@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/plugin-authorizer/index.js

@@ -0,0 +1,1740 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/plugins/authorizer.ts
+var authorizer_exports = {};
+__export(authorizer_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(authorizer_exports);
+
+// ../infra-client-plugin-sdk/src/contracts/manifest.ts
+var PLUGIN_PERMISSIONS = ["user", "admin"];
+var PLUGIN_MANIFEST_SCHEMA_VERSION = 1;
+var PLUGIN_HOST_API_VERSION = 1;
+var PLUGIN_ACCOUNT_PARAM = "accountNumber";
+var PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+var AWS_ACCOUNT_PATTERN = /^\d{12}$/;
+
+// ../infra-client-plugin-sdk/src/contracts/paths.ts
+var PLUGIN_API_ROOT = "/api/plugins";
+function pluginApiBaseUrl(pluginId) {
+  return `${PLUGIN_API_ROOT}/${pluginId}`;
+}
+function pluginAccountRoot(pluginId) {
+  return `${pluginApiBaseUrl(pluginId)}/accounts/{${PLUGIN_ACCOUNT_PARAM}}`;
+}
+function parsePluginResourcePath(resource) {
+  const prefix = `${PLUGIN_API_ROOT}/`;
+  if (!resource.startsWith(prefix)) return null;
+  const pluginId = resource.slice(prefix.length).split("/")[0];
+  if (!PLUGIN_ID_PATTERN.test(pluginId)) return null;
+  const root = pluginAccountRoot(pluginId);
+  if (resource === root) return { pluginId, routePath: "/" };
+  return resource.startsWith(`${root}/`) ? { pluginId, routePath: resource.slice(root.length) } : null;
+}
+
+// ../infra-client-plugin-sdk/src/contracts/access.ts
+var PLUGIN_TARGET_PREFIX = "plugin#";
+function pluginTargetKey(target) {
+  return `${PLUGIN_TARGET_PREFIX}${target.pluginId}#${target.accountNumber}#${target.permission}`;
+}
+function parsePluginTargetKey(key) {
+  if (!key.startsWith(PLUGIN_TARGET_PREFIX)) return null;
+  const parts = key.slice(PLUGIN_TARGET_PREFIX.length).split("#");
+  if (parts.length !== 3) return null;
+  const [pluginId, accountNumber, permission] = parts;
+  if (!PLUGIN_ID_PATTERN.test(pluginId) || !AWS_ACCOUNT_PATTERN.test(accountNumber)) return null;
+  if (!PLUGIN_PERMISSIONS.includes(permission)) return null;
+  return { pluginId, accountNumber, permission };
+}
+function pluginPermissionsImpliedBy(granted, declared) {
+  if (!declared.includes(granted)) return [];
+  if (granted === "admin" && declared.includes("user")) return ["admin", "user"];
+  return [granted];
+}
+
+// ../infra-client-plugin-sdk/src/contracts/catalog.ts
+function pluginCatalogStatus(record) {
+  if (!record.installed) return "removed";
+  if (record.schemaVersion !== PLUGIN_MANIFEST_SCHEMA_VERSION || record.manifest.hostApiVersion !== PLUGIN_HOST_API_VERSION) {
+    return "unsupported";
+  }
+  return record.manifest.enabled ? "active" : "disabled";
+}
+
+// lambdacode/api/services/access.ts
+var import_client_dynamodb = require("@aws-sdk/client-dynamodb");
+var import_lib_dynamodb = require("@aws-sdk/lib-dynamodb");
+var ddb = import_lib_dynamodb.DynamoDBDocumentClient.from(new import_client_dynamodb.DynamoDBClient({}));
+var ACCESS_TABLE_NAME = process.env.ACCESS_TABLE_NAME;
+var userPrincipal = (sub) => `user#${sub}`;
+var groupPrincipal = (groupId) => `group#${groupId}`;
+var pluginTarget = (pluginId, accountNumber, permission) => pluginTargetKey({ pluginId, accountNumber, permission });
+function parsePrincipal(p) {
+  if (p.startsWith("user#")) return { kind: "user", userId: p.slice(5) };
+  if (p.startsWith("group#")) return { kind: "group", groupId: p.slice(6) };
+  return null;
+}
+function parseTarget(t) {
+  if (t.startsWith("role#")) {
+    const rest = t.slice(5);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "role", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  if (t.startsWith("resource#")) return { kind: "resource", resourceId: t.slice(9) };
+  if (t.startsWith("share#")) return { kind: "share", shareId: t.slice(6) };
+  if (t.startsWith("plugin#")) {
+    const p = parsePluginTargetKey(t);
+    return p ? { kind: "plugin", ...p } : null;
+  }
+  if (t.startsWith("member#")) return { kind: "member", groupId: t.slice(7) };
+  if (t.startsWith("pref#role#")) {
+    const rest = t.slice(10);
+    const hash = rest.indexOf("#");
+    if (hash < 0) return null;
+    return { kind: "pref", accountNumber: rest.slice(0, hash), roleName: rest.slice(hash + 1) };
+  }
+  return null;
+}
+var consistentRead = (opts) => opts.consistent ? { ConsistentRead: true } : {};
+function isExpired(row, now = Date.now()) {
+  return Boolean(row.expiresAt) && !(Date.parse(row.expiresAt) > now);
+}
+async function queryPrincipal(principal, targetPrefix, opts = {}) {
+  const rows = [];
+  let ExclusiveStartKey;
+  do {
+    const page = await ddb.send(
+      new import_lib_dynamodb.QueryCommand({
+        TableName: ACCESS_TABLE_NAME,
+        KeyConditionExpression: targetPrefix ? "principal = :p AND begins_with(#t, :pre)" : "principal = :p",
+        ExpressionAttributeValues: {
+          ":p": principal,
+          ...targetPrefix ? { ":pre": targetPrefix } : {}
+        },
+        ...targetPrefix ? { ExpressionAttributeNames: { "#t": "target" } } : {},
+        ...consistentRead(opts),
+        ExclusiveStartKey
+      })
+    );
+    rows.push(...page?.Items ?? []);
+    ExclusiveStartKey = page?.LastEvaluatedKey;
+  } while (ExclusiveStartKey);
+  return rows;
+}
+function entryOf(target, direct, groups, now) {
+  const d = direct ? { grantedBy: direct.grantedBy, grantedAt: direct.grantedAt, expiresAt: direct.expiresAt } : void 0;
+  const directActive = Boolean(direct && !isExpired(direct, now));
+  const active = directActive || groups.length > 0;
+  return {
+    target,
+    direct: d,
+    groups,
+    active,
+    expiresAt: groups.length === 0 && directActive ? direct?.expiresAt : void 0
+  };
+}
+var BATCH_GET_ATTEMPTS = 5;
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function batchGetAll(table, keys, opts = {}) {
+  const out = [];
+  for (let i = 0; i < keys.length; i += 100) {
+    let chunk = keys.slice(i, i + 100);
+    for (let attempt = 0; chunk.length; attempt++) {
+      if (attempt >= BATCH_GET_ATTEMPTS) {
+        throw new Error(`${table} BatchGet left ${chunk.length} keys unprocessed after ${attempt} attempts`);
+      }
+      if (attempt) await sleep(20 * attempt);
+      const res = await ddb.send(
+        new import_lib_dynamodb.BatchGetCommand({ RequestItems: { [table]: { Keys: chunk, ...consistentRead(opts) } } })
+      );
+      out.push(...res?.Responses?.[table] ?? []);
+      chunk = res?.UnprocessedKeys?.[table]?.Keys ?? [];
+    }
+  }
+  return out;
+}
+async function effectiveForMany(userId, targets, opts = {}) {
+  const out = /* @__PURE__ */ new Map();
+  const wanted = [...new Set(targets)];
+  if (!wanted.length) return out;
+  const [ownWanted, memberships] = await Promise.all([
+    batchGetAll(ACCESS_TABLE_NAME, wanted.map((target) => ({ principal: userPrincipal(userId), target })), opts),
+    queryPrincipal(userPrincipal(userId), "member#", opts)
+  ]);
+  const direct = new Map(ownWanted.map((r) => [r.target, r]));
+  const groupIds = memberships.map((r) => r.target.slice("member#".length));
+  const holding = /* @__PURE__ */ new Map();
+  const keys = groupIds.flatMap((g) => wanted.map((target) => ({ principal: groupPrincipal(g), target })));
+  for (const it of await batchGetAll(ACCESS_TABLE_NAME, keys, opts)) {
+    const row = it;
+    const p = parsePrincipal(row.principal);
+    if (p?.kind !== "group" || isExpired(row)) continue;
+    const list = holding.get(row.target) ?? [];
+    list.push(p.groupId);
+    holding.set(row.target, list);
+  }
+  const now = Date.now();
+  for (const t of wanted) {
+    const d = direct.get(t);
+    const g = holding.get(t) ?? [];
+    if (!d && !g.length) continue;
+    out.set(t, entryOf(t, d, g, now));
+  }
+  return out;
+}
+
+// lambdacode/api/services/auditService.ts
+var import_crypto = require("crypto");
+var import_client_dynamodb2 = require("@aws-sdk/client-dynamodb");
+var import_lib_dynamodb2 = require("@aws-sdk/lib-dynamodb");
+
+// lambdacode/api/services/actorContext.ts
+var import_async_hooks = require("async_hooks");
+var store = new import_async_hooks.AsyncLocalStorage();
+function currentActor() {
+  return store.getStore();
+}
