@shumai-one/shumai 0.4.7 → 0.4.9

package/bin/{chunk-t3t7dcfq.js → chunk-6yayg55q.js}

@@ -1,2 +1,2 @@
 // @bun
-import{Oe}from"./chunk-yqvhgtez.js";var ye=new TextEncoder,q=new TextDecoder,re=new TextDecoder("utf-8",{fatal:!0});function A(...e){let t=e.reduce((o,{length:a})=>o+a,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function tt(e,t,r){if(t<0||t>=4294967296)throw RangeError(`value must be >= 0 and <= 4294967295. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],r)}function rt(e){let t=Math.floor(e/4294967296),r=e%4294967296,n=new Uint8Array(8);return tt(n,t,0),tt(n,r,4),n}function Te(e){let t=new Uint8Array(4);return tt(t,e),t}function b(e){let t=new Uint8Array(e.length);for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);if(n>127)throw TypeError("non-ASCII string encountered in encode()");t[r]=n}return t}var Pe=(e,t="algorithm.name")=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function nt(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Ie(e,t){let{modulusLength:r}=t.algorithm;if(typeof r!=="number"||r<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function k(e,t,r){let n=e.algorithm;if(n.name!==t.name)throw Pe(t.name);if(t.hash&&n.hash?.name!==t.hash)throw Pe(t.hash,"algorithm.hash");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw Pe(t.namedCurve,"algorithm.namedCurve");if(t.length!==void 0&&n.length!==t.length)throw Pe(t.length,"algorithm.length");nt(e,r)}function Ot(e,t,...r){if(r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`}else if(r.length===2)e+=`one of type ${r[0]} or ${r[1]}.`;else e+=`of type ${r[0]}.`;if(t==null)e+=` Received ${t}`;else if(typeof t==="function"&&t.name)e+=` Received function ${t.name}`;else if(typeof t==="object"&&t!=null){if(t.constructor?.name)e+=` Received an instance of ${t.constructor.name}`}return e}var B=(e,...t)=>Ot("Key must be ",e,...t),he=(e,t,...r)=>Ot(`Key for the ${e} algorithm must be `,t,...r);class x extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,t){super(e,t);this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class _ extends x{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class Qi extends x{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class ne extends x{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class m extends x{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class _e extends x{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",t){super(e,t)}}class f extends x{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class w extends x{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class E extends x{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class De extends x{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"}class Ue extends x{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class we extends x{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",t){super(e,t)}}class ot extends x{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",t){super(e,t)}}class it extends x{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",t){super(e,t)}}class at extends x{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",t){super(e,t)}}function Re(e){if(!M(e))throw Error("CryptoKey instance expected")}var M=(e)=>{if(e?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return e instanceof CryptoKey}catch{return!1}},st=(e)=>e?.[Symbol.toStringTag]==="KeyObject",Ne=(e)=>M(e)||st(e);var L=(e)=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function _t(e,t){let r=e.byteLength<<3;if(r!==t)throw new f(`Invalid Content Encryption Key length. Expected ${t} bits, got ${r} bits`)}var Wr=(e)=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function Dt(e,t){if(t.length<<3!==e.ivBits)throw new f("Invalid Initialization Vector length")}async function Ut(e,t,r){if(!(t instanceof Uint8Array))throw TypeError(B(t,"Uint8Array"));let n=e.cekBits>>1,o=await crypto.subtle.importKey("raw",t.subarray(n>>3),"AES-CBC",!1,[r]),a=await crypto.subtle.importKey("raw",t.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[o,a,n]}async function Rt(e,t,r){return new Uint8Array((await crypto.subtle.sign("HMAC",e,t)).slice(0,r>>3))}async function Cr(e,t,r,n,o){let[a,i,s]=await Ut(e,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},a,t)),p=A(o,n,c,rt(o.length*8)),d=await Rt(i,p,s);return{ciphertext:c,tag:d,iv:n}}async function vr(e,t){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),o=await crypto.subtle.sign(r,n,e);return crypto.subtle.verify(r,n,o,t)}async function Tr(e,t,r,n,o,a){let[i,s,c]=await Ut(e,t,"decrypt"),p=A(a,n,r,rt(a.length*8)),d=await Rt(s,p,c);try{if(await vr(o,d))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},i,r))}catch{}throw new _e}async function Pr(e,t,r,n,o){let a=r instanceof Uint8Array?await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(k(r,e.subtle,"encrypt"),r),i=new Uint8Array(await crypto.subtle.encrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},a,t)),s=i.slice(-16);return{ciphertext:i.slice(0,-16),tag:s,iv:n}}async function Ir(e,t,r,n,o,a){let i=t instanceof Uint8Array?await crypto.subtle.importKey("raw",t,"AES-GCM",!1,["decrypt"]):(k(t,e.subtle,"decrypt"),t);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:n,name:"AES-GCM",tagLength:128},i,A(r,o)))}catch{throw new _e}}async function He(e,t,r,n,o){if(!M(r)&&!