@deploybaseline/microsoft 0.0.0-stage → 0.14.1

package/dist/chunk-G7326MH2.js

@@ -0,0 +1,3837 @@
+// ../core/dist/index.js
+import { timingSafeEqual } from "crypto";
+import { createPublicKey } from "crypto";
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
+}
+var NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase64(input, url = false) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = false) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/errors.js
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message2, options) {
+    super(message2, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+};
+var JWTExpired = class extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWSInvalid = class extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message2 = "signature verification failed", options) {
+    super(message2, options);
+  }
+};
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+function encode2(input) {
+  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, true);
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/validate.js
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return false;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return false;
+        parameters.add(parameter);
+      }
+  return true;
+}
+function assertNotSet(value, name) {
+  if (value !== void 0)
+    throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message2);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message2);
+  return parsed;
+}
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCritDuplicates(Err, protectedHeader) {
+  const { crit } = protectedHeader ?? {};
+  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return true;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized, parsed;
+  try {
+    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed))
+    throw new Err("JOSE Header is not a JSON object");
+  return [parsed, serialized];
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag];
+var jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+var cache;
+var nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = false) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+var wrap = [
+  ["encrypt", "wrapKey"],
+  ["decrypt", "unwrapKey"]
+];
+var derive = [[], ["deriveBits"]];
+var none = [[], []];
+function rsaes(bits) {
+  return {
+    kty: ["RSA"],
+    mode: "key-encryption",
+    subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
+    usages: wrap,
+    ops: ["wrapKey", "unwrapKey"]
+  };
+}
+function ecdh(mode) {
+  return {
+    kty: ["EC", "OKP"],
+    mode,
+    subtle: { name: "ECDH" },
+    resolve: ({ kty, crv, asymmetricKeyType }) => {
+      if (crv === "X25519" || asymmetricKeyType === "x25519")
+        return { name: "X25519" };
+      if (kty === "OKP")
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      return { name: "ECDH", namedCurve: crv };
+    },
+    usages: derive,
+    ops: [void 0, "deriveBits"]
+  };
+}
+function aeskw(bits, gcm = false) {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
+    usages: none,
+    ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
+  };
+}
+function pbes2() {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: true,
+    subtle: { name: "PBKDF2" },
+    usages: none,
+    ops: ["deriveBits", "deriveBits"]
+  };
+}
+var JWE = table({
+  dir: {
+    kty: ["oct"],
+    mode: "direct-encryption",
+    secret: true,
+    subtle: { name: "AES-GCM" },
+    usages: none,
+    ops: ["encrypt", "decrypt"]
+  },
+  "RSA-OAEP": rsaes(1),
+  "RSA-OAEP-256": rsaes(256),
+  "RSA-OAEP-384": rsaes(384),
+  "RSA-OAEP-512": rsaes(512),
+  "ECDH-ES": ecdh("direct-key-agreement"),
+  "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
+  A128KW: aeskw(128),
+  A192KW: aeskw(192),
+  A256KW: aeskw(256),
+  A128GCMKW: aeskw(128, true),
+  A192GCMKW: aeskw(192, true),
+  A256GCMKW: aeskw(256, true),
+  "PBES2-HS256+A128KW": pbes2(),
+  "PBES2-HS384+A192KW": pbes2(),
+  "PBES2-HS512+A256KW": pbes2()
+});
+var contentOps = ["encrypt", "decrypt"];
+function contentEncryption(bits, cbc = false) {
+  return {
+    kty: ["oct"],
+    secret: true,
+    subtle: { name: cbc ? "AES-CBC" : "AES-GCM", length: bits },
+    usages: none,
+    ops: contentOps,
+    cekBits: bits,
+    ivBits: cbc ? 128 : 96,
+    cbc
+  };
+}
+var ENC = table({
+  A128GCM: contentEncryption(128),
+  A192GCM: contentEncryption(192),
+  A256GCM: contentEncryption(256),
+  "A128CBC-HS256": contentEncryption(256, true),
+  "A192CBC-HS384": contentEncryption(384, true),
+  "A256CBC-HS512": contentEncryption(512, true)
+});
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = false;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = false;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3);
+var multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+};
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+function validateStringClaim(claim, value) {
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
+}
+function numericDate(value, label) {
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
+}
+var normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
+function validateNumericDate(payload, claim, required = false) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+var producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+var JWTClaimsBuilder = class {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
+};
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_sign.js
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    protectedHeader = normalized[0], protectedHeaderString = encode2(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  if (!isDisjoint(protectedHeader, unprotectedHeader))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
+  if (b64) {
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= encode2(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = encode2(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
+  const jws = {
+    signature: encode2(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
+    payload: payloadS
+  };
+  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+}
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/jwt/sign.js
+var SignJWT_base = JWTClaimsBuilder;
+var SignJWT = class extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
+};
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_algorithm.js
+var algArgument = '"alg" (Algorithm)';
+function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+function keyAlgorithm(alg, source) {
+  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/lib/asn1.js
+var bytesEqual = (a, b) => {
+  if (a.byteLength !== b.length)
+    return false;
+  for (let i = 0; i < a.byteLength; i++)
+    if (a[i] !== b[i])
+      return false;
+  return true;
+};
+var createASN1State = (data) => ({ data, pos: 0 });
+var readByte = (state) => {
+  const byte = state.data[state.pos++];
+  if (byte === void 0)
+    throw new Error("Unexpected end of ASN.1 input");
+  return byte;
+};
+var parseLength = (state) => {
+  const first = readByte(state);
+  if (first & 128) {
+    const lengthOfLen = first & 127;
+    let length = 0;
+    for (let i = 0; i < lengthOfLen; i++)
+      length = length << 8 | readByte(state);
+    return length;
+  }
+  return first;
+};
+var skipElement = (state, count = 1) => {
+  for (; count-- > 0; ) {
+    state.pos++;
+    const length = parseLength(state);
+    state.pos += length;
+  }
+};
+var expectTag = (state, expectedTag, errorMessage) => {
+  if (readByte(state) !== expectedTag)
+    throw new Error(errorMessage);
+};
+var getSubarray = (state, length) => {
+  if (length < 0 || state.pos + length > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  const result = state.data.subarray(state.pos, state.pos + length);
+  return state.pos += length, result;
+};
+var parseAlgorithmOID = (state) => {
+  expectTag(state, 6, "Expected algorithm OID");
+  const oidLen = parseLength(state);
+  return getSubarray(state, oidLen);
+};
+function parseKeyHeader(state, keyFormat) {
+  if (expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`), parseLength(state), keyFormat === "pkcs8") {
+    expectTag(state, 2, "Expected version field");
+    const length = parseLength(state);
+    state.pos += length;
+  }
+  expectTag(state, 48, "Expected algorithm identifier"), parseLength(state);
+}
+var parseECAlgorithmIdentifier = (state) => {
+  const algOid = parseAlgorithmOID(state);
+  if (bytesEqual(algOid, [43, 101, 110]))
+    return "X25519";
+  if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1]))
+    throw new Error("Unsupported key algorithm");
+  expectTag(state, 6, "Expected curve OID");
+  const curveOidLen = parseLength(state), curveOid = getSubarray(state, curveOidLen);
+  if (bytesEqual(curveOid, [42, 134, 72, 206, 61, 3, 1, 7]))
+    return "P-256";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 34]))
+    return "P-384";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 35]))
+    return "P-521";
+  throw new Error("Unsupported named curve");
+};
+var genericImport = async (keyFormat, keyData, alg, options) => {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  const isPublic = keyFormat === "spki";
+  let algorithm;
+  if (entry.resolve)
+    try {
+      const state = createASN1State(keyData);
+      parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
+    } catch {
+      throw new JOSENotSupported("Invalid or unsupported key format");
+    }
+  else
+    algorithm = entry.subtle;
+  return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
+};
+var processPEMData = (pem, pattern) => decodeBase64(pem.replace(pattern, ""));
+function spkiFromX509(buf) {
+  const state = createASN1State(buf);
+  expectTag(state, 48, "Invalid certificate structure");
+  const certificateLength = parseLength(state);
+  if (certificateLength < 0 || state.pos + certificateLength > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  expectTag(state, 48, "Invalid tbsCertificate structure"), parseLength(state), buf[state.pos] === 160 ? skipElement(state, 6) : skipElement(state, 5);
+  const spkiStart = state.pos;
+  expectTag(state, 48, "Invalid SPKI structure");
+  const spkiContentLen = parseLength(state);
+  return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
+}
+var fromX509 = (pem, alg, options) => {
+  let spki;
+  try {
+    const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
+    spki = spkiFromX509(certificate);
+  } catch (cause) {
+    throw new TypeError("Failed to parse the X.509 certificate", { cause });
+  }
+  return genericImport("spki", spki, alg, options);
+};
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/key/import.js
+async function importX509(x509, alg, options) {
+  if (typeof x509 != "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0)
+    throw new TypeError('"x509" must be X.509 formatted string');
+  return fromX509(x509, alg, options);
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_protected_header.js
+function decodeProtectedHeader(token) {
+  let protectedB64u;
+  if (typeof token == "string") {
+    const parts = token.split(".");
+    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+  } else if (typeof token == "object" && token)
+    if ("protected" in token)
+      protectedB64u = token.protected;
+    else
+      throw new TypeError("Token does not contain a Protected Header");
+  const invalid2 = "Invalid Token or Protected Header formatting";
+  if (typeof protectedB64u != "string" || !protectedB64u)
+    throw new TypeError(invalid2);
+  return parseJoseHeader(protectedB64u, TypeError, invalid2);
+}
+
+// ../../../node_modules/.pnpm/jose@6.2.12/node_modules/jose/dist/webapi/util/decode_jwt.js
+function decodeJwt(jwt) {
+  if (typeof jwt != "string")
+    throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+  const { 1: payload, length } = jwt.split(".");
+  if (length === 5)
+    throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+  if (length !== 3)
+    throw new JWTInvalid("Invalid JWT");
+  if (!payload)
+    throw new JWTInvalid("JWTs must contain a payload");
+  let decoded;
+  try {
+    decoded = decode(payload);
+  } catch {
+    throw new JWTInvalid("Failed to base64url decode the payload");
+  }
+  let result;
+  try {
+    result = JSON.parse(strictDecoder.decode(decoded));
+  } catch {
+    throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+  }
+  if (!isObject(result))
+    throw new JWTInvalid("Invalid JWT Claims Set");
+  return result;
+}
+
+// ../core/dist/index.js
+import { readFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { fileURLToPath } from "url";
+import { appendFileSync, mkdirSync } from "fs";
+import { createServer as createNodeServer } from "http";
+import { join as join3 } from "path";
+import { threadId } from "worker_threads";
+import { createHmac as createHmac2, sign as signData, timingSafeEqual as timingSafeEqual3, verify as verifyData } from "crypto";
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey as createPublicKey2,
+  generateKeyPair
+} from "crypto";
+import { readFileSync as readFileSync3 } from "fs";
+function resolveBaseUrl(opts) {
+  if (opts.seedBaseUrl) {
+    return opts.seedBaseUrl.replace(/\{service\}/g, opts.service);
+  }
+  if (opts.baseUrl) {
+    return opts.baseUrl.replace(/\{service\}/g, opts.service);
+  }
+  const envBaseUrl = process.env.BASELINE_BASE_URL;
+  if (envBaseUrl) {
+    return envBaseUrl.replace(/\{service\}/g, opts.service);
+  }
+  return `http://localhost:${opts.port}`;
+}
+function composeService(options) {
+  const { name, modules } = options;
+  const owners = /* @__PURE__ */ new Map();
+  const moduleNames = /* @__PURE__ */ new Set();
+  for (const module of modules) {
+    if (moduleNames.has(module.name)) {
+      throw new Error(`${name}: module ${module.name} is listed twice`);
+    }
+    moduleNames.add(module.name);
+    for (const collection of module.collections ?? []) {
+      if (!collection.includes(".")) {
+        throw new Error(
+          `${name}/${module.name}: collection "${collection}" must be namespaced, e.g. "${module.name}.${collection}"`
+        );
+      }
+      const owner = owners.get(collection);
+      if (owner) {
+        throw new Error(`${name}: modules ${owner} and ${module.name} both own collection "${collection}"`);
+      }
+      owners.set(collection, module.name);
+    }
+  }