+
+// lambdacode/api/services/auditService.ts
+var ddb2 = import_lib_dynamodb2.DynamoDBDocumentClient.from(new import_client_dynamodb2.DynamoDBClient({}));
+var tableName = () => process.env.AUDIT_TABLE_NAME ?? "";
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var DEFAULT_RETENTION_DAYS = 400;
+var REASON_MAX = 300;
+var NOTE_MAX = 500;
+var AFFECTED_CAP = 50;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function retentionDays() {
+  const n = Number(process.env.AUDIT_RETENTION_DAYS);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_RETENTION_DAYS;
+}
+var UNKNOWN_ACTOR = { kind: "system", id: "system:unknown" };
+var warnedNoTable = false;
+function tableOr() {
+  const table = tableName();
+  if (table) return table;
+  if (!warnedNoTable) {
+    warnedNoTable = true;
+    log("WARN: AUDIT_TABLE_NAME unset \u2014 activity is not recorded");
+  }
+  return void 0;
+}
+function compact(value) {
+  if (Array.isArray(value)) return value.map(compact);
+  if (value && typeof value === "object" && !(value instanceof Set)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v !== void 0) out[k] = compact(v);
+    }
+    return out;
+  }
+  return value;
+}
+var SESSION_ACTIONS = /* @__PURE__ */ new Set(["vpn.connect", "vpn.disconnect"]);
+function toRow(input, now) {
+  const bound = input.actor ?? currentActor();
+  if (!bound) log("ERROR: activity row without a bound actor (missing runAsActor?)", { action: input.action, target: input.target });
+  const actor = bound ?? UNKNOWN_ACTOR;
+  const details = input.details ? { ...input.details } : void 0;
+  if (details?.note !== void 0) details.note = String(details.note).slice(0, NOTE_MAX);
+  if (details?.affected && details.affected.length > AFFECTED_CAP) {
+    details.affectedCount = details.affected.length;
+    details.affected = details.affected.slice(0, AFFECTED_CAP);
+  }
+  if (details?.unchanged && details.unchanged.length > AFFECTED_CAP) {
+    details.unchangedCount = details.unchanged.length;
+    details.unchanged = details.unchanged.slice(0, AFFECTED_CAP);
+  }
+  const accountNumber = input.accountNumber ?? accountOf(input.target);
+  return compact({
+    ...input,
+    eventId: (0, import_crypto.randomUUID)(),
+    outcome: input.outcome ?? "OK",
+    reason: input.reason === void 0 ? void 0 : String(input.reason).slice(0, REASON_MAX),
+    actor: { kind: actor.kind, id: actor.id, name: actor.name, claims: actor.claims && Object.keys(actor.claims).length ? actor.claims : void 0 },
+    accountNumber,
+    details,
+    at: now.toISOString(),
+    day: now.toISOString().slice(0, 10),
+    userId: input.subject?.id,
+    actorId: SESSION_ACTIONS.has(input.action) && input.subject?.kind === "user" ? input.subject.id : actor.id,
+    expiresAt: Math.floor(now.getTime() / 1e3) + retentionDays() * 24 * 60 * 60
+  });
+}
+function accountOf(target) {
+  if (!target) return void 0;
+  const p = parseTarget(target);
+  if (p?.kind === "role" || p?.kind === "plugin") return p.accountNumber;
+  if (target.startsWith("account#")) return target.slice("account#".length);
+  return void 0;
+}
+async function recordEvent(input) {
+  const table = tableOr();
+  if (!table) return;
+  const row = toRow(input, /* @__PURE__ */ new Date());
+  try {
+    await ddb2.send(new import_lib_dynamodb2.PutCommand({ TableName: table, Item: row }));
+    log("activity recorded", { action: row.action, outcome: row.outcome, actor: row.actorId, subject: row.userId, target: row.target, eventId: row.eventId });
+  } catch (err) {
+    log("ERROR: activity write failed (mutation unaffected)", { action: row.action, target: row.target, error: err.message });
+  }
+}
+
+// lambdacode/api/services/pluginCatalog.ts
+var import_client_dynamodb3 = require("@aws-sdk/client-dynamodb");
+var import_lib_dynamodb3 = require("@aws-sdk/lib-dynamodb");
+var ddb3 = import_lib_dynamodb3.DynamoDBDocumentClient.from(new import_client_dynamodb3.DynamoDBClient({}));
+var emptyPluginCatalog = {
+  async list() {
+    return [];
+  },
+  async get() {
+    return void 0;
+  }
+};
+var log2 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+function isPluginCatalogRecord(item) {
+  if (!item || typeof item !== "object") return false;
+  const r = item;
+  const m = r.manifest;
+  return typeof r.pluginId === "string" && typeof r.schemaVersion === "number" && typeof r.installed === "boolean" && typeof r.revision === "string" && !!m && typeof m === "object" && m.id === r.pluginId && typeof m.enabled === "boolean" && typeof m.hostApiVersion === "number" && Array.isArray(m.accounts) && Array.isArray(m.permissions) && Array.isArray(r.routes);
+}
+function dynamoPluginCatalog(tableName2) {
+  const accept = (item) => {
+    if (isPluginCatalogRecord(item)) return item;
+    log2("WARN: malformed plugin catalog record skipped", {
+      pluginId: item?.pluginId
+    });
+    return void 0;
+  };
+  return {
+    async list(opts = {}) {
+      const out = [];
+      let ExclusiveStartKey;
+      do {
+        const page = await ddb3.send(
+          new import_lib_dynamodb3.ScanCommand({ TableName: tableName2, ExclusiveStartKey, ...opts.consistent ? { ConsistentRead: true } : {} })
+        );
+        for (const item of page?.Items ?? []) {
+          const r = accept(item);
+          if (r) out.push(r);
+        }
+        ExclusiveStartKey = page?.LastEvaluatedKey;
+      } while (ExclusiveStartKey);
+      return out;
+    },
+    async get(pluginId, opts = {}) {
+      const res = await ddb3.send(
+        new import_lib_dynamodb3.GetCommand({
+          TableName: tableName2,
+          Key: { pluginId },
+          ...opts.consistent ? { ConsistentRead: true } : {}
+        })
+      );
+      return res.Item ? accept(res.Item) : void 0;
+    }
+  };
+}
+function pluginCatalog() {
+  const table = process.env.PLUGIN_CATALOG_TABLE_NAME;
+  return table ? dynamoPluginCatalog(table) : emptyPluginCatalog;
+}
+
+// lambdacode/api/services/pluginAccess.ts
+function pluginAvailability(record, accountNumber, permission, registeredAccounts2) {
+  if (!record) return { available: false, reason: "plugin-unknown" };
+  const status = pluginCatalogStatus(record);
+  if (status !== "active") return { available: false, reason: `plugin-${status}` };
+  if (!record.manifest.permissions.some((p) => p.id === permission)) {
+    return { available: false, reason: "permission-undeclared" };
+  }
+  if (!record.manifest.accounts.some((a) => a.accountNumber === accountNumber)) {
+    return { available: false, reason: "account-unbound" };
+  }
+  if (!registeredAccounts2.has(accountNumber)) return { available: false, reason: "account-unregistered" };
+  return { available: true };
+}
+function withAccounts(catalog, accounts) {
+  const accountNames = /* @__PURE__ */ new Map();
+  for (const [n, meta] of accounts) if (meta.name) accountNames.set(n, meta.name);
+  return { catalog, registeredAccounts: new Set(accounts.keys()), accountNames };
+}
+function deriveCapabilities(pluginId, accountNumber, held, ctx) {
+  const record = ctx.catalog.get(pluginId);
+  const declared = record?.manifest.permissions.map((p) => p.id) ?? [];
+  const out = [];
+  for (const permission of PLUGIN_PERMISSIONS) {
+    const sources = [...held.values()].filter(
+      (s) => s.permission === permission || pluginPermissionsImpliedBy(s.permission, declared).includes(permission)
+    );
+    if (!sources.length) continue;
+    const a = pluginAvailability(record, accountNumber, permission, ctx.registeredAccounts);
+    out.push({ pluginId, accountNumber, permission, sources, ...a.available ? { available: true } : a });
+  }
+  return out;
+}
+var sourceOf = (permission, direct, groups) => ({
+  permission,
+  ...direct && !isExpired(direct) ? { direct } : {},
+  groups
+});
+var byBindingThenPermission = (a, b) => a.pluginId.localeCompare(b.pluginId) || a.accountNumber.localeCompare(b.accountNumber) || PLUGIN_PERMISSIONS.indexOf(a.permission) - PLUGIN_PERMISSIONS.indexOf(b.permission);
+function resolvePluginCapabilities(entries, ctx) {
+  const byBinding = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    if (!e.active) continue;
+    const p = parseTarget(e.target);
