){jwe.aad=aadMember}if(protectedHeader){jwe.protected=protectedHeaderS}if(sharedUnprotectedHeader){jwe.unprotected=sharedUnprotectedHeader}if(unprotectedHeader){jwe.header=unprotectedHeader}return jwe}async function createJWE(input,key){return encryptJWE(input,checkEncryptHeaders(input),key)}class FlattenedEncrypt{#plaintext;#protectedHeader;#sharedUnprotectedHeader;#unprotectedHeader;#aad;#cek;#iv;#keyManagementParameters;constructor(plaintext){if(!(plaintext instanceof Uint8Array)){throw new TypeError("plaintext must be an instance of Uint8Array")}this.#plaintext=plaintext}setKeyManagementParameters(parameters){assertNotSet(this.#keyManagementParameters,"setKeyManagementParameters");this.#keyManagementParameters=parameters;return this}setProtectedHeader(protectedHeader){assertNotSet(this.#protectedHeader,"setProtectedHeader");this.#protectedHeader=protectedHeader;return this}setSharedUnprotectedHeader(sharedUnprotectedHeader){assertNotSet(this.#sharedUnprotectedHeader,"setSharedUnprotectedHeader");this.#sharedUnprotectedHeader=sharedUnprotectedHeader;return this}setUnprotectedHeader(unprotectedHeader){assertNotSet(this.#unprotectedHeader,"setUnprotectedHeader");this.#unprotectedHeader=unprotectedHeader;return this}setAdditionalAuthenticatedData(aad){this.#aad=aad;return this}setContentEncryptionKey(cek){assertNotSet(this.#cek,"setContentEncryptionKey");this.#cek=cek;return this}setInitializationVector(iv){assertNotSet(this.#iv,"setInitializationVector");this.#iv=iv;return this}async encrypt(key,options){if(!this.#protectedHeader&&!this.#unprotectedHeader&&!this.#sharedUnprotectedHeader){throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()")}validateCritDuplicates(JWEInvalid,this.#protectedHeader);return createJWE([this.#plaintext,this.#protectedHeader,this.#unprotectedHeader,this.#sharedUnprotectedHeader,this.#aad,this.#cek,this.#iv,this.#keyManagementParameters,options?.crit,options?unprotected in options:false],key)}}async function getSigKey(entry,key,usage){if(key instanceof Uint8Array){return crypto.subtle.importKey("raw",key,entry.subtle,false,[usage])}checkCryptoKey(key,entry.subtle,usage);if(entry.minRsaBits)checkModulusLength(entry.alg,key);return key}async function verify(entry,key,signature,data){const cryptoKey=await getSigKey(entry,key,"verify");try{return await crypto.subtle.verify(entry.signing,cryptoKey,signature,data)}catch{return false}}var sig=[["verify"],["sign"]];function hmac(bits){const subtle={name:"HMAC",hash:`SHA-${bits}`};return{kty:["oct"],secret:true,subtle,signing:subtle,usages:sig}}function rsa(bits,saltLength){const name=saltLength?"RSA-PSS":"RSASSA-PKCS1-v1_5";const subtle={name,hash:`SHA-${bits}`};return{kty:["RSA"],subtle,signing:saltLength?{...subtle,saltLength}:subtle,usages:sig,minRsaBits:2048}}function ecdsa(crv,bits){return{kty:["EC"],crv,subtle:{name:"ECDSA",namedCurve:crv},signing:{name:"ECDSA",hash:`SHA-${bits}`},usages:sig}}function eddsa(){const subtle={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle,signing:subtle,usages:sig}}function mldsa(bits){const name=`ML-DSA-${bits}`;const subtle={name};return{kty:["AKP"],subtle,signing:subtle,usages:sig}}var JWS=table({HS256:hmac(256),HS384:hmac(384),HS512:hmac(512),RS256:rsa(256),RS384:rsa(384),RS512:rsa(512),PS256:rsa(256,32),PS384:rsa(384,48),PS512:rsa(512,64),ES256:ecdsa("P-256",256),ES384:ecdsa("P-384",384),ES512:ecdsa("P-521",512),EdDSA:eddsa(),Ed25519:eddsa(),"ML-DSA-44":mldsa(44),"ML-DSA-65":mldsa(65),"ML-DSA-87":mldsa(87)});function jwsAlgorithm(alg){const entry=typeof alg==="string"?JWS[alg]:undefined;if(!entry){throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`)}return entry}function prepareVerify(options){return[options&&validateAlgorithms("algorithms",options.algorithms),options?.crit]}async function verifySignature(jws,shared,key){const{protected:encodedProtected,header,payload:inputPayload}=jws;let parsedProt={};if(encodedProtected){parsedProt=parseJoseHeader(encodedProtected,JWSInvalid,"JWS Protected Header is invalid")}let joseHeader;if(header!==undefined){if(!isDisjoint(parsedProt,header)){throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint")}joseHeader={...parsedProt,...header}}else{joseHeader=parsedProt}const extensions=validateCrit(JWSInvalid,JWS_RECOGNIZED,shared[1],parsedProt,joseHeader);let b64=true;if(extensions.includes("b64")){b64=parsedProt.b64;if(typeof b64!=="boolean"){throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean')}}const{alg}=joseHeader;if(typeof alg!=="string"||!alg){throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid')}if(shared[0]&&!shared[0].has(alg)){throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed')}if(b64){if(typeof inputPayload!=="string"){throw new JWSInvalid("JWS Payload must be a string")}}else if(typeof inputPayload!=="string"&&!(inputPayload instanceof Uint8Array)){throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance")}let resolvedKey=false;if(typeof key==="function"){key=await key(parsedProt,jws);resolvedKey=true}const entry=jwsAlgorithm(alg);const data=concat(encodedProtected!==undefined?encode(encodedProtected):new Uint8Array,encode("."),typeof inputPayload==="string"?b64?shared[2]??=encodeBase64url(inputPayload,"payload",JWSInvalid):encoder.encode(inputPayload):inputPayload);const signature=decodeBase64url(jws.signature,"signature",JWSInvalid);const k=await prepareKey(entry,key,"verify");const verified=await verify(entry,k,signature,data);if(!verified){throw new JWSSignatureVerificationFailed}let payload;if(b64){payload=decodeBase64url(inputPayload,"payload",JWSInvalid)}else if(typeof inputPayload==="string"){payload=encoder.encode(inputPayload)}else{payload=inputPayload}return[payload,parsedProt,b64,k,resolvedKey]}async function verifyCompact(jws,shared,key){if(jws instanceof Uint8Array){jws=decoder.decode(jws)}if(typeof jws!