+  let routes = /* @__PURE__ */ new Map();
+  return {
+    name,
+    modules,
+    moduleRoutes: () => routes,
+    register(app, store, webhooks, baseUrl, tokenMap) {
+      const registered = /* @__PURE__ */ new Map();
+      const routeOwner = /* @__PURE__ */ new Map();
+      for (const module of modules) {
+        const before = app.routeTable.length;
+        const operationsBefore = app.operationTable.length;
+        const upgradesBefore = app.upgradeTable.length;
+        module.register({ app, store: guardedStore(store, name, module.name, owners), webhooks, baseUrl, tokenMap });
+        const added = [
+          ...app.routeTable.slice(before).map((route) => `${route.method} ${route.path}`),
+          ...app.upgradeTable.slice(upgradesBefore).map((path) => `WS ${path}`),
+          ...app.operationTable.slice(operationsBefore)
+        ];
+        for (const route of added) {
+          const owner = routeOwner.get(route);
+          if (owner) {
+            throw new Error(`${name}: modules ${owner} and ${module.name} both register ${route}`);
+          }
+          routeOwner.set(route, module.name);
+        }
+        registered.set(module.name, added);
+      }
+      routes = registered;
+    },
+    seed(store, baseUrl) {
+      for (const module of modules) {
+        module.seed?.({ store: guardedStore(store, name, module.name, owners), baseUrl });
+      }
+    }
+  };
+}
+function guardedStore(store, service, module, owners) {
+  return new Proxy(store, {
+    get(target, property, receiver) {
+      if (property !== "collection") {
+        const value = Reflect.get(target, property, receiver);
+        return typeof value === "function" ? value.bind(target) : value;
+      }
+      return (collection, indexFields) => {
+        if (!(target.hasCollection(collection) || owners.has(collection))) {
+          throw new Error(
+            `${service}/${module}: creates collection "${collection}" without declaring it in collections`
+          );
+        }
+        return target.collection(collection, indexFields);
+      };
+    }
+  });
+}
+var TRAILING_SLASHES = /\/+$/;
+function normalizeUri(uri) {
+  try {
+    const u = new URL(uri);
+    return `${u.origin}${u.pathname.replace(TRAILING_SLASHES, "")}`;
+  } catch {
+    return uri.replace(TRAILING_SLASHES, "").split("?")[0];
+  }
+}
+function matchesRedirectUri(incoming, registered) {
+  const normalized = normalizeUri(incoming);
+  return registered.some((r) => normalizeUri(r) === normalized);
+}
+function constantTimeSecretEqual(a, b) {
+  const bufA = Buffer.from(a, "utf-8");
+  const bufB = Buffer.from(b, "utf-8");
+  if (bufA.length !== bufB.length) {
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+function bodyStr(v) {
+  if (typeof v === "string") {
+    return v;
+  }
+  if (Array.isArray(v) && typeof v[0] === "string") {
+    return v[0];
+  }
+  return "";
+}
+var isDebug = typeof process !== "undefined" && (process.env.DEBUG === "1" || process.env.DEBUG === "true" || process.env.BASELINE_DEBUG === "1");
+function debug(label, ...args) {
+  if (isDebug) {
+    console.log(`[${label}]`, ...args);
+  }
+}
+var AUTH_SCHEME_PREFIX = /^(Bearer|token)\s+/i;
+function serializeTokenMap(tokenMap) {
+  return [...tokenMap.entries()].map(([token, user]) => ({
+    token,
+    login: user.login,
+    id: user.id,
+    scopes: user.scopes,
+    ...user.installation ? { installation: user.installation } : {}
+  }));
+}
+function restoreTokenMap(tokenMap, tokens) {
+  tokenMap.clear();
+  for (const t of tokens) {
+    tokenMap.set(t.token, {
+      login: t.login,
+      id: t.id,
+      scopes: t.scopes,
+      ...t.installation ? { installation: t.installation } : {}
+    });
+  }
+}
+function authMiddleware(tokens, appKeyResolver, fallbackUser) {
+  return async (c, next) => {
+    const authHeader = c.req.header("Authorization");
+    if (authHeader) {
+      const token = authHeader.replace(AUTH_SCHEME_PREFIX, "").trim();
+      if (token.startsWith("eyJ") && appKeyResolver) {
+        try {
+          const [, payloadB64] = token.split(".");
+          const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+          const appId = typeof payload.iss === "string" ? Number.parseInt(payload.iss, 10) : payload.iss;
+          if (typeof appId === "number" && !Number.isNaN(appId)) {
+            const appInfo = appKeyResolver(appId);
+            if (appInfo) {
+              const publicKey = createPublicKey(appInfo.privateKey);
+              await jwtVerify(token, publicKey, { algorithms: ["RS256"] });
+              c.set("authApp", {
+                appId,
+                slug: appInfo.slug,
+                name: appInfo.name
+              });
+            }
+          }
+        } catch {
+        }
+      } else {
+        let user = tokens.get(token);
+        if (!user && fallbackUser && token.length > 0) {
+          debug("auth", "fallback user for unknown token", { login: fallbackUser.login, id: fallbackUser.id });
+          user = { login: fallbackUser.login, id: fallbackUser.id, scopes: fallbackUser.scopes };
+        }
+        if (user) {
+          c.set("authUser", user);
+          c.set("authToken", token);
+          c.set("authScopes", user.scopes);
+        }
+      }
+    }
+    await next();
+  };
+}
+var SDK_VERSION = true ? "0.14.0" : "dev";
+var STATE_WRITER = `@deploybaseline/core@${SDK_VERSION}`;
+function captureServiceState(target, stateVersion) {
+  return {
+    stateVersion,
+    store: target.store.snapshot(),
+    tokens: serializeTokenMap(target.tokenMap),
+    webhooks: target.webhooks.snapshot()
+  };
+}
+function restoreServiceState(target, state) {
+  target.store.restore(state.store);
+  restoreTokenMap(target.tokenMap, state.tokens);
+  target.webhooks.restore(state.webhooks);
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function escapeAttr(s) {
+  return escapeHtml(s).replace(/'/g, "&#39;");
+}
+var CSS = `
+.inspector-json{white-space:pre-wrap;overflow-wrap:anywhere;font-size:.8125rem;line-height:1.6;max-height:70vh;overflow:auto}
+.inspector-detail{padding:14px 0;border-bottom:1px solid #0a3300}
+.inspector-detail summary{cursor:pointer;overflow-wrap:anywhere}
+.email-preview{width:100%;min-height:300px;border:1px solid #0a3300;border-radius:8px;background:#fff;margin-top:10px}
+.email-text{white-space:pre-wrap;overflow-wrap:anywhere}
+.inspector-action{display:inline-block;margin-top:12px;padding:8px 12px;border:1px solid #0a3300;border-radius:6px;background:#001a00;color:#33ff00;font:inherit;font-size:.8125rem;cursor:pointer}
+.inspector-action:hover{background:#0a3300}
+.inspector-scroll{overflow-x:auto}
+.inspector-inline-form{display:inline-flex;gap:8px;align-items:center;margin:0}
+.inspector-inline-form .inspector-action,.inspector-inline-form .btn-revoke{margin-top:0}
+.inspector-actions{display:flex;flex-wrap:wrap;gap:8px;align-items:center;margin-top:12px}
+.inspector-actions .inspector-action,.inspector-actions .inspector-input{margin-top:0}
+a.inspector-action{text-decoration:none}
+.inspector-actions .btn-revoke{padding:8px 12px;font-size:.8125rem;font-weight:400}
+td .inspector-actions{margin-top:0}
+.inspector-input{padding:8px 10px;border:1px solid #0a3300;border-radius:6px;background:#000;color:#33ff00;font:inherit;font-size:.8125rem;margin-top:12px}
+.inspector-input:focus{outline:none;border-color:#33ff00}
+.inspector-textarea{display:block;width:100%;min-height:96px;resize:vertical;box-sizing:border-box;white-space:pre-wrap}
+.inspector-notice{padding:10px 12px;margin-bottom:16px;border:1px solid #0a3300;border-radius:6px;background:#001a00;font-size:.8125rem;overflow-wrap:anywhere}
+.inspector-notice-error{border-color:#ff4444;color:#ff4444;background:#1a0a0a}
+.inspector-section code{font-size:.8125rem;overflow-wrap:anywhere}
+@font-face{
+  font-family:'Geist';font-style:normal;font-weight:100 900;font-display:swap;
+  src:url('/_baseline/fonts/geist-sans.woff2') format('woff2');
+}
+@font-face{
+  font-family:'Geist Pixel';font-style:normal;font-weight:400;font-display:swap;
+  src:url('/_baseline/fonts/GeistPixel-Square.woff2') format('woff2');
+}
+*{box-sizing:border-box;margin:0;padding:0}
+body{
+  font-family:'Geist',-apple-system,BlinkMacSystemFont,sans-serif;
+  background:#000;color:#33ff00;min-height:100vh;
+  -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;
+}
+.brand-bar{
+  border-bottom:1px solid #0a3300;padding:10px 20px;
+  display:flex;align-items:center;gap:10px;font-size:.8125rem;color:#1a8c00;
+}
+.brand-bar.sticky{position:sticky;top:0;z-index:1000;background:#000;height:42px;}
+.brand-bar-title{font-weight:600;color:#33ff00;font-family:'Geist Pixel',monospace;}
+.brand-bar-links{margin-left:auto;display:flex;gap:16px;}
+.brand-bar-links a{
+  color:#1a8c00;font-size:.75rem;text-decoration:none;transition:color .15s;
+}
+.brand-bar-links a:hover{color:#33ff00;}
+.brand-bar-links a .full{display:inline;}
+.brand-bar-links a .short{display:none;}
+@media(max-width:600px){
+  .brand-bar-links a .full{display:none;}
+  .brand-bar-links a .short{display:inline;}
+}
+
+.content{
+  display:flex;align-items:center;justify-content:center;
+  min-height:calc(100vh - 42px);padding:24px 16px;
+}
+.content-inner{width:100%;max-width:420px;}
+.card-title{
+  font-family:'Geist Pixel',monospace;
+  font-size:1.125rem;font-weight:600;margin-bottom:4px;color:#33ff00;
+}
+.card-subtitle{color:#1a8c00;font-size:.8125rem;margin-bottom:18px;line-height:1.45;}
+.powered-by{
+  position:fixed;bottom:0;left:0;right:0;
+  text-align:center;padding:12px;font-size:.6875rem;color:#0a3300;
+  font-family:'Geist Pixel',monospace;
+}
+.powered-by a{color:#1a8c00;text-decoration:none;transition:color .15s;}
+.powered-by a:hover{color:#33ff00;}
+
+.error-title{
+  font-family:'Geist Pixel',monospace;
+  color:#ff4444;font-size:1.125rem;font-weight:600;margin-bottom:8px;
+}
+.error-msg{color:#1a8c00;font-size:.875rem;line-height:1.5;}
+.error-card{text-align:center;}
+
+.user-form{margin-bottom:8px;}
+.user-form:last-of-type{margin-bottom:0;}
+.user-btn{
+  width:100%;display:flex;align-items:center;gap:12px;
+  padding:10px 12px;border:1px solid #0a3300;border-radius:8px;
+  background:#000;color:inherit;cursor:pointer;text-align:left;
+  font:inherit;transition:border-color .15s;
+}
+.user-btn:hover{border-color:#33ff00;}
+.avatar{
+  width:36px;height:36px;border-radius:50%;
+  background:#0a3300;color:#33ff00;font-weight:600;font-size:.875rem;
+  display:flex;align-items:center;justify-content:center;flex-shrink:0;
+  font-family:'Geist Pixel',monospace;
+}
+.user-text{min-width:0;}
+.user-login{font-weight:600;font-size:.875rem;display:block;color:#33ff00;}
+.user-meta{color:#1a8c00;font-size:.75rem;margin-top:1px;}
+.user-email{font-size:.6875rem;color:#116600;word-break:break-all;margin-top:1px;}
+
+.settings-layout{
+  max-width:920px;margin:0 auto;padding:28px 20px;
+  display:flex;gap:28px;
+}
+.settings-sidebar{width:200px;flex-shrink:0;}
+.settings-sidebar a{
+  display:block;padding:6px 10px;border-radius:6px;color:#1a8c00;
+  text-decoration:none;font-size:.8125rem;transition:color .15s;
+}
+.settings-sidebar a:hover{color:#33ff00;}
+.settings-sidebar a.active{color:#33ff00;font-weight:600;}
+.settings-main{flex:1;min-width:0;}
+
+.s-card{
+  padding:18px 0;margin-bottom:14px;border-bottom:1px solid #0a3300;
+}
+.s-card:last-child{border-bottom:none;}
+.s-card-header{display:flex;align-items:center;gap:14px;margin-bottom:14px;}
+.s-icon{
+  width:42px;height:42px;border-radius:8px;
+  background:#0a3300;display:flex;align-items:center;justify-content:center;
+  font-size:1.125rem;font-weight:700;color:#116600;flex-shrink:0;
+  font-family:'Geist Pixel',monospace;
+}
+.s-title{
+  font-family:'Geist Pixel',monospace;
+  font-size:1.25rem;font-weight:600;color:#33ff00;
+}
+.s-subtitle{font-size:.75rem;color:#1a8c00;margin-top:2px;}
+.section-heading{
+  font-size:.9375rem;font-weight:600;margin-bottom:10px;color:#33ff00;
+  display:flex;align-items:center;justify-content:space-between;
+}
+.perm-list{list-style:none;}
+.perm-list li{padding:5px 0;font-size:.8125rem;display:flex;align-items:center;gap:6px;color:#1a8c00;}
+.check{color:#33ff00;}
+.org-row{
+  display:flex;align-items:center;gap:8px;padding:7px 0;
+  border-bottom:1px solid #0a3300;font-size:.8125rem;
+}
+.org-row:last-child{border-bottom:none;}
+.org-icon{
+  width:22px;height:22px;border-radius:4px;background:#0a3300;
+  display:flex;align-items:center;justify-content:center;
+  font-size:.625rem;font-weight:700;color:#116600;flex-shrink:0;
+  font-family:'Geist Pixel',monospace;
+}
+.org-name{font-weight:600;color:#33ff00;}
+.badge{font-size:.6875rem;padding:1px 7px;border-radius:999px;font-weight:500;}
+.badge-granted{background:#0a3300;color:#33ff00;}
+.badge-denied{background:#1a0a0a;color:#ff4444;}
+.badge-requested{background:#0a3300;color:#1a8c00;}
+.btn-revoke{
+  display:inline-block;padding:5px 14px;border-radius:6px;
+  border:1px solid #0a3300;background:transparent;color:#ff4444;
+  font-size:.75rem;font-weight:600;cursor:pointer;transition:border-color .15s;
+}
+.btn-revoke:hover{border-color:#ff4444;}
+.info-text{color:#1a8c00;font-size:.75rem;line-height:1.5;margin-top:10px;}
+.app-link{
+  display:flex;align-items:center;gap:12px;padding:12px;
+  border:1px solid #0a3300;border-radius:8px;background:#000;
+  text-decoration:none;color:inherit;margin-bottom:8px;transition:border-color .15s;
+}
+.app-link:hover{border-color:#33ff00;}
+.app-link-name{font-weight:600;font-size:.875rem;color:#33ff00;}
+.app-link-scopes{font-size:.6875rem;color:#1a8c00;margin-top:1px;}
+.empty{color:#1a8c00;text-align:center;padding:28px 0;font-size:.875rem;}
+
+.inspector-layout{max-width:960px;margin:0 auto;padding:28px 20px;}
+.inspector-tabs{display:flex;gap:4px;margin-bottom:20px;}
+.inspector-tabs a{
+  padding:7px 16px;border-radius:6px;text-decoration:none;
+  font-size:.8125rem;color:#1a8c00;border:1px solid transparent;
+  transition:color .15s,border-color .15s;
+}
+.inspector-tabs a:hover{color:#33ff00;}
+.inspector-tabs a.active{color:#33ff00;font-weight:600;border-color:#0a3300;background:#0a3300;}
+.inspector-section{margin-bottom:24px;}
+.inspector-section h2{
+  font-family:'Geist Pixel',monospace;
+  font-size:1rem;font-weight:600;color:#33ff00;margin-bottom:10px;
+}
+.inspector-section h3{
+  font-family:'Geist Pixel',monospace;
