@continuous-excellence/ze-great-dashboard-aws 0.27.13 → 0.28.1

package/dist/lambda.mjs

@@ -733,8 +733,8 @@ var init_transport = __esm({
 var invalidFunction;
 var init_invalidFunction = __esm({
   "node_modules/@smithy/core/dist-es/submodules/client/invalid-dependency/invalidFunction.js"() {
-    invalidFunction = (message) => () => {
-      throw new Error(message);
+    invalidFunction = (message2) => () => {
+      throw new Error(message2);
     };
   }
 });
@@ -743,7 +743,7 @@ var init_invalidFunction = __esm({
 var invalidProvider;
 var init_invalidProvider = __esm({
   "node_modules/@smithy/core/dist-es/submodules/client/invalid-dependency/invalidProvider.js"() {
-    invalidProvider = (message) => () => Promise.reject(message);
+    invalidProvider = (message2) => () => Promise.reject(message2);
   }
 });
 
@@ -833,9 +833,9 @@ var init_poller = __esm({
         if (currentAttempt > 0) {
           const delayMs = exponentialBackoffWithJitter(minDelayMs, maxDelayMs, currentAttempt, waitUntil);
           if (abortController?.signal?.aborted || abortSignal?.aborted) {
-            const message = "AbortController signal aborted.";
-            observedResponses[message] |= 0;
-            observedResponses[message] += 1;
+            const message2 = "AbortController signal aborted.";
+            observedResponses[message2] |= 0;
+            observedResponses[message2] += 1;
             return { state: WaiterState.ABORTED, observedResponses };
           }
           if (Date.now() + delayMs > waitUntil) {
@@ -845,9 +845,9 @@ var init_poller = __esm({
         }
         const { state: state2, reason } = await acceptorChecks(client, input2);
         if (reason) {
-          const message = createMessageFromResponse(reason);
-          observedResponses[message] |= 0;
-          observedResponses[message] += 1;
+          const message2 = createMessageFromResponse(reason);
+          observedResponses[message2] |= 0;
+          observedResponses[message2] += 1;
         }
         if (state2 !== WaiterState.RETRY) {
           return { state: state2, reason, final: reason, observedResponses };
@@ -2123,8 +2123,8 @@ var init_exceptions = __esm({
           exception[k5] = v;
         }
       });
-      const message = exception.message || exception.Message || "UnknownError";
-      exception.message = message;
+      const message2 = exception.message || exception.Message || "UnknownError";
+      exception.message = message2;
       delete exception.Message;
       return exception;
     };
@@ -2983,8 +2983,8 @@ var init_parse_utils = __esm({
       }
       return expectByte(value);
     };
-    stackTraceWarning = (message) => {
-      return String(new TypeError(message).stack || message).split("\n").slice(0, 5).filter((s2) => !s2.includes("stackTraceWarning")).join("\n");
+    stackTraceWarning = (message2) => {
+      return String(new TypeError(message2).stack || message2).split("\n").slice(0, 5).filter((s2) => !s2.includes("stackTraceWarning")).join("\n");
     };
     logger = {
       warn: console.warn
@@ -3615,7 +3615,7 @@ var init_ProviderError = __esm({
     ProviderError = class _ProviderError extends Error {
       name = "ProviderError";
       tryNextLink;
-      constructor(message, options = true) {
+      constructor(message2, options = true) {
         let logger2;
         let tryNextLink = true;
         if (typeof options === "boolean") {
@@ -3625,10 +3625,10 @@ var init_ProviderError = __esm({
           logger2 = options.logger;
           tryNextLink = options.tryNextLink ?? true;
         }
-        super(message);
+        super(message2);
         this.tryNextLink = tryNextLink;
         Object.setPrototypeOf(this, _ProviderError.prototype);
-        logger2?.debug?.(`@smithy/property-provider ${tryNextLink ? "->" : "(!)"} ${message}`);
+        logger2?.debug?.(`@smithy/property-provider ${tryNextLink ? "->" : "(!)"} ${message2}`);
       }
       static from(error62, options = true) {
         return Object.assign(new this(error62.message, options), error62);
@@ -3644,8 +3644,8 @@ var init_CredentialsProviderError = __esm({
     init_ProviderError();
     CredentialsProviderError = class _CredentialsProviderError extends ProviderError {
       name = "CredentialsProviderError";
-      constructor(message, options = true) {
-        super(message, options);
+      constructor(message2, options = true) {
+        super(message2, options);
         Object.setPrototypeOf(this, _CredentialsProviderError.prototype);
       }
     };
@@ -3659,8 +3659,8 @@ var init_TokenProviderError = __esm({
     init_ProviderError();
     TokenProviderError = class _TokenProviderError extends ProviderError {
       name = "TokenProviderError";
-      constructor(message, options = true) {
-        super(message, options);
+      constructor(message2, options = true) {
+        super(message2, options);
         Object.setPrototypeOf(this, _TokenProviderError.prototype);
       }
     };
@@ -5194,8 +5194,8 @@ var EndpointError;
 var init_EndpointError = __esm({
   "node_modules/@smithy/core/dist-es/submodules/endpoints/util-endpoints/types/EndpointError.js"() {
     EndpointError = class extends Error {
-      constructor(message) {
-        super(message);
+      constructor(message2) {
+        super(message2);
         this.name = "EndpointError";
       }
     };
@@ -6257,7 +6257,7 @@ var init_createChecksumStream_browser = __esm({
       if (!isReadableStream(source)) {
         throw new Error(`@smithy/util-stream: unsupported source type ${source?.constructor?.name ?? source} in ChecksumStream.`);
       }
-      const encoder2 = base64Encoder ?? toBase642;
+      const encoder3 = base64Encoder ?? toBase642;
       if (typeof TransformStream !== "function") {
         throw new Error("@smithy/util-stream: unable to instantiate ChecksumStream because API unavailable: ReadableStream/TransformStream.");
       }
@@ -6270,7 +6270,7 @@ var init_createChecksumStream_browser = __esm({
         },
         async flush(controller) {
           const digest2 = await checksum.digest();
-          const received = encoder2(digest2);
+          const received = encoder3(digest2);
           if (expectedChecksum !== received) {
             const error62 = new Error(`Checksum mismatch: expected "${expectedChecksum}" but received "${received}" in response header "${checksumSourceLocation}".`);
             controller.error(error62);
@@ -6850,8 +6850,8 @@ var init_sdk_stream_mixin = __esm({
           if (encoding === void 0 || Buffer.isEncoding(encoding)) {
             return fromArrayBuffer(buf2.buffer, buf2.byteOffset, buf2.byteLength).toString(encoding);
           } else {
-            const decoder = new TextDecoder(encoding);
-            return decoder.decode(buf2);
+            const decoder2 = new TextDecoder(encoding);
+            return decoder2.decode(buf2);
           }
         },
         transformToWebStream: () => {
@@ -7729,8 +7729,8 @@ var init_Sha256WebCrypto = __esm({
           if (this.secret) {
             this.finished = true;
             const key = await subtle.importKey("raw", this.secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-            const sig = await subtle.sign("HMAC", key, data);
-            return new Uint8Array(sig);
+            const sig2 = await subtle.sign("HMAC", key, data);
+            return new Uint8Array(sig2);
           }
           const hash2 = await subtle.digest("SHA-256", data);
           return new Uint8Array(hash2);
@@ -8090,18 +8090,18 @@ var init_EventStreamCodec = __esm({
         this.messageBuffer = [];
         this.isEndOfStream = false;
       }
-      feed(message) {
-        this.messageBuffer.push(this.decode(message));
+      feed(message2) {
+        this.messageBuffer.push(this.decode(message2));
       }
       endOfStream() {
         this.isEndOfStream = true;
       }
       getMessage() {
-        const message = this.messageBuffer.pop();
+        const message2 = this.messageBuffer.pop();
         const isEndOfStream = this.isEndOfStream;
         return {
           getMessage() {
-            return message;
+            return message2;
           },
           isEndOfStream() {
             return isEndOfStream;
@@ -8137,8 +8137,8 @@ var init_EventStreamCodec = __esm({
         view2.setUint32(length - 4, checksum.digestSync(), false);
         return out;
       }
-      decode(message) {
-        const { headers, body } = splitMessage(message);
+      decode(message2) {
+        const { headers, body } = splitMessage(message2);
         return { headers: this.headerMarshaller.parse(headers), body };
       }
       formatHeaders(rawHeaders) {
@@ -8208,8 +8208,8 @@ var init_SmithyMessageDecoderStream = __esm({
         return this.asyncIterator();
       }
       async *asyncIterator() {
-        for await (const message of this.options.messageStream) {
-          const deserialized = await this.options.deserializer(message);
+        for await (const message2 of this.options.messageStream) {
+          const deserialized = await this.options.deserializer(message2);
           if (deserialized === void 0)
             continue;
           yield deserialized;
@@ -8317,8 +8317,8 @@ function getUnmarshalledStream(source, options) {
   return {
     [Symbol.asyncIterator]: async function* () {
       for await (const chunk of source) {
-        const message = options.eventStreamCodec.decode(chunk);
-        const type = await messageUnmarshaller(message);
+        const message2 = options.eventStreamCodec.decode(chunk);
+        const type = await messageUnmarshaller(message2);
         if (type === void 0)
           continue;
         yield type;
@@ -8327,32 +8327,32 @@ function getUnmarshalledStream(source, options) {
   };
 }
 function getMessageUnmarshaller(deserializer, toUtf83) {
-  return async function(message) {
-    const { value: messageType } = message.headers[":message-type"];
+  return async function(message2) {
+    const { value: messageType } = message2.headers[":message-type"];
     if (messageType === "error") {
-      const unmodeledError = new Error(message.headers[":error-message"].value || "UnknownError");
-      unmodeledError.name = message.headers[":error-code"].value;