=="string"){throw new JWSInvalid("Compact JWS must be a string or Uint8Array")}const{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3){throw new JWSInvalid("Invalid Compact JWS")}return verifySignature({payload,protected:protectedHeader,signature},shared,key)}var epoch=(date)=>Math.floor(date.getTime()/1000);var multipliers={s:1,m:60,h:3600,d:86400,w:604800,y:31557600};var REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;var checkFailed="check_failed";function secs(str){const matched=REGEX.exec(str);if(!matched||matched[4]&&matched[1]){throw new TypeError("Invalid time period format")}const value=parseFloat(matched[2]);const numericDate=Math.round(value*multipliers[matched[3][0].toLowerCase()]);if(matched[1]==="-"||matched[4]==="ago"){return-numericDate}return numericDate}function validateInput(label,input){if(!Number.isFinite(input)){throw new TypeError(`Invalid ${label} input`)}return input}var normalizeTyp=(value)=>{if(value.includes("/")){return value.toLowerCase()}return`application/${value.toLowerCase()}`};var checkAudiencePresence=(audPayload,audOption)=>{if(typeof audPayload==="string"){return audOption.includes(audPayload)}if(Array.isArray(audPayload)){return audOption.some((aud)=>audPayload.includes(aud))}return false};function validateNumericDate(payload,claim,required=false){const value=payload[claim];if(value===undefined&&!required)return;if(typeof value!=="number"){throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`,payload,claim,"invalid")}return value}function unexpectedClaim(payload,claim){throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`,payload,claim,checkFailed)}function validateClaimsSet(protectedHeader,encodedPayload,options={}){let payload;try{payload=JSON.parse(strictDecoder.decode(encodedPayload))}catch{}if(!isObject(payload)){throw new JWTInvalid("JWT Claims Set must be a top-level JSON object")}const{typ}=options;if(typ&&(typeof protectedHeader.typ!=="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ))){throw new JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ",checkFailed)}const{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options;const presenceCheck=[...requiredClaims];if(maxTokenAge!==undefined)presenceCheck.push("iat");if(audience!==undefined)presenceCheck.push("aud");if(subject!==undefined)presenceCheck.push("sub");if(issuer!==undefined)presenceCheck.push("iss");for(const claim of new Set(presenceCheck.reverse())){if(!Object.hasOwn(payload,claim)){throw new JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing")}}if(issuer!==undefined&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss)){unexpectedClaim(payload,"iss")}if(subject!==undefined&&payload.sub!==subject){unexpectedClaim(payload,"sub")}if(audience!==undefined&&!checkAudiencePresence(payload.aud,typeof audience==="string"?[audience]:audience)){unexpectedClaim(payload,"aud")}const{clockTolerance}=options;let tolerance=0;if(typeof clockTolerance==="string"){tolerance=secs(clockTolerance)}else if(clockTolerance!==undefined){if(typeof clockTolerance!=="number"){throw new TypeError("Invalid clockTolerance option type")}tolerance=clockTolerance}validateInput("clockTolerance option",tolerance);const{currentDate}=options;const now=validateInput("currentDate option",epoch(currentDate||new Date));const iat=validateNumericDate(payload,"iat",maxTokenAge!==undefined);const nbf=validateNumericDate(payload,"nbf");if(nbf!==undefined){if(nbf>now+tolerance){throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf",checkFailed)}}const exp=validateNumericDate(payload,"exp");if(exp!==undefined){if(exp<=now-tolerance){throw new JWTExpired('"exp" claim timestamp check failed',payload,"exp",checkFailed)}}if(maxTokenAge!==undefined){const age=now-iat;const max=typeof maxTokenAge==="number"?maxTokenAge:secs(maxTokenAge);if(age-tolerance>max){throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat",checkFailed)}if(age<0-tolerance){throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat",checkFailed)}}return payload}async function jwtVerify(jwt,key,options){const verified=await verifyCompact(jwt,prepareVerify(options),key);if(!verified[2]){throw new JWTInvalid("JWTs MUST NOT use unencoded payload")}const payload=validateClaimsSet(verified[1],verified[0],options);const result={payload,protectedHeader:verified[1]};if(typeof key==="function"){return{...result,key:verified[3]}}return result}class CompactEncrypt{#flattened;constructor(plaintext){this.#flattened=new FlattenedEncrypt(plaintext)}setContentEncryptionKey(cek){this.#flattened.setContentEncryptionKey(cek);return this}setInitializationVector(iv){this.#flattened.setInitializationVector(iv);return this}setProtectedHeader(protectedHeader){this.#flattened.setProtectedHeader(protectedHeader);return this}setKeyManagementParameters(parameters){this.#flattened.setKeyManagementParameters(parameters);return this}async encrypt(key,options){const jwe=await this.#flattened.encrypt(key,options);return[jwe.protected,jwe.encrypted_key,jwe.iv,jwe.ciphertext,jwe.tag].join(".")}}function signatureAlgorithm(alg){const entry=typeof alg==="string"?JWS[alg]:undefined;if(!entry||entry.secret){throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set')}return entry}function isJWKSLike(jwks){if(!jwks||typeof jwks!=="object"){return false}const{keys}=jwks;return Array.isArray(keys)&&keys.every(isObject)}class LocalJWKSetImpl{#jwks;#cached=new WeakMap;constructor(jwks){if(!isJWKSLike(jwks)){throw new JWKSInvalid("JSON Web Key Set malformed")}this.#jwks=structuredClone(jwks)}jwks(){return this.#jwks}async getKey(protectedHeader,token){const{alg,kid}={...protectedHeader,...token?.header};const entry=signatureAlgorithm(alg);const candidates=this.#jwks.keys.filter((jwk)=>entry.kty.includes(jwk.kty)&&(typeof kid!=="string"||kid===jwk.kid)&&(!(typeof jwk.alg==="string"||jwk.kty==="AKP")||alg===jwk.alg)&&(typeof jwk.use!=="string"||jwk.use==="sig")&&(!Array.isArray(jwk.key_ops)||jwk.key_ops.includes("verify"))&&(!entry.crv||jwk.crv===entry.crv));const{0:jwk,length}=candidates;if(length===0){throw new JWKSNoMatchingKey}if(length!==1){const error=new JWKSMultipleMatchingKeys;const _cached=this.#cached;error[Symbol.asyncIterator]=async function*(){for(const jwk of candidates){try{yield await importWithAlgCache(_cached,jwk,entry)}catch{}}};throw error}return importWithAlgCache(this.#cached,jwk,entry)}}async function importWithAlgCache(cache,jwk,entry){const cached=cache.get(jwk)||cache.set(jwk,{__proto__:null}).get(jwk);if(cached[entry.alg]===undefined){const key=await jwkToKey(entry,{...jwk,alg:entry.alg,ext:true});if(key.type!