+  font-size:.875rem;font-weight:600;color:#1a8c00;margin:16px 0 8px;
+}
+.inspector-table{width:100%;border-collapse:collapse;margin-bottom:12px;}
+.inspector-table th,.inspector-table td{
+  text-align:left;padding:8px 12px;border-bottom:1px solid #0a3300;
+  font-size:.8125rem;
+}
+.inspector-table th{color:#1a8c00;font-weight:600;font-size:.75rem;text-transform:uppercase;letter-spacing:.04em;}
+.inspector-table td{color:#33ff00;}
+.inspector-table tbody tr{transition:background .1s;}
+.inspector-table tbody tr:hover{background:#0a3300;}
+.inspector-empty{color:#1a8c00;text-align:center;padding:20px 0;font-size:.8125rem;}
+
+.checkout-layout{
+  display:flex;min-height:calc(100vh - 42px);
+}
+.checkout-summary{
+  flex:1;background:#020;padding:48px 40px 48px 10%;
+  display:flex;flex-direction:column;justify-content:center;
+  border-right:1px solid #0a3300;
+}
+.checkout-form-side{
+  flex:1;background:#000;padding:48px 10% 48px 40px;
+  display:flex;flex-direction:column;justify-content:center;
+}
+.checkout-merchant{
+  display:flex;align-items:center;gap:10px;margin-bottom:6px;
+}
+.checkout-merchant-name{
+  font-family:'Geist Pixel',monospace;
+  font-size:.9375rem;font-weight:600;color:#33ff00;
+}
+.checkout-test-badge{
+  font-size:.625rem;font-weight:700;letter-spacing:.04em;text-transform:uppercase;
+  background:#0a3300;color:#1a8c00;padding:2px 8px;border-radius:4px;
+}
+.checkout-total{
+  font-family:'Geist Pixel',monospace;
+  font-size:2rem;font-weight:700;color:#33ff00;margin:8px 0 28px;
+}
+.checkout-line-item{
+  display:flex;align-items:center;gap:14px;padding:14px 0;
+  border-bottom:1px solid #0a3300;
+}
+.checkout-line-item:first-child{border-top:1px solid #0a3300;}
+.checkout-item-icon{
+  width:42px;height:42px;border-radius:6px;background:#0a3300;
+  display:flex;align-items:center;justify-content:center;flex-shrink:0;
+  font-family:'Geist Pixel',monospace;font-size:.875rem;font-weight:700;color:#116600;
+}
+.checkout-item-details{flex:1;min-width:0;}
+.checkout-item-name{font-size:.875rem;font-weight:600;color:#33ff00;}
+.checkout-item-qty{font-size:.75rem;color:#1a8c00;margin-top:2px;}
+.checkout-item-price{
+  font-size:.875rem;font-weight:600;color:#33ff00;text-align:right;white-space:nowrap;
+}
+.checkout-item-unit{font-size:.6875rem;color:#1a8c00;text-align:right;margin-top:2px;}
+.checkout-totals{margin-top:20px;}
+.checkout-totals-row{
+  display:flex;justify-content:space-between;padding:6px 0;
+  font-size:.8125rem;color:#1a8c00;
+}
+.checkout-totals-row.total{
+  border-top:1px solid #0a3300;margin-top:8px;padding-top:14px;
+  font-size:.9375rem;font-weight:600;color:#33ff00;
+}
+.checkout-form-section{margin-bottom:24px;}
+.checkout-form-label{
+  font-size:.8125rem;font-weight:600;color:#33ff00;margin-bottom:8px;display:block;
+}
+.checkout-input{
+  width:100%;padding:10px 12px;border:1px solid #0a3300;border-radius:6px;
+  background:#020;color:#33ff00;font:inherit;font-size:.875rem;
+  transition:border-color .15s;outline:none;
+}
+.checkout-input:focus{border-color:#33ff00;}
+.checkout-input::placeholder{color:#116600;}
+.checkout-card-box{
+  border:1px solid #0a3300;border-radius:6px;padding:14px;
+  background:#020;
+}
+.checkout-card-row{
+  display:flex;gap:12px;margin-top:10px;
+}
+.checkout-card-row .checkout-input{flex:1;}
+.checkout-error{font-size:.75rem;color:#ff5555;margin-top:6px;}
+.checkout-sim-note{
+  font-size:.6875rem;color:#1a8c00;margin-top:10px;text-align:center;
+  font-style:italic;
+}
+.checkout-pay-btn{
+  width:100%;padding:14px;border:none;border-radius:8px;
+  background:#33ff00;color:#000;font:inherit;font-size:.9375rem;font-weight:700;
+  cursor:pointer;transition:background .15s;
+  font-family:'Geist Pixel',monospace;
+}
+.checkout-pay-btn:hover{background:#44ff22;}
+.checkout-cancel{
+  text-align:center;margin-top:14px;
+}
+.checkout-cancel a{
+  color:#1a8c00;text-decoration:none;font-size:.8125rem;
+  transition:color .15s;
+}
+.checkout-cancel a:hover{color:#33ff00;}
+.consent-scopes{list-style:none;margin:0 0 18px;padding:0;border:1px solid #0a3300;}
+.consent-scopes li{padding:10px 14px;border-bottom:1px solid #0a3300;}
+.consent-scopes li:last-child{border-bottom:none;}
+.consent-scope-name{display:block;font-size:.8125rem;color:#33ff00;}
+.consent-scope-key{display:block;font-size:.6875rem;color:#116600;margin-top:2px;word-break:break-all;}
+.card-cancel{text-align:center;margin-top:14px;}
+.card-cancel a{color:#1a8c00;text-decoration:none;font-size:.8125rem;transition:color .15s;}
+.card-cancel a:hover{color:#33ff00;}
+.card-form{margin:0 0 8px;}
+.card-field{margin-bottom:14px;}
+.card-label{display:block;font-size:.8125rem;font-weight:600;color:#33ff00;margin-bottom:6px;}
+.card-hint{display:block;font-size:.6875rem;color:#116600;margin-top:4px;}
+.card-input{
+  width:100%;padding:10px 12px;border:1px solid #0a3300;border-radius:6px;
+  background:#020;color:#33ff00;font:inherit;font-size:.875rem;outline:none;transition:border-color .15s;
+}
+.card-input:focus{border-color:#33ff00;}
+.card-choices{list-style:none;margin:0;padding:0;border:1px solid #0a3300;border-radius:8px;}
+.card-choices li{border-bottom:1px solid #0a3300;}
+.card-choices li:last-child{border-bottom:none;}
+.card-choice{display:flex;align-items:center;gap:10px;padding:10px 12px;cursor:pointer;font-size:.8125rem;color:#33ff00;}
+.card-choice input{accent-color:#33ff00;flex-shrink:0;}
+.card-choice-detail{display:block;font-size:.6875rem;color:#1a8c00;margin-top:1px;}
+.card-submit{
+  width:100%;padding:12px;border:none;border-radius:8px;background:#33ff00;color:#000;
+  font:inherit;font-size:.875rem;font-weight:700;cursor:pointer;transition:background .15s;
+  font-family:'Geist Pixel',monospace;
+}
+.card-submit:hover{background:#44ff22;}
+.card-notice{padding:10px 12px;margin-bottom:14px;border:1px solid #0a3300;border-radius:6px;background:#001a00;font-size:.8125rem;color:#1a8c00;overflow-wrap:anywhere;}
+.card-notice-error{border-color:#ff4444;color:#ff4444;background:#1a0a0a;}
+.card-code{display:block;padding:10px 12px;margin-bottom:14px;border:1px solid #0a3300;border-radius:6px;font-size:.75rem;color:#33ff00;overflow-wrap:anywhere;font-family:monospace;}
+@media(max-width:768px){
+  .checkout-layout{flex-direction:column;}
+  .checkout-summary{padding:32px 20px;border-right:none;border-bottom:1px solid #0a3300;}
+  .checkout-form-side{padding:32px 20px;}
+}
+`;
+var POWERED_BY = `<div class="powered-by">Powered by <a href="https://docs.deploybaseline.com" target="_blank" rel="noopener">baseline</a></div>`;
+function brandBar(service) {
+  const title = service ? `${escapeHtml(service)} Emulator` : "Emulator";
+  return `<div class="brand-bar">
+  <span class="brand-bar-title">${title}</span>
+  <nav class="brand-bar-links">
+    <a href="https://github.com/deploybaseline/baseline-cli/issues" target="_blank" rel="noopener"><span class="full">Report Issue</span><span class="short">Report</span></a>
+    <a href="https://github.com/deploybaseline/baseline-cli" target="_blank" rel="noopener"><span class="full">Source Code</span><span class="short">Source</span></a>
+    <a href="https://docs.deploybaseline.com" target="_blank" rel="noopener"><span class="full">Learn More</span><span class="short">Learn</span></a>
+  </nav>
+</div>`;
+}
+function head(title) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width,initial-scale=1"/>
+<link rel="icon" href="/_baseline/favicon.ico"/>
+<title>${escapeHtml(title)} | baseline</title>
+<style>${CSS}</style>
+</head>`;
+}
+function renderCardPage(title, subtitle, body, service) {
+  return `${head(title)}
+<body>
+${brandBar(service)}
+<div class="content">
+  <div class="content-inner">
+    <div class="card-title">${escapeHtml(title)}</div>
+    <div class="card-subtitle">${subtitle}</div>
+    ${body}
+  </div>
+</div>
+${POWERED_BY}
+</body></html>`;
+}
+function renderErrorPage(title, message2, service) {
+  return `${head(title)}
+<body>
+${brandBar(service)}
+<div class="content">
+  <div class="content-inner error-card">
+    <div class="error-title">${escapeHtml(title)}</div>
+    <div class="error-msg">${escapeHtml(message2)}</div>
+  </div>
+</div>
+${POWERED_BY}
+</body></html>`;
+}
+function renderJsonDetails(label, value, open2 = false) {
+  const text = JSON.stringify(value, null, 2) ?? "";
+  const bounded2 = text.length > 65536 ? `${text.slice(0, 65536)}
+[remaining data omitted from preview]` : text;
+  return `<details class="inspector-detail"${open2 ? " open" : ""}><summary>${escapeHtml(label)}</summary><pre class="inspector-json">${escapeHtml(bounded2)}</pre></details>`;
+}
+function renderInspectorPage(title, tabs, activeTab, body, service) {
+  const tabLinks = tabs.map(
+    (t) => `<a href="${escapeAttr(t.href)}" class="${t.id === activeTab ? "active" : ""}">${escapeHtml(t.label)}</a>`
+  ).join("");
+  return `${head(title)}
+<body>
+${brandBar(service)}
+<div class="inspector-layout">
+  <nav class="inspector-tabs">${tabLinks}</nav>
+  ${body}
+</div>
+${POWERED_BY}
+</body></html>`;
+}
+function renderFormPostPage(action, fields, service) {
+  const hiddens = Object.entries(fields).filter(([, v]) => v !== null && v !== void 0).map(([k, v]) => `<input type="hidden" name="${escapeAttr(k)}" value="${escapeAttr(v)}"/>`).join("\n");
+  return `${head("Redirecting")}
+<body onload="document.forms[0].submit()">
+${brandBar(service)}
+<div class="content">
+  <div class="content-inner" style="text-align:center">
+    <div class="card-subtitle">Redirecting&hellip;</div>
+    <form method="POST" action="${escapeAttr(action)}">
+${hiddens}
+    <noscript><button type="submit" class="user-btn" style="margin-top:12px;justify-content:center">
+      <span class="user-login">Continue</span>
+    </button></noscript>
+    </form>
+  </div>
+</div>
+${POWERED_BY}
+</body></html>`;
+}
+function renderUserButton(opts) {
+  const hiddens = Object.entries(opts.hiddenFields).map(([k, v]) => `<input type="hidden" name="${escapeAttr(k)}" value="${escapeAttr(v)}"/>`).join("");
+  const nameLine = opts.name ? `<div class="user-meta">${escapeHtml(opts.name)}</div>` : "";
+  const emailLine = opts.email ? `<div class="user-email">${escapeHtml(opts.email)}</div>` : "";
+  return `<form class="user-form" method="post" action="${escapeAttr(opts.formAction)}">
+${hiddens}
+<button type="submit" class="user-btn">
+  <span class="avatar">${escapeHtml(opts.letter)}</span>
+  <span class="user-text">
+    <span class="user-login">${escapeHtml(opts.login)}</span>
+    ${nameLine}${emailLine}
+  </span>
+</button>
+</form>`;
+}
+function renderEmailPreview(html, text) {
+  if (html) {
+    return `<iframe class="email-preview" sandbox="allow-popups allow-popups-to-escape-sandbox" srcdoc="${escapeAttr(`<base target="_blank">${html}`)}"></iframe>`;
+  }
+  if (text) {
+    return `<div class="s-card"><pre class="info-text email-text">${escapeHtml(text)}</pre></div>`;
+  }
+  return '<div class="empty">No content</div>';
+}
+var INSPECTOR = "/_baseline/control/inspector";
+var STATE_PAGE = `${INSPECTOR}/state`;
+var __dirname = dirname2(fileURLToPath(import.meta.url));
+var FONTS = {
+  "geist-sans.woff2": readFileSync(join2(__dirname, "fonts", "geist-sans.woff2")),
+  "GeistPixel-Square.woff2": readFileSync(join2(__dirname, "fonts", "GeistPixel-Square.woff2"))
+};
+var FAVICON = readFileSync(join2(__dirname, "fonts", "favicon.ico"));
+function registerFontRoutes(app) {
+  app.get("/_baseline/fonts/:name", (c) => {
+    const name = c.req.param("name");
+    const buf = FONTS[name];
+    if (!buf) {
+      return c.notFound();
+    }
+    return new Response(buf, {
+      headers: {
+        "Content-Type": "font/woff2",
+        "Cache-Control": "public, max-age=31536000, immutable",
+        "Access-Control-Allow-Origin": "*"
+      }
+    });
+  });
+  app.get(
+    "/_baseline/favicon.ico",
+    (_c) => new Response(FAVICON, {
+      headers: {
+        "Content-Type": "image/x-icon",
+        "Cache-Control": "public, max-age=31536000, immutable"
+      }
+    })
+  );
+}
+var MATCH_ANYTHING = /^.*$/;
+var PARAM_NAME_CHAR = /[A-Za-z0-9_]/;
+var STATUS_TEXT = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  403: "Forbidden",
+  404: "Not Found",
+  500: "Internal Server Error",
+  501: "Not Implemented",
+  503: "Service Unavailable"
+};
+function rejectUpgrade(socket, status, message2 = STATUS_TEXT[status] ?? "") {
+  if (socket.destroyed) {
+    return;
+  }
+  const body = Buffer.from(message2);
+  socket.end(
+    `HTTP/1.1 ${status} ${STATUS_TEXT[status] ?? "Error"}\r
+Connection: close\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Length: ${body.length}\r
+\r
+${message2}`,
+    () => socket.destroy()
+  );
+}
+var HonoRequest = class {
+  raw;
+  url;
+  method;
+  path;
+  params;
+  strictJson;
+  constructor(request, params, strictJson = false) {
+    this.params = params;
+    this.strictJson = strictJson;
+    this.raw = request;
+    this.url = request.url;
+    this.method = request.method;
+    this.path = new URL(request.url).pathname;
+  }
+  header(name) {
+    if (name) {
+      return this.raw.headers.get(name) ?? void 0;
+    }
+    const headers = {};
+    this.raw.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    return headers;
+  }
+  query(name) {
+    return new URL(this.url).searchParams.get(name) ?? void 0;
+  }
+  queries(name) {
+    const values = new URL(this.url).searchParams.getAll(name);
+    return values.length > 0 ? values : void 0;
+  }
+  param(name) {
+    if (!name) {
+      return { ...this.params };
+    }
+    return this.params[name] ?? "";
+  }
+  // biome-ignore lint/suspicious/noExplicitAny: public default, as in Hono; callers read untyped JSON bodies without a cast
+  async json() {
+    try {
+      return await this.raw.json();
+    } catch (error) {
+      if (!this.strictJson) {
+        throw error;
+      }
+      throw Object.assign(new Error("Invalid JSON request body", { cause: error }), { status: 400 });
+    }
+  }
+  text() {
+    return this.raw.text();
+  }
+  arrayBuffer() {
+    return this.raw.arrayBuffer();
+  }
+  async parseBody() {
+    const contentType = this.header("Content-Type") ?? "";
+    if (contentType.includes("multipart/form-data")) {
+      return formDataToObject(await this.raw.formData());
+    }
+    if (contentType.includes("application/x-www-form-urlencoded")) {