+      const unmodeledError = new Error(message2.headers[":error-message"].value || "UnknownError");
+      unmodeledError.name = message2.headers[":error-code"].value;
       throw unmodeledError;
     } else if (messageType === "exception") {
-      const code = message.headers[":exception-type"].value;
-      const exception = { [code]: message };
+      const code = message2.headers[":exception-type"].value;
+      const exception = { [code]: message2 };
       const deserializedException = await deserializer(exception);
       if (deserializedException.$unknown) {
-        const error62 = new Error(toUtf83(message.body));
+        const error62 = new Error(toUtf83(message2.body));
         error62.name = code;
         throw error62;
       }
       throw deserializedException[code];
     } else if (messageType === "event") {
       const event = {
-        [message.headers[":event-type"].value]: message
+        [message2.headers[":event-type"].value]: message2
       };
       const deserialized = await deserializer(event);
       if (deserialized.$unknown)
         return;
       return deserialized;
     } else {
-      throw Error(`Unrecognizable event type: ${message.headers[":event-type"].value}`);
+      throw Error(`Unrecognizable event type: ${message2.headers[":event-type"].value}`);
     }
   };
 }
@@ -8682,14 +8682,14 @@ var init_EventStreamSerde = __esm({
         }
         const dataObject = hasBindings ? out : body.byteLength === 0 ? {} : await this.deserializer.read(eventStreamSchema, body);
         if (ErrCtor) {
-          const message = dataObject.message ?? dataObject.Message ?? "Unknown";
+          const message2 = dataObject.message ?? dataObject.Message ?? "Unknown";
           const metadata = {};
           const $fault = eventStreamSchema.getMergedTraits().error;
           if ($fault) {
             metadata.$fault = $fault;
           }
           return Object.assign(new ErrCtor({}), metadata, {
-            message
+            message: message2
           }, dataObject);
         }
         return dataObject;
@@ -14086,7 +14086,7 @@ ${toHex2(hashedRequest)}`;
     var cacheQueue = [];
     var createScope = (shortDate, region, service) => `${shortDate}/${region}/${service}/${KEY_TYPE_IDENTIFIER}`;
     var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service) => {
-      const credsHash = await hmac(sha256Constructor, credentials.secretAccessKey, credentials.accessKeyId);
+      const credsHash = await hmac2(sha256Constructor, credentials.secretAccessKey, credentials.accessKeyId);
       const cacheKey = `${shortDate}:${region}:${service}:${toHex2(credsHash)}:${credentials.sessionToken}`;
       if (cacheKey in signingKeyCache) {
         return signingKeyCache[cacheKey];
@@ -14097,7 +14097,7 @@ ${toHex2(hashedRequest)}`;
       }
       let key = `AWS4${credentials.secretAccessKey}`;
       for (const signable of [shortDate, region, service, KEY_TYPE_IDENTIFIER]) {
-        key = await hmac(sha256Constructor, key, signable);
+        key = await hmac2(sha256Constructor, key, signable);
       }
       return signingKeyCache[cacheKey] = key;
     };
@@ -14107,7 +14107,7 @@ ${toHex2(hashedRequest)}`;
         delete signingKeyCache[cacheKey];
       });
     };
-    var hmac = (ctor, secret, data) => {
+    var hmac2 = (ctor, secret, data) => {
       const hash2 = new ctor(secret);
       hash2.update(toUint8Array2(data));
       return hash2.digest();
@@ -14725,8 +14725,8 @@ var require_dist_cjs4 = __commonJS({
     var InstanceMetadataV1FallbackError = class _InstanceMetadataV1FallbackError extends CredentialsProviderError2 {
       tryNextLink;
       name = "InstanceMetadataV1FallbackError";
-      constructor(message, tryNextLink = true) {
-        super(message, tryNextLink);
+      constructor(message2, tryNextLink = true) {
+        super(message2, tryNextLink);
         this.tryNextLink = tryNextLink;
         Object.setPrototypeOf(this, _InstanceMetadataV1FallbackError.prototype);
       }
@@ -16203,9 +16203,9 @@ function loadCborStructIterator(ns) {
   for (let i5 = 0; i5 < memberNames.length; ++i5) {
     encodedKeys[i5] = encodeCborStringKey(memberNames[i5]);
   }
-  const cache5 = { memberNames, memberSchemas, encodedKeys };
-  schema[CBOR_STRUCT_CACHE] = cache5;
-  return cache5;
+  const cache6 = { memberNames, memberSchemas, encodedKeys };
+  schema[CBOR_STRUCT_CACHE] = cache6;
+  return cache6;
 }
 function encodeCborStringKey(s2) {
   let utf8Bytes;
@@ -16255,8 +16255,8 @@ function writeValue(ns, value, container, serdeContext) {
     encodeHeader(majorMap, 0);
     return;
   }
-  const isObject2 = typeof value === "object";
-  if (isObject2) {
+  const isObject3 = typeof value === "object";
+  if (isObject3) {
     if (ns.isBlobSchema()) {
       if (value instanceof Uint8Array) {
         writeBytes(value);
@@ -16370,8 +16370,8 @@ function writeStruct(ns, value, serdeContext) {
     }
     return;
   }
-  const cache5 = loadCborStructIterator(ns);
-  const { memberNames, memberSchemas, encodedKeys } = cache5;
+  const cache6 = loadCborStructIterator(ns);
+  const { memberNames, memberSchemas, encodedKeys } = cache6;
   const z2 = memberNames.length;
   let headerSize;
   if (z2 < 24) {
@@ -16837,8 +16837,8 @@ function readMap(ns) {
 }
 function readStruct(ns, count, startPos) {
   const isUnion = ns.isUnionSchema();
-  const cache5 = loadCborStructIterator(ns);
-  const { memberSchemas, encodedKeys, memberNames } = cache5;
+  const cache6 = loadCborStructIterator(ns);
+  const { memberSchemas, encodedKeys, memberNames } = cache6;
   const z2 = encodedKeys.length;
   const result = {};
   let unknownKey;
@@ -17021,8 +17021,8 @@ function readListIndefinite(ns) {
 function readMapIndefinite(ns) {
   pos += 1;
   if (ns.isStructSchema()) {
-    const cache5 = loadCborStructIterator(ns);
-    const { memberSchemas, encodedKeys, memberNames } = cache5;
+    const cache6 = loadCborStructIterator(ns);
+    const { memberSchemas, encodedKeys, memberNames } = cache6;
     const z2 = encodedKeys.length;
     const isUnion = ns.isUnionSchema();
     const result = {};
@@ -17525,7 +17525,7 @@ var init_SmithyRpcV2CborProtocol = __esm({
         }
         const ns = NormalizedSchema.of(errorSchema);
         const ErrorCtor = registry2.getErrorCtor(errorSchema);
-        const message = dataObject.message ?? dataObject.Message ?? "Unknown";
+        const message2 = dataObject.message ?? dataObject.Message ?? "Unknown";
         const exception = new ErrorCtor({});
         const output2 = {};
         for (const [name, member2] of ns.structIterator()) {
@@ -17533,7 +17533,7 @@ var init_SmithyRpcV2CborProtocol = __esm({
         }
         throw Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2);
       }
       getDefaultContentType() {
@@ -17614,8 +17614,8 @@ var init_ProtocolLib = __esm({
             throw this.decorateServiceException(Object.assign(new ErrorCtor({ name: errorName }), errorMetadata), dataObject);
           }
           const d5 = dataObject;
-          const message = d5?.message ?? d5?.Message ?? d5?.Error?.Message ?? d5?.Error?.message;
-          throw this.decorateServiceException(Object.assign(new Error(message), {
+          const message2 = d5?.message ?? d5?.Message ?? d5?.Error?.Message ?? d5?.Error?.message;
+          throw this.decorateServiceException(Object.assign(new Error(message2), {
             name: errorName
           }, errorMetadata), dataObject);
         }
@@ -17728,7 +17728,7 @@ var init_AwsSmithyRpcV2CborProtocol = __esm({
         this.mixin.compose(this.compositeErrorRegistry, errorName, this.options.defaultNamespace);
         const { errorSchema, errorMetadata } = await this.mixin.getErrorSchemaOrThrowBaseException(errorName, this.options.defaultNamespace, response, dataObject, metadata, this.awsQueryCompatible ? this.mixin.findQueryCompatibleError : void 0);
         const ns = NormalizedSchema.of(errorSchema);
-        const message = dataObject.message ?? dataObject.Message ?? "UnknownError";
+        const message2 = dataObject.message ?? dataObject.Message ?? "UnknownError";
         const ErrorCtor = this.compositeErrorRegistry.getErrorCtor(errorSchema) ?? Error;
         const exception = new ErrorCtor({});
         const output2 = {};
@@ -17742,7 +17742,7 @@ var init_AwsSmithyRpcV2CborProtocol = __esm({
         }
         throw this.mixin.decorateServiceException(Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2), dataObject);
       }
     };
@@ -18139,9 +18139,9 @@ var init_JsonShapeDeserializer2 = __esm({
         return this._read(schema, data);
       }
       _read(schema, value) {
-        const isObject2 = value !== null && typeof value === "object";
+        const isObject3 = value !== null && typeof value === "object";
         const ns = NormalizedSchema.of(schema);
-        if (isObject2) {
+        if (isObject3) {
           if (ns.isStructSchema()) {
             return this._readStruct(ns, value);
           }
@@ -18218,7 +18218,7 @@ var init_JsonShapeDeserializer2 = __esm({
           return value;
         }
         if (ns.isDocumentSchema()) {
-          if (isObject2) {
+          if (isObject3) {
             if (Array.isArray(value)) {
               for (let i5 = 0; i5 < value.length; ++i5) {
                 const v = value[i5];
@@ -18589,11 +18589,11 @@ var init_JsonShapeSerializer2 = __esm({
       }
       static B64 = (() => {
         const chars2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-        const table = new Uint8Array(64);
+        const table2 = new Uint8Array(64);
         for (let i5 = 0; i5 < 64; ++i5) {
-          table[i5] = chars2.charCodeAt(i5);
+          table2[i5] = chars2.charCodeAt(i5);
         }
-        return table;
+        return table2;
       })();
       writeBase64(data) {
         const b64Len = Math.ceil(data.length / 3) * 4;
@@ -18649,7 +18649,7 @@ var init_JsonShapeSerializer2 = __esm({
           return;
         }
         const ns = NormalizedSchema.of(schema);
-        const isObject2 = typeof value === "object";
+        const isObject3 = typeof value === "object";
         if (ns.isStringSchema()) {
           const mediaType = ns.getMergedTraits().mediaType;
           if (mediaType) {
@@ -18660,7 +18660,7 @@ var init_JsonShapeSerializer2 = __esm({
             }
           }