=="public"){throw new JWKSInvalid("JSON Web Key Set members must be public keys")}cached[entry.alg]=key}return cached[entry.alg]}function createLocalJWKSet(jwks){const set=new LocalJWKSetImpl(jwks);const localJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);Object.defineProperty(localJWKSet,"jwks",{value:()=>structuredClone(set.jwks())});return localJWKSet}function isCloudflareWorkers(){return typeof WebSocketPair!=="undefined"||typeof navigator!=="undefined"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime!=="undefined"&&EdgeRuntime==="vercel"}var USER_AGENT;if(typeof navigator==="undefined"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 ")){const NAME="jose";const VERSION="v6.2.9";USER_AGENT=`${NAME}/${VERSION}`}var customFetch=Symbol();async function fetchJwks(url,headers,signal,fetchImpl=fetch){const response=await fetchImpl(url,{method:"GET",signal,redirect:"manual",headers}).catch((err)=>{if(err.name==="TimeoutError"){throw new JWKSTimeout}throw err});if(response.status!==200){throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response")}try{return await response.json()}catch{throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var jwksCache=Symbol();function isFreshJwksCache(input,cacheMaxAge){if(typeof input!=="object"||input===null){return false}if(!("uat"in input)||typeof input.uat!=="number"||Date.now()-input.uat>=cacheMaxAge){return false}if(!("jwks"in input)||!isObject(input.jwks)||!Array.isArray(input.jwks.keys)||!Array.prototype.every.call(input.jwks.keys,isObject)){return false}return true}class RemoteJWKSetImpl{#url;#timeoutDuration;#cooldownDuration;#cacheMaxAge;#jwksTimestamp;#pendingFetch;#headers;#customFetch;#local;#cache;constructor(url,options){if(!(url instanceof URL)){throw new TypeError("url must be an instance of URL")}this.#url=new URL(url.href);const opts=options??{};this.#timeoutDuration=typeof opts.timeoutDuration==="number"?opts.timeoutDuration:5000;this.#cooldownDuration=typeof opts.cooldownDuration==="number"?opts.cooldownDuration:30000;this.#cacheMaxAge=typeof opts.cacheMaxAge==="number"?opts.cacheMaxAge:600000;this.#headers=new Headers(opts.headers);if(USER_AGENT&&!this.#headers.has("User-Agent")){this.#headers.set("User-Agent",USER_AGENT)}if(!this.#headers.has("accept")){this.#headers.set("accept","application/json");this.#headers.append("accept","application/jwk-set+json")}this.#customFetch=opts[customFetch];const cache=opts[jwksCache];if(cache!==undefined){this.#cache=cache;if(isFreshJwksCache(cache,this.#cacheMaxAge)){this.#jwksTimestamp=this.#cache.uat;this.#local=createLocalJWKSet(this.#cache.jwks)}}}pendingFetch(){return!!this.#pendingFetch}#validFor(duration){return typeof this.#jwksTimestamp==="number"&&Date.now()<this.#jwksTimestamp+duration}coolingDown(){return this.#validFor(this.#cooldownDuration)}fresh(){return this.#validFor(this.#cacheMaxAge)}jwks(){return this.#local?.jwks()}async getKey(protectedHeader,token){if(!this.#local||!this.fresh()){await this.reload()}try{return await this.#local(protectedHeader,token)}catch(err){if(err instanceof JWKSNoMatchingKey){if(this.coolingDown()===false){await this.reload();return this.#local(protectedHeader,token)}}throw err}}async reload(){if(this.#pendingFetch&&isCloudflareWorkers()){this.#pendingFetch=undefined}this.#pendingFetch||=fetchJwks(this.#url.href,this.#headers,AbortSignal.timeout(this.#timeoutDuration),this.#customFetch).then((json)=>{this.#local=createLocalJWKSet(json);if(this.#cache){this.#cache.uat=Date.now();this.#cache.jwks=json}this.#jwksTimestamp=Date.now()}).finally(()=>{this.#pendingFetch=undefined});await this.#pendingFetch}}function createRemoteJWKSet(url,options){const set=new RemoteJWKSetImpl(url,options);const remoteJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);Object.defineProperties(remoteJWKSet,{coolingDown:{get:()=>set.coolingDown(),enumerable:true},fresh:{get:()=>set.fresh(),enumerable:true},reload:{value:()=>set.reload(),enumerable:true},reloading:{get:()=>set.pendingFetch(),enumerable:true},jwks:{value:()=>set.jwks(),enumerable:true}});return remoteJWKSet}var loopbackHostname=/^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\])$/u;var requireTenantOrigin=(value,name)=>{let url;try{url=new URL(value)}catch{throw new TypeError(`${name} must contain only an HTTPS origin or a loopback HTTP origin`)}const allowedScheme=url.protocol==="https:"||url.protocol==="http:"&&loopbackHostname.test(url.hostname);if(!allowedScheme||url.origin!==value){throw new TypeError(`${name} must contain only an HTTPS origin or a loopback HTTP origin`)}return url.origin};class FederatedAuthRejectedError extends Error{code;constructor(code){super("Federated application authentication was rejected");this.name="FederatedAuthRejectedError";this.code=code}}var createCiTransport=(issuer,fetch2=globalThis.fetch)=>{const request=async(path,init,signal)=>{const url=new URL(path,issuer);if(url.origin!==issuer){throw new FederatedAuthRejectedError("invalid_identity")}try{const response=await fetch2(url,{...init,redirect:"manual",signal:signal===undefined?AbortSignal.timeout(1e4):AbortSignal.any([signal,AbortSignal.timeout(1e4)])});if(response.status>=500||response.status>=300&&response.status<400){throw new ApplicationUserAuthUnavailableError(new Error("CI authority unavailable"))}return response}catch(error){signal?.throwIfAborted();if(error instanceof ApplicationUserAuthUnavailableError){throw error}throw new ApplicationUserAuthUnavailableError(error)}};const keys=createRemoteJWKSet(new URL("/oauth/jwks",issuer),{[customFetch]:async(url,init)=>await request(url,init),cacheMaxAge:300000});return{keys,request}};var readJson=async(response,validate,signal)=>{let text;try{text=await response.text()}catch(error){signal?.throwIfAborted();throw new ApplicationUserAuthUnavailableError(error)}try{if(new TextEncoder().encode(text).byteLength>1048576){throw new Error("CI response too large")}const value=JSON.parse(text);if(!validate(value)){throw new FederatedAuthRejectedError("invalid_identity")}return value}catch{throw new FederatedAuthRejectedError("invalid_identity")}};var ajv=new import_ajv.default;var nonempty={minLength:1,type:"string"};var claimsSchema=ajv.compile({properties:{app_id:nonempty,client_id:nonempty,exp:{type:"integer"},iat:{type:"integer"},org_id:nonempty,scope:nonempty,sid:nonempty,sub:nonempty},required:["app_id","client_id","exp","iat","org_id","scope","sid","sub"],type:"object"});var