+    if (p?.kind !== "plugin") continue;
+    const key = `${p.pluginId}#${p.accountNumber}`;
+    const b = byBinding.get(key) ?? { pluginId: p.pluginId, accountNumber: p.accountNumber, held: /* @__PURE__ */ new Map() };
+    b.held.set(p.permission, sourceOf(p.permission, e.direct, e.groups));
+    byBinding.set(key, b);
+  }
+  const out = [];
+  for (const b of byBinding.values()) out.push(...deriveCapabilities(b.pluginId, b.accountNumber, b.held, ctx));
+  return out.sort(byBindingThenPermission);
+}
+async function checkPluginPermission(userId, pluginId, accountNumber, required, opts = {}) {
+  const read = { consistent: opts.consistent ?? true };
+  const [record, accounts] = await Promise.all([
+    opts.record ?? (opts.catalog ?? pluginCatalog()).get(pluginId, read),
+    registeredAccounts([accountNumber], read)
+  ]);
+  const ctx = withAccounts(new Map(record ? [[pluginId, record]] : []), accounts);
+  const availability = pluginAvailability(record, accountNumber, required, ctx.registeredAccounts);
+  if (!availability.available) return { allowed: false, reason: availability.reason, record };
+  const targets = PLUGIN_PERMISSIONS.map((p) => pluginTarget(pluginId, accountNumber, p));
+  const held = await effectiveForMany(userId, targets, read);
+  const allowed = resolvePluginCapabilities(held.values(), ctx).some((c) => c.permission === required && c.available);
+  return { allowed, reason: allowed ? "allowed" : "no-grant", record };
+}
+async function registeredAccounts(numbers, opts = {}) {
+  const out = /* @__PURE__ */ new Map();
+  const ids = [...new Set(numbers)];
+  if (!ids.length) return out;
+  const table = process.env.ACCOUNTS_TABLE_NAME;
+  if (!table) throw new Error("ACCOUNTS_TABLE_NAME is not set (plugin catalog readers need the Accounts table)");
+  for (const item of await batchGetAll(table, ids.map((accountNumber) => ({ accountNumber })), opts)) {
+    out.set(item.accountNumber, { name: item.name || void 0 });
+  }
+  return out;
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/error.js
+var JwtBaseError = class extends Error {
+};
+var FailedAssertionError = class extends JwtBaseError {
+  constructor(msg, actual, expected) {
+    super(msg);
+    this.failedAssertion = {
+      actual,
+      expected
+    };
+  }
+};
+var JwtParseError = class extends JwtBaseError {
+  constructor(msg, error) {
+    const message2 = error != null ? `${msg}: ${error}` : msg;
+    super(message2);
+  }
+};
+var ParameterValidationError = class extends JwtBaseError {
+};
+var JwtInvalidSignatureError = class extends JwtBaseError {
+};
+var JwtInvalidSignatureAlgorithmError = class extends FailedAssertionError {
+};
+var JwtInvalidClaimError = class extends FailedAssertionError {
+  withRawJwt({ header, payload }) {
+    this.rawJwt = {
+      header,
+      payload
+    };
+    return this;
+  }
+};
+var JwtInvalidIssuerError = class extends JwtInvalidClaimError {
+};
+var JwtInvalidAudienceError = class extends JwtInvalidClaimError {
+};
+var JwtInvalidScopeError = class extends JwtInvalidClaimError {
+};
+var JwtExpiredError = class extends JwtInvalidClaimError {
+};
+var JwtNotBeforeError = class extends JwtInvalidClaimError {
+};
+var CognitoJwtInvalidGroupError = class extends JwtInvalidClaimError {
+};
+var CognitoJwtInvalidTokenUseError = class extends JwtInvalidClaimError {
+};
+var CognitoJwtInvalidClientIdError = class extends JwtInvalidClaimError {
+};
+var JwksValidationError = class extends JwtBaseError {
+};
+var JwkValidationError = class extends JwtBaseError {
+};
+var JwtWithoutValidKidError = class extends JwtBaseError {
+};
+var KidNotFoundInJwksError = class extends JwtBaseError {
+};
+var WaitPeriodNotYetEndedJwkError = class extends JwtBaseError {
+};
+var JwksNotAvailableInCacheError = class extends JwtBaseError {
+};
+var JwkInvalidUseError = class extends FailedAssertionError {
+};
+var JwkInvalidKtyError = class extends FailedAssertionError {
+};
+var FetchError = class extends JwtBaseError {
+  constructor(uri, msg) {
+    super(`Failed to fetch ${uri}: ${msg}`);
+  }
+};
+var NonRetryableFetchError = class extends FetchError {
+};
+
+// ../../node_modules/aws-jwt-verify/dist/esm/node-web-compat-node.js
+var import_crypto2 = require("crypto");
+
+// ../../node_modules/aws-jwt-verify/dist/esm/asn1.js
+var Asn1Class;
+(function(Asn1Class2) {
+  Asn1Class2[Asn1Class2["Universal"] = 0] = "Universal";
+})(Asn1Class || (Asn1Class = {}));
+var Asn1Encoding;
+(function(Asn1Encoding2) {
+  Asn1Encoding2[Asn1Encoding2["Primitive"] = 0] = "Primitive";
+  Asn1Encoding2[Asn1Encoding2["Constructed"] = 1] = "Constructed";
+})(Asn1Encoding || (Asn1Encoding = {}));
+var Asn1Tag;
+(function(Asn1Tag2) {
+  Asn1Tag2[Asn1Tag2["BitString"] = 3] = "BitString";
+  Asn1Tag2[Asn1Tag2["ObjectIdentifier"] = 6] = "ObjectIdentifier";
+  Asn1Tag2[Asn1Tag2["Sequence"] = 16] = "Sequence";
+  Asn1Tag2[Asn1Tag2["Null"] = 5] = "Null";
+  Asn1Tag2[Asn1Tag2["Integer"] = 2] = "Integer";
+})(Asn1Tag || (Asn1Tag = {}));
+function encodeIdentifier(identifier) {
+  const identifierAsNumber = identifier.class << 7 | identifier.primitiveOrConstructed << 5 | identifier.tag;
+  return Buffer.from([identifierAsNumber]);
+}
+function encodeLength(length) {
+  if (length < 128) {
+    return Buffer.from([length]);
+  }
+  const integers = [];
+  while (length > 0) {
+    integers.push(length % 256);
+    length = length >> 8;
+  }
+  integers.reverse();
+  return Buffer.from([128 | integers.length, ...integers]);
+}
+function encodeBufferAsPositiveInteger(buffer) {
+  if (buffer[0] >> 7) {
+    buffer = Buffer.concat([Buffer.from([0]), buffer]);
+  }
+  return Buffer.concat([
+    encodeIdentifier({
+      class: Asn1Class.Universal,
+      primitiveOrConstructed: Asn1Encoding.Primitive,
+      tag: Asn1Tag.Integer
+    }),
+    encodeLength(buffer.length),
+    buffer
+  ]);
+}
+function encodeObjectIdentifier(oid) {
+  const oidComponents = oid.split(".").map((i) => parseInt(i));
+  const firstSubidentifier = oidComponents[0] * 40 + oidComponents[1];
+  const subsequentSubidentifiers = oidComponents.slice(2).reduce((expanded, component) => {
+    const bytes = [];
+    do {
+      bytes.push(component % 128);
+      component = component >> 7;
+    } while (component);
+    return expanded.concat(bytes.map((b, index) => index ? b + 128 : b).reverse());
+  }, []);
+  const oidBuffer = Buffer.from([
+    firstSubidentifier,
+    ...subsequentSubidentifiers
+  ]);
+  return Buffer.concat([
+    encodeIdentifier({
+      class: Asn1Class.Universal,
+      primitiveOrConstructed: Asn1Encoding.Primitive,
+      tag: Asn1Tag.ObjectIdentifier
+    }),
+    encodeLength(oidBuffer.length),
+    oidBuffer
+  ]);
+}
+function encodeBufferAsBitString(buffer) {
+  const bitString = Buffer.concat([Buffer.from([0]), buffer]);
+  return Buffer.concat([
+    encodeIdentifier({
+      class: Asn1Class.Universal,
+      primitiveOrConstructed: Asn1Encoding.Primitive,
+      tag: Asn1Tag.BitString
+    }),
+    encodeLength(bitString.length),
+    bitString
+  ]);
+}
+function encodeSequence(sequenceItems) {
+  const concatenated = Buffer.concat(sequenceItems);
+  return Buffer.concat([
+    encodeIdentifier({
+      class: Asn1Class.Universal,
+      primitiveOrConstructed: Asn1Encoding.Constructed,
+      tag: Asn1Tag.Sequence
+    }),
+    encodeLength(concatenated.length),
+    concatenated
+  ]);
+}
+function encodeNull() {
+  return Buffer.concat([
+    encodeIdentifier({
+      class: Asn1Class.Universal,
+      primitiveOrConstructed: Asn1Encoding.Primitive,
+      tag: Asn1Tag.Null
+    }),
+    encodeLength(0)
+  ]);
+}
+var ALGORITHM_RSA_ENCRYPTION = encodeSequence([
+  encodeObjectIdentifier("1.2.840.113549.1.1.1"),
+  encodeNull()
+  // parameters
+]);
+function constructPublicKeyInDerFormat(n, e) {
+  return encodeSequence([
+    ALGORITHM_RSA_ENCRYPTION,
+    encodeBufferAsBitString(encodeSequence([
+      encodeBufferAsPositiveInteger(n),
+      encodeBufferAsPositiveInteger(e)
+    ]))
+  ]);
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/https-node.js
+var import_https = require("https");
+
+// ../../node_modules/aws-jwt-verify/dist/esm/https-common.js