         }
-        if (isObject2) {
+        if (isObject3) {
           if (ns.isStructSchema()) {
             this.writeStruct(ns, value);
             return;
@@ -19007,7 +19007,7 @@ var init_AwsJsonRpcProtocol = __esm({
         this.mixin.compose(this.compositeErrorRegistry, errorIdentifier, this.options.defaultNamespace);
         const { errorSchema, errorMetadata } = await this.mixin.getErrorSchemaOrThrowBaseException(errorIdentifier, this.options.defaultNamespace, response, dataObject, metadata, awsQueryCompatible ? this.mixin.findQueryCompatibleError : void 0);
         const ns = NormalizedSchema.of(errorSchema);
-        const message = dataObject.message ?? dataObject.Message ?? "UnknownError";
+        const message2 = dataObject.message ?? dataObject.Message ?? "UnknownError";
         const ErrorCtor = this.compositeErrorRegistry.getErrorCtor(errorSchema) ?? Error;
         const exception = new ErrorCtor({});
         const output2 = {};
@@ -19022,7 +19022,7 @@ var init_AwsJsonRpcProtocol = __esm({
         }
         throw this.mixin.decorateServiceException(Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2), dataObject);
       }
     };
@@ -19155,7 +19155,7 @@ var init_AwsRestJsonProtocol = __esm({
         this.mixin.compose(this.compositeErrorRegistry, errorIdentifier, this.options.defaultNamespace);
         const { errorSchema, errorMetadata } = await this.mixin.getErrorSchemaOrThrowBaseException(errorIdentifier, this.options.defaultNamespace, response, dataObject, metadata);
         const ns = NormalizedSchema.of(errorSchema);
-        const message = dataObject.message ?? dataObject.Message ?? "UnknownError";
+        const message2 = dataObject.message ?? dataObject.Message ?? "UnknownError";
         const ErrorCtor = this.compositeErrorRegistry.getErrorCtor(errorSchema) ?? Error;
         const exception = new ErrorCtor({});
         await this.deserializeHttpMessage(errorSchema, context, response, dataObject);
@@ -19167,7 +19167,7 @@ var init_AwsRestJsonProtocol = __esm({
         }
         throw this.mixin.decorateServiceException(Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2), dataObject);
       }
       getDefaultContentType() {
@@ -19205,9 +19205,9 @@ var init_JsonShapeDeserializer = __esm({
         return this._read(schema, data);
       }
       _read(schema, value) {
-        const isObject2 = value !== null && typeof value === "object";
+        const isObject3 = value !== null && typeof value === "object";
         const ns = NormalizedSchema.of(schema);
-        if (isObject2) {
+        if (isObject3) {
           if (ns.isStructSchema()) {
             const record2 = value;
             const union2 = ns.isUnionSchema();
@@ -19317,7 +19317,7 @@ var init_JsonShapeDeserializer = __esm({
           return value;
         }
         if (ns.isDocumentSchema()) {
-          if (isObject2) {
+          if (isObject3) {
             const out = Array.isArray(value) ? [] : {};
             for (const k5 in value) {
               if (k5 === "__proto__") {
@@ -19437,9 +19437,9 @@ var init_JsonShapeSerializer = __esm({
         }
       }
       _write(schema, value, container) {
-        const isObject2 = value !== null && typeof value === "object";
+        const isObject3 = value !== null && typeof value === "object";
         const ns = NormalizedSchema.of(schema);
-        if (isObject2) {
+        if (isObject3) {
           if (ns.isStructSchema()) {
             const record2 = value;
             const out = {};
@@ -19563,7 +19563,7 @@ var init_JsonShapeSerializer = __esm({
           this.useReplacer = true;
         }
         if (ns.isDocumentSchema()) {
-          if (isObject2) {
+          if (isObject3) {
             if (value instanceof Uint8Array) {
               return (this.serdeContext?.base64Encoder ?? toBase64)(value);
             }
@@ -19820,9 +19820,9 @@ var require_dist_cjs7 = __commonJS({
       parseTag() {
         const p3 = this;
         ++p3.i;
-        let tag = "";
+        let tag2 = "";
         while (p3.i < p3.z && !" 	\r\n>/".includes(p3.x[p3.i])) {
-          tag += p3.x[p3.i++];
+          tag2 += p3.x[p3.i++];
         }
         let hasAttrs = false;
         const attrs = {};
@@ -19856,7 +19856,7 @@ var require_dist_cjs7 = __commonJS({
             throw new Error("@aws-sdk XML parse error: expected > at the end of self-closing tag.");
           }
           ++p3.i;
-          return { tag, value: hasAttrs ? attrs : "" };
+          return { tag: tag2, value: hasAttrs ? attrs : "" };
         }
         if (p3.x[p3.i] !== ">") {
           throw new Error("@aws-sdk XML parse error: expected > at the end of opening tag.");
@@ -19890,22 +19890,22 @@ var require_dist_cjs7 = __commonJS({
           }
         }
         if (!p3.isNext("</")) {
-          throw new Error(`@aws-sdk XML parse error: missing closing tag </${tag}>.`);
+          throw new Error(`@aws-sdk XML parse error: missing closing tag </${tag2}>.`);
         }
         p3.i += 2;
         const closeTag = p3.readTo(">").trim();
-        if (closeTag !== tag) {
-          throw new Error(`@aws-sdk XML parse error: mismatched tags <${tag}> and </${closeTag}>.`);
+        if (closeTag !== tag2) {
+          throw new Error(`@aws-sdk XML parse error: mismatched tags <${tag2}> and </${closeTag}>.`);
         }
         if (!hasAttrs && textParts.length === 0 && !hasElementChild) {
-          return { tag, value: "" };
+          return { tag: tag2, value: "" };
         }
         if (!hasAttrs && !hasElementChild) {
           const text = textParts.length === 1 ? textParts[0] : textParts.join("");
           if (text.trim() === "" && text.includes("\n")) {
-            return { tag, value: "" };
+            return { tag: tag2, value: "" };
           }
-          return { tag, value: text };
+          return { tag: tag2, value: text };
         }
         const obj = {};
         for (const text of textParts) {
@@ -19934,7 +19934,7 @@ var require_dist_cjs7 = __commonJS({
           }
           obj[k5] = v;
         }
-        return { tag, value: obj };
+        return { tag: tag2, value: obj };
       }
       static ENTITIES = {
         amp: "&",
@@ -20407,12 +20407,12 @@ var init_AwsQueryProtocol = __esm({
         const errorIdentifier = this.loadQueryErrorCode(response, dataObject) ?? "Unknown";
         this.mixin.compose(this.compositeErrorRegistry, errorIdentifier, this.options.defaultNamespace);
         const errorData = this.loadQueryError(dataObject) ?? {};
-        const message = this.loadQueryErrorMessage(dataObject);
-        errorData.message = message;
+        const message2 = this.loadQueryErrorMessage(dataObject);
+        errorData.message = message2;
         errorData.Error = {
           Type: errorData.Type,
           Code: errorData.Code,
-          Message: message
+          Message: message2
         };
         const { errorSchema, errorMetadata } = await this.mixin.getErrorSchemaOrThrowBaseException(errorIdentifier, this.options.defaultNamespace, response, errorData, metadata, this.mixin.findQueryCompatibleError);
         const ns = NormalizedSchema.of(errorSchema);
@@ -20430,7 +20430,7 @@ var init_AwsQueryProtocol = __esm({
         }
         throw this.mixin.decorateServiceException(Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2), dataObject);
       }
       loadQueryErrorCode(output2, data) {
@@ -20909,7 +20909,7 @@ var init_AwsRestXmlProtocol = __esm({
         }
         const { errorSchema, errorMetadata } = await this.mixin.getErrorSchemaOrThrowBaseException(errorIdentifier, this.options.defaultNamespace, response, dataObject, metadata);
         const ns = NormalizedSchema.of(errorSchema);
-        const message = dataObject.Error?.message ?? dataObject.Error?.Message ?? dataObject.message ?? dataObject.Message ?? "UnknownError";
+        const message2 = dataObject.Error?.message ?? dataObject.Error?.Message ?? dataObject.message ?? dataObject.Message ?? "UnknownError";
         const ErrorCtor = this.compositeErrorRegistry.getErrorCtor(errorSchema) ?? Error;
         const exception = new ErrorCtor({});
         await this.deserializeHttpMessage(errorSchema, context, response, dataObject);
@@ -20922,7 +20922,7 @@ var init_AwsRestXmlProtocol = __esm({
         }
         throw this.mixin.decorateServiceException(Object.assign(exception, errorMetadata, {
           $fault: ns.getMergedTraits().error,
-          message
+          message: message2
         }, output2), dataObject);
       }
       getDefaultContentType() {
@@ -25309,21 +25309,21 @@ var require_dist_cjs11 = __commonJS({
         } catch (error62) {
           if (error62.name === "AccessDeniedException") {
             const errorType = error62.error;
-            let message;
+            let message2;
             switch (errorType) {
               case "TOKEN_EXPIRED":
-                message = "Your session has expired. Please reauthenticate.";
+                message2 = "Your session has expired. Please reauthenticate.";
                 break;
               case "USER_CREDENTIALS_CHANGED":
-                message = "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
+                message2 = "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
                 break;
               case "INSUFFICIENT_PERMISSIONS":
-                message = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
+                message2 = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
                 break;
               default:
-                message = `Failed to refresh token: ${String(error62)}. Please re-authenticate using \`aws login\``;
+                message2 = `Failed to refresh token: ${String(error62)}. Please re-authenticate using \`aws login\``;
             }
-            throw new CredentialsProviderError2(message, {
+            throw new CredentialsProviderError2(message2, {
               logger: this.logger,
               tryNextLink: false
             });
@@ -25450,11 +25450,11 @@ var require_dist_cjs11 = __commonJS({
           };
           const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
           const payloadB64 = Buffer.from(JSON.stringify(payload2)).toString("base64url");
-          const message = `${headerB64}.${payloadB64}`;