identitySchema=ajv.compile({properties:{applicationId:nonempty,audience:nonempty,clientId:nonempty,expiresAt:nonempty,groupIds:{items:nonempty,type:"array"},issuer:nonempty,organizationId:nonempty,roles:{items:nonempty,type:"array"},scopes:{items:nonempty,type:"array"},user:{properties:{email:{type:["string","null"]},id:nonempty,name:{type:["string","null"]}},required:["id","email","name"],type:"object"}},required:["applicationId","audience","clientId","expiresAt","issuer","organizationId","scopes","user"],type:"object"});var verifyAccessTokenClaims=async(token,keys,policy)=>{try{const{payload}=await jwtVerify(token,keys,{algorithms:["ES256"],audience:policy.audience,currentDate:new Date(policy.now()),issuer:policy.issuer});if(!claimsSchema(payload)||payload.iat*1000>policy.now()){throw new FederatedAuthRejectedError("invalid_identity")}return payload}catch(error){if(error instanceof ApplicationUserAuthUnavailableError){throw error}if(error instanceof JWKSTimeout){throw new ApplicationUserAuthUnavailableError(error)}throw new FederatedAuthRejectedError("invalid_identity")}};var readCurrentIdentity=async(request,token,claims,policy,signal)=>{const response=await request("/oauth/identity",{headers:{authorization:`Bearer ${token}`}},signal);if(response.status===401||response.status===403){return null}const value=await readJson(response,identitySchema,signal);const granted=claims.scope.split(" ");if(response.status!==200||value.issuer!==policy.issuer||value.audience!==policy.audience||value.applicationId!==claims.app_id||value.clientId!==claims.client_id||value.organizationId!==claims.org_id||value.user.id!==claims.sub||Date.parse(value.expiresAt)!==claims.exp*1000||!value.scopes.every((scope)=>granted.includes(scope))){throw new FederatedAuthRejectedError("invalid_identity")}return value};var verified=(claims,scopes)=>({applicationId:claims.app_id,clientId:claims.client_id,expiresAt:new Date(claims.exp*1000),organizationId:claims.org_id,scopes,sessionId:claims.sid,userId:claims.sub});var createAccessTokenVerifier=(options)=>{const issuer=requireTenantOrigin(options.issuer,"issuer");if(options.audience===""||options.applicationId===""||options.clientId===""||options.organizationId===""||options.applicationId===undefined&&options.clientId===undefined){throw new TypeError("Access token verification requires an audience and an applicationId or clientId")}const policy={audience:options.audience,issuer,now:options.now??Date.now};const{keys,request}=createCiTransport(issuer,options.fetch);const claimsOf=async(token)=>{const claims=await verifyAccessTokenClaims(token,keys,policy);if(options.applicationId!==undefined&&claims.app_id!==options.applicationId||options.clientId!==undefined&&claims.client_id!==options.clientId||options.organizationId!==undefined&&claims.org_id!==options.organizationId){throw new FederatedAuthRejectedError("invalid_identity")}return claims};return{identity:async(token,{signal}={})=>{const claims=await claimsOf(token);const current=await readCurrentIdentity(request,token,claims,policy,signal);if(current===null){throw new FederatedAuthRejectedError("invalid_identity")}return{...verified(claims,current.scopes),groupIds:current.groupIds,roles:current.roles,user:current.user}},verify:async(token)=>{const claims=await claimsOf(token);return verified(claims,claims.scope.split(" ").filter(Boolean))}}};var readApplicationEnrollment=(env,prefix="CI_")=>{const missing=[];const required=(key)=>{const value=env[`${prefix}${key}`]??"";if(value===""){missing.push(`${prefix}${key}`)}return value};const enrollment={applicationId:required("APPLICATION_ID"),audience:required("AUDIENCE"),clientId:required("CLIENT_ID"),issuer:required("ISSUER"),organizationId:required("ORGANIZATION_ID"),scopes:required("SCOPES").split(" ").filter(Boolean)};if(missing.length>0){throw new TypeError(`CI enrollment is incomplete: ${missing.join(", ")} not set. Run \`ci apps enroll --env-file <path>\`.`)}const clientSecret=env[`${prefix}CLIENT_SECRET`]??"";return clientSecret===""?enrollment:{...enrollment,clientSecret}};var credential=Symbol.for("@collective-intelligence/external-apps-server-sdk/ci-entity-invocation");var bindCiEntityCredential=(context,accessToken)=>{Object.defineProperty(context,credential,{value:(candidate)=>candidate===context?accessToken:undefined});return Object.freeze(context)};var secureScope={attributes:"Path=/; HttpOnly; Secure; SameSite=Lax",name:"__Host-ci-federated"};var loopbackScope={attributes:"Path=/; HttpOnly; SameSite=Lax",name:"ci-federated"};var cookieScope=(request)=>new URL(request.url).protocol==="https:"?secureScope:loopbackScope;var base64=(value)=>btoa(String.fromCodePoint(...value)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"");var randomValue=()=>base64(globalThis.crypto.getRandomValues(new Uint8Array(32)));var digest2=async(value)=>base64(new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",new TextEncoder().encode(value))));var sessionCookie=(request)=>{const{name:cookieName}=cookieScope(request);const values=(request.headers.get("cookie")??"").split(";").map((cookie)=>cookie.trim()).filter((cookie)=>cookie.startsWith(`${cookieName}=`));if(values.length!==1){return null}const value=values[0]?.slice(cookieName.length+1)??"";return/^[\w-]{43}$/u.test(value)?value:null};var cookieHeader=(request,value,maxAge)=>{const scope=cookieScope(request);return`${scope.name}=${value}; ${scope.attributes}; Max-Age=${maxAge}`};var returnTarget=(value,origin)=>{if(value.length>2048||/[\u0000-\u0020\\]/u.test(value)){throw new TypeError("Invalid return target")}const target=new URL(value,origin);if(target.origin!==origin||target.username!==""||target.password!==""){throw new TypeError("Invalid return target")}return`${target.pathname}${target.search}${target.hash}`};var noStoreHeaders={"cache-control":"no-store","referrer-policy":"no-referrer"};var redirect=(location,cookie)=>{const headers=new Headers({...noStoreHeaders,location});if(cookie!==undefined){headers.set("set-cookie",cookie)}return new Response(null,{headers,status:302})};var import_ajv2=__toESM(require_ajv(),1);var isRenewable=(options,grant)=>options.clientSecret!==undefined&&grant.refreshToken!==undefined&&grant.refreshExpiresAt!