(r instanceof Uint8Array))throw TypeError(B(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n)Dt(e,n);else n=Wr(e);if(r instanceof Uint8Array)_t(r,e.cekBits);return e.cbc?Cr(e,t,r,n,o):Pr(e,t,r,n,o)}async function ke(e,t,r,n,o,a){if(!M(t)&&!(t instanceof Uint8Array))throw TypeError(B(t,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new f("JWE Initialization Vector missing");if(!o)throw new f("JWE Authentication Tag missing");if(!e.cbc&&o.length!==16)throw new f("Invalid Authentication Tag length");if(Dt(e,n),t instanceof Uint8Array)_t(t,e.cekBits);return e.cbc?Tr(e,t,r,n,o,a):Ir(e,t,r,n,o,a)}var nf={};Oe(nf,{decode:()=>D,encode:()=>ur});function ct(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function Be(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}var pt="The input to be decoded is not correctly encoded.";function D(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof e==="string"?e:q.decode(e),{alphabet:"base64url"})}catch(r){throw TypeError(pt,{cause:r})}let t=e;if(t instanceof Uint8Array)t=q.decode(t);if(t.includes("+")||t.includes("/"))throw TypeError(pt);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return Be(t)}catch{throw TypeError(pt)}}function ur(e){let t=e;if(typeof t==="string")t=ye.encode(t);if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:"base64url",omitPadding:!0});return ct(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Z(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function S(e){if(typeof e!=="object"||e===null||Object.prototype.toString.call(e)!=="[object Object]")return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Me(e){return S(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(S)}function Nt(...e){let t=new Set;for(let r of e){if(!r)continue;for(let n of Object.keys(r)){if(t.has(n))return!1;t.add(n)}}return!0}var Ht=Symbol();function Q(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function W(e,t,r){try{return D(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}function dt(e,t,r){try{return b(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}async function $e(e,t){let r=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,t))}function F(e,t,r){let n;try{n=JSON.parse(re.decode(D(e)))}catch{throw new t(r)}if(!S(n))throw new t(r);return n}async function j(e,t){if(t.kty==="RSA"&&"oth"in t&&t.oth!==void 0)throw new m('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,n=!!(t.d||t.priv),o={...t};if(o.kty!=="AKP")delete o.alg;return delete o.use,crypto.subtle.importKey("jwk",o,r,t.ext??!n,t.key_ops??e.usages[n?1:0])}function oe(e){return{__proto__:null,...e}}function Le(e){let t=oe(e);if(t.ext!==void 0&&typeof t.ext!=="boolean")throw TypeError('"ext" (Extractable) Parameter must be a boolean');if(t.key_ops!==void 0){let r=t.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some((o)=>typeof o!=="string")||new Set(n).size!==n.length)throw TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}var ft=(e)=>e[Symbol.toStringTag],Or=(e,t,r)=>{let{alg:n}=e;if(t.use!==void 0){let o=r==="sign"||r==="verify"?"sig":"enc";if(t.use!==o)throw TypeError(`Invalid key for this operation, its "use" must be "${o}" when present`)}if(t.alg!==void 0&&t.alg!==n)throw TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(t.key_ops)){let o=r==="encrypt"||r==="decrypt"?e.ops?.[r==="encrypt"?0:1]:r;if(o&&!t.key_ops.includes(o))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${o}" when present`)}};function _r(e,t,r){let{alg:n,secret:o}=e,a=r==="decrypt"||r==="sign";if(o&&t instanceof Uint8Array)return[Bt,t];if(S(t)){let i=Le(t);if(typeof i.kty!=="string")throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(o?i.kty==="oct"&&typeof i.k==="string":i.kty!=="oct"&&(a?i.kty==="AKP"&&typeof i.priv==="string"||typeof i.d==="string":i.d===void 0&&i.priv===void 0)))throw TypeError(o?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${a?"private":"public"} JWK`);return Or(e,i,r),[Lt,t,i]}if(!Ne(t))throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(o){if(t.type!=="secret")throw TypeError(`${ft(t)} instances for symmetric algorithms must be of type "secret"`)}else{if(t.type==="secret")throw TypeError(`${ft(t)} instances for asymmetric algorithms must not be of type "secret"`);let i=a?"private":"public";if((t.type==="public"||t.type==="private")&&t.type!==i){let s=r==="sign"?"signing":r==="verify"?"verifying":`${r.slice(0,-1)}tion`;throw TypeError(`${ft(t)} instances for asymmetric algorithm ${s} must be of type "${i}"`)}}return M(t)?[Mt,t]:[$t,t]}var Bt=0,Mt=1,$t=2,Lt=3,ut,Dr={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function je(e,t,r){ut||=new WeakMap;let n=ut.get(e);if(r)if(n)n[t]=r;else ut.set(e,{[t]:r});return r??n?.[t]}var kt=async(e,t,r)=>je(e,r.alg)??je(e,r.alg,await j(r,{...t,alg:r.alg})),Ur=(e,t)=>{let r=je(e,t.alg);if(r)return r;let n=e.type==="public",o=t.usages[n?0:1],{asymmetricKeyType:a}=e,i=Dr[e.asymmetricKeyDetails?.namedCurve],s=t.resolve?.