-          const asn1Signature = sign2("sha256", Buffer.from(message), privateKey);
+          const message2 = `${headerB64}.${payloadB64}`;
+          const asn1Signature = sign2("sha256", Buffer.from(message2), privateKey);
           const rawSignature = this.derToRawSignature(asn1Signature);
           const signatureB64 = rawSignature.toString("base64url");
-          return `${message}.${signatureB64}`;
+          return `${message2}.${signatureB64}`;
         } catch (error62) {
           throw new CredentialsProviderError2(`Failed to generate Dpop proof: ${error62 instanceof Error ? error62.message : String(error62)}`, { logger: this.logger, tryNextLink: false });
         }
@@ -26146,12 +26146,12 @@ var require_dist_cjs16 = __commonJS({
       r5 + 3
     ]);
     var bdd5 = BinaryDecisionDiagram2.from(nodes5, root5, _data5.conditions, _data5.results);
-    var cache5 = new EndpointCache2({
+    var cache6 = new EndpointCache2({
       size: 50,
       params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"]
     });
     var defaultEndpointResolver5 = (endpointParams, context = {}) => {
-      return cache5.get(endpointParams, () => decideEndpoint2(bdd5, {
+      return cache6.get(endpointParams, () => decideEndpoint2(bdd5, {
         endpointParams,
         logger: context.logger
       }));
@@ -27906,12 +27906,12 @@ var require_dist_cjs17 = __commonJS({
       r5 + 3
     ]);
     var bdd5 = BinaryDecisionDiagram2.from(nodes5, root5, _data5.conditions, _data5.results);
-    var cache5 = new EndpointCache2({
+    var cache6 = new EndpointCache2({
       size: 50,
       params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"]
     });
     var defaultEndpointResolver5 = (endpointParams, context = {}) => {
-      return cache5.get(endpointParams, () => decideEndpoint2(bdd5, {
+      return cache6.get(endpointParams, () => decideEndpoint2(bdd5, {
         endpointParams,
         logger: context.logger
       }));
@@ -42122,12 +42122,12 @@ var require_directives = __commonJS({
        * Given a fully resolved tag, returns its printable string form,
        * taking into account current tag prefixes and defaults.
        */
-      tagString(tag) {
+      tagString(tag2) {
         for (const [handle2, prefix] of Object.entries(this.tags)) {
-          if (tag.startsWith(prefix))
-            return handle2 + escapeTagName(tag.substring(prefix.length));
+          if (tag2.startsWith(prefix))
+            return handle2 + escapeTagName(tag2.substring(prefix.length));
         }
-        return tag[0] === "!" ? tag : `!<${tag}>`;
+        return tag2[0] === "!" ? tag2 : `!<${tag2}>`;
       }
       toString(doc) {
         const lines = this.yaml.explicit ? [`%YAML ${this.yaml.version || "1.2"}`] : [];
@@ -43104,7 +43104,7 @@ ${indent}${start}${value}${end2}`;
       const str = value.replace(/\n+/g, `$&
 ${indent}`);
       if (actualString) {
-        const test = (tag) => tag.default && tag.tag !== "tag:yaml.org,2002:str" && tag.test?.test(str);
+        const test = (tag2) => tag2.default && tag2.tag !== "tag:yaml.org,2002:str" && tag2.test?.test(str);
         const { compat, tags } = ctx.doc.schema;
         if (tags.some(test) || compat?.some(test))
           return quotedString(value, ctx);
@@ -43234,9 +43234,9 @@ var require_stringify = __commonJS({
         anchors$1.add(anchor2);
         props.push(`&${anchor2}`);
       }
-      const tag = node2.tag ?? (tagObj.default ? null : tagObj.tag);
-      if (tag)
-        props.push(doc.directives.tagString(tag));
+      const tag2 = node2.tag ?? (tagObj.default ? null : tagObj.tag);
+      if (tag2)
+        props.push(doc.directives.tagString(tag2));
       return props.join(" ");
     }
     function stringify(item, ctx, onComment, onChompKeep) {
@@ -43444,7 +43444,7 @@ var require_merge = __commonJS({
       }),
       stringify: () => MERGE_KEY
     };
-    var isMergeKey = (ctx, key) => (merge3.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge3.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge3.tag && tag.default);
+    var isMergeKey = (ctx, key) => (merge3.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge3.identify(key.value)) && ctx?.doc.schema.tags.some((tag2) => tag2.tag === merge3.tag && tag2.default);
     function addMergeToJSMap(ctx, map4, value) {
       const source = resolveAliasValue(ctx, value);
       if (identity.isSeq(source))
@@ -44111,14 +44111,14 @@ var require_bool = __commonJS({
 var require_stringifyNumber = __commonJS({
   "node_modules/yaml/dist/stringify/stringifyNumber.js"(exports) {
     "use strict";
-    function stringifyNumber({ format: format2, minFractionDigits, tag, value }) {
+    function stringifyNumber({ format: format2, minFractionDigits, tag: tag2, value }) {
       if (typeof value === "bigint")
         return String(value);
       const num = typeof value === "number" ? value : Number(value);
       if (!isFinite(num))
         return isNaN(num) ? ".nan" : num < 0 ? "-.inf" : ".inf";
       let n3 = Object.is(value, -0) ? "-0" : JSON.stringify(value);
-      if (!format2 && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^-?\d/.test(n3) && !n3.includes("e")) {
+      if (!format2 && minFractionDigits && (!tag2 || tag2 === "tag:yaml.org,2002:float") && /^-?\d/.test(n3) && !n3.includes("e")) {
         let i5 = n3.indexOf(".");
         if (i5 < 0) {
           i5 = n3.length;
@@ -44993,17 +44993,17 @@ var require_tags = __commonJS({
         }
       }
       if (Array.isArray(customTags)) {
-        for (const tag of customTags)
-          tags = tags.concat(tag);
+        for (const tag2 of customTags)
+          tags = tags.concat(tag2);
       } else if (typeof customTags === "function") {
         tags = customTags(tags.slice());
       }
       if (addMergeTag)
         tags = tags.concat(merge3.merge);
-      return tags.reduce((tags2, tag) => {
-        const tagObj = typeof tag === "string" ? tagsByName[tag] : tag;
+      return tags.reduce((tags2, tag2) => {
+        const tagObj = typeof tag2 === "string" ? tagsByName[tag2] : tag2;
         if (!tagObj) {
-          const tagName = JSON.stringify(tag);
+          const tagName = JSON.stringify(tag2);
           const keys = Object.keys(tagsByName).map((key) => JSON.stringify(key)).join(", ");
           throw new Error(`Unknown custom tag ${tagName}; use one of ${keys}`);
         }
@@ -45243,7 +45243,7 @@ var require_Document = __commonJS({
           options = replacer;
           replacer = void 0;
         }
-        const { aliasDuplicateObjects, anchorPrefix, flow, keepUndefined, onTagObj, tag } = options ?? {};
+        const { aliasDuplicateObjects, anchorPrefix, flow, keepUndefined, onTagObj, tag: tag2 } = options ?? {};
         const { onAnchor, setAnchors, sourceObjects } = anchors.createNodeAnchors(
           this,
           // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
@@ -45258,7 +45258,7 @@ var require_Document = __commonJS({
           schema: this.schema,
           sourceObjects
         };
-        const node2 = createNode.createNode(value, tag, ctx);
+        const node2 = createNode.createNode(value, tag2, ctx);
         if (flow && identity.isCollection(node2))
           node2.flow = true;
         setAnchors();
@@ -45443,22 +45443,22 @@ var require_errors = __commonJS({
   "node_modules/yaml/dist/errors.js"(exports) {
     "use strict";
     var YAMLError = class extends Error {
-      constructor(name, pos2, code, message) {
+      constructor(name, pos2, code, message2) {
         super();
         this.name = name;
         this.code = code;
-        this.message = message;
+        this.message = message2;
         this.pos = pos2;
       }
     };
     var YAMLParseError2 = class extends YAMLError {
-      constructor(pos2, code, message) {
-        super("YAMLParseError", pos2, code, message);
+      constructor(pos2, code, message2) {
+        super("YAMLParseError", pos2, code, message2);
       }
     };
     var YAMLWarning = class extends YAMLError {
-      constructor(pos2, code, message) {
-        super("YAMLWarning", pos2, code, message);
+      constructor(pos2, code, message2) {
+        super("YAMLWarning", pos2, code, message2);
       }
     };
     var prettifyError2 = (src, lc) => (error62) => {
@@ -45517,7 +45517,7 @@ var require_resolve_props = __commonJS({
       let reqSpace = false;
       let tab = null;
       let anchor2 = null;
-      let tag = null;
+      let tag2 = null;
       let newlineAfterProp = null;
       let comma = null;
       let found = null;
@@ -45563,7 +45563,7 @@ var require_resolve_props = __commonJS({
               commentSep += token.source;
             atNewline = true;
             hasNewline = true;
-            if (anchor2 || tag)
+            if (anchor2 || tag2)
               newlineAfterProp = token;
             hasSpace = true;
             break;
@@ -45579,9 +45579,9 @@ var require_resolve_props = __commonJS({
             reqSpace = true;
             break;
           case "tag": {
-            if (tag)
+            if (tag2)
               onError(token, "MULTIPLE_TAGS", "A node can have at most one tag");
-            tag = token;
+            tag2 = token;
             start ?? (start = token.offset);
             atNewline = false;
             hasSpace = false;
@@ -45589,7 +45589,7 @@ var require_resolve_props = __commonJS({
             break;
           }
           case indicator:
-            if (anchor2 || tag)
+            if (anchor2 || tag2)
               onError(token, "BAD_PROP_ORDER", `Anchors and tags must be after the ${token.source} indicator`);
             if (found)
               onError(token, "UNEXPECTED_TOKEN", `Unexpected ${token.source} in ${flow ?? "collection"}`);
@@ -45627,7 +45627,7 @@ var require_resolve_props = __commonJS({
         comment,
         hasNewline,
         anchor: anchor2,
-        tag,
+        tag: tag2,
         newlineAfterProp,
         end: end2,
         start: start ?? end2
@@ -45724,8 +45724,8 @@ var require_resolve_block_map = __commonJS({
     var utilFlowIndentCheck = require_util_flow_indent_check();
     var utilMapIncludes = require_util_map_includes();
     var startColMsg = "All mapping items must start at the same column";