==undefined;var longestMargin=30000;var renewalMargin=(lifetime)=>Math.min(longestMargin,lifetime/10);var createAccessRenewal=(now,renew,limit=5000)=>{const entries=new Map;const pending=new Map;const dropExpired=()=>{for(const[key,entry]of entries){if(entry.access.expiresAt<=now()){entries.delete(key)}}};const keep=(key,access)=>{dropExpired();for(const oldest of entries.keys()){if(entries.size<limit){break}entries.delete(oldest)}entries.set(key,{access,renewAt:access.expiresAt-renewalMargin(access.expiresAt-now())})};return{accessFor:async(grant)=>{const key=await digest2(grant.refreshToken);dropExpired();const entry=entries.get(key);if(entry!==undefined&&now()<entry.renewAt){return entry.access}if(now()<grant.expiresAt-longestMargin){return grant}entries.delete(key);const shared=pending.get(key);if(shared!==undefined){return await shared}const renewal=renew(grant);if(pending.size<limit){pending.set(key,renewal)}try{const access=await renewal;if(access!==null&&pending.get(key)===renewal){keep(key,access)}return access}finally{if(pending.get(key)===renewal){pending.delete(key)}}},forget:async(grant)=>{const key=await digest2(grant.refreshToken);entries.delete(key);pending.delete(key)},size:()=>entries.size+pending.size}};var ajv2=new import_ajv2.default;var nonempty2={minLength:1,type:"string"};var tokenSchema=ajv2.compile({properties:{access_token:nonempty2,expires_in:{exclusiveMinimum:0,type:"integer"},refresh_token:nonempty2,refresh_token_expires_in:{minimum:0,type:"integer"},token_type:{const:"Bearer",type:"string"}},required:["access_token","expires_in","token_type"],type:"object"});var refusalSchema=ajv2.compile({properties:{error:nonempty2},required:["error"],type:"object"});var metadataSchema=ajv2.compile({properties:{authorization_endpoint:nonempty2,issuer:nonempty2,jwks_uri:nonempty2,token_endpoint:nonempty2},required:["issuer","authorization_endpoint","token_endpoint","jwks_uri"],type:"object"});var createCiAuthClient=(options,now)=>{const{keys,request}=createCiTransport(options.issuer,options.fetch);const policy={audience:options.audience,issuer:options.issuer,now};const identity=async(grant)=>{if(grant.expiresAt<=now()){return null}const claims=await verifyAccessTokenClaims(grant.accessToken,keys,policy);if(claims.client_id!==options.clientId||claims.org_id!==options.organizationId){throw new FederatedAuthRejectedError("invalid_identity")}const value=await readCurrentIdentity(request,grant.accessToken,claims,policy);if(value===null){return null}if(!options.scopes.every((scope)=>value.scopes.includes(scope))){throw new FederatedAuthRejectedError("invalid_identity")}const expiresAt=Math.min(grant.expiresAt,Date.parse(value.expiresAt));if(expiresAt<=now()){return null}return{applicationId:value.applicationId,expiresAt:new Date(expiresAt),groupIds:value.groupIds,identity:{email:value.user.email,id:value.user.id,issuer:value.issuer,kind:"ci_user",name:value.user.name,organizationId:value.organizationId},roles:value.roles,scopes:value.scopes}};const clientForm=async(path,fields)=>{const body=new URLSearchParams({client_id:options.clientId,...fields});if(options.clientSecret!==undefined){body.set("client_secret",options.clientSecret)}return await request(path,{body,headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST"})};const renew=async(grant)=>{const response=await clientForm("/oauth/token",{grant_type:"refresh_token",refresh_token:grant.refreshToken});try{if(response.status===200){const token=await readJson(response,tokenSchema);return{accessToken:token.access_token,expiresAt:now()+token.expires_in*1000}}if(response.status===400){const refusal=await readJson(response,refusalSchema);if(refusal.error==="invalid_grant"){return null}}}catch(error){if(!(error instanceof FederatedAuthRejectedError)){throw error}}throw new ApplicationUserAuthUnavailableError(new Error("CI renewal failed"))};const revoke=async(grant)=>{const response=isRenewable(options,grant)?await clientForm("/oauth/logout",{token:grant.refreshToken,token_type_hint:"refresh_token"}):await request("/oauth/logout",{headers:{authorization:`Bearer ${grant.accessToken}`},method:"POST"});if(response.status!==200&&response.status!==401){throw new ApplicationUserAuthUnavailableError(new Error("CI grant revocation failed"))}};return{exchange:async({callback,code,verifier})=>{const discovery=await request("/.well-known/oauth-authorization-server");const metadata=await readJson(discovery,metadataSchema);if(discovery.status!==200||metadata.issuer!==options.issuer||metadata.authorization_endpoint!==`${options.issuer}/oauth/authorize`||metadata.token_endpoint!==`${options.issuer}/oauth/token`||metadata.jwks_uri!==`${options.issuer}/oauth/jwks`){throw new FederatedAuthRejectedError("invalid_identity")}const response=await clientForm("/oauth/token",{code,code_verifier:verifier,grant_type:"authorization_code",redirect_uri:callback});const token=await readJson(response,tokenSchema);if(response.status!==200){throw new FederatedAuthRejectedError("authorization_failed")}const access={accessToken:token.access_token,expiresAt:now()+token.expires_in*1000};const grant=options.clientSecret===undefined||token.refresh_token===undefined||token.refresh_token_expires_in===undefined?access:{...access,refreshExpiresAt:now()+token.refresh_token_expires_in*1000,refreshToken:token.refresh_token};try{const session=await identity(grant);if(session===null){throw new FederatedAuthRejectedError("invalid_identity")}return{...grant,expiresAt:session.expiresAt.getTime()}}catch(error){await revoke(grant);throw error}},identity,renew,revoke}};var import_ajv3=__toESM(require_ajv(),1);var chunkBytes=3500;var maxChunks=8;var encoder2=new TextEncoder;var decoder2=new TextDecoder;var ajv3=new import_ajv3.default;var nonempty3={minLength:1,type:"string"};var sessionRecordSchema=ajv3.compile({properties:{expiresAt:{type:"integer"},grant:{nullable:true,properties:{accessToken:nonempty3,expiresAt:{type:"integer"},refreshExpiresAt:{type:"integer"},refreshToken:nonempty3},required:["accessToken","expiresAt"],type:"object"},login:{oneOf:[{additionalProperties:false,properties:{status:{const:"idle"}},required:["status"],type:"object"},{additionalProperties:false,properties:{expiresAt:{type:"integer"},returnTo:nonempty3,state:nonempty3,status:{enum:["pending","exchanging"]},verifier:nonempty3},required:["expiresAt","returnTo","state","status","verifier"],type:"object"}]},revision:nonempty3},required:["expiresAt","grant","login","revision"],type:"object"});var chunkName=(scope,index)=>index===0?scope.name:`${scope.name}.