({crv:i,asymmetricKeyType:a})??t.subtle;return je(e,t.alg,e.toCryptoKey(s,n,o))};async function U(e,t,r){let n=_r(e,t,r);switch(n[0]){case Bt:case Mt:return n[1];case Lt:{let o=n[1],a=n[2];if(a.kty==="oct")return D(a.k);if(!Object.isFrozen(o)){let{key_ops:i}=o;if(Array.isArray(i))Object.freeze(i);Object.freeze(o)}return kt(o,a,e)}case $t:{let o=n[1];if(o.type==="secret")return o.export();if("toCryptoKey"in o&&typeof o.toCryptoKey==="function")return Ur(o,e);return kt(o,o.export({format:"jwk"}),e)}}}function ge(e){let t={__proto__:null};for(let r in e)t[r]={...e[r],alg:r};return t}var Rr=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Nr=[[],["deriveBits"]],Ge=[[],[]];function ze(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${e}`},usages:Rr,ops:["wrapKey","unwrapKey"]}}function Ve(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty:e,crv:t,asymmetricKeyType:r})=>{if(t==="X25519"||r==="x25519")return{name:"X25519"};if(e==="OKP")throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:t}},usages:Nr,ops:[void 0,"deriveBits"]}}function ie(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:Ge,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function lt(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:Ge,ops:["deriveBits","deriveBits"]}}var mt=ge({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:Ge,ops:["encrypt","decrypt"]},"RSA-OAEP":ze(1),"RSA-OAEP-256":ze(256),"RSA-OAEP-384":ze(384),"RSA-OAEP-512":ze(512),"ECDH-ES":Ve(),"ECDH-ES+A128KW":Ve(),"ECDH-ES+A192KW":Ve(),"ECDH-ES+A256KW":Ve(),A128KW:ie(128),A192KW:ie(192),A256KW:ie(256),A128GCMKW:ie(128,!0),A192GCMKW:ie(192,!0),A256GCMKW:ie(256,!0),"PBES2-HS256+A128KW":lt(),"PBES2-HS384+A192KW":lt(),"PBES2-HS512+A256KW":lt()}),Hr=["encrypt","decrypt"];function ae(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:Ge,ops:Hr,cekBits:e,ivBits:t?128:96,cbc:t}}var kr=ge({A128GCM:ae(128),A192GCM:ae(192),A256GCM:ae(256),"A128CBC-HS256":ae(256,!0),"A192CBC-HS384":ae(384,!0),"A256CBC-HS512":ae(512,!0)});function jt(e,t){throw new m(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function R(e){return(typeof e==="string"?mt[e]:void 0)??jt("alg","Algorithm")}function ee(e){return(typeof e==="string"?kr[e]:void 0)??jt("enc","Encryption Algorithm")}function zt(e,t){if(e.algorithm.name!=="ECDH"&&e.algorithm.name!=="X25519")throw TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");nt(e,t)}async function Gt(e,t,r){let n=R(t).subtle,o=e instanceof Uint8Array?await crypto.subtle.importKey("raw",e,"AES-KW",!0,[r]):e;return k(o,n,r),o}async function yt(e,t,r){let n=await Gt(t,e,"wrapKey"),o=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",o,n,"AES-KW"))}async function ht(e,t,r){let n=await Gt(t,e,"unwrapKey"),o=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",o))}function Ft(e,t,r){k(t,R(e).subtle,r),Ie(e,t)}function Br(e,t){if(e instanceof Uint8Array)return crypto.subtle.importKey("raw",e,"PBKDF2",!1,["deriveBits"]);return k(e,R(t).subtle,"deriveBits"),e}async function Xt(e,t,r,n){if(!(e instanceof Uint8Array)||e.length<8)throw new f("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new f("PBES2 Count Input must be a positive integer");let o=A(b(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),i={hash:`SHA-${t.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:o},s=await Br(n,t);return new Uint8Array(await crypto.subtle.deriveBits(i,s,a))}function wt(e){return A(Te(e.length),e)}async function Mr(e,t,r){let n=t>>3,o=32,a=Math.ceil(n/32),i=new Uint8Array(a*32);for(let s=1;s<=a;s++){let c=await $e("sha256",A(Te(s),e,r));i.set(c,(s-1)*32)}return i.slice(0,n)}async function Yt(e,t,r,n,o=new Uint8Array,a=new Uint8Array){zt(e),zt(t,"deriveBits");let i=A(wt(b(r)),wt(o),wt(a),Te(n)),s=new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name==="X25519"?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3));return Mr(s,n,i)}function qt(e){Re(e);let t=e.algorithm.namedCurve;if(t!=="P-256"&&t!=="P-384"&&t!=="P-521"&&e.algorithm.name!=="X25519")throw new m("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function Ee(e){if(e===void 0)throw new f("JWE Encrypted Key missing")}function Vt(e){if(e!==void 0)throw new f("Encountered unexpected JWE Encrypted Key")}async function Zt(e,t,r,n,o,a){let i=R(e);if(e==="dir")return Vt(n),r;switch(i.subtle.name){case"ECDH":{if(e==="ECDH-ES")Vt(n);if(!S(o.epk))throw new f('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');qt(r);let s=await j(i,o.epk),c,p;if(o.apu!==void 0){if(typeof o.apu!=="string")throw new f('JOSE Header "apu" (Agreement PartyUInfo) invalid');c=W(o.apu,"apu",f)}if(o.apv!==void 0){if(typeof o.apv!=="string")throw new f('JOSE Header "apv" (Agreement PartyVInfo) invalid');p=W(o.apv,"apv",f)}let d=await Yt(s,r,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),c,p);if(e==="ECDH-ES")return d;return Ee(n),ht(e.slice(-6),d,n)}case"RSA-OAEP":return Ee(n),Re(r),Ft(e,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(Ee(n),typeof o.p2c!=="number")throw new f('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=a||1e4;if(o.p2c>s)throw new f('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof o.p2s!=="string")throw new f('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let c=W(o.p2s,"p2s",f),p=await Xt(c,e,o.p2c,r);return ht(e.slice(-6),p,n)}case"AES-KW":return Ee(n),ht(e,r,n);case"AES-GCM":{if(Ee(n),typeof o.iv!=="string")throw new f('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof o.tag!=="string")throw new f('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=W(o.iv,"iv",f);let c;return c=W(o.tag,"tag",f),ke(ee(e.slice(0,-2)),r,n,s,c,new Uint8Array)}}}async function Qt(e,t,r,n,o={}){let a,i,s,c=R(e);if(e==="dir")return[r,void 0,void 0];switch(c.subtle.name){case"ECDH":{qt(r);let{apu:p,apv:d}=o;if(p!==void 0)Z(p,'"apu"');if(d!==void 0)Z(d,'"apv"');let u;if(o.epk!