+function validateHttpsJsonResponse(uri, statusCode, contentType) {
+  if (statusCode === 429) {
+    throw new FetchError(uri, "Too many requests");
+  } else if (statusCode !== 200) {
+    throw new NonRetryableFetchError(uri, `Status code is ${statusCode}, expected 200`);
+  }
+  if (!contentType || !contentType.toLowerCase().startsWith("application/json")) {
+    throw new NonRetryableFetchError(uri, `Content-type is "${contentType}", expected "application/json"`);
+  }
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/https-node.js
+var import_stream = require("stream");
+var import_util = require("util");
+
+// ../../node_modules/aws-jwt-verify/dist/esm/safe-json-parse.js
+function isJsonObject(j) {
+  return typeof j === "object" && !Array.isArray(j) && j !== null;
+}
+function safeJsonParse(s) {
+  return JSON.parse(s, (_, value) => {
+    if (typeof value === "object" && !Array.isArray(value) && value !== null) {
+      delete value.__proto__;
+      delete value.constructor;
+    }
+    return value;
+  });
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/https-node.js
+async function fetchJson(uri, requestOptions, data) {
+  let responseTimeout;
+  return new Promise((resolve, reject) => {
+    const req = (0, import_https.request)(uri, {
+      method: "GET",
+      ...requestOptions
+    }, (response) => {
+      (0, import_stream.pipeline)([
+        response,
+        getJsonDestination(uri, response.statusCode, response.headers)
+      ], done);
+    });
+    if (requestOptions?.responseTimeout) {
+      responseTimeout = setTimeout(() => done(new FetchError(uri, `Response time-out (after ${requestOptions.responseTimeout} ms.)`)), requestOptions.responseTimeout);
+      responseTimeout.unref();
+    }
+    function done(...args) {
+      if (responseTimeout)
+        clearTimeout(responseTimeout);
+      if (args[0] == null) {
+        resolve(args[1]);
+        return;
+      }
+      req.socket?.emit("agentRemove");
+      let error = args[0];
+      if (!(error instanceof FetchError)) {
+        error = new FetchError(uri, error.message);
+      }
+      req.destroy();
+      reject(error);
+    }
+    req.on("error", done);
+    req.end(data);
+  });
+}
+function getJsonDestination(uri, statusCode, headers) {
+  return async (responseIterable) => {
+    validateHttpsJsonResponse(uri, statusCode, headers["content-type"]);
+    const collected = [];
+    for await (const chunk of responseIterable) {
+      collected.push(chunk);
+    }
+    try {
+      return safeJsonParse(new import_util.TextDecoder("utf8", { fatal: true, ignoreBOM: true }).decode(Buffer.concat(collected)));
+    } catch (err) {
+      throw new NonRetryableFetchError(uri, err);
+    }
+  };
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/node-web-compat-node.js
+var JwtSignatureAlgorithms;
+(function(JwtSignatureAlgorithms2) {
+  JwtSignatureAlgorithms2["RS256"] = "RSA-SHA256";
+  JwtSignatureAlgorithms2["RS384"] = "RSA-SHA384";
+  JwtSignatureAlgorithms2["RS512"] = "RSA-SHA512";
+})(JwtSignatureAlgorithms || (JwtSignatureAlgorithms = {}));
+var nodeWebCompat = {
+  fetchJson,
+  transformJwkToKeyObjectSync: (jwk) => (0, import_crypto2.createPublicKey)({
+    key: constructPublicKeyInDerFormat(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+    format: "der",
+    type: "spki"
+  }),
+  transformJwkToKeyObjectAsync: async (jwk) => (0, import_crypto2.createPublicKey)({
+    key: constructPublicKeyInDerFormat(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+    format: "der",
+    type: "spki"
+  }),
+  parseB64UrlString: (b64) => Buffer.from(b64, "base64").toString("utf8"),
+  verifySignatureSync: ({ alg, keyObject, jwsSigningInput, signature }) => (
+    // eslint-disable-next-line security/detect-object-injection
+    (0, import_crypto2.createVerify)(JwtSignatureAlgorithms[alg]).update(jwsSigningInput).verify(keyObject, signature, "base64")
+  ),
+  verifySignatureAsync: async ({ alg, keyObject, jwsSigningInput, signature }) => (
+    // eslint-disable-next-line security/detect-object-injection
+    (0, import_crypto2.createVerify)(JwtSignatureAlgorithms[alg]).update(jwsSigningInput).verify(keyObject, signature, "base64")
+  ),
+  defaultFetchTimeouts: {
+    socketIdle: 500,
+    response: 1500
+  },
+  setTimeoutUnref: (...args) => setTimeout(...args).unref()
+};
+
+// ../../node_modules/aws-jwt-verify/dist/esm/https.js
+var fetchJson2 = nodeWebCompat.fetchJson;
+var SimpleJsonFetcher = class {
+  constructor(props) {
+    this.defaultRequestOptions = {
+      timeout: nodeWebCompat.defaultFetchTimeouts.socketIdle,
+      responseTimeout: nodeWebCompat.defaultFetchTimeouts.response,
+      ...props?.defaultRequestOptions
+    };
+  }
+  /**
+   * Execute a HTTPS request (with 1 immediate retry in case of errors)
+   * @param uri - The URI
+   * @param requestOptions - The RequestOptions to use
+   * @param data - Data to send to the URI (e.g. POST data)
+   * @returns - The response as parsed JSON
+   */
+  async fetch(uri, requestOptions, data) {
+    requestOptions = { ...this.defaultRequestOptions, ...requestOptions };
+    try {
+      return await fetchJson2(uri, requestOptions, data);
+    } catch (err) {
+      if (err instanceof NonRetryableFetchError) {
+        throw err;
+      }
+      return fetchJson2(uri, requestOptions, data);
+    }
+  }
+};
+
+// ../../node_modules/aws-jwt-verify/dist/esm/assert.js
+function assertStringEquals(name, actual, expected, errorConstructor = FailedAssertionError) {
+  if (!actual) {
+    throw new errorConstructor(`Missing ${name}. Expected: ${expected}`, actual, expected);
+  }
+  if (typeof actual !== "string") {
+    throw new errorConstructor(`${name} is not of type string`, actual, expected);
+  }
+  if (expected !== actual) {
+    throw new errorConstructor(`${name} not allowed: ${actual}. Expected: ${expected}`, actual, expected);
+  }
+}
+function assertStringArrayContainsString(name, actual, expected, errorConstructor = FailedAssertionError) {
+  if (!actual) {
+    throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+  }
+  if (typeof actual !== "string") {
+    throw new errorConstructor(`${name} is not of type string`, actual, expected);
+  }
+  return assertStringArraysOverlap(name, actual, expected, errorConstructor);
+}
+function assertStringArraysOverlap(name, actual, expected, errorConstructor = FailedAssertionError) {
+  if (!actual) {
+    throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+  }
+  const expectedAsSet = new Set(Array.isArray(expected) ? expected : [expected]);
+  if (typeof actual === "string") {
+    actual = [actual];
+  }
+  if (!Array.isArray(actual)) {
+    throw new errorConstructor(`${name} is not an array`, actual, expected);
+  }
+  const overlaps = actual.some((actualItem) => {
+    if (typeof actualItem !== "string") {
+      throw new errorConstructor(`${name} includes elements that are not of type string`, actual, expected);
+    }
+    return expectedAsSet.has(actualItem);
+  });
+  if (!overlaps) {
+    throw new errorConstructor(`${name} not allowed: ${actual.join(", ")}. ${expectationMessage(expected)}`, actual, expected);
+  }
+}
+function expectationMessage(expected) {
+  if (Array.isArray(expected)) {
+    if (expected.length > 1) {
+      return `Expected one of: ${expected.join(", ")}`;
+    }
+    return `Expected: ${expected[0]}`;
+  }
+  return `Expected: ${expected}`;
+}
+function assertIsNotPromise(actual, errorFactory) {
+  if (actual && typeof actual.then === "function") {
+    throw errorFactory();
+  }
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/jwk.js
+var optionalJwkFieldNames = [
+  "use",
+  "alg",
+  "kid",
+  "n",
+  "e"
+  // https://datatracker.ietf.org/doc/html/rfc7518#section-6.3.1.2
+];
+var mandatoryJwkFieldNames = [
+  "kty"
+  // https://datatracker.ietf.org/doc/html/rfc7517#section-4.1
+];
+function findJwkInJwks(jwks, kid) {
+  return jwks.keys.find((jwk) => jwk.kid != null && jwk.kid === kid);
+}
+async function fetchJwks(jwksUri) {
+  const jwks = await fetchJson2(jwksUri);
+  assertIsJwks(jwks);
+  return jwks;
+}
+async function fetchJwk(jwksUri, decomposedJwt) {