${String(index)}`;var chunkCookie=(scope,index,value,maxAge)=>`${chunkName(scope,index)}=${value}; ${scope.attributes}; Max-Age=${String(maxAge)}`;var keyFor=async(secret)=>new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",encoder2.encode(secret)));var encryptRecord=async(record,secret)=>await new CompactEncrypt(encoder2.encode(JSON.stringify(record))).setProtectedHeader({alg:"dir",enc:"A256GCM"}).encrypt(await keyFor(secret));var parseSessionRecord=(validate,text)=>{try{const value=JSON.parse(text);return validate(value)?value:null}catch{return null}};var decryptRecord=async(token,secrets)=>{const keys=await Promise.all(secrets.map(keyFor));const attempts=await Promise.allSettled(keys.map(async(key)=>{const{plaintext}=await compactDecrypt(token,key);return parseSessionRecord(sessionRecordSchema,decoder2.decode(plaintext))}));for(const attempt of attempts){if(attempt.status==="fulfilled"&&attempt.value!==null){return attempt.value}}return null};var readCookieMap=(request)=>{const cookies=new Map;for(const part of(request.headers.get("cookie")??"").split(";")){const trimmed=part.trim();const separator=trimmed.indexOf("=");if(separator<=0){continue}cookies.set(trimmed.slice(0,separator),trimmed.slice(separator+1))}return cookies};var readSealedSession=async(request,secrets)=>{const scope=cookieScope(request);const cookies=readCookieMap(request);const first=cookies.get(chunkName(scope,0));if(first===undefined){return null}const separator=first.indexOf(".");const declared=Math.trunc(Number(first.slice(0,separator)));if(separator<=0||!Number.isSafeInteger(declared)||declared<1||declared>maxChunks){return null}const chunks=[first.slice(separator+1)];for(let index=1;index<declared;index+=1){const chunk=cookies.get(chunkName(scope,index));if(chunk===undefined){return null}chunks.push(chunk)}return await decryptRecord(chunks.join(""),secrets)};var sealedSessionCookies=async(request,record,secrets,maxAge)=>{const scope=cookieScope(request);const[current]=secrets;if(current===undefined||current.length===0){throw new TypeError("sealed-cookie session requires a rotatable secret")}const headers=[];if(record===null){for(let index=0;index<maxChunks;index+=1){headers.push(chunkCookie(scope,index,"",0))}return headers}const token=await encryptRecord(record,current);const chunks=[];for(let offset=0;offset<token.length;offset+=chunkBytes){chunks.push(token.slice(offset,offset+chunkBytes))}if(chunks.length>maxChunks){throw new TypeError("Sealed session cookie exceeds the browser size limit")}headers.push(chunkCookie(scope,0,`${String(chunks.length)}.${chunks[0]??""}`,maxAge));for(let index=1;index<chunks.length;index+=1){headers.push(chunkCookie(scope,index,chunks[index]??"",maxAge))}for(let index=chunks.length;index<maxChunks;index+=1){headers.push(chunkCookie(scope,index,"",0))}return headers};var appendCookies=(headers,cookies)=>{const next=new Headers(headers);for(const cookie of cookies){next.append("set-cookie",cookie)}return next};var redirectWithCookies=(location,cookies)=>{const headers=appendCookies(new Headers({...noStoreHeaders,location}),cookies);return new Response(null,{headers,status:302})};var storage=async(action)=>{try{return await action()}catch(error){throw new ApplicationUserAuthUnavailableError(error)}};var federatedBasePath=(basePath)=>{if(!/^\/[\w/-]+$/u.test(basePath)||basePath.endsWith("/")){throw new TypeError("basePath must be an absolute path without a trailing slash")}return basePath};var applicationOrigins=(value)=>{const origins=new Set([value].flat().map((origin)=>requireTenantOrigin(origin,"applicationOrigin")));if(origins.size===0){throw new TypeError("applicationOrigin must list at least one origin")}return origins};var listedOrigin=(context,url)=>context.origins.has(url.origin)?url.origin:null;var callbackFor=(context,origin)=>`${origin}${context.basePath}/callback`;var requireFederatedConfiguration=(ttl,options)=>{if(!Number.isSafeInteger(ttl)||ttl<300||ttl>604800||options.clientId===""||options.audience===""||options.organizationId===""||options.scopes.length===0){throw new TypeError("Federated authentication configuration is invalid")}};var federatedSessionSources=(options)=>{const sealed=options.session?.kind==="sealed_cookie"?options.session:undefined;const store=options.session?.kind==="store"?options.session.store:options.store;if(sealed===undefined&&store===undefined){throw new TypeError("Federated authentication requires a session store or sealed-cookie secrets")}if(sealed!==undefined&&(sealed.secrets.length===0||sealed.secrets.some((secret)=>secret.length===0))){throw new TypeError("sealed-cookie session requires a rotatable secret")}return{sealed,store}};var requireStore=(store)=>{if(store===undefined){throw new ApplicationUserAuthUnavailableError(new Error("Federated session store is required"))}return store};var pendingSession=(now,ttl,returnTo,grant)=>({expiresAt:now()+ttl*1000,grant,login:{expiresAt:now()+600000,returnTo,state:randomValue(),status:"pending",verifier:randomValue()},revision:randomValue()});var idleSession=(now,ttl,grant)=>{const expiresAt=now()+ttl*1000;return{expiresAt,grant:grant.refreshExpiresAt===undefined?grant:{...grant,refreshExpiresAt:Math.min(grant.refreshExpiresAt,expiresAt)},login:{status:"idle"},revision:randomValue()}};var authorizationHref=async(context,origin,login)=>{const url=new URL("/oauth/authorize",context.issuer);url.search=new URLSearchParams({client_id:context.options.clientId,code_challenge:await digest2(login.verifier),code_challenge_method:"S256",organization_id:context.options.organizationId,redirect_uri:callbackFor(context,origin),response_type:"code",scope:context.options.scopes.join(" "),state:login.state}).toString();return url.href};var requireCallbackQuery=(url)=>{if(url.searchParams.getAll("state").length!==1||url.searchParams.getAll("code").length!==1||url.searchParams.has("error")){throw new FederatedAuthRejectedError("invalid_state")}};var isPendingSession=(record)=>record.login.status==="pending";var requirePendingLogin=(record,nowMs,state)=>{if(record===null||!isPendingSession(record)){throw new FederatedAuthRejectedError("invalid_state")}if(record.expiresAt<=nowMs||record.login.expiresAt<=nowMs||record.login.state!