-    function resolveBlockMap({ composeNode, composeEmptyNode }, ctx, bm, onError, tag) {
-      const NodeClass = tag?.nodeClass ?? YAMLMap.YAMLMap;
+    function resolveBlockMap({ composeNode, composeEmptyNode }, ctx, bm, onError, tag2) {
+      const NodeClass = tag2?.nodeClass ?? YAMLMap.YAMLMap;
       const map4 = new NodeClass(ctx.schema);
       if (ctx.atRoot)
         ctx.atRoot = false;
@@ -45828,8 +45828,8 @@ var require_resolve_block_seq = __commonJS({
     var YAMLSeq = require_YAMLSeq();
     var resolveProps = require_resolve_props();
     var utilFlowIndentCheck = require_util_flow_indent_check();
-    function resolveBlockSeq({ composeNode, composeEmptyNode }, ctx, bs, onError, tag) {
-      const NodeClass = tag?.nodeClass ?? YAMLSeq.YAMLSeq;
+    function resolveBlockSeq({ composeNode, composeEmptyNode }, ctx, bs, onError, tag2) {
+      const NodeClass = tag2?.nodeClass ?? YAMLSeq.YAMLSeq;
       const seq = new NodeClass(ctx.schema);
       if (ctx.atRoot)
         ctx.atRoot = false;
@@ -45929,10 +45929,10 @@ var require_resolve_flow_collection = __commonJS({
     var utilMapIncludes = require_util_map_includes();
     var blockMsg = "Block collections are not allowed within flow collections";
     var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
-    function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
+    function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag2) {
       const isMap = fc.start.source === "{";
       const fcName = isMap ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const NodeClass = tag2?.nodeClass ?? (isMap ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -46120,8 +46120,8 @@ var require_compose_collection = __commonJS({
     var resolveBlockMap = require_resolve_block_map();
     var resolveBlockSeq = require_resolve_block_seq();
     var resolveFlowCollection = require_resolve_flow_collection();
-    function resolveCollection(CN, ctx, token, onError, tagName, tag) {
-      const coll = token.type === "block-map" ? resolveBlockMap.resolveBlockMap(CN, ctx, token, onError, tag) : token.type === "block-seq" ? resolveBlockSeq.resolveBlockSeq(CN, ctx, token, onError, tag) : resolveFlowCollection.resolveFlowCollection(CN, ctx, token, onError, tag);
+    function resolveCollection(CN, ctx, token, onError, tagName, tag2) {
+      const coll = token.type === "block-map" ? resolveBlockMap.resolveBlockMap(CN, ctx, token, onError, tag2) : token.type === "block-seq" ? resolveBlockSeq.resolveBlockSeq(CN, ctx, token, onError, tag2) : resolveFlowCollection.resolveFlowCollection(CN, ctx, token, onError, tag2);
       const Coll = coll.constructor;
       if (tagName === "!" || tagName === Coll.tagName) {
         coll.tag = Coll.tagName;
@@ -46138,20 +46138,20 @@ var require_compose_collection = __commonJS({
         const { anchor: anchor2, newlineAfterProp: nl } = props;
         const lastProp = anchor2 && tagToken ? anchor2.offset > tagToken.offset ? anchor2 : tagToken : anchor2 ?? tagToken;
         if (lastProp && (!nl || nl.offset < lastProp.offset)) {
-          const message = "Missing newline after block sequence props";
-          onError(lastProp, "MISSING_CHAR", message);
+          const message2 = "Missing newline after block sequence props";
+          onError(lastProp, "MISSING_CHAR", message2);
         }
       }
       const expType = token.type === "block-map" ? "map" : token.type === "block-seq" ? "seq" : token.start.source === "{" ? "map" : "seq";
       if (!tagToken || !tagName || tagName === "!" || tagName === YAMLMap.YAMLMap.tagName && expType === "map" || tagName === YAMLSeq.YAMLSeq.tagName && expType === "seq") {
         return resolveCollection(CN, ctx, token, onError, tagName);
       }
-      let tag = ctx.schema.tags.find((t) => t.tag === tagName && t.collection === expType);
-      if (!tag) {
+      let tag2 = ctx.schema.tags.find((t) => t.tag === tagName && t.collection === expType);
+      if (!tag2) {
         const kt = ctx.schema.knownTags[tagName];
         if (kt?.collection === expType) {
           ctx.schema.tags.push(Object.assign({}, kt, { default: false }));
-          tag = kt;
+          tag2 = kt;
         } else {
           if (kt) {
             onError(tagToken, "BAD_COLLECTION_TYPE", `${kt.tag} used for ${expType} collection, but expects ${kt.collection ?? "scalar"}`, true);
@@ -46161,13 +46161,13 @@ var require_compose_collection = __commonJS({
           return resolveCollection(CN, ctx, token, onError, tagName);
         }
       }
-      const coll = resolveCollection(CN, ctx, token, onError, tagName, tag);
-      const res = tag.resolve?.(coll, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg), ctx.options) ?? coll;
+      const coll = resolveCollection(CN, ctx, token, onError, tagName, tag2);
+      const res = tag2.resolve?.(coll, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg), ctx.options) ?? coll;
       const node2 = identity.isNode(res) ? res : new Scalar.Scalar(res);
       node2.range = coll.range;
       node2.tag = tagName;
-      if (tag?.format)
-        node2.format = tag.format;
+      if (tag2?.format)
+        node2.format = tag2.format;
       return node2;
     }
     exports.composeCollection = composeCollection;
@@ -46211,15 +46211,15 @@ var require_resolve_block_scalar = __commonJS({
             trimIndent = indent.length;
         } else {
           if (indent.length < trimIndent) {
-            const message = "Block scalars with more-indented leading empty lines must use an explicit indentation indicator";
-            onError(offset + indent.length, "MISSING_CHAR", message);
+            const message2 = "Block scalars with more-indented leading empty lines must use an explicit indentation indicator";
+            onError(offset + indent.length, "MISSING_CHAR", message2);
           }
           if (header.indent === 0)
             trimIndent = indent.length;
           contentStart = i5;
           if (trimIndent === 0 && !ctx.atRoot) {
-            const message = "Block scalar values in collections must be indented";
-            onError(offset, "BAD_INDENT", message);
+            const message2 = "Block scalar values in collections must be indented";
+            onError(offset, "BAD_INDENT", message2);
           }
           break;
         }
@@ -46242,8 +46242,8 @@ var require_resolve_block_scalar = __commonJS({
           content = content.slice(0, -1);
         if (content && indent.length < trimIndent) {
           const src = header.indent ? "explicit indentation indicator" : "first line";
-          const message = `Block scalar lines must not be less indented than their ${src}`;
-          onError(offset - content.length - (crlf ? 2 : 1), "BAD_INDENT", message);
+          const message2 = `Block scalar lines must not be less indented than their ${src}`;
+          onError(offset - content.length - (crlf ? 2 : 1), "BAD_INDENT", message2);
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
@@ -46321,8 +46321,8 @@ var require_resolve_block_scalar = __commonJS({
             break;
           case "comment":
             if (strict && !hasSpace) {
-              const message = "Comments must be separated from other tokens by white space characters";
-              onError(token, "MISSING_CHAR", message);
+              const message2 = "Comments must be separated from other tokens by white space characters";
+              onError(token, "MISSING_CHAR", message2);
             }
             length += token.source.length;
             comment = token.source.substring(1);
@@ -46333,8 +46333,8 @@ var require_resolve_block_scalar = __commonJS({
             break;
           /* istanbul ignore next should not happen */
           default: {
-            const message = `Unexpected token in block scalar header: ${token.type}`;
-            onError(token, "UNEXPECTED_TOKEN", message);
+            const message2 = `Unexpected token in block scalar header: ${token.type}`;
+            onError(token, "UNEXPECTED_TOKEN", message2);
             const ts = token.source;
             if (ts && typeof ts === "string")
               length += ts.length;
@@ -46588,18 +46588,18 @@ var require_compose_scalar = __commonJS({
     function composeScalar(ctx, token, tagToken, onError) {
       const { value, type, comment, range: range2 } = token.type === "block-scalar" ? resolveBlockScalar.resolveBlockScalar(ctx, token, onError) : resolveFlowScalar.resolveFlowScalar(token, ctx.options.strict, onError);
       const tagName = tagToken ? ctx.directives.tagName(tagToken.source, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg)) : null;
-      let tag;
+      let tag2;
       if (ctx.options.stringKeys && ctx.atKey) {
-        tag = ctx.schema[identity.SCALAR];
+        tag2 = ctx.schema[identity.SCALAR];
       } else if (tagName)
-        tag = findScalarTagByName(ctx.schema, value, tagName, tagToken, onError);
+        tag2 = findScalarTagByName(ctx.schema, value, tagName, tagToken, onError);
       else if (token.type === "scalar")
-        tag = findScalarTagByTest(ctx, value, token, onError);
+        tag2 = findScalarTagByTest(ctx, value, token, onError);
       else
-        tag = ctx.schema[identity.SCALAR];
+        tag2 = ctx.schema[identity.SCALAR];
       let scalar;
       try {
-        const res = tag.resolve(value, (msg) => onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg), ctx.options);
+        const res = tag2.resolve(value, (msg) => onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg), ctx.options);
         scalar = identity.isScalar(res) ? res : new Scalar.Scalar(res);
       } catch (error62) {
         const msg = error62 instanceof Error ? error62.message : String(error62);
@@ -46612,8 +46612,8 @@ var require_compose_scalar = __commonJS({
         scalar.type = type;
       if (tagName)
         scalar.tag = tagName;
-      if (tag.format)
-        scalar.format = tag.format;
+      if (tag2.format)
+        scalar.format = tag2.format;
       if (comment)
         scalar.comment = comment;
       return scalar;
@@ -46622,17 +46622,17 @@ var require_compose_scalar = __commonJS({
       if (tagName === "!")
         return schema[identity.SCALAR];
       const matchWithTest = [];
-      for (const tag of schema.tags) {
-        if (!tag.collection && tag.tag === tagName) {