+  if (!decomposedJwt.header.kid) {
+    throw new JwtWithoutValidKidError("JWT header does not have valid kid claim");
+  }
+  const jwks = await fetchJwks(jwksUri);
+  const jwk = findJwkInJwks(jwks, decomposedJwt.header.kid);
+  if (!jwk) {
+    throw new KidNotFoundInJwksError(`JWK for kid "${decomposedJwt.header.kid}" not found in the JWKS`);
+  }
+  return jwk;
+}
+function assertIsJwks(jwks) {
+  if (!jwks) {
+    throw new JwksValidationError("JWKS empty");
+  }
+  if (!isJsonObject(jwks)) {
+    throw new JwksValidationError("JWKS should be an object");
+  }
+  if (!Object.keys(jwks).includes("keys")) {
+    throw new JwksValidationError("JWKS does not include keys");
+  }
+  if (!Array.isArray(jwks.keys)) {
+    throw new JwksValidationError("JWKS keys should be an array");
+  }
+  for (const jwk of jwks.keys) {
+    assertIsJwk(jwk);
+  }
+}
+function assertIsRsaSignatureJwk(jwk) {
+  assertStringEquals("JWK use", jwk.use, "sig", JwkInvalidUseError);
+  assertStringEquals("JWK kty", jwk.kty, "RSA", JwkInvalidKtyError);
+  if (!jwk.n)
+    throw new JwkValidationError("Missing modulus (n)");
+  if (!jwk.e)
+    throw new JwkValidationError("Missing exponent (e)");
+}
+function assertIsJwk(jwk) {
+  if (!jwk) {
+    throw new JwkValidationError("JWK empty");
+  }
+  if (!isJsonObject(jwk)) {
+    throw new JwkValidationError("JWK should be an object");
+  }
+  for (const field of mandatoryJwkFieldNames) {
+    if (typeof jwk[field] !== "string") {
+      throw new JwkValidationError(`JWK ${field} should be a string`);
+    }
+  }
+  for (const field of optionalJwkFieldNames) {
+    if (field in jwk && typeof jwk[field] !== "string") {
+      throw new JwkValidationError(`JWK ${field} should be a string`);
+    }
+  }
+}
+function isJwks(jwks) {
+  try {
+    assertIsJwks(jwks);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isJwk(jwk) {
+  try {
+    assertIsJwk(jwk);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var SimplePenaltyBox = class {
+  constructor(props) {
+    this.waitingUris = /* @__PURE__ */ new Map();
+    this.waitSeconds = props?.waitSeconds ?? 10;
+  }
+  async wait(jwksUri) {
+    if (this.waitingUris.has(jwksUri)) {
+      throw new WaitPeriodNotYetEndedJwkError("Not allowed to fetch JWKS yet, still waiting for back off period to end");
+    }
+  }
+  release(jwksUri) {
+    const i = this.waitingUris.get(jwksUri);
+    if (i) {
+      clearTimeout(i);
+      this.waitingUris.delete(jwksUri);
+    }
+  }
+  registerFailedAttempt(jwksUri) {
+    const i = nodeWebCompat.setTimeoutUnref(() => {
+      this.waitingUris.delete(jwksUri);
+    }, this.waitSeconds * 1e3);
+    this.waitingUris.set(jwksUri, i);
+  }
+  registerSuccessfulAttempt(jwksUri) {
+    this.release(jwksUri);
+  }
+};
+var SimpleJwksCache = class {
+  constructor(props) {
+    this.jwksCache = /* @__PURE__ */ new Map();
+    this.fetchingJwks = /* @__PURE__ */ new Map();
+    this.penaltyBox = props?.penaltyBox ?? new SimplePenaltyBox();
+    this.fetcher = props?.fetcher ?? new SimpleJsonFetcher();
+  }
+  addJwks(jwksUri, jwks) {
+    this.jwksCache.set(jwksUri, jwks);
+  }
+  async getJwks(jwksUri) {
+    const existingFetch = this.fetchingJwks.get(jwksUri);
+    if (existingFetch) {
+      return existingFetch;
+    }
+    const jwksPromise = this.fetcher.fetch(jwksUri).then((res) => {
+      assertIsJwks(res);
+      return res;
+    });
+    this.fetchingJwks.set(jwksUri, jwksPromise);
+    let jwks;
+    try {
+      jwks = await jwksPromise;
+    } finally {
+      this.fetchingJwks.delete(jwksUri);
+    }
+    this.jwksCache.set(jwksUri, jwks);
+    return jwks;
+  }
+  getCachedJwk(jwksUri, decomposedJwt) {
+    if (typeof decomposedJwt.header.kid !== "string") {
+      throw new JwtWithoutValidKidError("JWT header does not have valid kid claim");
+    }
+    if (!this.jwksCache.has(jwksUri)) {
+      throw new JwksNotAvailableInCacheError(`JWKS for uri ${jwksUri} not yet available in cache`);
+    }
+    const jwk = findJwkInJwks(this.jwksCache.get(jwksUri), decomposedJwt.header.kid);
+    if (!jwk) {
+      throw new KidNotFoundInJwksError(`JWK for kid ${decomposedJwt.header.kid} not found in the JWKS`);
+    }
+    return jwk;
+  }
+  async getJwk(jwksUri, decomposedJwt) {
+    if (typeof decomposedJwt.header.kid !== "string") {
+      throw new JwtWithoutValidKidError("JWT header does not have valid kid claim");
+    }
+    const cachedJwks = this.jwksCache.get(jwksUri);
+    if (cachedJwks) {
+      const cachedJwk = findJwkInJwks(cachedJwks, decomposedJwt.header.kid);
+      if (cachedJwk) {
+        return cachedJwk;
+      }
+    }
+    await this.penaltyBox.wait(jwksUri, decomposedJwt.header.kid);
+    const jwks = await this.getJwks(jwksUri);
+    const jwk = findJwkInJwks(jwks, decomposedJwt.header.kid);
+    if (!jwk) {
+      this.penaltyBox.registerFailedAttempt(jwksUri, decomposedJwt.header.kid);
+      throw new KidNotFoundInJwksError(`JWK for kid "${decomposedJwt.header.kid}" not found in the JWKS`);
+    } else {
+      this.penaltyBox.registerSuccessfulAttempt(jwksUri, decomposedJwt.header.kid);
+    }
+    return jwk;
+  }
+};
+
+// ../../node_modules/aws-jwt-verify/dist/esm/jwt-model.js
+var supportedSignatureAlgorithms = [
+  "RS256",
+  "RS384",
+  "RS512"
+];
+
+// ../../node_modules/aws-jwt-verify/dist/esm/jwt.js
+function assertJwtHeader(header) {
+  if (!isJsonObject(header)) {
+    throw new JwtParseError("JWT header is not an object");
+  }
+  if (header.alg !== void 0 && typeof header.alg !== "string") {
+    throw new JwtParseError("JWT header alg claim is not a string");
+  }
+  if (header.kid !== void 0 && typeof header.kid !== "string") {
+    throw new JwtParseError("JWT header kid claim is not a string");
+  }
+}
+function assertJwtPayload(payload) {
+  if (!isJsonObject(payload)) {
+    throw new JwtParseError("JWT payload is not an object");
+  }
+  if (payload.exp !== void 0 && !Number.isFinite(payload.exp)) {
+    throw new JwtParseError("JWT payload exp claim is not a number");
+  }
+  if (payload.iss !== void 0 && typeof payload.iss !== "string") {
+    throw new JwtParseError("JWT payload iss claim is not a string");
+  }
+  if (payload.sub !== void 0 && typeof payload.sub !== "string") {
+    throw new JwtParseError("JWT payload sub claim is not a string");
+  }
+  if (payload.aud !== void 0 && typeof payload.aud !== "string" && (!Array.isArray(payload.aud) || payload.aud.some((aud) => typeof aud !== "string"))) {
+    throw new JwtParseError("JWT payload aud claim is not a string or array of strings");
+  }
+  if (payload.nbf !== void 0 && !Number.isFinite(payload.nbf)) {
+    throw new JwtParseError("JWT payload nbf claim is not a number");
+  }
+  if (payload.iat !== void 0 && !Number.isFinite(payload.iat)) {
+    throw new JwtParseError("JWT payload iat claim is not a number");
+  }
+  if (payload.scope !== void 0 && typeof payload.scope !== "string") {
+    throw new JwtParseError("JWT payload scope claim is not a string");
+  }
+  if (payload.jti !== void 0 && typeof payload.jti !== "string") {
+    throw new JwtParseError("JWT payload jti claim is not a string");
+  }
+}
+function decomposeUnverifiedJwt(jwt) {
+  if (!jwt) {
+    throw new JwtParseError("Empty JWT");
+  }
+  if (typeof jwt !== "string") {
+    throw new JwtParseError("JWT is not a string");
+  }
+  if (!jwt.match(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)) {
+    throw new JwtParseError("JWT string does not consist of exactly 3 parts (header, payload, signature)");
+  }
+  const [headerB64, payloadB64, signatureB64] = jwt.split(".");
+  const [headerString, payloadString] = [headerB64, payloadB64].map(nodeWebCompat.parseB64UrlString);
+  let header;
+  try {
+    header = safeJsonParse(headerString);
+  } catch (err) {
+    throw new JwtParseError("Invalid JWT. Header is not a valid JSON object", err);
+  }
+  assertJwtHeader(header);
+  let payload;
+  try {
+    payload = safeJsonParse(payloadString);
+  } catch (err) {
+    throw new JwtParseError("Invalid JWT. Payload is not a valid JSON object", err);
+  }
+  assertJwtPayload(payload);
+  return {
+    header,