+      const params = new URLSearchParams(await this.raw.text());
+      const out = {};
+      for (const [key, value] of params) {
+        appendBodyValue(out, key, value);
+      }
+      return out;
+    }
+    if (contentType.includes("application/json")) {
+      const body = this.strictJson ? await this.json() : await this.raw.json().catch(() => ({}));
+      return body && typeof body === "object" && !Array.isArray(body) ? body : {};
+    }
+    return {};
+  }
+};
+var Context = class {
+  req;
+  vars = /* @__PURE__ */ new Map();
+  responseHeaders = new Headers();
+  headerOperations = [];
+  appliedHeaders = /* @__PURE__ */ new WeakMap();
+  responseStatus = 200;
+  /** In middleware, after `await next()`: the response the rest of the chain produced, as in Hono. */
+  res;
+  notFoundHandler;
+  constructor(request, params, notFoundHandler, strictJson = false) {
+    this.notFoundHandler = notFoundHandler;
+    this.req = new HonoRequest(request, params, strictJson);
+  }
+  get(key) {
+    return this.vars.get(key);
+  }
+  set(key, value) {
+    this.vars.set(key, value);
+  }
+  header(name, value, options) {
+    if (options?.append) {
+      this.responseHeaders.append(name, value);
+    } else {
+      this.responseHeaders.set(name, value);
+    }
+    this.headerOperations.push({ name, value, append: options?.append === true });
+  }
+  status(status) {
+    this.responseStatus = status;
+  }
+  json(data, status, headers) {
+    return this.response(JSON.stringify(data), status, defaultContentType(headers, "application/json; charset=UTF-8"));
+  }
+  text(text, status, headers) {
+    return this.response(text, status, defaultContentType(headers, "text/plain; charset=UTF-8"));
+  }
+  html(html, status, headers) {
+    return this.response(html, status, defaultContentType(headers, "text/html; charset=UTF-8"));
+  }
+  body(body, status, headers) {
+    return this.response(body, status, headers);
+  }
+  redirect(location, status = 302) {
+    return this.response(null, status, { Location: location });
+  }
+  notFound() {
+    return this.notFoundHandler(this);
+  }
+  finalize(response) {
+    const applied = this.appliedHeaders.get(response) ?? 0;
+    if (applied === this.headerOperations.length) {
+      return response;
+    }
+    const headers = new Headers(response.headers);
+    mergeHeaders(headers, this.headerOperations.slice(applied));
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  response(body, status, headers) {
+    const merged = new Headers(headers);
+    mergeHeaders(merged, this.headerOperations);
+    const response = new Response(body, {
+      status: status ?? this.responseStatus,
+      headers: merged
+    });
+    this.appliedHeaders.set(response, this.headerOperations.length);
+    return response;
+  }
+};
+var recordedRoutes = /* @__PURE__ */ new Set();
+function recordRouteHit(method, pattern) {
+  recordCoverageHit(`${method} ${pattern}`);
+}
+function recordCoverageHit(key) {
+  const dir = process.env.BASELINE_COVERAGE_DIR;
+  if (!dir) {
+    return;
+  }
+  if (recordedRoutes.has(key)) {
+    return;
+  }
+  recordedRoutes.add(key);
+  try {
+    mkdirSync(dir, { recursive: true });
+    appendFileSync(join3(dir, `${process.pid}-${threadId}.jsonl`), `${JSON.stringify(key)}
+`);
+  } catch {
+  }
+}
+var SAMPLES_PER_KEY = 3;
+var sampleCounts = /* @__PURE__ */ new Map();
+async function recordResponseSample(method, pattern, response) {
+  if (!process.env.BASELINE_RESPONSE_DIR) {
+    return;
+  }
+  if (!((response.headers.get("content-type") ?? "").includes("json") && response.body)) {
+    return;
+  }
+  if (!sampleSlot(method, pattern, response.status)) {
+    return;
+  }
+  try {
+    writeResponseSample(method, pattern, response.status, JSON.parse(await response.clone().text()));
+  } catch {
+  }
+}
+function recordResponseBody(method, pattern, status, body) {
+  if (!process.env.BASELINE_RESPONSE_DIR || body === null || body === void 0) {
+    return;
+  }
+  if (!sampleSlot(method, pattern, status)) {
+    return;
+  }
+  try {
+    writeResponseSample(method, pattern, status, body);
+  } catch {
+  }
+}
+function sampleSlot(method, pattern, status) {
+  const key = `${method} ${pattern} ${status}`;
+  const count = sampleCounts.get(key) ?? 0;
+  if (count >= SAMPLES_PER_KEY) {
+    return false;
+  }
+  sampleCounts.set(key, count + 1);
+  return true;
+}
+function writeResponseSample(method, pattern, status, body) {
+  const dir = process.env.BASELINE_RESPONSE_DIR;
+  mkdirSync(dir, { recursive: true });
+  appendFileSync(
+    join3(dir, `${process.pid}-${threadId}.jsonl`),
+    `${JSON.stringify({ method, route: pattern, status, body })}
+`
+  );
+}
+function mergeHeaders(target, operations) {
+  for (const { name, value, append } of operations) {
+    if (append) {
+      target.append(name, value);
+    } else {
+      target.set(name, value);
+    }
+  }
+}
+var Hono = class {
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  get routeTable() {
+    return this.routes.map((r) => ({ method: r.method, path: r.compiled.pattern, source: r.source }));
+  }
+  /**
+   * Operations served inside routes, such as GraphQL root fields
+   * (`"Query.issues"`, `"Mutation.issueCreate"`) or vendor routes a service
+   * dispatches itself (`"GET /v1.0/me/events"`, Microsoft Graph). The
+   * coverage matrix lists them next to routes.
+   */
+  get operationTable() {
+    return [...this.operations];
+  }
+  /** Upgrade routes (WebSocket endpoints) as registered paths. */
+  get upgradeTable() {
+    return this.upgrades.map((route) => route.compiled.pattern);
+  }
+  /**
+   * Accept upgrade requests (WebSocket handshakes) on `path`. The handler gets
+   * Node's request and socket; `@deploybaseline/ws` completes the handshake.
+   * Upgrades skip middleware, so the handler checks its own credentials.
+   * A request that reaches `fetch` without going through an upgrading server answers 501.
+   */
+  upgrade(path, handler) {
+    if (this.options.strictRoutes && (path === "/_baseline" || path.startsWith("/_baseline/"))) {
+      throw new Error(`Upgrade route ${path} uses the reserved /_baseline namespace`);
+    }
+    this.upgrades.push({ compiled: compilePath(path), handler });
+    return this;
+  }
+  /** Node `upgrade` event handler for this app's upgrade routes. Sockets it accepts are closed by `dispose()`. */
+  handleUpgrade = (request, socket, head2, path) => {
+    const url = new URL(path ?? request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
+    const route = this.upgrades.find((candidate) => pathMatches(candidate.compiled, url.pathname));
+    if (!route) {
+      return false;
+    }
+    recordCoverageHit(`WS ${route.compiled.pattern}`);
+    this.upgradedSockets.add(socket);
+    socket.once("close", () => this.upgradedSockets.delete(socket));
+    const params = matchPath(route.compiled, url.pathname) ?? {};
+    Promise.resolve().then(() => route.handler({ request, socket, head: head2, url, params })).catch((error) => {
+      this.options.onError?.(error, new Request(url));
+      rejectUpgrade(socket, 500);
+    });
+    return true;
+  };
+  /** Run cleanup when the service stops, e.g. closing WebSocket connections. */
+  onDispose(callback) {
+    this.disposers.push(callback);
+    return this;
+  }
+  /** Run `onDispose` callbacks, then close any upgraded socket still open. Safe to call more than once. */
+  async dispose() {
+    const callbacks = this.disposers.splice(0);
+    await Promise.allSettled(callbacks.map((callback) => Promise.resolve().then(callback)));
+    for (const socket of this.upgradedSockets) {
+      socket.destroy();
+    }
+    this.upgradedSockets.clear();
+  }
+  upgrades = [];
+  upgradedSockets = /* @__PURE__ */ new Set();
+  disposers = [];
+  /** Declare operations served by this app's routes (see `operationTable`). Duplicates are ignored. */
+  declareOperations(keys) {
+    for (const key of keys) {
+      if (!this.operations.includes(key)) {
+        this.operations.push(key);
+      }
+    }
+    return this;
+  }
+  operations = [];
+  matchedRoute(method, path) {
+    const route = this.routes.find((r) => r.method === method && matchPath(r.compiled, path)) ?? (method === "HEAD" ? this.routes.find((r) => r.method === "GET" && matchPath(r.compiled, path)) : void 0);
+    return route && { method: route.method, path: route.compiled.pattern, source: route.source };
+  }
+  middleware = [];
+  routes = [];
+  errorHandler = (err) => {
+    const message2 = err instanceof Error ? err.message : "Internal Server Error";
+    return new Response(message2, { status: 500 });
+  };
+  notFoundHandler = () => new Response("404 Not Found", { status: 404 });
+  use(pathOrHandler, ...handlers) {
+    if (typeof pathOrHandler === "string") {
+      this.middleware.push({ method: "ALL", compiled: compilePath(pathOrHandler), handlers });
+    } else {
+      this.middleware.push({ method: "ALL", compiled: compilePath("*"), handlers: [pathOrHandler, ...handlers] });
+    }
+    return this;
+  }
+  on(method, path, ...handlers) {
+    const compiled = compilePath(path);
+    const source = this.options.strictRoutes ? new Error().stack?.split("\n").slice(2).join("\n") : void 0;
+    if (this.options.strictRoutes) {
+      if (path === "/_baseline" || path.startsWith("/_baseline/")) {
+        throw new Error(`Route ${method} ${path} uses the reserved /_baseline namespace`);
+      }
+      const existing = this.routes.find(
+        (r) => r.method === method.toUpperCase() && r.compiled.regex.source === compiled.regex.source
+      );
+      if (existing) {
+        throw new Error(
+          `Duplicate route ${method} ${path}
+First registration:${existing.source}
+Second registration:${source}`
+        );
+      }
+    }
+    this.routes.push({ method: method.toUpperCase(), compiled, handlers, source });
+    return this;
+  }
+  get(path, ...handlers) {
+    return this.on("GET", path, ...handlers);
+  }
+  post(path, ...handlers) {
+    return this.on("POST", path, ...handlers);
+  }
+  put(path, ...handlers) {
+    return this.on("PUT", path, ...handlers);
+  }
+  patch(path, ...handlers) {
+    return this.on("PATCH", path, ...handlers);
+  }
+  delete(path, ...handlers) {
+    return this.on("DELETE", path, ...handlers);
+  }
+  onError(handler) {
+    this.errorHandler = handler;
+    return this;
+  }
+  notFound(handler) {
+    this.notFoundHandler = handler;
+    return this;
+  }
+  async request(input, init) {
+    if (input instanceof Request) {
+      return this.fetch(input);
+    }
+    const url = input.startsWith("/") ? `http://localhost${input}` : input;
+    return this.fetch(new Request(url, init));
+  }
+  fetch = async (request) => {
+    const url = new URL(request.url);
+    const path = url.pathname;
+    const method = request.method.toUpperCase();
+    if (request.headers.get("upgrade")?.toLowerCase() === "websocket" && this.upgrades.some((route) => pathMatches(route.compiled, path) || pathMatches(route.compiled, `${path}/`))) {
+      return Response.json(
+        {
+          error: "WebSocket endpoints need a server that can upgrade connections. Run this service with the Baseline CLI or createEmulator; a plain fetch handler serves HTTP only.",
+          documentation_url: "https://docs.deploybaseline.com/websockets"
+        },
+        { status: 501 }
+      );
+    }
+    const matched = this.match(method, path);
+    const context = new Context(request, matched.params, this.notFoundHandler, this.options.strictJson);
+    try {
+      const response = await this.dispatch(context, matched.handlers);
+      const finalized = context.finalize(response ?? await this.notFoundHandler(context));
+      if (matched.route && process.env.BASELINE_RESPONSE_DIR) {
+        await recordResponseSample(matched.route.method, matched.route.compiled.pattern, finalized);
+      }
+      return finalized;
+    } catch (err) {
+      this.options.onError?.(err, request);
+      return context.finalize(await this.errorHandler(err, context));
+    }
+  };
+  match(method, path) {
+    const handlers = [];
+    const params = {};
+    for (const route2 of this.middleware) {
+      const match = matchPath(route2.compiled, path);
+      if (!match) {
+        continue;
+      }
+      Object.assign(params, match);
+      for (const handler of route2.handlers) {
+        handlers.push({ handler, params: match });
+      }
+    }
+    const route = this.routes.find((candidate) => candidate.method === method && pathMatches(candidate.compiled, path)) ?? (method === "HEAD" ? this.routes.find((candidate) => candidate.method === "GET" && pathMatches(candidate.compiled, path)) : void 0);
+    if (route) {
+      recordRouteHit(route.method, route.compiled.pattern);
+      const match = matchPath(route.compiled, path) ?? {};
+      Object.assign(params, match);
+      for (const handler of route.handlers) {
+        handlers.push({ handler, params: match });
+      }
+    }
+    return { handlers, params, route };
+  }
+  async dispatch(context, handlers) {
+    let index = -1;
+    const run = async (nextIndex) => {
+      if (nextIndex <= index) {
+        throw new Error("next() called multiple times");
+      }
+      index = nextIndex;
+      const matched = handlers[nextIndex];
+      if (!matched) {
+        return void 0;
+      }
+      const originalParams = context.req.param();
+      Object.assign(originalParams, matched.params);
+      let nextResponse;
+      let nextCalled = false;
+      const next = async () => {
+        nextCalled = true;
+        nextResponse = await run(nextIndex + 1);
+        if (nextResponse instanceof Response) {
+          context.res = nextResponse;
+        }
+      };
+      const response = await matched.handler(context, next);
+      if (response instanceof Response) {
+        return response;
+      }
+      if (nextCalled) {
+        return nextResponse;
+      }
+      return response;
+    };
+    return run(0);
+  }
+};
+function cors(options = {}) {
+  const origin = options.origin ?? "*";
+  const allowMethods = options.allowMethods ?? ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "OPTIONS"];
+  return async (c, next) => {
+    c.header("Access-Control-Allow-Origin", origin);
+    if (options.credentials) {
+      c.header("Access-Control-Allow-Credentials", "true");
+    }