-          if (tag.default && tag.test)
-            matchWithTest.push(tag);
+      for (const tag2 of schema.tags) {
+        if (!tag2.collection && tag2.tag === tagName) {
+          if (tag2.default && tag2.test)
+            matchWithTest.push(tag2);
           else
-            return tag;
+            return tag2;
         }
       }
-      for (const tag of matchWithTest)
-        if (tag.test?.test(value))
-          return tag;
+      for (const tag2 of matchWithTest)
+        if (tag2.test?.test(value))
+          return tag2;
       const kt = schema.knownTags[tagName];
       if (kt && !kt.collection) {
         schema.tags.push(Object.assign({}, kt, { default: false, test: void 0 }));
@@ -46642,17 +46642,17 @@ var require_compose_scalar = __commonJS({
       return schema[identity.SCALAR];
     }
     function findScalarTagByTest({ atKey, directives, schema }, value, token, onError) {
-      const tag = schema.tags.find((tag2) => (tag2.default === true || atKey && tag2.default === "key") && tag2.test?.test(value)) || schema[identity.SCALAR];
+      const tag2 = schema.tags.find((tag3) => (tag3.default === true || atKey && tag3.default === "key") && tag3.test?.test(value)) || schema[identity.SCALAR];
       if (schema.compat) {
-        const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
-        if (tag.tag !== compat.tag) {
-          const ts = directives.tagString(tag.tag);
+        const compat = schema.compat.find((tag3) => tag3.default && tag3.test?.test(value)) ?? schema[identity.SCALAR];
+        if (tag2.tag !== compat.tag) {
+          const ts = directives.tagString(tag2.tag);
           const cs = directives.tagString(compat.tag);
           const msg = `Value may be parsed as either ${ts} or ${cs}`;
           onError(token, "TAG_RESOLVE_FAILED", msg, true);
         }
       }
-      return tag;
+      return tag2;
     }
     exports.composeScalar = composeScalar;
   }
@@ -46701,20 +46701,20 @@ var require_compose_node = __commonJS({
     var CN = { composeNode, composeEmptyNode };
     function composeNode(ctx, token, props, onError) {
       const atKey = ctx.atKey;
-      const { spaceBefore, comment, anchor: anchor2, tag } = props;
+      const { spaceBefore, comment, anchor: anchor2, tag: tag2 } = props;
       let node2;
       let isSrcToken = true;
       switch (token.type) {
         case "alias":
           node2 = composeAlias(ctx, token, onError);
-          if (anchor2 || tag)
+          if (anchor2 || tag2)
             onError(token, "ALIAS_PROPS", "An alias node must not specify any properties");
           break;
         case "scalar":
         case "single-quoted-scalar":
         case "double-quoted-scalar":
         case "block-scalar":
-          node2 = composeScalar.composeScalar(ctx, token, tag, onError);
+          node2 = composeScalar.composeScalar(ctx, token, tag2, onError);
           if (anchor2)
             node2.anchor = anchor2.source.substring(1);
           break;
@@ -46726,13 +46726,13 @@ var require_compose_node = __commonJS({
             if (anchor2)
               node2.anchor = anchor2.source.substring(1);
           } catch (error62) {
-            const message = error62 instanceof Error ? error62.message : String(error62);
-            onError(token, "RESOURCE_EXHAUSTION", message);
+            const message2 = error62 instanceof Error ? error62.message : String(error62);
+            onError(token, "RESOURCE_EXHAUSTION", message2);
           }
           break;
         default: {
-          const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
-          onError(token, "UNEXPECTED_TOKEN", message);
+          const message2 = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
+          onError(token, "UNEXPECTED_TOKEN", message2);
           isSrcToken = false;
         }
       }
@@ -46741,7 +46741,7 @@ var require_compose_node = __commonJS({
         onError(anchor2, "BAD_ALIAS", "Anchor cannot be an empty string");
       if (atKey && ctx.options.stringKeys && (!identity.isScalar(node2) || typeof node2.value !== "string" || node2.tag && node2.tag !== "tag:yaml.org,2002:str")) {
         const msg = "With stringKeys, all keys must be strings";
-        onError(tag ?? token, "NON_STRING_KEY", msg);
+        onError(tag2 ?? token, "NON_STRING_KEY", msg);
       }
       if (spaceBefore)
         node2.spaceBefore = true;
@@ -46755,14 +46755,14 @@ var require_compose_node = __commonJS({
         node2.srcToken = token;
       return node2;
     }
-    function composeEmptyNode(ctx, offset, before, pos2, { spaceBefore, comment, anchor: anchor2, tag, end: end2 }, onError) {
+    function composeEmptyNode(ctx, offset, before, pos2, { spaceBefore, comment, anchor: anchor2, tag: tag2, end: end2 }, onError) {
       const token = {
         type: "scalar",
         offset: utilEmptyScalarPosition.emptyScalarPosition(offset, before, pos2),
         indent: -1,
         source: ""
       };
-      const node2 = composeScalar.composeScalar(ctx, token, tag, onError);
+      const node2 = composeScalar.composeScalar(ctx, token, tag2, onError);
       if (anchor2) {
         node2.anchor = anchor2.source.substring(1);
         if (node2.anchor === "")
@@ -46888,12 +46888,12 @@ var require_composer = __commonJS({
         this.prelude = [];
         this.errors = [];
         this.warnings = [];
-        this.onError = (source, code, message, warning2) => {
+        this.onError = (source, code, message2, warning2) => {
           const pos2 = getErrorPos(source);
           if (warning2)
-            this.warnings.push(new errors.YAMLWarning(pos2, code, message));
+            this.warnings.push(new errors.YAMLWarning(pos2, code, message2));
           else
-            this.errors.push(new errors.YAMLParseError(pos2, code, message));
+            this.errors.push(new errors.YAMLParseError(pos2, code, message2));
         };
         this.directives = new directives.Directives({ version: options.version || "1.2" });
         this.options = options;
@@ -46963,10 +46963,10 @@ ${cb}` : comment;
           console.dir(token, { depth: null });
         switch (token.type) {
           case "directive":
-            this.directives.add(token.source, (offset, message, warning2) => {
+            this.directives.add(token.source, (offset, message2, warning2) => {
               const pos2 = getErrorPos(token);
               pos2[0] += offset;
-              this.onError(pos2, "BAD_DIRECTIVE", message, warning2);
+              this.onError(pos2, "BAD_DIRECTIVE", message2, warning2);
             });
             this.prelude.push(token.source);
             this.atDirectives = true;
@@ -47055,12 +47055,12 @@ var require_cst_scalar = __commonJS({
     var stringifyString = require_stringifyString();
     function resolveAsScalar(token, strict = true, onError) {
       if (token) {
-        const _onError = (pos2, code, message) => {
+        const _onError = (pos2, code, message2) => {
           const offset = typeof pos2 === "number" ? pos2 : Array.isArray(pos2) ? pos2[0] : pos2.offset;
           if (onError)
-            onError(offset, code, message);
+            onError(offset, code, message2);
           else
-            throw new errors.YAMLParseError([offset, offset + 1], code, message);
+            throw new errors.YAMLParseError([offset, offset + 1], code, message2);
         };
         switch (token.type) {
           case "scalar":
@@ -48220,8 +48220,8 @@ var require_parser = __commonJS({
         }
         const type = cst.tokenType(source);
         if (!type) {
-          const message = `Not a YAML token: ${source}`;
-          yield* this.pop({ type: "error", offset: this.offset, message, source });
+          const message2 = `Not a YAML token: ${source}`;
+          yield* this.pop({ type: "error", offset: this.offset, message: message2, source });
           this.offset += source.length;
         } else if (type === "scalar") {
           this.atNewLine = false;
@@ -48311,8 +48311,8 @@ var require_parser = __commonJS({
       *pop(error62) {
         const token = error62 ?? this.stack.pop();
         if (!token) {
-          const message = "Tried to pop an empty stack";
-          yield { type: "error", offset: this.offset, source: "", message };
+          const message2 = "Tried to pop an empty stack";
+          yield { type: "error", offset: this.offset, source: "", message: message2 };
         } else if (this.stack.length === 0) {
           yield token;
         } else {
@@ -50587,8 +50587,8 @@ function prefixIssues(path, issues) {
     return iss;
   });
 }
-function unwrapMessage(message) {
-  return typeof message === "string" ? message : message?.message;
+function unwrapMessage(message2) {
+  return typeof message2 === "string" ? message2 : message2?.message;
 }
 function attachSchema(issues, start, inst) {
   var _a4;
@@ -50606,7 +50606,7 @@ function finalizeIssue(iss, ctx, config2) {
       iss.schema = iss.inst;
   }
   const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;
-  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
+  const message2 = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
   const full = {};
   for (const k5 of Object.keys(iss)) {
     if (k5 === "inst" || k5 === "schema" || k5 === "continue" || k5 === "input" || k5 === "__proto__")
@@ -50614,7 +50614,7 @@ function finalizeIssue(iss, ctx, config2) {
     full[k5] = iss[k5];
   }
   full.path ?? (full.path = []);
-  full.message = message;
+  full.message = message2;
   if (ctx?.reportInput) {
     full.input = iss.input;
   }
@@ -50729,16 +50729,16 @@ var Class = class {
   constructor(..._args) {
   }
 };
-function members(proto, table) {
-  for (const key in table) {
-    const desc = Object.getOwnPropertyDescriptor(table, key);
+function members(proto, table2) {
+  for (const key in table2) {
+    const desc = Object.getOwnPropertyDescriptor(table2, key);
     if (desc.get)
       Object.defineProperty(proto, key, { ...desc, enumerable: false });
     else
       defineBound(proto, key, desc.value);
   }
-  for (const sym of Object.getOwnPropertySymbols(table)) {
-    defineBound(proto, sym, table[sym]);
+  for (const sym of Object.getOwnPropertySymbols(table2)) {
+    defineBound(proto, sym, table2[sym]);
   }
 }