+    headerB64,
+    payload,
+    payloadB64,
+    signatureB64
+  };
+}
+function validateJwtFields(payload, options) {
+  if (payload.exp !== void 0) {
+    if (payload.exp + (options.graceSeconds ?? 0) < Date.now() / 1e3) {
+      throw new JwtExpiredError(`Token expired at ${new Date(payload.exp * 1e3).toISOString()}`, payload.exp);
+    }
+  }
+  if (payload.nbf !== void 0) {
+    if (payload.nbf - (options.graceSeconds ?? 0) > Date.now() / 1e3) {
+      throw new JwtNotBeforeError(`Token can't be used before ${new Date(payload.nbf * 1e3).toISOString()}`, payload.nbf);
+    }
+  }
+  if (options.issuer !== null) {
+    if (options.issuer === void 0) {
+      throw new ParameterValidationError("issuer must be provided or set to null explicitly");
+    }
+    assertStringArrayContainsString("Issuer", payload.iss, options.issuer, JwtInvalidIssuerError);
+  }
+  if (options.audience !== null) {
+    if (options.audience === void 0) {
+      throw new ParameterValidationError("audience must be provided or set to null explicitly");
+    }
+    assertStringArraysOverlap("Audience", payload.aud, options.audience, JwtInvalidAudienceError);
+  }
+  if (options.scope != null) {
+    assertStringArraysOverlap("Scope", payload.scope?.split(" "), options.scope, JwtInvalidScopeError);
+  }
+}
+
+// ../../node_modules/aws-jwt-verify/dist/esm/jwt-rsa.js
+function validateJwtHeaderAndJwk(header, jwk) {
+  assertIsRsaSignatureJwk(jwk);
+  if (jwk.alg) {
+    assertStringEquals("JWT signature algorithm", header.alg, jwk.alg, JwtInvalidSignatureAlgorithmError);
+  }
+  assertStringArrayContainsString("JWT signature algorithm", header.alg, supportedSignatureAlgorithms, JwtInvalidSignatureAlgorithmError);
+}
+async function verifyDecomposedJwt(decomposedJwt, jwksUri, options, jwkFetcher = fetchJwk, transformJwkToKeyObjectFn = nodeWebCompat.transformJwkToKeyObjectAsync) {
+  const { header, headerB64, payload, payloadB64, signatureB64 } = decomposedJwt;
+  const jwk = await jwkFetcher(jwksUri, decomposedJwt);
+  validateJwtHeaderAndJwk(decomposedJwt.header, jwk);
+  const keyObject = await transformJwkToKeyObjectFn(jwk, header.alg, payload.iss);
+  const valid = await nodeWebCompat.verifySignatureAsync({
+    jwsSigningInput: `${headerB64}.${payloadB64}`,
+    signature: signatureB64,
+    alg: header.alg,
+    keyObject
+  });
+  if (!valid) {
+    throw new JwtInvalidSignatureError("Invalid signature");
+  }
+  try {
+    validateJwtFields(payload, options);
+    if (options.customJwtCheck) {
+      await options.customJwtCheck({ header, payload, jwk });
+    }
+  } catch (err) {
+    if (options.includeRawJwtInErrors && err instanceof JwtInvalidClaimError) {
+      throw err.withRawJwt(decomposedJwt);
+    }
+    throw err;
+  }
+  return payload;
+}
+function verifyDecomposedJwtSync(decomposedJwt, jwkOrJwks, options, transformJwkToKeyObjectFn) {
+  const { header, headerB64, payload, payloadB64, signatureB64 } = decomposedJwt;
+  let jwk;
+  if (isJwk(jwkOrJwks)) {
+    jwk = jwkOrJwks;
+  } else if (isJwks(jwkOrJwks)) {
+    const locatedJwk = header.kid ? findJwkInJwks(jwkOrJwks, header.kid) : void 0;
+    if (!locatedJwk) {
+      throw new KidNotFoundInJwksError(`JWK for kid ${header.kid} not found in the JWKS`);
+    }
+    jwk = locatedJwk;
+  } else {
+    throw new ParameterValidationError([
+      `Expected a valid JWK or JWKS (parsed as JavaScript object), but received: ${jwkOrJwks}.`,
+      "If you're passing a JWKS URI, use the async verify() method instead, it will download and parse the JWKS for you"
+    ].join());
+  }
+  validateJwtHeaderAndJwk(decomposedJwt.header, jwk);
+  const keyObject = transformJwkToKeyObjectFn(jwk, header.alg, payload.iss);
+  const valid = nodeWebCompat.verifySignatureSync({
+    jwsSigningInput: `${headerB64}.${payloadB64}`,
+    signature: signatureB64,
+    alg: header.alg,
+    keyObject
+  });
+  if (!valid) {
+    throw new JwtInvalidSignatureError("Invalid signature");
+  }
+  try {
+    validateJwtFields(payload, options);
+    if (options.customJwtCheck) {
+      const res = options.customJwtCheck({ header, payload, jwk });
+      assertIsNotPromise(res, () => new ParameterValidationError("Custom JWT checks must be synchronous but a promise was returned"));
+    }
+  } catch (err) {
+    if (options.includeRawJwtInErrors && err instanceof JwtInvalidClaimError) {
+      throw err.withRawJwt(decomposedJwt);
+    }
+    throw err;
+  }
+  return payload;
+}
+var JwtRsaVerifierBase = class {
+  constructor(verifyProperties, jwksCache = new SimpleJwksCache()) {
+    this.jwksCache = jwksCache;
+    this.issuersConfig = /* @__PURE__ */ new Map();
+    this.publicKeyCache = new KeyObjectCache();
+    if (Array.isArray(verifyProperties)) {
+      if (!verifyProperties.length) {
+        throw new ParameterValidationError("Provide at least one issuer configuration");
+      }
+      for (const prop of verifyProperties) {
+        if (this.issuersConfig.has(prop.issuer)) {
+          throw new ParameterValidationError(`issuer ${prop.issuer} supplied multiple times`);
+        }
+        this.issuersConfig.set(prop.issuer, this.withJwksUri(prop));
+      }
+    } else {
+      this.issuersConfig.set(verifyProperties.issuer, this.withJwksUri(verifyProperties));
+    }
+  }
+  get expectedIssuers() {
+    return Array.from(this.issuersConfig.keys());
+  }
+  getIssuerConfig(issuer) {
+    if (!issuer) {
+      if (this.issuersConfig.size !== 1) {
+        throw new ParameterValidationError("issuer must be provided");
+      }
+      issuer = this.issuersConfig.keys().next().value;
+    }
+    const config = this.issuersConfig.get(issuer);
+    if (!config) {
+      throw new ParameterValidationError(`issuer not configured: ${issuer}`);
+    }
+    return config;
+  }
+  /**
+   * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+   * available for JWT verification. Use this method to speed up the first JWT verification
+   * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+   * in case the JwtVerifier does not have internet access to download the JWKS
+   *
+   * @param jwksThe JWKS
+   * @param issuer The issuer for which you want to cache the JWKS
+   *  Supply this field, if you instantiated the JwtVerifier with multiple issuers
+   * @returns void
+   */
+  cacheJwks(...[jwks, issuer]) {
+    const issuerConfig = this.getIssuerConfig(issuer);
+    this.jwksCache.addJwks(issuerConfig.jwksUri, jwks);
+    this.publicKeyCache.clearCache(issuerConfig.issuer);
+  }
+  /**
+   * Hydrate the JWKS cache for (all of) the configured issuer(s).
+   * This will fetch and cache the latest and greatest JWKS for concerned issuer(s).
+   *
+   * @param issuer The issuer to fetch the JWKS for
+   * @returns void
+   */
+  async hydrate() {
+    const jwksFetches = this.expectedIssuers.map((issuer) => this.getIssuerConfig(issuer).jwksUri).map((jwksUri) => this.jwksCache.getJwks(jwksUri));
+    await Promise.all(jwksFetches);
+  }
+  /**
+   * Verify (synchronously) a JWT that is signed using RS256 / RS384 / RS512.
+   *
+   * @param jwt The JWT, as string
+   * @param props Verification properties
+   * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+   */
+  verifySync(...[jwt, properties]) {
+    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+    return this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
+  }
+  /**
+   * Verify (synchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
+   *
+   * @param decomposedJwt The decomposed Jwt
+   * @param jwk The JWK to verify the JWTs signature with
+   * @param verifyProperties The properties to use for verification
+   * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+   */
+  verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties) {
+    const jwk = this.jwksCache.getCachedJwk(jwksUri, decomposedJwt);
+    return verifyDecomposedJwtSync(decomposedJwt, jwk, verifyProperties, this.publicKeyCache.transformJwkToKeyObjectSync.bind(this.publicKeyCache));
+  }
+  /**
+   * Verify (asynchronously) a JWT that is signed using RS256 / RS384 / RS512.
+   * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+   * in case it is not yet available in the cache.