==void 0)u=await U(c,o.epk,"decrypt");else u=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let l=crypto.subtle,K=u;if(!K.extractable){if(typeof l.getPublicKey!=="function")throw TypeError('CryptoKey for "epk" must be extractable');K=await l.getPublicKey(u,[])}let{x:T,y:g,crv:h,kty:v}=await l.exportKey("jwk",K),y=await Yt(r,u,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),p,d);if(i={epk:{x:T,crv:h,kty:v}},v==="EC")i.epk.y=g;if(p)i.apu=ur(p);if(d)i.apv=ur(d);if(e==="ECDH-ES"){s=y;break}s=n||L(t);let J=e.slice(-6);a=await yt(J,y,s);break}case"RSA-OAEP":{s=n||L(t),Re(r),Ft(e,r,"encrypt"),a=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",r,s));break}case"PBKDF2":{s=n||L(t);let{p2c:p=2048,p2s:d=crypto.getRandomValues(new Uint8Array(16))}=o,u=await Xt(d,e,p,r);a=await yt(e.slice(-6),u,s),i={p2c:p,p2s:ur(d)};break}case"AES-KW":{s=n||L(t),a=await yt(e,r,s);break}case"AES-GCM":{s=n||L(t);let{iv:p}=o,d=await He(ee(e.slice(0,-2)),s,r,p,new Uint8Array);a=d.ciphertext,i={iv:ur(d.iv),tag:ur(d.tag)};break}}return[s,a,i]}var se={__proto__:null,b64:!0},Fe={__proto__:null};function be(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some((r)=>typeof r!=="string")))throw TypeError(`"${e}" option must be an array of strings`);if(!t)return;return new Set(t)}function Xe(e,t){let{crit:r}=t??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function N(e,t,r,n,o){if(o.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some((i)=>typeof i!=="string"||i.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let a=r===void 0?t:{__proto__:null,...r,...t};for(let i of n.crit){if(!(i in a))throw new m(`Extension Header Parameter "${i}" is not recognized`);if(!Object.hasOwn(o,i)||o[i]===void 0)throw new e(`Extension Header Parameter "${i}" is missing`);if(a[i]&&(!Object.hasOwn(n,i)||n[i]===void 0))throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`)}return n.crit}function ce(e,t){if(t.includes("b64")){let r=e.b64;if(typeof r!=="boolean")throw new w('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function pe(e,t){let r,n;try{r=JSON.stringify(t),n=JSON.parse(r)}catch(o){throw new e("JOSE Header is not valid JSON",{cause:o})}if(!S(n))throw new e("JOSE Header is not a JSON object");return[n,r]}function Ye(e,t){if(e.zip!==void 0&&e.zip!=="DEF")throw new m('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(e.zip!==void 0&&!t?.zip)throw new f('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function er(e){if(typeof globalThis[e]>"u")throw new m(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function tr(e){er("CompressionStream");let t=new CompressionStream("deflate-raw"),r=t.writable.getWriter();r.write(e).catch(()=>{}),r.close().catch(()=>{});let n=[],o=t.readable.getReader();for(;;){let{value:a,done:i}=await o.read();if(i)break;n.push(a)}return A(...n)}async function rr(e,t){er("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let o=[],a=0,i=r.readable.getReader();for(;;){let{value:s,done:c}=await i.read();if(c)break;if(o.push(s),a+=s.byteLength,t!==1/0&&a>t)throw new f("Decompressed plaintext exceeded the configured limit")}return A(...o)}function nr(e){return[e&&be("keyManagementAlgorithms",e.keyManagementAlgorithms),e&&be("contentEncryptionAlgorithms",e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function $r(e,t,r,n,o){let[a,i,s,c,p]=r,[d,u,l,K,T]=t,{encrypted_key:g}=e;N(f,Fe,s,d,o),Ye(o,d);let{alg:h,enc:v}=o;if(typeof h!=="string"||!h)throw new f("missing JWE Algorithm (alg) in JWE Header");if(typeof v!=="string"||!v)throw new f("missing JWE Encryption Algorithm (enc) in JWE Header");if(a&&!a.has(h)||!a&&h.startsWith("PBES2"))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');if(i&&!i.has(v))throw new ne('"enc" (Encryption Algorithm) Header Parameter value not allowed');let y=ee(v),J;if(g!==void 0)J=W(g,"encrypted_key",f);let P=!1;if(typeof n==="function")n=await n(d,e),P=!0;let H=R(h),O=await U(h==="dir"?y:H,n,"decrypt"),I;try{if(I=await Zt(h,y,O,J,o,c),g!==void 0&&I instanceof Uint8Array&&I.byteLength<<3!==y.cekBits)I=L(y)}catch(C){if(C instanceof TypeError||C instanceof f||C instanceof m)throw C;I=L(y)}let X=await ke(y,I,u,l,K,T);if(o.zip==="DEF"){let C=p??250000;if(C===0)throw new m('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(C!==1/0&&(!Number.isSafeInteger(C)||C<1))throw TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");X=await rr(X,C).catch((Y)=>{if(Y instanceof f)throw Y;throw new f("Failed to decompress plaintext",{cause:Y})})}return[X,d,O,P]}async function or(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new f("Compact JWE must be a string or Uint8Array");let{0:n,1:o,2:a,3:i,4:s,length:c}=e.split(".");if(c!==5)throw new f("Invalid Compact JWE");let p={ciphertext:i,iv:a||void 0,protected:n,tag:s||void 0,encrypted_key:o||void 0},d=F(n,f,"JWE Protected Header is invalid"),u=b(n),l=[d,W(i,"ciphertext",f),a?W(a,"iv",f):void 0,s?W(s,"tag",f):void 0,u];return $r(p,l,t,r,d)}function ir(e,t,r){if(!Nt(e,t,r))throw new f("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Lr(e){let[,t,r,n,o,a,i,s,c]=e;if(o!==void 0)Z(o,"JWE Additional Authenticated Data");if(a!==void 0)Z(a,"JWE Content Encryption Key");if(i!==void 0)Z(i,"JWE Initialization Vector");if(t!==void 0)t=pe(f,t)[0],e[1]=t;if(r!==void 0)r=pe(f,r)[0],e[2]=r;if(n!==void 0)n=pe(f,n)[0],e[3]=n;if(s!==void 0&&!S(s))throw TypeError("JWE Key Management Parameters must be an object");ir(t,r,n);let p={...t,...r,...n};Xe(f,t),N(f,Fe,c,t,p),Ye(p,t);let{alg:d,enc:u}=p;if(typeof d!