+    if (c.req.method.toUpperCase() === "OPTIONS") {
+      if (!c.req.header("Access-Control-Request-Method") && options.passThrough?.(c)) {
+        await next();
+        return;
+      }
+      c.header("Access-Control-Allow-Methods", allowMethods.join(","));
+      const allowHeaders = options.allowHeaders?.join(",") ?? c.req.header("Access-Control-Request-Headers");
+      if (allowHeaders) {
+        c.header("Access-Control-Allow-Headers", allowHeaders);
+      }
+      if (options.maxAge !== null && options.maxAge !== void 0) {
+        c.header("Access-Control-Max-Age", String(options.maxAge));
+      }
+      return c.body(null, 204);
+    }
+    await next();
+  };
+}
+function serve(options) {
+  const port = options.port ?? 3e3;
+  const { upgrade } = options;
+  const server = createNodeServer(async (req, res) => {
+    try {
+      const request = nodeRequestToFetchRequest(req);
+      const response = await options.fetch(request);
+      await writeFetchResponse(res, response, req.method?.toUpperCase() === "HEAD");
+    } catch (err) {
+      const message2 = err instanceof Error ? err.message : "Internal Server Error";
+      res.statusCode = 500;
+      res.setHeader("Content-Type", "text/plain; charset=UTF-8");
+      res.end(message2);
+    }
+  });
+  server.on("upgrade", (req, socket, head2) => {
+    socket.on("error", () => {
+    });
+    let handled = false;
+    try {
+      handled = upgrade?.(req, socket, head2) ?? false;
+    } catch {
+      rejectUpgrade(socket, 500);
+      return;
+    }
+    if (!handled) {
+      rejectUpgrade(socket, 404);
+    }
+  });
+  server.listen(port, options.hostname ?? "127.0.0.1");
+  return server;
+}
+function compilePath(pattern) {
+  if (pattern === "*" || pattern === "/*") {
+    return { pattern, regex: MATCH_ANYTHING, paramNames: [] };
+  }
+  const paramNames = [];
+  let source = "^";
+  for (let i = 0; i < pattern.length; i += 1) {
+    const char = pattern[i];
+    if (char === "/" && pattern[i + 1] === "*" && i + 2 === pattern.length) {
+      source += "(?:/.*)?";
+      break;
+    }
+    if (char === "*") {
+      source += ".*";
+      continue;
+    }
+    if (char !== ":") {
+      source += escapeRegex(char);
+      continue;
+    }
+    let name = "";
+    i += 1;
+    while (i < pattern.length && PARAM_NAME_CHAR.test(pattern[i])) {
+      name += pattern[i];
+      i += 1;
+    }
+    i -= 1;
+    paramNames.push(name);
+    if (pattern[i + 1] === "{") {
+      const close = pattern.indexOf("}", i + 2);
+      if (close < 0) {
+        throw new Error(`Invalid route pattern: ${pattern}`);
+      }
+      const expr = pattern.slice(i + 2, close);
+      source += `(${expr})`;
+      i = close;
+    } else {
+      source += "([^/]+)";
+    }
+  }
+  source += "$";
+  return { pattern, regex: new RegExp(source), paramNames };
+}
+function pathMatches(compiled, path) {
+  const match = matchPath(compiled, path);
+  return match !== null && match !== void 0;
+}
+function matchPath(compiled, path) {
+  const match = compiled.regex.exec(path);
+  if (!match) {
+    return null;
+  }
+  const params = {};
+  for (let i = 0; i < compiled.paramNames.length; i += 1) {
+    params[compiled.paramNames[i]] = decodePathParam(match[i + 1] ?? "");
+  }
+  return params;
+}
+function decodePathParam(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function escapeRegex(value) {
+  return value.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&");
+}
+function defaultContentType(headers, contentType) {
+  const out = new Headers(headers);
+  if (!out.has("Content-Type")) {
+    out.set("Content-Type", contentType);
+  }
+  return out;
+}
+function formDataToObject(formData) {
+  const out = {};
+  for (const [key, value] of formData) {
+    appendBodyValue(out, key, value);
+  }
+  return out;
+}
+function appendBodyValue(target, key, value) {
+  if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    return;
+  }
+  const existing = Object.hasOwn(target, key) ? target[key] : void 0;
+  if (existing === void 0) {
+    target[key] = value;
+  } else if (Array.isArray(existing)) {
+    existing.push(value);
+  } else {
+    target[key] = [existing, value];
+  }
+}
+function nodeRequestToFetchRequest(req) {
+  const host = req.headers.host ?? "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === null || value === void 0) {
+      continue;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        headers.append(key, item);
+      }
+    } else {
+      headers.set(key, value);
+    }
+  }
+  const method = req.method ?? "GET";
+  const hasBody = method !== "GET" && method !== "HEAD";
+  return new Request(url.toString(), {
+    method,
+    headers,
+    body: hasBody ? req : void 0,
+    duplex: "half"
+  });
+}
+async function writeFetchResponse(res, response, headOnly) {
+  res.statusCode = response.status;
+  res.statusMessage = response.statusText;
+  const headersWithCookies = response.headers;
+  const cookies = headersWithCookies.getSetCookie?.();
+  response.headers.forEach((value, key) => {
+    if (key.toLowerCase() === "set-cookie" && cookies && cookies.length > 0) {
+      return;
+    }
+    res.setHeader(key, value);
+  });
+  if (cookies && cookies.length > 0) {
+    res.setHeader("Set-Cookie", cookies);
+  }
+  if (headOnly || !response.body) {
+    res.end();
+    return;
+  }
+  res.flushHeaders();
+  const reader = response.body.getReader();
+  const onClose = () => {
+    if (!res.writableFinished) {
+      reader.cancel().catch(() => {
+      });
+    }
+  };
+  res.once("close", onClose);
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (res.destroyed) {
+        break;
+      }
+      if (!res.write(value)) {
+        await new Promise((resolve2) => {
+          const settle = () => {
+            res.off("drain", settle);
+            res.off("close", settle);
+            resolve2();
+          };
+          res.once("drain", settle);
+          res.once("close", settle);
+        });
+      }
+    }
+    res.end();
+  } catch (err) {
+    res.destroy(err instanceof Error ? err : void 0);
+  } finally {
+    res.off("close", onClose);
+  }
+}
+var toBuffer = (body) => typeof body === "string" ? Buffer.from(body) : Buffer.from(body);
+function hmacSha256Hex(secret, body) {
+  return createHmac2("sha256", secret).update(toBuffer(body)).digest("hex");
+}
+function githubSignature256(secret, body) {
+  return `sha256=${hmacSha256Hex(secret, body)}`;
+}
+var TRAILING_COLON = /:$/;
+var URL_SCHEME2 = /^[a-z][a-z0-9+.-]*:/i;
+var MAX_DELIVERIES = 1e3;
+function githubHeaders({ event, body, subscription, deliveryId }) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-GitHub-Event": event,
+    "X-GitHub-Delivery": String(deliveryId)
+  };
+  if (subscription.secret) {
+    headers["X-Hub-Signature-256"] = githubSignature256(subscription.secret, body);
+  }
+  return headers;
+}
+var WebhookDispatcher = class {
+  options;
+  constructor(options = {}) {
+    this.options = options;
+    if (options.neutral) {
+      this.headerFactory = () => ({ "Content-Type": "application/json" });
+    }
+    this.setRetryPolicy(options.retry);
+  }
+  retryPolicy;
+  pendingRetries = /* @__PURE__ */ new Map();
+  subscriptions = [];
+  deliveries = [];
+  subscriptionIdCounter = 1;
+  deliveryIdCounter = 1;
+  headerFactory = githubHeaders;
+  /**
+   * Deliver to subscriptions whose URL starts with `<scheme>:` through
+   * `transport` instead of HTTP. Delivery records, retries, and redelivery work
+   * the same way.
+   */
+  setTransport(scheme, transport) {
+    this.transports.set(`${scheme.replace(TRAILING_COLON, "")}:`, transport);
+  }
+  transports = /* @__PURE__ */ new Map();
+  setHeaderFactory(factory) {
+    this.headerFactory = factory;
+  }
+  setRetryPolicy(policy) {
+    if (policy && (!Number.isInteger(policy.attempts) || policy.attempts < 1)) {
+      throw new Error("Webhook retry attempts must be a positive integer");
+    }
+    this.retryPolicy = policy;
+  }
+  /** Resolves once no retries are scheduled. For tests. */
+  async settled() {
+    while (this.pendingRetries.size > 0 || this.inFlight.size > 0) {
+      await Promise.allSettled([...this.inFlight]);
+      if (this.pendingRetries.size > 0) {
+        await new Promise((resolve2) => setTimeout(resolve2, 5));
+      }
+    }
+  }
+  inFlight = /* @__PURE__ */ new Set();
+  register(sub) {
+    const { id: explicitId, ...rest } = sub;
+    let id;
+    if (explicitId === void 0) {
+      id = this.subscriptionIdCounter;
+      this.subscriptionIdCounter += 1;
+    } else {
+      id = explicitId;
+    }
+    if (id >= this.subscriptionIdCounter) {
+      this.subscriptionIdCounter = id + 1;
+    }
+    const subscription = { ...rest, id };
+    this.subscriptions.push(subscription);
+    return subscription;
+  }
+  unregister(id) {
+    const idx = this.subscriptions.findIndex((s) => s.id === id);
+    if (idx === -1) {
+      return false;
+    }
+    this.subscriptions.splice(idx, 1);
+    return true;
+  }
+  getSubscription(id) {
+    return this.subscriptions.find((s) => s.id === id);
+  }
+  getSubscriptions(owner, repo) {
+    return this.subscriptions.filter((s) => {
+      if (owner && s.owner !== owner) {
+        return false;
+      }
+      if (repo !== void 0 && s.repo !== repo) {
+        return false;
+      }
+      return true;
+    });
+  }
+  updateSubscription(id, data) {
+    const sub = this.subscriptions.find((s) => s.id === id);
+    if (!sub) {
+      return void 0;
+    }
+    Object.assign(sub, data);
+    return sub;
+  }
+  async dispatch(event, action, payload, owner, repo) {
+    const matchingSubs = this.subscriptions.filter((s) => {
+      if (!s.active) {
+        return false;
+      }
+      if (s.owner !== owner) {
+        return false;
+      }
+      if (repo !== void 0) {
+        if (s.repo !== repo) {
+          return false;
+        }
+      } else if (s.repo !== void 0) {
+        return false;
+      }
+      return event === "ping" || s.events.includes("*") || s.events.includes(event);
+    });
+    for (const sub of matchingSubs) {
+      const first = await this.deliver(sub, event, action, payload);
+      if (this.retryPolicy && !first.success && retryable(first)) {
+        this.scheduleRetry(sub, first, 2);
+      }
+    }
+  }
+  scheduleRetry(sub, first, attempt) {
+    const policy = this.retryPolicy;
+    if (!policy || attempt > policy.attempts || this.options.signal?.aborted) {
+      return;
+    }
+    const delay = Math.min((policy.backoffMs ?? 1e3) * 2 ** (attempt - 2), policy.maxBackoffMs ?? 6e4);
+    const timer = setTimeout(() => {
+      this.pendingRetries.delete(timer);
+      if (!(this.subscriptions.includes(sub) && sub.active)) {
+        return;
+      }
+      const run = this.deliver(sub, first.event, first.action, first.payload, { attempt, retry_of: first.id }).then(
+        (delivery) => {
+          if (!delivery.success && retryable(delivery)) {
+            this.scheduleRetry(sub, first, attempt + 1);
+          }
+        }
+      );
+      this.inFlight.add(run);
+      run.finally(() => this.inFlight.delete(run));
+    }, delay);
+    timer.unref?.();
+    this.pendingRetries.set(timer, () => clearTimeout(timer));
+  }
+  async redeliver(deliveryId, options = {}) {
+    const original = this.deliveries.find((delivery) => delivery.id === deliveryId);
+    if (!original) {
+      return void 0;
+    }
+    const sub = this.getSubscription(original.hook_id);
+    if (!sub?.active) {
+      return void 0;
+    }
+    return this.deliver(sub, original.event, original.action, original.payload, {
+      headers: options.headers,
+      redelivery_of: original.id,
+      redelivery_count: (original.redelivery_count ?? 0) + 1
+    });
+  }
+  async deliver(sub, event, action, payload, options = {}) {
+    const body = JSON.stringify(payload);
+    const id = this.deliveryIdCounter;
+    this.deliveryIdCounter += 1;
+    const delivery = {
+      id,
+      hook_id: sub.id,
+      event,
+      action,
+      payload: body === void 0 ? void 0 : JSON.parse(body),
+      status_code: null,
+      delivered_at: (/* @__PURE__ */ new Date()).toISOString(),
+      duration: null,
+      success: false,
+      ...options.redelivery_of === void 0 ? {} : { redelivery_of: options.redelivery_of, redelivery_count: options.redelivery_count },
+      ...options.attempt === void 0 ? {} : { attempt: options.attempt, retry_of: options.retry_of }
+    };
+    this.deliveries.push(delivery);
+    if (this.deliveries.length > MAX_DELIVERIES) {
+      this.deliveries.splice(0, this.deliveries.length - MAX_DELIVERIES);
+    }
+    try {
+      const headers = {
+        ...this.headerFactory({ event, action, body, subscription: sub, deliveryId: delivery.id }),
+        ...options.headers
+      };
+      const start = Date.now();
+      const transport = this.transports.get(URL_SCHEME2.exec(sub.url)?.[0].toLowerCase() ?? "");
+      if (transport) {
+        const result = await transport({
+          subscription: sub,
+          event,
+          payload: delivery.payload,
+          body,
+          headers,
+          deliveryId: delivery.id,
+          attempt: options.attempt ?? 1,
+          redeliveryCount: options.redelivery_count
+        });
+        delivery.duration = Date.now() - start;
+        delivery.status_code = result.status_code;
+        delivery.success = result.success;
+        return delivery;
+      }
+      const response = await fetch(sub.url, {
+        method: "POST",
+        headers,
+        body,
+        signal: this.options.signal ? AbortSignal.any([this.options.signal, AbortSignal.timeout(1e4)]) : AbortSignal.timeout(1e4)
+      });
+      delivery.duration = Date.now() - start;
+      delivery.status_code = response.status;
+      delivery.success = response.ok;
+    } catch {
+      delivery.duration = 0;
+      delivery.success = false;
+    }
+    return delivery;
+  }
+  snapshot() {
+    return {
+      subscriptions: this.subscriptions.map((sub) => ({ ...sub, events: [...sub.events] })),
+      nextSubscriptionId: this.subscriptionIdCounter,
+      nextDeliveryId: this.deliveryIdCounter
+    };
+  }
+  /**
+   * Replace subscriptions and counters with saved ones. Delivery history and
+   * scheduled retries are dropped, as after a restart. The header factory and
+   * retry policy stay as configured.