 function own(inst, key, value, enumerable = true) {
@@ -50749,10 +50749,10 @@ function hide(inst, key, value) {
   return own(inst, key, value, false);
 }
 // @__NO_SIDE_EFFECTS__
-function derived(computes, table) {
+function derived(computes, table2) {
   for (const key in computes) {
     const compute = computes[key];
-    Object.defineProperty(table, key, {
+    Object.defineProperty(table2, key, {
       configurable: true,
       enumerable: true,
       get() {
@@ -50763,7 +50763,7 @@ function derived(computes, table) {
       }
     });
   }
-  return table;
+  return table2;
 }
 function defineBound(proto, key, fn) {
   Object.defineProperty(proto, key, {
@@ -52897,7 +52897,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const catchall = def.catchall;
   let value;
   const memo2 = globalConfig.memoizer;
@@ -52905,7 +52905,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   inst._zod.parse = (payload2, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload2.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload2.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -53041,7 +53041,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return doc.compile();
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -53050,7 +53050,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload2, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload2.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload2.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -62151,8 +62151,8 @@ var globalRegistry = globalThis.__zod_globalRegistry;
 var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
 var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
-  constructor(message = "z.compile does not support async refinements, transforms, or checks") {
-    super(message);
+  constructor(message2 = "z.compile does not support async refinements, transforms, or checks") {
+    super(message2);
     this.name = "ZodCompileAsyncError";
   }
 };
@@ -64855,12 +64855,12 @@ function initializeContext(params) {
     external: params?.external ?? void 0
   };
 }
-function handleUnrepresentable(schema, ctx, json2, params, message) {
-  const result = typeof ctx.unrepresentable === "function" ? ctx.unrepresentable({ zodSchema: schema, path: params.path, message }) : ctx.unrepresentable;
+function handleUnrepresentable(schema, ctx, json2, params, message2) {
+  const result = typeof ctx.unrepresentable === "function" ? ctx.unrepresentable({ zodSchema: schema, path: params.path, message: message2 }) : ctx.unrepresentable;
   if (result === "any")
     return false;
   if (result === void 0 || result === "throw")
-    throw new Error(message);
+    throw new Error(message2);
   Object.assign(json2, result);
   return true;
 }
@@ -68743,21 +68743,21 @@ function visit(schema, fnOrHandlers) {
     const h5 = fnOrHandlers[node2._zod.def.type];
     return h5 ? h5(node2, rewritten) : node2;
   };
-  const cache5 = /* @__PURE__ */ new Map();
+  const cache6 = /* @__PURE__ */ new Map();
   function run(s2) {
-    const cached2 = cache5.get(s2);
+    const cached2 = cache6.get(s2);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache5.get(s2)
+        getter: () => cache6.get(s2)
       });
     }
     if (cached2 !== void 0)
       return cached2;
-    cache5.set(s2, RESOLVING);
+    cache6.set(s2, RESOLVING);
     const inner = mapInner(s2);
     const mapped = fn(inner, inner !== s2);
-    cache5.set(s2, mapped);
+    cache6.set(s2, mapped);
     return mapped;
   }
   function mapInner(s2) {
@@ -69218,14 +69218,14 @@ var boardSchema = external_exports.object({
     });
   })
 });
-var authSchema = external_exports.object({
+var authSchema = external_exports.strictObject({
   issuer: external_exports.url(),
-  /** Absent in gateway mode — the gateway does the flow, the proxy still validates. */
-  client_id: external_exports.string().min(1).optional(),
-  allow: external_exports.object({
-    groups: external_exports.array(external_exports.string().min(1)).optional(),
-    subjects: external_exports.array(external_exports.string().min(1)).optional()
-  }).optional()
+  /** Browser SPA client id. It is public, unlike every source credential. */
+  client_id: external_exports.string().min(1),
+  /** The separately registered API resource accepted by the dashboard proxy. */
+  audience: external_exports.string().min(1),
+  /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
+  allow: external_exports.strictObject({ subjects: external_exports.array(external_exports.string().min(1)).min(1) })
 });
 var boardConfigSchema = external_exports.object({
   sources: external_exports.record(external_exports.string().min(1), sourceSchema).default({}),
@@ -69310,7 +69310,8 @@ var clientEnvSchema = external_exports.object({
   /** Omitted entirely when unauthenticated — presence is what turns auth on. */
   auth: external_exports.object({
     issuer: external_exports.string().min(1),
-    clientId: external_exports.string().min(1).optional()
+    clientId: external_exports.string().min(1),
+    audience: external_exports.string().min(1)
   }).optional()
 });
 var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: external_exports.string().min(1) });
@@ -70668,8 +70669,8 @@ function errorResponse2(kind, error62, panel, response) {
 
 // packages/server/src/configuration-error.ts
 var ConfigurationError = class extends Error {
-  constructor(message, diagnostics) {
-    super(message);
+  constructor(message2, diagnostics) {
+    super(message2);
     this.diagnostics = diagnostics;
   }
   diagnostics;
@@ -71016,13 +71017,13 @@ var getPattern = (label, next) => {
   }
   return null;
 };
-var tryDecode = (str, decoder) => {
+var tryDecode = (str, decoder2) => {
   try {
-    return decoder(str);
+    return decoder2(str);
   } catch {
     return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match2) => {
       try {
-        return decoder(match2);
+        return decoder2(match2);
       } catch {
         return match2;
       }
@@ -72973,6 +72974,762 @@ function safeOrigin(value) {
   }
 }
 
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder2 = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf2 = new Uint8Array(size);
+  let i5 = 0;
+  for (const buffer of buffers)
+    buf2.set(buffer, i5), i5 += buffer.length;
+  return buf2;
+}
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode3(string4) {
+  if (typeof string4 == "string" && string4.length >= 128) {
+    if (NON_ASCII.test(string4))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder2.encode(string4);
+  }
+  const bytes = new Uint8Array(string4.length);
+  for (let i5 = 0; i5 < string4.length; i5++) {
+    const code = string4.charCodeAt(i5);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i5] = code;
+  }
+  return bytes;
+}
+function decodeBase642(encoded, url2 = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url2 ? "base64url" : "base64" });
+  if (url2) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i5 = 0; i5 < binary.length; i5++)
+    bytes[i5] = binary.charCodeAt(i5);
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message2, options) {
+    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload2, claim2 = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim: claim2, reason, payload: payload2 } }), this.claim = claim2, this.reason = reason, this.payload = payload2;
+  }
+};
+var JWTExpired = class extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload2, claim2 = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim: claim2, reason, payload: payload2 } }), this.claim = claim2, this.reason = reason, this.payload = payload2;
+  }
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+var JWKSInvalid = class extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+};
+var JWKSNoMatchingKey = class extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSMultipleMatchingKeys = class extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSTimeout = class extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message2 = "request timed out", options) {
+    super(message2, options);
+  }
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message2 = "signature verification failed", options) {
+    super(message2, options);
+  }
+};
+
+// node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode3(input2) {
+  try {
+    return decodeBase642(typeof input2 == "string" ? input2 : decoder.decode(input2), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+
+// node_modules/jose/dist/webapi/lib/validate.js
+function isObject2(input2) {
+  if (typeof input2 != "object" || input2 === null || Object.prototype.toString.call(input2) !== "[object Object]")
+    return false;
+  const prototype = Object.getPrototypeOf(input2);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input2) {
+  return isObject2(input2) && Array.isArray(input2.keys) && Array.from(input2.keys).every(isObject2);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode3(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode3(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode3(b64)));
+  } catch {
+    throw new ErrorClass(message2);
+  }
+  if (!isObject2(parsed))
+    throw new ErrorClass(message2);
+  return parsed;
+}
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s2) => typeof s2 != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input2) => typeof input2 != "string" || input2.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return true;
+}
+
+// node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag];
+var jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject2(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode3(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache5 ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached2 = cache5.get(cacheKey);
+  if (cached2?.[alg])
+    return cached2[alg];
+  if (cached2 || cache5.set(cacheKey, cached2 = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached2[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached2[alg] = await jwkToKey(entry, normalized);
+}
+var cache5;
+var nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation2) => typeof operation2 != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+
+// node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+