=="string"||!d)throw new f('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof u!=="string"||!u)throw new f('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,d,u,ee(u)]}async function jr(e,t,r){let[n,o,,a]=t,[i,s,c,p,d,u,l,K,,T]=e,g=s,h=c;if(u&&(o==="dir"||o==="ECDH-ES"))throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let v=R(o),y=await U(o==="dir"?a:v,r,"encrypt"),[J,P,H]=await Qt(o,a,y,u,K);if(H){if(T)h=h?{...h,...H}:H;else g=g?{...g,...H}:H;ir(g,h,p)}let O,I;if(g)O=ur(JSON.stringify(g)),I=b(O);else O="",I=new Uint8Array;let X,C;if(d?.byteLength)C=ur(d),X=A(I,b("."),b(C));else X=I;let Y=i;if(n.zip==="DEF")Y=await tr(Y).catch((Jr)=>{throw new f("Failed to compress plaintext",{cause:Jr})});let{ciphertext:Kr,tag:Pt,iv:It}=await He(a,Y,J,l,X),G={ciphertext:ur(Kr)};if(It)G.iv=ur(It);if(Pt)G.tag=ur(Pt);if(P)G.encrypted_key=ur(P);if(C)G.aad=C;if(g)G.protected=O;if(p)G.unprotected=p;if(h)G.header=h;return G}async function ar(e,t,r){if(!e[1]&&!e[2]&&!e[3])throw new f("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(r!==void 0)e[8]=r?.crit,e[9]=r?Ht in r:!1;return jr(e,Lr(e),t)}async function sr(e,t,r){if(t instanceof Uint8Array)return crypto.subtle.importKey("raw",t,e.subtle,!1,[r]);if(k(t,e.subtle,r),e.minRsaBits)Ie(e.alg,t);return t}async function cr(e,t,r){let n=await sr(e,t,"sign"),o=await crypto.subtle.sign(e.signing,n,r);return new Uint8Array(o)}async function pr(e,t,r,n){let o=await sr(e,t,"verify");try{return await crypto.subtle.verify(e.signing,o,r,n)}catch{return!1}}var Se=[["verify"],["sign"]];function gt(e){let t={name:"HMAC",hash:`SHA-${e}`};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:Se}}function de(e,t){let n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${e}`};return{kty:["RSA"],subtle:n,signing:t?{...n,saltLength:t}:n,usages:Se,minRsaBits:2048}}function Et(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:`SHA-${t}`},usages:Se}}function dr(){let e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:Se}}function bt(e){let r={name:`ML-DSA-${e}`};return{kty:["AKP"],subtle:r,signing:r,usages:Se}}var Ae=ge({HS256:gt(256),HS384:gt(384),HS512:gt(512),RS256:de(256),RS384:de(384),RS512:de(512),PS256:de(256,32),PS384:de(384,48),PS512:de(512,64),ES256:Et("P-256",256),ES384:Et("P-384",384),ES512:Et("P-521",512),EdDSA:dr(),Ed25519:dr(),"ML-DSA-44":bt(44),"ML-DSA-65":bt(65),"ML-DSA-87":bt(87)});function qe(e){let t=typeof e==="string"?Ae[e]:void 0;if(!t)throw new m(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function fr(e){return[e&&be("algorithms",e.algorithms),e?.crit]}function Vr(e,t=e===void 0?{}:F(e,w,"JWS Protected Header is invalid")){return t}function Gr(e,t,r){let n=ce(e,N(w,se,r[1],e,t)),o=t.alg;if(typeof o!=="string"||!o)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(r[0]&&!r[0].has(o))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');return[n,o]}function Fr(e){try{return b(e)}catch{throw new w("JWS Compact Serialization payload must use only ASCII characters")}}async function Xr(e,t,r,n,o,a,i){let s=!1;if(typeof r==="function")r=await r(o,e),s=!0;let c=typeof i==="string",p=qe(a),d=A(n!==void 0?b(n):new Uint8Array,b("."),c?t[2]??=dt(i,"payload",w):i),u=W(e.signature,"signature",w),l=await U(p,r,"verify");if(!await pr(p,l,u,d))throw new at;return[c?W(i,"payload",w):i,o,c,l,s]}async function lr(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new w("Compact JWS must be a string or Uint8Array");let{0:n,1:o,2:a,length:i}=e.split(".");if(i!==3)throw new w("Invalid Compact JWS");let s={payload:o,protected:n,signature:a},c=Vr(n),[p,d]=Gr(c,c,t),u=p?o:Fr(o);return Xr(s,t,r,n,c,d,u)}var xe=(e)=>Math.floor(e.getTime()/1000),Yr={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},qr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fe="check_failed";function St(){throw TypeError("Invalid time period format")}function Ze(e){if(typeof e!=="string")St();let t=qr.exec(e);if(!t||t[4]&&t[1])St();let r=parseFloat(t[2]),n=Math.round(r*Yr[t[3][0].toLowerCase()]);if(!Number.isFinite(n))St();if(t[1]==="-"||t[4]==="ago")return-n;return n}function ue(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function At(e,t){if(typeof t!=="string")throw TypeError(`"${e}" claim must be a string`)}function Zr(e){if(typeof e!=="string"&&(!Array.isArray(e)||Array.from(e).some((t)=>typeof t!=="string")))throw TypeError('"aud" claim must be a string or an array of strings')}function xt(e,t){if(typeof e==="number")return ue(t,e);if(e instanceof Date)return ue(t,xe(e));return xe(new Date)+Ze(e)}var mr=(e)=>{let t=e.toLowerCase();return e.includes("/")?t:`application/${t}`},Qr=(e,t)=>{if(typeof e==="string")return t.includes(e);if(Array.isArray(e))return t.some((r)=>e.includes(r));return!1};function Kt(e,t,r=!1){let n=e[t];if(n===void 0&&!r)return;if(typeof n!=="number")throw new _(`"${t}" claim must be a number`,e,t,"invalid");return n}function Jt(e,t){throw new _(`unexpected "${t}" claim value`,e,t,fe)}function le(e,t,r={}){let n;try{n=JSON.parse(re.decode(t))}catch{}if(!S(n))throw new E("JWT Claims Set must be a top-level JSON object");let{typ:o}=r;if(o!==void 0&&(typeof e.typ!=="string"||mr(e.typ)!==mr(o)))throw new _('unexpected "typ" JWT header value',n,"typ",fe);let{requiredClaims:a=[],issuer:i,subject:s,audience:c,maxTokenAge:p}=r,d=[...a];if(p!==void 0)d.push("iat");if(c!