+   */
+  restore(snapshot) {
+    this.clear();
+    this.subscriptions = snapshot.subscriptions.map((sub) => ({ ...sub, events: [...sub.events] }));
+    const highest = this.subscriptions.reduce((max, sub) => Math.max(max, sub.id), 0);
+    this.subscriptionIdCounter = Math.max(snapshot.nextSubscriptionId, highest + 1);
+    this.deliveryIdCounter = Math.max(snapshot.nextDeliveryId, 1);
+  }
+  getDeliveries(hookId) {
+    if (hookId !== void 0) {
+      return this.deliveries.filter((d) => d.hook_id === hookId);
+    }
+    return [...this.deliveries];
+  }
+  clear() {
+    for (const cancel of this.pendingRetries.values()) {
+      cancel();
+    }
+    this.pendingRetries.clear();
+    this.subscriptions.length = 0;
+    this.deliveries.length = 0;
+    this.subscriptionIdCounter = 1;
+    this.deliveryIdCounter = 1;
+  }
+};
+function retryable(delivery) {
+  return delivery.status_code === null || delivery.status_code === 429 || delivery.status_code >= 500;
+}
+var FAULT_PROFILES = {
+  degraded: [
+    { match: "*", latency_ms: 300 },
+    { match: "*", rate: 0.1, response: { status: 503, body: { error: "Service Unavailable (injected fault)" } } }
+  ],
+  throttled: [
+    {
+      match: "*",
+      rate: 0.3,
+      response: { status: 429, headers: { "Retry-After": "1" }, body: { error: "Too Many Requests (injected fault)" } }
+    }
+  ]
+};
+function normalizeFaults(service, config) {
+  const raw = Array.isArray(config) ? { rules: config } : config;
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`${service}.faults must be a list of rules or an object`);
+  }
+  const { seed, profile, rules = [] } = raw;
+  if (seed !== void 0 && !Number.isInteger(seed)) {
+    throw new Error(`${service}.faults.seed must be an integer`);
+  }
+  if (profile !== void 0 && !Object.hasOwn(FAULT_PROFILES, profile)) {
+    throw new Error(`${service}.faults.profile must be one of ${Object.keys(FAULT_PROFILES).join(", ")}`);
+  }
+  if (!Array.isArray(rules)) {
+    throw new Error(`${service}.faults.rules must be a list`);
+  }
+  for (const [index, rule] of rules.entries()) {
+    validateRule(`${service}.faults.rules[${index}]`, rule);
+  }
+  return {
+    ...seed === void 0 ? {} : { seed },
+    ...profile === void 0 ? {} : { profile },
+    rules: [...profile ? FAULT_PROFILES[profile] : [], ...rules]
+  };
+}
+function validateRule(where, rule) {
+  if (!rule || typeof rule !== "object") {
+    throw new Error(`${where} must be an object`);
+  }
+  const { match, rate, latency_ms, response } = rule;
+  if (typeof match !== "string" || !match) {
+    throw new Error(`${where}.match must be "*" or "METHOD /path"`);
+  }
+  if (rate !== void 0 && (typeof rate !== "number" || rate < 0 || rate > 1)) {
+    throw new Error(`${where}.rate must be a number from 0 to 1`);
+  }
+  if (latency_ms !== void 0 && (typeof latency_ms !== "number" || latency_ms < 0 || latency_ms > 6e4)) {
+    throw new Error(`${where}.latency_ms must be from 0 to 60000`);
+  }
+  if (latency_ms === void 0 && response === void 0) {
+    throw new Error(`${where} needs latency_ms, response, or both`);
+  }
+  if (response !== void 0) {
+    const status = response?.status;
+    if (!Number.isInteger(status) || status < 100 || status > 599) {
+      throw new Error(`${where}.response.status must be an HTTP status code`);
+    }
+    const { headers } = response;
+    if (headers !== void 0) {
+      try {
+        new Headers(headers);
+      } catch (error) {
+        throw new Error(`${where}.response.headers must map valid header names to strings`, { cause: error });
+      }
+    }
+  }
+}
+var MAX_DELAY_MS = 6e4;
+var WHITESPACE = /\s+/;
+function seededRandom(seed) {
+  let state = seed >>> 0;
+  return () => {
+    state = state + 1831565813 >>> 0;
+    let t = state;
+    t = Math.imul(t ^ t >>> 15, t | 1);
+    t ^= t + Math.imul(t ^ t >>> 7, t | 61);
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function compileMatch(match) {
+  if (match === "*") {
+    return () => true;
+  }
+  const [first, ...rest] = match.trim().split(WHITESPACE);
+  const method = rest.length ? first.toUpperCase() : void 0;
+  const pattern = rest.length ? rest.join(" ") : first;
+  const source = pattern.split("/").map(
+    (segment) => segment.startsWith(":") ? "[^/]+" : segment.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")
+  ).join("/");
+  const regex = new RegExp(`^${source}/?$`);
+  return (requestMethod, path) => (!method || method === requestMethod) && regex.test(path);
+}
+var FaultInjector = class {
+  service;
+  active = { rules: [] };
+  compiled = [];
+  random = Math.random;
+  constructor(service, config) {
+    this.service = service;
+    if (config !== void 0) {
+      this.set(config);
+    }
+  }
+  set(config) {
+    this.active = normalizeFaults(this.service, config);
+    this.compiled = this.active.rules.map((rule) => ({ rule, test: compileMatch(rule.match) }));
+    this.random = this.active.seed === void 0 ? Math.random : seededRandom(this.active.seed);
+    return this.current();
+  }
+  clear() {
+    this.set([]);
+  }
+  current() {
+    return structuredClone(this.active);
+  }
+  /**
+   * Wrap a fetch handler: delay and short-circuit matching requests. Control,
+   * inspector, and font paths are exempt, so opening the inspector never
+   * shifts the seeded sequence.
+   */
+  wrap(fetch2) {
+    return async (request) => {
+      if (this.compiled.length === 0) {
+        return fetch2(request);
+      }
+      const path = new URL(request.url).pathname;
+      if (path.startsWith("/_baseline") || path.startsWith("/_inspector") || path.startsWith("/fonts/")) {
+        return fetch2(request);
+      }
+      let delay = 0;
+      let response;
+      for (const { rule, test } of this.compiled) {
+        if (!test(request.method, path)) {
+          continue;
+        }
+        if (rule.rate !== void 0 && rule.rate < 1 && this.random() >= rule.rate) {
+          continue;
+        }
+        delay += rule.latency_ms ?? 0;
+        if (rule.response && !response) {
+          ({ response } = rule);
+        }
+      }
+      if (delay > 0) {
+        await new Promise((resolve2) => setTimeout(resolve2, Math.min(delay, MAX_DELAY_MS)));
+      }
+      if (!response) {
+        return fetch2(request);
+      }
+      const headers = new Headers({ "X-Baseline-Fault": "injected", ...response.headers });
+      if (response.body === void 0) {
+        return new Response(null, { status: response.status, headers });
+      }
+      if (typeof response.body === "string") {
+        return new Response(response.body, { status: response.status, headers });
+      }
+      headers.set("Content-Type", "application/json");
+      return new Response(JSON.stringify(response.body), { status: response.status, headers });
+    };
+  }
+};
+var WHITESPACE2 = /\s+/;
+function splitName(name) {
+  const [given, ...rest] = name.trim().split(WHITESPACE2);
+  return { given, family: rest.join(" ") || void 0 };
+}
+var lowerCase = (value) => typeof value === "string" ? value.toLowerCase() : void 0;
+var defaultUsername = (email) => email.split("@")[0].replace(/[^A-Za-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "user";
+var compact = (user) => Object.fromEntries(Object.entries(user).filter(([, v]) => v !== void 0));
+function applyIdentities(seed, identities, mapping) {
+  if (!(mapping && identities.length)) {
+    return seed;
+  }
+  const existing = seed?.[mapping.key];
+  if (existing !== void 0 && !Array.isArray(existing)) {
+    return seed;
+  }
+  const users = [...existing ?? []];
+  const seen = new Set(users.map(mapping.match).filter((key) => !!key));
+  for (const identity of identities) {
+    const { override, ...person } = identity;
+    if (override === false) {
+      continue;
+    }
+    const user = compact({
+      ...mapping.user({ ...person, username: person.username ?? defaultUsername(person.email) }),
+      ...override ?? {}
+    });
+    const key = mapping.match(user);
+    if (key && seen.has(key)) {
+      continue;
+    }
+    if (key) {
+      seen.add(key);
+    }
+    users.push(user);
+  }
+  return { ...seed, [mapping.key]: users };
+}
+var DEFAULT_DOCS_URL = "https://docs.deploybaseline.com";
+function getDocsUrl(c) {
+  return c.get("docsUrl") ?? DEFAULT_DOCS_URL;
+}
+function errorStatus(err) {
+  if (err && typeof err === "object" && "status" in err) {
+    const s = err.status;
+    if (typeof s === "number" && Number.isFinite(s)) {
+      return s;
+    }
+  }
+  return 500;
+}
+function createApiErrorHandler(documentationUrl) {
+  return (err, c) => {
+    if (documentationUrl) {
+      c.set("docsUrl", documentationUrl);
+    }
+    const status = errorStatus(err);
+    const message2 = err instanceof Error ? err.message : "Internal Server Error";
+    const errors = err instanceof ApiError && err.errors?.length ? { errors: err.errors } : {};
+    return c.json(
+      {
+        message: message2,
+        ...errors,
+        documentation_url: getDocsUrl(c)
+      },
+      status
+    );
+  };
+}
+function createErrorHandler(documentationUrl) {
+  return async (c, next) => {
+    if (documentationUrl) {
+      c.set("docsUrl", documentationUrl);
+    }
+    await next();
+  };
+}
+var errorHandler = createErrorHandler();
+var ApiError = class extends Error {
+  status;
+  /** Detail entries, sent as `errors`: GitHub's `{ resource, field, code }` objects, or plain messages. */
+  errors;
+  constructor(status, message2, errors, options) {
+    super(message2, options);
+    this.status = status;
+    this.errors = errors;
+    this.name = "ApiError";
+  }
+};
+var BASIC_SCHEME = /^basic /i;
+var ALGS = ["RS256", "ES256"];
+function signingKeyStoreKey(service) {
+  return `${service}.signing_keys`;
+}
+var inflight = /* @__PURE__ */ new WeakMap();
+var privateKeys = /* @__PURE__ */ new WeakMap();
+function isRecord3(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const v = value;
+  return typeof v.kid === "string" && ALGS.includes(v.alg) && typeof v.private_jwk === "object" && v.private_jwk !== null && typeof v.public_jwk === "object" && v.public_jwk !== null;
+}
+function importPrivateJwk(jwk) {
+  return createPrivateKey({ key: jwk, format: "jwk" });
+}
+function publicJwkOf(privateKey) {
+  const jwk = createPublicKey2(privateKey).export({ format: "jwk" });
+  if (jwk.kty === "EC") {
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  }
+  return { kty: jwk.kty, n: jwk.n, e: jwk.e };
+}
+function toSigningKey(record) {
+  let privateKey = privateKeys.get(record);
+  if (!privateKey) {
+    privateKey = importPrivateJwk(record.private_jwk);
+    privateKeys.set(record, privateKey);
+  }
+  return {
+    kid: record.kid,
+    alg: record.alg,
+    privateKey,
+    publicJwk: { ...record.public_jwk, kid: record.kid, use: "sig", alg: record.alg }
+  };
+}
+async function generateRecord(kid, alg) {
+  const privateKey = await new Promise((resolve2, reject) => {
+    const done = (error, _publicKey, key) => error ? reject(error) : resolve2(key);
+    if (alg === "ES256") {
+      generateKeyPair("ec", { namedCurve: "P-256" }, done);
+    } else {
+      generateKeyPair("rsa", { modulusLength: 2048 }, done);