+   *
+   * @param jwt The JWT, as string
+   * @param props Verification properties
+   * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+   */
+  async verify(...[jwt, properties]) {
+    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+    return this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
+  }
+  /**
+   * Verify (asynchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
+   *
+   * @param decomposedJwt The decomposed Jwt
+   * @param jwk The JWK to verify the JWTs signature with
+   * @param verifyProperties The properties to use for verification
+   * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+   */
+  verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties) {
+    return verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties, this.jwksCache.getJwk.bind(this.jwksCache), this.publicKeyCache.transformJwkToKeyObjectAsync.bind(this.publicKeyCache));
+  }
+  /**
+   * Get the verification parameters to use, by merging the issuer configuration,
+   * with the overriding properties that are now provided
+   *
+   * @param jwt: the JWT that is going to be verified
+   * @param verifyProperties: the overriding properties, that override the issuer configuration
+   * @returns The merged verification parameters
+   */
+  getVerifyParameters(jwt, verifyProperties) {
+    const decomposedJwt = decomposeUnverifiedJwt(jwt);
+    assertStringArrayContainsString("Issuer", decomposedJwt.payload.iss, this.expectedIssuers, JwtInvalidIssuerError);
+    const issuerConfig = this.getIssuerConfig(decomposedJwt.payload.iss);
+    return {
+      decomposedJwt,
+      jwksUri: issuerConfig.jwksUri,
+      verifyProperties: {
+        ...issuerConfig,
+        ...verifyProperties
+      }
+    };
+  }
+  /**
+   * Get issuer config with JWKS URI, by adding a default JWKS URI if needed
+   *
+   * @param config: the issuer config.
+   * @returns The config with JWKS URI
+   */
+  withJwksUri(config) {
+    if (config.jwksUri) {
+      return config;
+    }
+    const issuerUri = new URL(config.issuer).pathname.replace(/\/$/, "");
+    return {
+      jwksUri: new URL(`${issuerUri}/.well-known/jwks.json`, config.issuer).href,
+      ...config
+    };
+  }
+};
+var KeyObjectCache = class {
+  constructor(transformJwkToKeyObjectSyncFn = nodeWebCompat.transformJwkToKeyObjectSync, transformJwkToKeyObjectAsyncFn = nodeWebCompat.transformJwkToKeyObjectAsync) {
+    this.transformJwkToKeyObjectSyncFn = transformJwkToKeyObjectSyncFn;
+    this.transformJwkToKeyObjectAsyncFn = transformJwkToKeyObjectAsyncFn;
+    this.publicKeys = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Transform the JWK into an RSA public key in native key object format.
+   * If the transformed JWK is already in the cache, it is returned from the cache instead.
+   *
+   * @param jwk: the JWK
+   * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+   * @param issuer: the issuer that uses the JWK for signing JWTs (used for caching the transformation)
+   * @returns the RSA public key in native key object format
+   */
+  transformJwkToKeyObjectSync(jwk, jwtHeaderAlg, issuer) {
+    const alg = jwk.alg ?? jwtHeaderAlg;
+    if (!issuer || !jwk.kid || !alg) {
+      return this.transformJwkToKeyObjectSyncFn(jwk, alg, issuer);
+    }
+    const fromCache = this.publicKeys.get(issuer)?.get(jwk.kid)?.get(alg);
+    if (fromCache)
+      return fromCache;
+    const publicKey = this.transformJwkToKeyObjectSyncFn(jwk, alg, issuer);
+    this.putKeyObjectInCache(issuer, jwk.kid, alg, publicKey);
+    return publicKey;
+  }
+  /**
+   * Transform the JWK into an RSA public key in native key object format (async).
+   * If the transformed JWK is already in the cache, it is returned from the cache instead.
+   *
+   * @param jwk: the JWK
+   * @param jwtHeaderAlg: the alg from the JWT header (used if absent on JWK)
+   * @param issuer: the issuer that uses the JWK for signing JWTs (used for caching the transformation)
+   * @returns the RSA public key in native key object format
+   */
+  async transformJwkToKeyObjectAsync(jwk, jwtHeaderAlg, issuer) {
+    const alg = jwk.alg ?? jwtHeaderAlg;
+    if (!issuer || !jwk.kid || !alg) {
+      return this.transformJwkToKeyObjectAsyncFn(jwk, alg, issuer);
+    }
+    const fromCache = this.publicKeys.get(issuer)?.get(jwk.kid)?.get(alg);
+    if (fromCache)
+      return fromCache;
+    const publicKey = await this.transformJwkToKeyObjectAsyncFn(jwk, alg, issuer);
+    this.putKeyObjectInCache(issuer, jwk.kid, alg, publicKey);
+    return publicKey;
+  }
+  putKeyObjectInCache(issuer, kid, alg, publicKey) {
+    const cachedIssuer = this.publicKeys.get(issuer);
+    const cachedIssuerKid = cachedIssuer?.get(kid);
+    if (cachedIssuerKid) {
+      cachedIssuerKid.set(alg, publicKey);
+    } else if (cachedIssuer) {
+      cachedIssuer.set(kid, /* @__PURE__ */ new Map([[alg, publicKey]]));
+    } else {
+      this.publicKeys.set(issuer, /* @__PURE__ */ new Map([[kid, /* @__PURE__ */ new Map([[alg, publicKey]])]]));
+    }
+  }
+  clearCache(issuer) {
+    this.publicKeys.delete(issuer);
+  }
+};
+
+// ../../node_modules/aws-jwt-verify/dist/esm/cognito-verifier.js
+function validateCognitoJwtFields(payload, options) {
+  if (options.groups != null) {
+    assertStringArraysOverlap("Cognito group", payload["cognito:groups"], options.groups, CognitoJwtInvalidGroupError);
+  }
+  assertStringArrayContainsString("Token use", payload.token_use, ["id", "access"], CognitoJwtInvalidTokenUseError);
+  if (options.tokenUse !== null) {
+    if (options.tokenUse === void 0) {
+      throw new ParameterValidationError("tokenUse must be provided or set to null explicitly");
+    }
+    assertStringEquals("Token use", payload.token_use, options.tokenUse, CognitoJwtInvalidTokenUseError);
+  }
+  if (options.clientId !== null) {
+    if (options.clientId === void 0) {
+      throw new ParameterValidationError("clientId must be provided or set to null explicitly");
+    }
+    if (payload.token_use === "id") {
+      assertStringArrayContainsString('Client ID ("audience")', payload.aud, options.clientId, CognitoJwtInvalidClientIdError);
+    } else {
+      assertStringArrayContainsString("Client ID", payload.client_id, options.clientId, CognitoJwtInvalidClientIdError);
+    }
+  }
+}
+var CognitoJwtVerifier = class _CognitoJwtVerifier extends JwtRsaVerifierBase {
+  constructor(props, jwksCache) {
+    const issuerConfig = Array.isArray(props) ? props.map((p) => ({
+      ...p,
+      ..._CognitoJwtVerifier.parseUserPoolId(p.userPoolId),
+      audience: null
+      // checked instead by validateCognitoJwtFields
+    })) : {
+      ...props,
+      ..._CognitoJwtVerifier.parseUserPoolId(props.userPoolId),
+      audience: null
+      // checked instead by validateCognitoJwtFields
+    };
+    super(issuerConfig, jwksCache);
+  }
+  /**
+   * Parse a User Pool ID, to extract the issuer and JWKS URI
+   *
+   * @param userPoolId The User Pool ID
+   * @returns The issuer and JWKS URI for the User Pool
+   */
+  static parseUserPoolId(userPoolId) {
+    const match = userPoolId.match(/^(?<region>(\w+-)?\w+-\w+-\d)+_\w+$/);
+    if (!match) {
+      throw new ParameterValidationError(`Invalid Cognito User Pool ID: ${userPoolId}`);
+    }
+    const region = match.groups.region;
+    const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+    return {
+      issuer,
+      jwksUri: `${issuer}/.well-known/jwks.json`
+    };
+  }
+  // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+  static create(verifyProperties, additionalProperties) {
+    return new this(verifyProperties, additionalProperties?.jwksCache);
+  }
+  /**
+   * Verify (synchronously) a JWT that is signed by Amazon Cognito.
+   *
+   * @param jwt The JWT, as string
+   * @param props Verification properties
+   * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+   */
+  verifySync(...[jwt, properties]) {
+    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+    this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
+    try {
+      validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+    } catch (err) {
+      if (verifyProperties.includeRawJwtInErrors && err instanceof JwtInvalidClaimError) {
+        throw err.withRawJwt(decomposedJwt);
+      }
+      throw err;
+    }
+    return decomposedJwt.payload;
+  }
+  /**
+   * Verify (asynchronously) a JWT that is signed by Amazon Cognito.
+   * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+   * in case it is not yet available in the cache.