==void 0)d.push("aud");if(s!==void 0)d.push("sub");if(i!==void 0)d.push("iss");for(let y of new Set(d.reverse()))if(!Object.hasOwn(n,y))throw new _(`missing required "${y}" claim`,n,y,"missing");if(i!==void 0&&!(Array.isArray(i)?i:[i]).includes(n.iss))Jt(n,"iss");if(s!==void 0&&n.sub!==s)Jt(n,"sub");if(c!==void 0&&!Qr(n.aud,typeof c==="string"?[c]:c))Jt(n,"aud");let{clockTolerance:u}=r,l=0;if(typeof u==="string")l=Ze(u);else if(u!==void 0){if(typeof u!=="number")throw TypeError("Invalid clockTolerance option type");l=u}ue("clockTolerance option",l);let{currentDate:K}=r,T=ue("currentDate option",xe(K===void 0?new Date:K)),g=Kt(n,"iat",p!==void 0),h=Kt(n,"nbf");if(h!==void 0){if(h>T+l)throw new _('"nbf" claim timestamp check failed',n,"nbf",fe)}let v=Kt(n,"exp");if(v!==void 0){if(v<=T-l)throw new Qi('"exp" claim timestamp check failed',n,"exp",fe)}if(p!==void 0){let y=T-g,J=ue("maxTokenAge option",typeof p==="number"?p:Ze(p));if(y-l>J)throw new Qi('"iat" claim timestamp check failed (too far in the past)',n,"iat",fe);if(y<-l)throw new _('"iat" claim timestamp check failed (it should be in the past)',n,"iat",fe)}return n}var yr;function z(e){return yr.get(e)}function me(e){let t=z(e);for(let r of["iat","nbf","exp"]){let n=t[r];if(typeof n==="number"&&!Number.isFinite(n))throw TypeError(`"${r}" claim must be a finite number`)}return ye.encode(JSON.stringify(t))}function Qe(e,t){return z(e)[t]}class te{constructor(e={}){if(!S(e))throw TypeError("JWT Claims Set MUST be an object");(yr||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return At("iss",e),z(this).iss=e,this}setSubject(e){return At("sub",e),z(this).sub=e,this}setAudience(e){return Zr(e),z(this).aud=e,this}setJti(e){return At("jti",e),z(this).jti=e,this}setNotBefore(e){return z(this).nbf=xt(e,"setNotBefore"),this}setExpirationTime(e){return z(this).exp=xt(e,"setExpirationTime"),this}setIssuedAt(e){let t=z(this);if(e===void 0)t.iat=xe(new Date);else if(typeof e==="string")t.iat=ue("setIssuedAt",xe(new Date)+Ze(e));else t.iat=xt(e,"setIssuedAt");return this}}async function Pn(e,t,r){let n=await lr(e,fr(r),t);if(!n[2])throw new E("JWTs MUST NOT use unencoded payload");let a={payload:le(n[1],n[0],r),protectedHeader:n[1]};if(typeof t==="function")return{...a,key:n[3]};return a}async function ic(e,t,r){let n=await or(e,nr(r),t),o=n[1],a=le(o,n[0],r);for(let s of["iss","sub","aud"])if(o[s]!==void 0&&(s==="aud"?JSON.stringify(o.aud)!==JSON.stringify(a.aud):o[s]!==a[s]))throw new _(`replicated "${s}" claim header parameter mismatch`,a,s,"mismatch");let i={payload:a,protectedHeader:o};if(typeof t==="function")return{...i,key:n[2]};return i}function en(e){if(e===void 0)return[void 0,""];let t=pe(w,e);return[t[0],ur(t[1])]}function tn(e,t,r){return Xe(w,e),ce(e,N(w,se,r,e,t))}function rn(e){let t=e.alg;if(typeof t!=="string"||!t)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');return qe(t)}async function nn(e,t,r,n){let o=A(b(e),b("."),t),a=await U(r,n,"sign");return ur(await cr(r,a,o))}async function hr(e,t,r,n,o){let[a,i]=en(t);if(!a)throw new w("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!tn(a,a,r))o();let c=rn(a),p=ur(e),d=await nn(i,b(p),c,n);return`${i}.${p}.${d}`}var on=te;class lc extends on{#e;setProtectedHeader(e){return Q(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,t){return hr(me(this),this.#e,t?.crit,e,()=>{throw new E("JWTs MUST NOT use unencoded payload")})}}var an=te;class cc extends an{#e;#r;#n;#t;#o;#i;#a;setProtectedHeader(e){return Q(this.#t,"setProtectedHeader"),this.#t=e,this}setKeyManagementParameters(e){return Q(this.#n,"setKeyManagementParameters"),this.#n=e,this}setContentEncryptionKey(e){return Q(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Q(this.#r,"setInitializationVector"),this.#r=e,this}replicateIssuerAsHeader(){return this.#o=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,t){let r=me(this);if(this.#t&&(this.#o||this.#i||this.#a))this.#t={...this.#t,iss:this.#o?Qe(this,"iss"):void 0,sub:this.#i?Qe(this,"sub"):void 0,aud:this.#a?Qe(this,"aud"):void 0};let n=await ar([r,this.#t,void 0,void 0,void 0,this.#e,this.#r,this.#n,void 0,!1],e,t);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}var Wt='"alg" (Algorithm)';function Ct(e='JWK "alg" (Algorithm) Parameter'){throw new m(`Invalid or unsupported ${e} value`)}function Ke(e,t){return(typeof e==="string"?Ae[e]??mt[e]:void 0)??Ct(t)}function et(e){if(e!==void 0&&typeof e!=="boolean")throw TypeError('"extractable" option must be a boolean');return e}var Je=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let r=0;r<e.byteLength;r++)if(e[r]!==t[r])return!1;return!0},sn=(e)=>({data:e,pos:0}),vt=(e)=>{let t=e.data[e.pos++];if(t===void 0)throw Error("Unexpected end of ASN.1 input");return t},We=(e)=>{let t=vt(e);if(t&128){let r=t&127,n=0;for(let o=0;o<r;o++)n=n<<8|vt(e);return n}return t};var Ce=(e,t,r)=>{if(vt(e)!