+    }
+  });
+  return {
+    kid,
+    alg,
+    private_jwk: privateKey.export({ format: "jwk" }),
+    public_jwk: publicJwkOf(privateKey)
+  };
+}
+async function createSigningKeys(store, options) {
+  const storeKey = signingKeyStoreKey(options.service);
+  const existing = store.getData(storeKey);
+  if (isRecord3(existing)) {
+    return toSigningKey(existing);
+  }
+  let pending = inflight.get(store);
+  if (!pending) {
+    pending = /* @__PURE__ */ new Map();
+    inflight.set(store, pending);
+  }
+  let generation = pending.get(storeKey);
+  if (!generation) {
+    const map = pending;
+    generation = generateRecord(options.kid, options.alg ?? "RS256").then((record) => {
+      const current = store.getData(storeKey);
+      if (isRecord3(current)) {
+        return current;
+      }
+      store.setData(storeKey, record);
+      return record;
+    }).finally(() => map.delete(storeKey));
+    pending.set(storeKey, generation);
+  }
+  return toSigningKey(await generation);
+}
+function seedSigningKey(store, options, seed) {
+  const jwk = seed?.private_jwk;
+  const alg = options.alg ?? "RS256";
+  const ec = alg === "ES256";
+  if (!jwk || typeof jwk !== "object" || jwk.kty !== (ec ? "EC" : "RSA") || ec && jwk.crv !== "P-256" || typeof jwk.d !== "string") {
+    throw new Error(
+      ec ? `${options.service}.signing_key.private_jwk must be a P-256 EC private JWK (kty "EC", crv "P-256" with "d")` : `${options.service}.signing_key.private_jwk must be an RSA private JWK (kty "RSA" with "d")`
+    );
+  }
+  let privateKey;
+  try {
+    privateKey = importPrivateJwk(jwk);
+  } catch (error) {
+    throw new Error(`${options.service}.signing_key.private_jwk is not a valid ${ec ? "EC" : "RSA"} private key`, {
+      cause: error
+    });
+  }
+  const kid = typeof jwk.kid === "string" && jwk.kid ? jwk.kid : options.kid;
+  const record = {
+    kid,
+    alg,
+    private_jwk: privateKey.export({ format: "jwk" }),
+    public_jwk: publicJwkOf(privateKey)
+  };
+  store.setData(signingKeyStoreKey(options.service), record);
+  return record;
+}
+async function jwksDocument(store, options) {
+  const key = await createSigningKeys(store, options);
+  return { keys: [key.publicJwk] };
+}
+async function signJwt(store, key, claims, options) {
+  const { kid, alg, privateKey } = await createSigningKeys(store, key);
+  const builder = new SignJWT(claims).setProtectedHeader({ alg, kid, typ: "JWT" });
+  if (options.issuer !== void 0) {
+    builder.setIssuer(options.issuer);
+  }
+  if (options.audience !== void 0) {
+    builder.setAudience(options.audience);
+  }
+  if (options.subject !== void 0) {
+    builder.setSubject(options.subject);
+  }
+  builder.setIssuedAt(options.issuedAt);
+  if (options.notBefore !== void 0) {
+    builder.setNotBefore(options.notBefore);
+  }
+  if (options.expiresIn !== null) {
+    builder.setExpirationTime(options.expiresIn ?? "1h");
+  }
+  return builder.sign(privateKey);
+}
+function issueIdToken(store, key, claims, options) {
+  return signJwt(store, key, claims, options);
+}
+function pendingCodes(store, service) {
+  const storeKey = `${service}.oauth.pendingCodes`;
+  let map = store.getData(storeKey);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    store.setData(storeKey, map);
+  }
+  return map;
+}
+function basicClientCredentials(header) {
+  if (!(header && BASIC_SCHEME.test(header))) {
+    return null;
+  }
+  const decoded = Buffer.from(header.slice(6).trim(), "base64").toString("utf8");
+  const sep = decoded.indexOf(":");
+  if (sep === -1) {
+    return null;
+  }
+  const formDecode = (value) => {
+    try {
+      return decodeURIComponent(value.replace(/\+/g, " "));
+    } catch {
+      return value;
+    }
+  };
+  return { clientId: formDecode(decoded.slice(0, sep)), clientSecret: formDecode(decoded.slice(sep + 1)) };
+}
+function verifyPkce(verifier, challenge, method) {
+  if (!verifier) {
+    return false;
+  }
+  const m = (method ?? "plain").toLowerCase();
+  if (m === "s256") {
+    return createHash2("sha256").update(verifier).digest("base64url") === challenge;
+  }
+  if (m === "plain") {
+    return verifier === challenge;
+  }
+  return false;
+}
+var PROTOCOL_VERSION = 1;
+var FAULT_KINDS = ["latency", "response"];
+function processChannel() {
+  if (typeof process.send !== "function") {
+    throw new Error(
+      "This is a Baseline provider entry. It is started by the Baseline CLI, which talks to it over IPC; run `npx @deploybaseline/cli` instead."
+    );
+  }
+  return {
+    send: (message2) => {
+      if (process.connected) {
+        process.send(message2, void 0, {}, () => {
+        });
+      }
+    },
+    onMessage: (listener) => process.on("message", (message2) => listener(message2)),
+    onDisconnect: (listener) => process.once("disconnect", listener),
+    disconnect: () => {
+      if (process.connected) {
+        process.disconnect();
+      }
+    }
+  };
+}
+function isControlPath(pathname) {
+  return ["control", "faults", "state"].some(
+    (root) => pathname === `/_baseline/${root}` || pathname.startsWith(`/_baseline/${root}/`)
+  );
+}
+async function toWireRequest(request) {
+  const body = ["GET", "HEAD"].includes(request.method) ? void 0 : Buffer.from(await request.arrayBuffer());
+  return {
+    method: request.method,
+    url: request.url,
+    headers: [...request.headers],
+    ...body?.length ? { body: body.toString("base64") } : {}
+  };
+}
+function fromWireResponse(wire) {
+  const headers = new Headers();
+  for (const [name, value] of wire.headers) {
+    headers.append(name, value);
+  }
+  const body = wire.body !== void 0 && ![204, 304].includes(wire.status) ? Buffer.from(wire.body, "base64") : null;
+  return new Response(body, { status: wire.status, headers });
+}
+var ProviderError = class extends Error {
+  code;
+  name = "ProviderError";
+  constructor(code, message2, options) {
+    super(message2, options);
+    this.code = code;
+  }
+};
+function serializeValue(value) {
+  if (value instanceof Map) {
+    return { __type: "Map", entries: [...value.entries()].map(([k, v]) => [k, serializeValue(v)]) };
+  }
+  if (value instanceof Set) {
+    return { __type: "Set", values: [...value.values()] };
+  }
+  return value;
+}
+function deserializeValue(value) {
+  if (value !== null && typeof value === "object" && "__type" in value) {
+    const tagged = value;
+    if (tagged.__type === "Map") {
+      const entries = tagged.entries;
+      return new Map(entries.map(([k, v]) => [k, deserializeValue(v)]));
+    }
+    if (tagged.__type === "Set") {
+      return new Set(tagged.values);
+    }
+  }
+  return value;
+}
+var Collection = class {
+  items = /* @__PURE__ */ new Map();
+  indexes = /* @__PURE__ */ new Map();
+  autoId = 1;
+  fieldNames;
+  indexFields;
+  /** Called after every change, so the owning store can count revisions. */
+  onChange;
+  constructor(indexFields = [], onChange = () => {
+  }) {
+    this.indexFields = indexFields;
+    this.onChange = onChange;
+    this.fieldNames = indexFields.map(String).sort();
+    for (const field of indexFields) {
+      this.indexes.set(String(field), /* @__PURE__ */ new Map());
+    }
+  }
+  addToIndex(item) {
+    for (const field of this.indexFields) {
+      const value = item[field];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      const indexMap = this.indexes.get(String(field));
+      const key = String(value);
+      if (!indexMap.has(key)) {
+        indexMap.set(key, /* @__PURE__ */ new Set());
+      }
+      indexMap.get(key).add(item.id);
+    }
+  }
+  removeFromIndex(item) {
+    for (const field of this.indexFields) {
+      const value = item[field];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      const indexMap = this.indexes.get(String(field));
+      const key = String(value);
+      indexMap.get(key)?.delete(item.id);
+    }
+  }
+  insert(data) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const explicitId = data.id !== null && data.id !== void 0 && data.id > 0 ? data.id : void 0;
+    let id;
+    if (explicitId === void 0) {
+      id = this.autoId;
+      this.autoId += 1;
+    } else {
+      id = explicitId;
+    }
+    if (id >= this.autoId) {
+      this.autoId = id + 1;
+    }
+    const item = {
+      ...data,
+      id,
+      created_at: now,
+      updated_at: now
+    };
+    this.items.set(id, item);
+    this.addToIndex(item);
+    this.onChange();
+    return item;
+  }
+  get(id) {
+    return this.items.get(id);
+  }
+  findBy(field, value) {
+    if (this.indexes.has(String(field))) {
+      const ids = this.indexes.get(String(field)).get(String(value));
+      if (!ids) {
+        return [];
+      }
+      return Array.from(ids).map((id) => this.items.get(id)).filter(Boolean);
+    }
+    return this.all().filter((item) => item[field] === value);
+  }
+  findOneBy(field, value) {
+    return this.findBy(field, value)[0];
+  }
+  update(id, data) {
+    const existing = this.items.get(id);
+    if (!existing) {
+      return void 0;
+    }
+    this.removeFromIndex(existing);
+    const updated = {
+      ...existing,
+      ...data,
+      id,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.items.set(id, updated);
+    this.addToIndex(updated);
+    this.onChange();
+    return updated;
+  }
+  delete(id) {
+    const existing = this.items.get(id);
+    if (!existing) {
+      return false;
+    }
+    this.removeFromIndex(existing);
+    this.items.delete(id);
+    this.onChange();
+    return true;
+  }
+  all() {
+    return Array.from(this.items.values());
+  }
+  query(options = {}) {
+    let results = this.all();
+    if (options.filter) {
+      results = results.filter(options.filter);
+    }
+    const total_count = results.length;
+    if (options.sort) {
+      results.sort(options.sort);
+    }
+    const page = options.page ?? 1;
+    const per_page = Math.min(options.per_page ?? 30, 100);
+    const start = (page - 1) * per_page;
+    const paged = results.slice(start, start + per_page);
+    return {
+      items: paged,
+      total_count,
+      page,
+      per_page,
+      has_next: start + per_page < total_count,
+      has_prev: page > 1
+    };
+  }
+  count(filter) {
+    if (!filter) {
+      return this.items.size;
+    }
+    return this.all().filter(filter).length;
+  }
+  clear() {
+    this.items.clear();
+    for (const indexMap of this.indexes.values()) {
+      indexMap.clear();
+    }
+    this.autoId = 1;
+    this.onChange();
+  }
+  snapshot() {
+    return {
+      items: this.all(),
+      autoId: this.autoId,
+      indexFields: this.fieldNames
+    };
+  }
+  restore(snap) {
+    this.clear();
+    this.autoId = snap.autoId;
+    for (const item of snap.items) {
+      this.items.set(item.id, item);
+      this.addToIndex(item);
+    }
+  }
+};
+var Store = class {
+  collections = /* @__PURE__ */ new Map();
+  _data = /* @__PURE__ */ new Map();
+  _revision = 0;
+  /**
+   * Increases on every collection change, `setData`, `reset`, and `restore`.
+   * Runners compare it before and after a request to decide whether to save.
+   * Mutating an object returned by `getData` in place does not count.