==state){throw new FederatedAuthRejectedError("invalid_state")}return record};var requireCallbackCode=(url)=>{const code=url.searchParams.get("code")??"";if(code===""){throw new FederatedAuthRejectedError("invalid_state")}return code};var beginSealed=async(context,secrets,request,origin,returnTo)=>{const existing=await readSealedSession(request,secrets);const record=pendingSession(context.now,context.ttl,returnTo,existing?.grant??null);return redirectWithCookies(await authorizationHref(context,origin,record.login),await sealedSessionCookies(request,record,secrets,context.ttl))};var beginStored=async(context,store,request,origin,returnTo)=>{const existingCookie=sessionCookie(request);const existingId=existingCookie===null?null:await digest2(existingCookie);const existing=existingId===null?null:await storage(async()=>await store.read(existingId));const cookie=existing===null?randomValue():existingCookie??randomValue();const id=await digest2(cookie);const record=pendingSession(context.now,context.ttl,returnTo,existing?.grant??null);const saved=existing===null?await storage(async()=>await store.create(id,record)):await storage(async()=>await store.replace(id,existing.revision,record));if(!saved){return Response.json({error:"login_conflict"},{headers:noStoreHeaders,status:409})}return redirect(await authorizationHref(context,origin,record.login),cookieHeader(request,cookie,context.ttl))};var beginLogin=async(context,request,url,origin)=>{const returnTo=returnTarget(url.searchParams.get("returnTo")??"/",origin);if(context.sealed!==undefined){return await beginSealed(context,context.sealed.secrets,request,origin,returnTo)}return await beginStored(context,requireStore(context.store),request,origin,returnTo)};var endGrant=async(context,grant)=>{if(isRenewable(context.options,grant)){await context.renewal.forget(grant)}await context.ci.revoke(grant)};var completeSealed=async(context,secrets,request,url,origin)=>{const pending=requirePendingLogin(await readSealedSession(request,secrets),context.now(),url.searchParams.get("state"));const grant=await context.ci.exchange({callback:callbackFor(context,origin),code:requireCallbackCode(url),verifier:pending.login.verifier});try{if(pending.grant!==null){await endGrant(context,pending.grant)}return redirectWithCookies(pending.login.returnTo,await sealedSessionCookies(request,idleSession(context.now,context.ttl,grant),secrets,context.ttl))}catch(error){await endGrant(context,grant);throw error}};var completeStored=async(context,store,request,url,origin)=>{const cookie=sessionCookie(request);if(cookie===null){throw new FederatedAuthRejectedError("invalid_state")}const id=await digest2(cookie);const record=await storage(async()=>await store.read(id));const pending=requirePendingLogin(record,context.now(),url.searchParams.get("state"));const exchanging={...pending,login:{...pending.login,status:"exchanging"},revision:randomValue()};if(!await storage(async()=>await store.replace(id,pending.revision,exchanging))){throw new FederatedAuthRejectedError("invalid_state")}const grant=await context.ci.exchange({callback:callbackFor(context,origin),code:requireCallbackCode(url),verifier:pending.login.verifier});try{if(pending.grant!==null){await endGrant(context,pending.grant)}const authenticated=idleSession(context.now,context.ttl,grant);if(!await storage(async()=>await store.replace(id,exchanging.revision,authenticated))){throw new FederatedAuthRejectedError("invalid_state")}}catch(error){await endGrant(context,grant);throw error}return redirect(pending.login.returnTo,cookieHeader(request,cookie,context.ttl))};var completeLogin=async(context,request,url,origin)=>{requireCallbackQuery(url);if(context.sealed!==undefined){return await completeSealed(context,context.sealed.secrets,request,url,origin)}return await completeStored(context,requireStore(context.store),request,url,origin)};var effectiveGrant=async(context,grant)=>{if(!isRenewable(context.options,grant)){return grant}if(grant.refreshExpiresAt<=context.now()){return null}const access=await context.renewal.accessFor(grant);return access===null?null:{...grant,accessToken:access.accessToken,expiresAt:access.expiresAt}};var sessionEnd=(context,grant,session,recordExpiresAt)=>Math.min(recordExpiresAt,isRenewable(context.options,grant)?grant.refreshExpiresAt:session.expiresAt.getTime());var sessionFromGrant=async(context,recordGrant,recordExpiresAt)=>{const grant=await effectiveGrant(context,recordGrant);const session=grant===null?null:await context.ci.identity(grant);if(grant===null||session===null){return null}const expiresAt=sessionEnd(context,grant,session,recordExpiresAt);if(expiresAt<=context.now()){return null}return{...session,accessToken:grant.accessToken,expiresAt:new Date(expiresAt)}};var verifiedSealed=async(context,secrets,request)=>{const record=await readSealedSession(request,secrets);if(record===null||record.expiresAt<=context.now()||record.grant===null){return null}try{return await sessionFromGrant(context,record.grant,record.expiresAt)}catch(error){if(!(error instanceof FederatedAuthRejectedError)){throw error}return null}};var replaceClearedGrant=async(store,id,record)=>{await storage(async()=>await store.replace(id,record.revision,{...record,grant:null,revision:randomValue()}))};var verifiedStored=async(context,store,request)=>{const cookie=sessionCookie(request);if(cookie===null){return null}const id=await digest2(cookie);const record=await storage(async()=>await store.read(id));if(record===null||record.expiresAt<=context.now()||record.grant===null){return null}const keepsGrant=isRenewable(context.options,record.grant);try{const grant=await effectiveGrant(context,record.grant);const session=grant===null?null:await context.ci.identity(grant);if(grant===null||session===null){if(!keepsGrant){await replaceClearedGrant(store,id,record)}return null}const current=await storage(async()=>await store.read(id));const expiresAt=sessionEnd(context,grant,session,record.expiresAt);if(expiresAt<=context.now()){return null}return current?.revision===record.revision?{...session,accessToken:grant.accessToken,expiresAt:new Date(expiresAt)}:null}catch(error){if(!(error instanceof FederatedAuthRejectedError)){throw error}if(!keepsGrant){await replaceClearedGrant(store,id,record)}return null}};var getVerifiedSession=async(context,request)=>{if(listedOrigin(context,new URL(request.url))===null){return null}if(context.sealed!