+   *
+   * @param jwt The JWT, as string
+   * @param props Verification properties
+   * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+   */
+  async verify(...[jwt, properties]) {
+    const { decomposedJwt, jwksUri, verifyProperties } = this.getVerifyParameters(jwt, properties);
+    await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
+    try {
+      validateCognitoJwtFields(decomposedJwt.payload, verifyProperties);
+    } catch (err) {
+      if (verifyProperties.includeRawJwtInErrors && err instanceof JwtInvalidClaimError) {
+        throw err.withRawJwt(decomposedJwt);
+      }
+      throw err;
+    }
+    return decomposedJwt.payload;
+  }
+  /**
+   * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+   * available for JWT verification. Use this method to speed up the first JWT verification
+   * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+   * in case the JwtVerifier does not have internet access to download the JWKS
+   *
+   * @param jwks The JWKS
+   * @param userPoolId The userPoolId for which you want to cache the JWKS
+   *  Supply this field, if you instantiated the CognitoJwtVerifier with multiple userPoolIds
+   * @returns void
+   */
+  cacheJwks(...[jwks, userPoolId]) {
+    let issuer;
+    if (userPoolId !== void 0) {
+      issuer = _CognitoJwtVerifier.parseUserPoolId(userPoolId).issuer;
+    } else if (this.expectedIssuers.length > 1) {
+      throw new ParameterValidationError("userPoolId must be provided");
+    }
+    const issuerConfig = this.getIssuerConfig(issuer);
+    super.cacheJwks(jwks, issuerConfig.issuer);
+  }
+};
+
+// lambdacode/api/services/claims.ts
+var CUSTOM_PREFIX = "custom:";
+function customClaims(source) {
+  const out = {};
+  for (const [k, v] of Object.entries(source)) {
+    if (k.startsWith(CUSTOM_PREFIX) && typeof v === "string" && v !== "") {
+      out[k.slice(CUSTOM_PREFIX.length)] = v;
+    }
+  }
+  return out;
+}
+
+// lambdacode/api/services/serviceUserRegistry.ts
+var import_client_dynamodb4 = require("@aws-sdk/client-dynamodb");
+var import_lib_dynamodb4 = require("@aws-sdk/lib-dynamodb");
+var ddb4 = import_lib_dynamodb4.DynamoDBDocumentClient.from(new import_client_dynamodb4.DynamoDBClient({}));
+var SERVICE_USERS_TABLE_NAME = process.env.SERVICE_USERS_TABLE_NAME;
+var SERVICE_SCOPE = "api/invoke";
+async function getServiceUserName(clientId) {
+  const out = await ddb4.send(
+    new import_lib_dynamodb4.GetCommand({ TableName: SERVICE_USERS_TABLE_NAME, Key: { clientId }, ConsistentRead: true })
+  );
+  return out.Item?.name || void 0;
+}
+
+// lambdacode/api/services/tokenVerifier.ts
+var TokenVerificationError = class extends Error {
+  constructor(reason, message2) {
+    super(message2);
+    this.reason = reason;
+    this.name = "TokenVerificationError";
+  }
+};
+var idVerifier = CognitoJwtVerifier.create({
+  userPoolId: process.env.USER_POOL_ID,
+  tokenUse: "id",
+  clientId: null
+});
+var accessVerifier = CognitoJwtVerifier.create({
+  userPoolId: process.env.USER_POOL_ID,
+  tokenUse: "access",
+  clientId: null
+});
+function bearerToken(header) {
+  const value = header ?? "";
+  return value.startsWith("Bearer ") ? value.slice(7) : value;
+}
+var message = (err) => err instanceof Error ? err.message : String(err);
+async function verifyBearerToken(token) {
+  if (!token) throw new TokenVerificationError("invalid", "missing bearer token");
+  let idFailure;
+  let keysUnavailable = false;
+  try {
+    const payload2 = await idVerifier.verify(token);
+    return {
+      kind: "user",
+      subject: payload2.sub,
+      email: typeof payload2.email === "string" ? payload2.email : void 0,
+      claims: customClaims(payload2),
+      groups: payload2["cognito:groups"] ?? []
+    };
+  } catch (err) {
+    idFailure = err;
+    keysUnavailable = err instanceof FetchError;
+  }
+  let payload;
+  try {
+    payload = await accessVerifier.verify(token);
+  } catch (err) {
+    if (err instanceof FetchError || keysUnavailable) {
+      throw new TokenVerificationError("dependency", `signing keys unavailable: ${message(keysUnavailable ? idFailure : err)}`);
+    }
+    throw new TokenVerificationError("invalid", `not an ID token (${message(idFailure)}) nor an access token (${message(err)})`);
+  }
+  const scopes = typeof payload.scope === "string" ? payload.scope.split(" ") : [];
+  if (!scopes.includes(SERVICE_SCOPE)) throw new TokenVerificationError("invalid", `access token without the ${SERVICE_SCOPE} scope`);
+  let name;
+  try {
+    name = await getServiceUserName(payload.sub);
+  } catch (err) {
+    throw new TokenVerificationError("dependency", `service-user registry unavailable: ${message(err)}`);
+  }
+  if (!name) throw new TokenVerificationError("invalid", `no registry row for service client ${payload.sub}`);
+  return { kind: "service", subject: payload.sub, name };
+}
+
+// lambdacode/plugins/authorizer.ts
+var log3 = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var UNAUTHORIZED = "Unauthorized";
+function headerValue(event, name) {
+  const headers = event.headers ?? {};
+  const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
+  return key === void 0 ? void 0 : headers[key] ?? void 0;
+}
+async function resolveRoute(event, catalog) {
+  const resource = parsePluginResourcePath(event.resource ?? "");
+  if (!resource) return { denial: "resource-malformed" };
+  const { pluginId } = resource;
+  const accountNumber = event.pathParameters?.[PLUGIN_ACCOUNT_PARAM] ?? "";
+  if (!AWS_ACCOUNT_PATTERN.test(accountNumber)) return { denial: "account-malformed", pluginId };
+  const record = await catalog.get(pluginId, { consistent: true });
+  const route = record?.routes.find((r) => r.method === event.httpMethod && r.resourcePath === event.resource);
+  if (!record || !route) return { denial: "route-unknown", pluginId, accountNumber };
+  return { pluginId, accountNumber, record, route };
+}
+function policy(effect, principalId, methodArn, context) {
+  return {
+    principalId,
+    policyDocument: { Version: "2012-10-17", Statement: [{ Action: "execute-api:Invoke", Effect: effect, Resource: methodArn }] },
+    context
+  };
+}
+async function deny(refusal, fields, methodArn) {
+  const { reason, principal, correlationId, route } = refusal;
+  log3("plugin authorizer: deny", { ...fields, reason });
+  const name = principal.kind === "user" ? principal.email : principal.name;
+  await recordEvent({
+    category: "auth",
+    action: "plugin.access",
+    outcome: "DENIED",
+    reason,
+    actor: { kind: principal.kind === "user" ? "user" : "service", id: principal.subject, name },
+    subject: { kind: principal.kind === "user" ? "user" : "serviceUser", id: principal.subject, name },
+    target: route && pluginTarget(route.pluginId, route.accountNumber, route.route.permission),
+    targetName: route?.record.manifest.displayName,
+    details: { correlationId, routeId: route?.route.id, requiredPermission: route?.route.permission }
+  });
+  return policy("Deny", principal.subject, methodArn, { reason });
+}
+async function handler(event) {
+  const correlationId = event.requestContext?.requestId || "unknown";
+  const where = { correlationId, method: event.httpMethod, resource: event.resource };
+  const token = bearerToken(headerValue(event, "authorization"));
+  if (!token) {
+    log3("plugin authorizer: no bearer token", where);
+    throw new Error(UNAUTHORIZED);
+  }
+  const [verified, resolved] = await Promise.allSettled([verifyBearerToken(token), resolveRoute(event, pluginCatalog())]);
+  if (verified.status === "rejected") {
+    const err = verified.reason;
+    if (err instanceof TokenVerificationError && err.reason === "invalid") {
+      log3("plugin authorizer: token rejected", { ...where, error: err.message });
+      throw new Error(UNAUTHORIZED);
+    }
+    log3("plugin authorizer: verification failed on a dependency", { ...where, error: err.message });
+    throw err;
+  }
+  if (resolved.status === "rejected") {
+    log3("plugin authorizer: catalog unreadable", { ...where, error: resolved.reason.message });
+    throw resolved.reason;
+  }
+  const principal = verified.value;
+  const who = { subject: principal.subject, principalType: principal.kind };
+  const route = resolved.value;
+  if ("denial" in route) {
+    return deny({ reason: route.denial, principal, correlationId }, { ...where, ...who, pluginId: route.pluginId, accountNumber: route.accountNumber }, event.methodArn);
+  }
+  const what = {
+    ...where,
+    ...who,
+    pluginId: route.pluginId,
+    accountNumber: route.accountNumber,
+    routeId: route.route.id,
+    requiredPermission: route.route.permission,
+    revision: route.record.revision
+  };
+  const decision = await checkPluginPermission(principal.subject, route.pluginId, route.accountNumber, route.route.permission, {
+    record: route.record,
+    consistent: true
+  });
+  if (!decision.allowed) return deny({ reason: decision.reason, principal, correlationId, route }, what, event.methodArn);
+  const context = {
+    pluginId: route.pluginId,
+    pluginRevision: route.record.revision,
+    routeId: route.route.id,
+    accountNumber: route.accountNumber,
+    requiredPermission: route.route.permission,
+    subject: principal.subject,
+    principalType: principal.kind,
+    correlationId
+  };
+  log3("plugin authorizer: allow", what);
+  return policy("Allow", principal.subject, event.methodArn, { ...context });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});