+   */
+  get revision() {
+    return this._revision;
+  }
+  touch = () => {
+    this._revision += 1;
+  };
+  collection(name, indexFields = []) {
+    const existing = this.collections.get(name);
+    if (existing) {
+      if (indexFields.length > 0) {
+        const requested = indexFields.map(String).sort();
+        if (existing.fieldNames.length !== requested.length || existing.fieldNames.some((f, i) => f !== requested[i])) {
+          throw new Error(
+            `Collection "${name}" already exists with indexes [${existing.fieldNames}] but was requested with [${requested}]`
+          );
+        }
+      }
+      return existing;
+    }
+    const col = new Collection(indexFields, this.touch);
+    this.collections.set(name, col);
+    return col;
+  }
+  hasCollection(name) {
+    return this.collections.has(name);
+  }
+  getData(key) {
+    return this._data.get(key);
+  }
+  setData(key, value) {
+    this._data.set(key, value);
+    this.touch();
+  }
+  reset() {
+    for (const collection of this.collections.values()) {
+      collection.clear();
+    }
+    this._data.clear();
+    this.touch();
+  }
+  snapshot() {
+    const collections = {};
+    for (const [name, col] of this.collections) {
+      collections[name] = col.snapshot();
+    }
+    const data = {};
+    for (const [key, value] of this._data) {
+      data[key] = serializeValue(value);
+    }
+    return { collections, data };
+  }
+  restore(snap) {
+    const snapshotNames = new Set(Object.keys(snap.collections));
+    for (const name of this.collections.keys()) {
+      if (!snapshotNames.has(name)) {
+        this.collections.delete(name);
+      }
+    }
+    for (const [name, colSnap] of Object.entries(snap.collections)) {
+      const indexFields = colSnap.indexFields;
+      const col = this.collection(name, indexFields);
+      col.restore(colSnap);
+    }
+    this._data.clear();
+    for (const [key, value] of Object.entries(snap.data)) {
+      this._data.set(key, deserializeValue(value));
+    }
+    this.touch();
+  }
+};
+function createServer(plugin, options = {}) {
+  const port = options.port ?? 4e3;
+  const baseUrl = options.baseUrl ?? `http://localhost:${port}`;
+  const app = new Hono();
+  const store = new Store();
+  const webhooks = new WebhookDispatcher();
+  const tokenMap = /* @__PURE__ */ new Map();
+  if (options.tokens) {
+    for (const [token, user] of Object.entries(options.tokens)) {
+      tokenMap.set(token, {
+        login: user.login,
+        id: user.id,
+        scopes: user.scopes ?? ["repo", "user", "admin:org", "admin:repo_hook"]
+      });
+    }
+  }
+  const docsUrl = options.docsUrl ?? `https://docs.deploybaseline.com/${plugin.name}`;
+  registerFontRoutes(app);
+  app.onError(createApiErrorHandler(docsUrl));
+  app.use(
+    "*",
+    cors({
+      passThrough: (c) => app.matchedRoute("OPTIONS", new URL(c.req.url).pathname)?.method === "OPTIONS"
+    })
+  );
+  app.use("*", createErrorHandler(docsUrl));
+  app.use("*", authMiddleware(tokenMap, options.appKeyResolver, options.fallbackUser));
+  const rateLimitCounters = /* @__PURE__ */ new Map();
+  let lastPruneAt = Math.floor(Date.now() / 1e3);
+  app.use("*", async (c, next) => {
+    const token = c.get("authToken") ?? "__anonymous__";
+    const now = Math.floor(Date.now() / 1e3);
+    if (now - lastPruneAt > 3600) {
+      for (const [key, val] of rateLimitCounters) {
+        if (val.resetAt <= now) {
+          rateLimitCounters.delete(key);
+        }
+      }
+      lastPruneAt = now;
+    }
+    let counter = rateLimitCounters.get(token);
+    if (!counter || counter.resetAt <= now) {
+      counter = { remaining: 5e3, resetAt: now + 3600 };
+      rateLimitCounters.set(token, counter);
+    }
+    counter.remaining = Math.max(0, counter.remaining - 1);
+    c.header("X-RateLimit-Limit", "5000");
+    c.header("X-RateLimit-Remaining", String(counter.remaining));
+    c.header("X-RateLimit-Reset", String(counter.resetAt));
+    c.header("X-RateLimit-Resource", "core");
+    if (counter.remaining === 0) {
+      return c.json(
+        {
+          message: "API rate limit exceeded",
+          documentation_url: docsUrl
+        },
+        403
+      );
+    }
+    await next();
+  });
+  plugin.register(app, store, webhooks, baseUrl, tokenMap);
+  app.notFound(
+    (c) => c.json(
+      {
+        message: "Not Found",
+        documentation_url: docsUrl
+      },
+      404
+    )
+  );
+  return { app, store, webhooks, port, baseUrl, tokenMap };
+}
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var STOP_TIMEOUT_MS = 4e3;
+function runProvider(manifest, options = {}) {
+  const channel = options.channel ?? processChannel();
+  const exit = options.exit ?? ((code) => process.exit(code));
+  const version = options.version ?? readVersion(options.packageUrl);
+  let running;
+  let welcomed = false;
+  let stopping = false;
+  let finish;
+  const done = new Promise((resolve2) => {
+    finish = resolve2;
+  });
+  let nextControlId = 1;
+  const controls = /* @__PURE__ */ new Map();
+  let queue = Promise.resolve();
+  const send = (message2) => channel.send(message2);
+  const fail = (id, error) => {
+    const code = error instanceof ProviderError ? error.code : "internal";
+    send({ type: "error", ...id === void 0 ? {} : { id }, code, message: describe(error) });
+  };
+  const end = (code) => {
+    channel.disconnect();
+    finish(code);
+    exit(code);
+  };
+  channel.onMessage((message2) => {
+    if (message2.type === "control-response") {
+      const resolve2 = controls.get(message2.id);
+      controls.delete(message2.id);
+      resolve2?.(message2.response);
+      return;
+    }
+    if (message2.type === "welcome") {
+      welcomed = true;
+      return;
+    }
+    queue = queue.then(async () => {
+      if (stopping) {
+        return;
+      }
+      try {
+        if (!welcomed) {
+          throw new ProviderError("bad_request", `Expected welcome before ${message2.type}`);
+        }
+        await handle(message2);
+      } catch (error) {
+        fail("id" in message2 ? message2.id : void 0, error);
+      }
+    });
+  });
+  channel.onDisconnect(() => {
+    if (stopping) {
+      return;
+    }
+    stopping = true;
+    for (const resolve2 of controls.values()) {
+      resolve2(hostGone());
+    }
+    controls.clear();
+    const timer = setTimeout(() => end(1), STOP_TIMEOUT_MS);
+    timer.unref?.();
+    shutdown().catch(() => {
+    }).finally(() => {
+      clearTimeout(timer);
+      end(0);
+    });
+  });
+  send({
+    type: "hello",
+    protocol: PROTOCOL_VERSION,
+    name: manifest.name,
+    version,
+    sdk: SDK_VERSION,
+    stateVersion: manifest.stateVersion,
+    faults: FAULT_KINDS
+  });
+  async function handle(message2) {
+    switch (message2.type) {
+      case "start": {
+        if (running) {
+          throw new ProviderError("bad_request", "Already started");
+        }
+        running = await start(message2);
+        const { port } = running;
+        send({ type: "ready", id: message2.id, secrets, url: running.baseUrl, ...port === void 0 ? {} : { port } });
+        return;
+      }
+      case "listen": {
+        const service = started();
+        const port = service.listener ? service.port : await listen(service, startMessage);
+        send({ type: "listening", id: message2.id, port, url: service.baseUrl });
+        return;
+      }
+      case "snapshot":
+        send({ type: "snapshot", id: message2.id, state: capture(started()) });
+        return;
+      case "restore":
+        restore(started(), message2.state);
+        send({ type: "ok", id: message2.id });
+        return;
+      case "reset": {
+        const { server, seed } = started();
+        for (const [token, user] of server.tokenMap) {
+          if (user.installation) {
+            server.tokenMap.delete(token);
+          }
+        }
+        server.store.reset();
+        server.webhooks.clear();
+        seed();
+        send({ type: "ok", id: message2.id });
+        return;
+      }
+      case "faults":
+        try {
+          started().faults.set(message2.faults);
+        } catch (error) {
+          throw new ProviderError("faults_invalid", describe(error), { cause: error });
+        }
+        send({ type: "ok", id: message2.id });
+        return;
+      case "stop": {
+        stopping = true;
+        const state = await shutdown(message2.snapshot);
+        send({ type: "stopped", id: message2.id, ...state ? { state } : {} });
+        setImmediate(() => end(0));
+        return;
+      }
+      default:
+        throw new ProviderError("bad_request", `Unknown message ${message2.type}`);
+    }
+  }
+  let secrets = [];
+  let startMessage;
+  let loaded;
+  function started() {
+    if (!running) {
+      throw new ProviderError("bad_request", "Not started");
+    }
+    return running;
+  }
+  async function start(message2) {
+    startMessage = message2;
+    loaded = await manifest.load();
+    const service = loaded;
+    let config = applyIdentities(message2.seed, message2.identities ?? [], service.mapIdentity);
+    secrets = (message2.secrets ?? []).map((secret) => ({ ...secret }));
+    if (message2.generateSecrets && config && service.prepareSeed) {
+      try {
+        const prepared = await service.prepareSeed(config, secrets);
+        ({ config } = prepared);
+        secrets = prepared.generatedSecrets;
+      } catch (error) {
+        throw new ProviderError("seed_invalid", describe(error), { cause: error });
+      }
+    }
+    let listener;
+    let { port } = message2;
+    if (message2.listen) {
+      listener = await bind(
+        message2,
+        (request) => handler ? handler(request) : starting(),
+        (...args) => upgrade ? upgrade(...args) : false
+      );
+      port = boundPort(listener, message2.port);
+    }
+    const baseUrl = resolveBaseUrl({
+      service: message2.service,
+      port,
+      baseUrl: message2.baseUrl,
+      seedBaseUrl: message2.serviceBaseUrl
+    });
+    let resolver;
+    const appKeyResolver = service.createAppKeyResolver ? (appId) => resolver(appId) : void 0;
+    const server = createServer(service.plugin, {
+      port,
+      baseUrl,
+      tokens: message2.tokens,
+      appKeyResolver,
+      fallbackUser: manifest.defaultFallback(config)
+    });
+    resolver = service.createAppKeyResolver?.(server.store);
+    const seed = () => {
+      service.plugin.seed?.(server.store, baseUrl);
+      if (config && service.seedFromConfig) {
+        service.seedFromConfig(server.store, baseUrl, config, server.webhooks);
+      }
+    };
+    let faults;
+    try {
+      faults = new FaultInjector(message2.service, message2.faults);
+    } catch (error) {
+      throw new ProviderError("faults_invalid", describe(error), { cause: error });
+    }
+    const result = { config, baseUrl, server, faults, seed, listener, ...listener ? { port } : {} };
+    if (message2.state) {
+      restore(result, message2.state);
+    } else {
+      try {
+        seed();
+      } catch (error) {
+        throw new ProviderError("seed_invalid", describe(error), { cause: error });
+      }
+    }
+    handler = fetchFor(result);
+    upgrade = server.app.handleUpgrade;
+    return result;
+  }
+  let handler;
+  let upgrade;
+  function fetchFor(service) {
+    const { store, app } = service.server;
+    const inner = service.faults.wrap(async (request) => {
+      const { revision } = store;
+      const response = await app.fetch(request);
+      if (MUTATING_METHODS.has(request.method) || store.revision !== revision) {
+        send({ type: "dirty" });
+      }
+      return response;
+    });
+    return async (request) => isControlPath(new URL(request.url).pathname) ? forward(request) : inner(request);
+  }
+  async function forward(request) {
+    if (stopping) {
+      return fromWireResponse(hostGone());
+    }
+    const id = nextControlId;
+    nextControlId += 1;
+    const wire = await toWireRequest(request);
+    const response = await new Promise((resolve2) => {
+      controls.set(id, resolve2);
+      send({ type: "control", id, request: wire });
+    });
+    return fromWireResponse(response);
+  }
+  async function listen(service, message2) {
+    service.listener = await bind(
+      message2,
+      (request) => handler ? handler(request) : starting(),
+      (...args) => upgrade ? upgrade(...args) : false
+    );
+    service.port = boundPort(service.listener, message2.port);
+    return service.port;
+  }
+  function capture(service) {
+    const { store, tokenMap, webhooks } = service.server;
+    return captureServiceState({ store, tokenMap, webhooks }, manifest.stateVersion);
+  }
+  function restore(service, state) {
+    if (state.stateVersion !== manifest.stateVersion) {
+      throw new ProviderError(
+        "state_incompatible",
+        `Saved state for ${startMessage?.service ?? manifest.name} has stateVersion ${state.stateVersion}, but ${manifest.name} ${version} expects ${manifest.stateVersion}.`
+      );
+    }
+    const { store, tokenMap, webhooks } = service.server;
+    try {
+      restoreServiceState({ store, tokenMap, webhooks }, state);
+    } catch (error) {
+      throw new ProviderError("state_invalid", describe(error), { cause: error });
+    }
+  }
+  async function shutdown(snapshot = false) {
+    const service = running;
+    if (!service) {
+      return void 0;
+    }
+    const closing = service.listener ? closeListener(service.listener) : Promise.resolve();
+    const state = snapshot ? capture(service) : void 0;
+    await Promise.all([closing, service.server.app.dispose()]);
+    service.server.webhooks.clear();
+    return state;
+  }
+  return { done };
+}
+function bind(message2, fetch2, upgrade) {
+  const server = serve({ port: message2.port, hostname: message2.hostname, fetch: fetch2, upgrade });
+  return new Promise((resolve2, reject) => {
+    const ready = () => {
+      server.off("error", failed);
+      resolve2(server);
+    };
+    const failed = (error) => {
+      server.off("listening", ready);
+      reject(
+        new ProviderError(
+          error.code === "EADDRINUSE" || error.code === "EACCES" ? "port_in_use" : "internal",
+          error.message
+        )
+      );
+    };
+    server.once("listening", ready);
+    server.once("error", failed);
+  });
+}
+function boundPort(server, fallback) {
+  const address = server.address();
+  return address && typeof address === "object" ? address.port : fallback;
+}
+function closeListener(server) {
+  return new Promise((resolve2) => {
+    server.close(() => resolve2());
+    server.closeAllConnections();
+  });
+}
+var starting = () => Response.json({ error: "Starting" }, { status: 503 });
+var hostGone = () => ({
+  status: 503,
+  headers: [["content-type", "application/json"]],
+  body: Buffer.from(JSON.stringify({ error: "The Baseline host is not available" })).toString("base64")
+});
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function readVersion(url) {
+  if (!url) {
+    return "0.0.0";
+  }
+  try {
+    const pkg = JSON.parse(readFileSync3(url, "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var SQL_STATE_TABLE = "baseline_state";
+var SQL_STATE_SCHEMA = `CREATE TABLE IF NOT EXISTS ${SQL_STATE_TABLE} (
+  name TEXT PRIMARY KEY,
+  format INTEGER NOT NULL,
+  data TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+)`;
+var UPSERT = `INSERT INTO ${SQL_STATE_TABLE} (name, format, data, created_at, updated_at) VALUES (?, ?, ?, ?, ?)
+ON CONFLICT(name) DO UPDATE SET format = excluded.format, data = excluded.data, updated_at = excluded.updated_at`;
+
+export {
+  jwtVerify,
+  importX509,
+  decodeProtectedHeader,
+  decodeJwt,
+  composeService,
+  matchesRedirectUri,
+  constantTimeSecretEqual,
+  bodyStr,
+  debug,
+  escapeHtml,
+  escapeAttr,
+  renderCardPage,
+  renderErrorPage,
+  renderJsonDetails,
+  renderInspectorPage,
+  renderFormPostPage,
+  renderUserButton,
+  renderEmailPreview,
+  recordCoverageHit,
+  recordResponseBody,
+  splitName,
+  lowerCase,
+  createSigningKeys,
+  seedSigningKey,
+  jwksDocument,
+  signJwt,
+  issueIdToken,
+  pendingCodes,
+  basicClientCredentials,
+  verifyPkce,
+  runProvider
+};
+/*!
+ * This HTTP compatibility layer builds on Hono's API and design.
+ * https://github.com/honojs/hono
+ * Copyright (c) 2021 - present, Yusuke Wada and Hono contributors
+ * MIT license: see THIRD_PARTY_NOTICES.md in the repository and npm packages.
+ */
+//# sourceMappingURL=chunk-G7326MH2.js.map