==t)throw Error(r)},wr=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error("Unexpected end of ASN.1 input");let r=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,r},cn=(e)=>{Ce(e,6,"Expected algorithm OID");let t=We(e);return wr(e,t)};function pn(e,t){if(Ce(e,48,`Invalid ${t==="spki"?"SPKI":"PKCS#8"} structure`),We(e),t==="pkcs8"){Ce(e,2,"Expected version field");let r=We(e);e.pos+=r}Ce(e,48,"Expected algorithm identifier"),We(e)}var dn=(e)=>{let t=cn(e);if(Je(t,[43,101,110]))return"X25519";if(!Je(t,[42,134,72,206,61,2,1]))throw Error("Unsupported key algorithm");Ce(e,6,"Expected curve OID");let r=We(e),n=wr(e,r);if(Je(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Je(n,[43,129,4,0,34]))return"P-384";if(Je(n,[43,129,4,0,35]))return"P-521";throw Error("Unsupported named curve")},fn=async(e,t,r,n)=>{let o=et(n?.extractable),a=Ke(r,Wt);if(a.secret)Ct(Wt);let i=e==="spki",s;if(a.resolve)try{let c=sn(t);pn(c,e),s=a.resolve({crv:dn(c)})}catch{throw new m("Invalid or unsupported key format")}else s=a.subtle;return crypto.subtle.importKey(e,t,s,o??i,a.usages[i?0:1])},un=(e,t)=>Be(e.replace(t,"")),gr=(e,t,r)=>{let n=un(e,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return fn("pkcs8",n,t,r)};function ln(e){return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0))}async function mn(e){if(st(e))if(e.type==="secret")e=e.export();else return e.export({format:"jwk"});if(e instanceof Uint8Array)return{kty:"oct",k:ur(e)};if(!M(e))throw TypeError(B(e,"CryptoKey","KeyObject","Uint8Array"));if(!e.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:t,key_ops:r,alg:n,use:o,...a}=ln(await crypto.subtle.exportKey("jwk",e));if(a.kty==="AKP")a.alg=n;return a}function Er(e){return mn(e)}var V=(e,t)=>{if(typeof e!=="string"||!e)throw new De(`${t} missing or invalid`)};async function uc(e,t){let r;if(S(e)){if(r=oe(e),typeof r.kty!=="string")throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"))}else if(Ne(e))r=oe(await Er(e));else throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"));if(t??="sha256",t!=="sha256"&&t!=="sha384"&&t!=="sha512")throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":V(r.alg,'"alg" (Algorithm) Parameter'),V(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":V(r.crv,'"crv" (Curve) Parameter'),V(r.x,'"x" (X Coordinate) Parameter'),V(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":V(r.crv,'"crv" (Subtype of Key Pair) Parameter'),V(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":V(r.e,'"e" (Exponent) Parameter'),V(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!=="string")throw new De('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new m('"kty" (Key Type) Parameter missing or unsupported')}let o=b(JSON.stringify(n));return ur(await $e(t,o))}function yn(e,t,r,n){let{kty:o,key_ops:a,ext:i,kid:s,alg:c,use:p,crv:d}=oe(e),u=Array.isArray(a)?[...a]:a;return(i===void 0||typeof i==="boolean")&&(u===void 0||Array.isArray(u)&&u.every((l,K)=>typeof l==="string"&&u.indexOf(l)===K)&&u.includes("verify"))&&t.kty.includes(o)&&(n===void 0||typeof n==="string"&&n===s)&&(c===void 0?o!=="AKP":r===c)&&(p===void 0||p==="sig")&&(!t.crv||d===t.crv)}async function br(e,t,r){let n=e.get(t)||e.set(t,{}).get(t),{alg:o}=r;if(n[o]===void 0){let a=await j(r,{...t,alg:o,ext:!0});if(a.type!=="public")throw new Ue("JSON Web Key Set members must be public keys");n[o]=a}return n[o]}function _u(e){let t;try{t=structuredClone(e)}catch{}if(!Me(t))throw new Ue("JSON Web Key Set malformed");let r=new WeakMap;return Object.defineProperty(async(o,a)=>{let{alg:i,kid:s}={...o,...a?.header},c=typeof i==="string"?Ae[i]:void 0;if(!c||c.secret)throw new m('Unsupported "alg" value for a JSON Web Key Set');let p=t.keys.filter((l)=>yn(l,c,i,s)),{0:d,length:u}=p;if(!u)throw new we;if(u!==1){let l=new ot;throw l[Symbol.asyncIterator]=async function*(){for(let K of p)try{yield await br(r,K,c)}catch{}},l}return br(r,d,c)},"jwks",{value:()=>structuredClone(t)})}function hn(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var Tt;if(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))Tt="jose/v6.2.10";var Ar=Symbol();async function wn(e,t,r,n=fetch){let o=await n(e,{method:"GET",signal:r,redirect:"manual",headers:t}).catch((a)=>{if(a.name==="TimeoutError")throw new it;throw a});if(o.status!==200)throw new x("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch{throw new x("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var xr=Symbol();function ve(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Sr(e,t,r){if(Number.isNaN(e))throw TypeError(`"${r}" option must not be NaN`);return typeof e==="number"?e:t}function yu(e,t){if(!(e instanceof URL))throw TypeError("url must be an instance of URL");let r=new URL(e.href).href,n=t??{},o=n.timeoutDuration;if(typeof o==="number"&&(!Number.isInteger(o)||o<0))throw TypeError('"timeoutDuration" option must be a non-negative integer');let a=typeof o==="number"?o:5000,i=Sr(n.cooldownDuration,30000,"cooldownDuration"),s=Sr(n.cacheMaxAge,600000,"cacheMaxAge"),c=new Headers(n.headers);if(Tt&&!c.has("User-Agent"))c.set("User-Agent",Tt);if(!c.has("accept"))c.set("accept","application/json, application/jwk-set+json");let p=n[Ar],d=n[xr],u,l,K=0,T=0,g;if(d&&typeof d==="object"){let{uat:y,jwks:J}=d;if(ve(y,s)&&Me(J))u=y,g=_u(J)}let h=async()=>{if(l&&hn())l=void 0;if(!l){let y=++K,J=l=wn(r,c,AbortSignal.timeout(a),p).then((P)=>{let H=_u(P);if(y<=T)return;g=H;let O=Date.now();if(d)d.uat=O,d.jwks=P;u=O,T=y}).finally(()=>{if(l===J)l=void 0})}await l};return Object.defineProperties(async(y,J)=>{if(!g||!ve(u,s))await h();try{return await g(y,J)}catch(P){if(P instanceof we&&!ve(u,i))return await h(),g(y,J);throw P}},{coolingDown:{get:()=>ve(u,i),enumerable:!0},fresh:{get:()=>ve(u,s),enumerable:!0},reload:{value:h,enumerable:!0},reloading:{get:()=>!!l,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}var gn=te;class im extends gn{encode(){let e=ur(JSON.stringify({alg:"none"})),t=ur(me(this));return`${e}.