+// node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle2 = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle: subtle2, signing: subtle2, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle2 = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle: subtle2,
+    signing: saltLength ? { ...subtle2, saltLength } : subtle2,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle2 = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle: subtle2,
+    signing: subtle2,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle2 = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle: subtle2,
+    signing: subtle2,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+
+// node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload2) {
+  try {
+    return encode3(payload2);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = false;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode3(encodedProtected) : new Uint8Array(), encode3("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k5 = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k5, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k5 }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload2, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload: payload2, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+
+// node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date6) => Math.floor(date6.getTime() / 1e3);
+var multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+};
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input2) {
+  if (!Number.isFinite(input2))
+    throw new TypeError(`Invalid ${label} input`);
+  return input2;
+}
+var normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
+function validateNumericDate(payload2, claim2, required2 = false) {
+  const value = payload2[claim2];
+  if (!(value === void 0 && !required2)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload2, claim2, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload2, claim2) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim2}" claim value`, payload2, claim2, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload2;
+  try {
+    payload2 = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject2(payload2))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload2, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim2 of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload2, claim2))
+      throw new JWTClaimValidationFailed(`missing required "${claim2}" claim`, payload2, claim2, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload2.iss) && unexpectedClaim(payload2, "iss"), subject !== void 0 && payload2.sub !== subject && unexpectedClaim(payload2, "sub"), audience !== void 0 && !checkAudiencePresence(payload2.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload2, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload2, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload2, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload2, "nbf", checkFailed);
+  const exp = validateNumericDate(payload2, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload2, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload2, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload2, "iat", checkFailed);
+  }
+  return payload2;
+}
+
+// node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt2, key, options) {
+  const [verified, b64] = await verifyCompact(jwt2, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload2 = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload: payload2 };
+}
+
+// node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation2, index) => typeof operation2 == "string" && keyOps.indexOf(operation2) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache6, jwk, entry) {
+  const cached2 = cache6.get(jwk) || cache6.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached2[alg] === void 0) {
+    const pending2 = jwkToKey(entry, jwk, true).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached2[alg] = key, key;
+    }).catch((error62) => {
+      throw cached2[alg] === pending2 && delete cached2[alg], error62;
+    });
+    cached2[alg] = pending2;
+  }
+  return cached2[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached2 = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error62 = new JWKSMultipleMatchingKeys();
+      throw error62[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached2, jwk2, entry);
+          } catch {
+          }
+      }, error62;
+    }
+    return importWithAlgCache(cached2, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+
+// node_modules/jose/dist/webapi/jwks/remote.js
+function isCloudflareWorkers() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+var USER_AGENT2;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT2 = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url2, headers, signal, fetchImpl = fetch) {
+  const response = await fetchImpl(url2, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+var jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp4, duration3) {
+  return Number.isFinite(timestamp4) && Date.now() < timestamp4 + duration3;
+}
+function validateDuration(value, fallback2, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback2;
+}
+function createRemoteJWKSet(url2, options) {
+  if (!(url2 instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url2.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT2 && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT2), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache6 = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache6 && typeof cache6 == "object") {
+    const { uat, jwks } = cache6;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json2) => {
+        const next = createLocalJWKSet(json2);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache6 && (cache6.uat = updatedAt, cache6.jwks = json2), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
+    }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
+    }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: true
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: true
+    },
+    reload: {
+      value: reload,
+      enumerable: true
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: true
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: true
+    }
+  });
+}
+
+// packages/server/src/oidc-auth.ts
+async function createAccessTokenVerifier(auth, fetcher = globalThis.fetch) {
+  const configuredIssuer = auth.issuer.replace(/\/$/, "");
+  const discovery = await fetchJson(`${configuredIssuer}/.well-known/openid-configuration`, fetcher);
+  if (typeof discovery.issuer !== "string" || discovery.issuer.replace(/\/$/, "") !== configuredIssuer || typeof discovery.jwks_uri !== "string") {
+    throw new Error("OIDC discovery must name the configured issuer and a JWKS URI.");
+  }
+  const issuer = discovery.issuer;
+  let jwksUrl;
+  try {
+    jwksUrl = new URL(discovery.jwks_uri);
+  } catch {
+    throw new Error("OIDC discovery returned an invalid JWKS URI.");
+  }
+  const keys = createRemoteJWKSet(jwksUrl, { [customFetch]: fetcher });
+  return async (token) => {
+    const { payload: payload2 } = await jwtVerify(token, keys, { issuer, audience: auth.audience });
+    if (typeof payload2.sub !== "string" || !payload2.sub)
+      throw new Error("Access token has no subject.");
+    if (!auth.allow.subjects.includes(payload2.sub)) {
+      const error62 = new Error("Authenticated subject is not allowed to view this dashboard.");
+      error62.name = "UnauthorizedSubjectError";
+      throw error62;
+    }
+    return { subject: payload2.sub };
+  };
+}
+async function fetchJson(url2, fetcher) {
+  const response = await fetcher(url2);
+  if (!response.ok) throw new Error(`OIDC discovery request failed: ${response.status}`);
+  try {
+    return await response.json();
+  } catch {
+    throw new Error("OIDC discovery did not return JSON.");
+  }
+}
+function unauthorizedSubject(error62) {
+  return error62 instanceof Error && error62.name === "UnauthorizedSubjectError";
+}
+
 // packages/server/src/template.ts
 var ASSET_PATH_SENTINEL = "/__ASSET_PATH__";
 var TemplateFetchError = class extends Error {
@@ -73068,6 +73825,23 @@ function createApp(deps) {
     await next();
     c5.header("x-dashboard-request-id", id);
   });
+  app.use("/api/*", async (c5, next) => {
+    if (!deps.boardConfig?.auth) return next();
+    if (!deps.accessTokenVerifier)
+      return c5.json({ error: "Authentication verification is unavailable." }, 503);
+    const authorization = c5.req.header("authorization");
+    if (!authorization?.startsWith("Bearer "))
+      return c5.json({ error: "Authentication required." }, 401);
+    try {
+      await deps.accessTokenVerifier(authorization.slice("Bearer ".length));
+    } catch (error62) {
+      return c5.json(
+        { error: unauthorizedSubject(error62) ? "Access denied." : "Invalid access token." },
+        unauthorizedSubject(error62) ? 403 : 401
+      );
+    }
+    return next();
+  });
   app.onError((_error, c5) => {
     const id = c5.get("dashboardRequestId");
     logger2.log({
@@ -73380,7 +74154,14 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
       assetPath: config2.assetPath,
       assetPathId: diagnosticContext.configuredAssetPathId,
       proxyPath: config2.proxyPath,
-      board
+      board,
+      ...deps.boardConfig?.auth ? {
+        auth: {
+          issuer: deps.boardConfig.auth.issuer,
+          clientId: deps.boardConfig.auth.client_id,
+          audience: deps.boardConfig.auth.audience
+        }
+      } : {}
     };
     return new Response(renderIndexHtml(template, env2), {
       headers: {
@@ -73503,6 +74284,8 @@ async function startup(options = {}) {
       secretReference: config2.secretReference,
       credentialNames
     });
+    category = "authentication";
+    const accessTokenVerifier = boardConfig.auth ? await createAccessTokenVerifier(boardConfig.auth, fetcher) : void 0;
     category = "unknown";
     warnAboutMissingAuth(resolvedConfig, logger2);
     return {
@@ -73512,7 +74295,8 @@ async function startup(options = {}) {
         boardConfig,
         allowlist,
         credentials,
-        logger: logger2
+        logger: logger2,
+        accessTokenVerifier
       }),
       config: resolvedConfig
     };