==undefined){return await verifiedSealed(context,context.sealed.secrets,request)}if(context.store===undefined){return null}return await verifiedStored(context,context.store,request)};var entityContext=async(context,request,resourceId)=>{const origin=listedOrigin(context,new URL(request.url));if(origin===null||resourceId.trim()===""||request.headers.get("sec-fetch-site")==="cross-site"||request.headers.has("origin")&&request.headers.get("origin")!==origin){return null}const verified=await getVerifiedSession(context,request);if(verified===null||verified.roles===undefined||verified.groupIds===undefined){return null}return bindCiEntityCredential({applicationId:verified.applicationId,groupIds:verified.groupIds,issuer:context.issuer,organizationId:context.options.organizationId,resourceId,roles:verified.roles,scopes:verified.scopes,user:verified.identity},verified.accessToken)};var logoutSealed=async(context,secrets,request)=>{const record=await readSealedSession(request,secrets);const cookies=await sealedSessionCookies(request,null,secrets,0);const headers=appendCookies(new Headers(noStoreHeaders),cookies);try{if(record?.grant!==null&&record?.grant!==undefined){await endGrant(context,record.grant)}return Response.json({revoked:true},{headers})}catch(error){if(!(error instanceof ApplicationUserAuthUnavailableError)){throw error}return Response.json({error:error.code},{headers,status:503})}};var logoutStored=async(context,store,request)=>{const cookie=sessionCookie(request);const id=cookie===null?null:await digest2(cookie);const record=id===null?null:await storage(async()=>await store.remove(id));const headers={...noStoreHeaders,"set-cookie":cookieHeader(request,"",0)};try{if(record?.grant!==null&&record?.grant!==undefined){await endGrant(context,record.grant)}return Response.json({revoked:true},{headers})}catch(error){if(!(error instanceof ApplicationUserAuthUnavailableError)){throw error}return Response.json({error:error.code},{headers,status:503})}};var logoutSession=async(context,request,origin)=>{if(request.headers.get("origin")!==origin||request.headers.get("sec-fetch-site")==="cross-site"){return Response.json({error:"invalid_origin"},{headers:noStoreHeaders,status:403})}if(context.sealed!==undefined){return await logoutSealed(context,context.sealed.secrets,request)}return await logoutStored(context,requireStore(context.store),request)};var handleFederatedRequest=async(context,request)=>{try{const url=new URL(request.url);const origin=listedOrigin(context,url);if(origin===null||url.hash!==""){throw new FederatedAuthRejectedError("invalid_request")}if(url.pathname===`${context.basePath}/login`&&request.method==="GET"){return await beginLogin(context,request,url,origin)}if(url.pathname===`${context.basePath}/callback`&&request.method==="GET"){return await completeLogin(context,request,url,origin)}if(url.pathname===`${context.basePath}/logout`&&request.method==="POST"){return await logoutSession(context,request,origin)}if(url.pathname===`${context.basePath}/session`&&request.method==="GET"){const verified=await getVerifiedSession(context,request);const session=verified===null?null:{expiresAt:verified.expiresAt,identity:verified.identity};return Response.json(session,{headers:noStoreHeaders,status:session===null?401:200})}return new Response(null,{headers:noStoreHeaders,status:404})}catch(error){if(error instanceof ApplicationUserAuthUnavailableError){return Response.json({error:error.code},{headers:noStoreHeaders,status:503})}if(error instanceof FederatedAuthRejectedError||error instanceof TypeError){return Response.json({error:error instanceof FederatedAuthRejectedError?error.code:"invalid_request"},{headers:noStoreHeaders,status:400})}throw error}};var createFederatedAuth=(options)=>{const origins=applicationOrigins(options.applicationOrigin);const issuer=requireTenantOrigin(options.issuer,"issuer");const basePath=federatedBasePath(options.basePath??"/api/auth");const now=options.now??Date.now;const ttl=options.sessionTtlSeconds??86400;requireFederatedConfiguration(ttl,options);const sources=federatedSessionSources(options);const ci=createCiAuthClient(options,now);const context={basePath,ci,issuer,now,options,origins,renewal:createAccessRenewal(now,ci.renew),sealed:sources.sealed,store:sources.store,ttl};return{getAccessToken:async(request)=>{const verified=await getVerifiedSession(context,request);return verified?.accessToken??null},getEntityContext:async(request,resourceId)=>await entityContext(context,request,resourceId),getSession:async(request)=>{const verified=await getVerifiedSession(context,request);return verified===null?null:{expiresAt:verified.expiresAt,identity:verified.identity}},handler:async(request)=>await handleFederatedRequest(context,request),mode:"federated"}};var sessionRequest=(headers,applicationOrigin)=>new Request(new URL("/",applicationOrigin),{headers:{cookie:headers.get("cookie")??""}});var{authorizeWithUserAuth:authorizeWithUserAuth2}=exports_authorization;var{createAccessTokenVerifier:createAccessTokenVerifier2}=exports_access_token;var{readApplicationEnrollment:readApplicationEnrollment2}=exports_enrollment_env;var{sessionRequest:sessionRequest2}=exports_session_request;var{ApplicationUserAuthUnavailableError:ApplicationUserAuthUnavailableError2}=exports_contracts;var{createFederatedAuth:createFederatedAuth2}=exports_service;var{FederatedAuthRejectedError:FederatedAuthRejectedError2}=exports_errors2;var ApplicationUserAuthUnavailableError3=ApplicationUserAuthUnavailableError2;var authorizeWithUserAuth3=authorizeWithUserAuth2;var createAccessTokenVerifier3=createAccessTokenVerifier2;var createFederatedAuth3=createFederatedAuth2;var FederatedAuthRejectedError3=FederatedAuthRejectedError2;var readApplicationEnrollment3=readApplicationEnrollment2;var sessionRequest3=sessionRequest2;export{ApplicationUserAuthUnavailableError3 as ApplicationUserAuthUnavailableError,FederatedAuthRejectedError3 as FederatedAuthRejectedError,authorizeWithUserAuth3 as authorizeWithUserAuth,createAccessTokenVerifier3 as createAccessTokenVerifier,createFederatedAuth3 as createFederatedAuth,readApplicationEnrollment3 as readApplicationEnrollment,sessionRequest3 as sessionRequest};