${t}.`}static decode(e,t){if(typeof e!=="string")throw new E("Unsecured JWT must be a string");let{0:r,1:n,2:o,length:a}=e.split(".");if(a!==3||o!=="")throw new E("Invalid Unsecured JWT");let i,s;try{i=F(r,w,"JWS Protected Header is invalid");let p=N(w,se,void 0,i,i);s=ce(i,p)}catch(p){if(!(p instanceof w))throw p;throw new E("Invalid Unsecured JWT",{cause:p})}if(i.alg!=="none")throw new E("Invalid Unsecured JWT");if(!s)throw new E("JWTs MUST NOT use unencoded payload");return{payload:le(i,W(n,"payload",E),t),header:i}}}async function yA(e,t,r){if(typeof e!=="string"||e.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw TypeError('"pkcs8" must be PKCS#8 formatted string');return gr(e,t,r)}async function Ss(e,t,r){if(!S(e))throw TypeError("JWK must be an object");let n=Le(e),o=et(r?.extractable),{alg:a}=n;t??=a;let i=o??n.ext;if(n.kty!=="oct"&&!t)throw TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!=="string")throw TypeError('missing "k" (Key Value) Parameter value');return D(n.k);case"AKP":{if(typeof a!=="string"||!a)throw TypeError('missing "alg" (Algorithm) Parameter value');if(t!==a)throw TypeError("JWK alg and alg option value mismatch");return j(Ke(t),{...n,ext:i})}case"RSA":case"EC":case"OKP":return j(Ke(t),{...n,alg:t,ext:i});default:throw new m('Unsupported "kty" (Key Type) Parameter value')}}function jo(e){let t;if(typeof e==="string"){let n=e.split(".");if(n.length===3||n.length===5)[t]=n}else if(typeof e==="object"&&e)if("protected"in e)t=e.protected;else throw TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof t!=="string"||!t)throw TypeError(r);return F(t,TypeError,r)}function zr(e){if(typeof e!=="string")throw new E("JWTs must use Compact JWS serialization, JWT must be a string");let{1:t,length:r}=e.split(".");if(r===5)throw new E("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new E("Invalid JWT");if(!t)throw new E("JWTs must contain a payload");let n;try{n=D(t)}catch{throw new E("Failed to base64url decode the payload")}let o;try{o=JSON.parse(re.decode(n))}catch{throw new E("Failed to parse the decoded payload as JSON")}if(!S(o))throw new E("Invalid JWT Claims Set");return o}export{Qi,ur,nf,Pn,ic,lc,cc,uc,_u,yu,im,yA,Ss,jo,zr};
+import{Me}from"./chunk-jxfz4h24.js";var ye=new TextEncoder,q=new TextDecoder,re=new TextDecoder("utf-8",{fatal:!0});function A(...e){let t=e.reduce((o,{length:a})=>o+a,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function tt(e,t,r){if(t<0||t>=4294967296)throw RangeError(`value must be >= 0 and <= 4294967295. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],r)}function rt(e){let t=Math.floor(e/4294967296),r=e%4294967296,n=new Uint8Array(8);return tt(n,t,0),tt(n,r,4),n}function Te(e){let t=new Uint8Array(4);return tt(t,e),t}function b(e){let t=new Uint8Array(e.length);for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);if(n>127)throw TypeError("non-ASCII string encountered in encode()");t[r]=n}return t}var Pe=(e,t="algorithm.name")=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function nt(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Ie(e,t){let{modulusLength:r}=t.algorithm;if(typeof r!=="number"||r<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function k(e,t,r){let n=e.algorithm;if(n.name!==t.name)throw Pe(t.name);if(t.hash&&n.hash?.name!==t.hash)throw Pe(t.hash,"algorithm.hash");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw Pe(t.namedCurve,"algorithm.namedCurve");if(t.length!==void 0&&n.length!==t.length)throw Pe(t.length,"algorithm.length");nt(e,r)}function Ot(e,t,...r){if(r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`}else if(r.length===2)e+=`one of type ${r[0]} or ${r[1]}.`;else e+=`of type ${r[0]}.`;if(t==null)e+=` Received ${t}`;else if(typeof t==="function"&&t.name)e+=` Received function ${t.name}`;else if(typeof t==="object"&&t!=null){if(t.constructor?.name)e+=` Received an instance of ${t.constructor.name}`}return e}var B=(e,...t)=>Ot("Key must be ",e,...t),he=(e,t,...r)=>Ot(`Key for the ${e} algorithm must be `,t,...r);class x extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,t){super(e,t);this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class _ extends x{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class Wa extends x{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class ne extends x{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class m extends x{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class Oe extends x{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",t){super(e,t)}}class f extends x{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class w extends x{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class E extends x{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class _e extends x{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"}class De extends x{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class we extends x{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",t){super(e,t)}}class ot extends x{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",t){super(e,t)}}class it extends x{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",t){super(e,t)}}class at extends x{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",t){super(e,t)}}function Ue(e){if(!M(e))throw Error("CryptoKey instance expected")}var M=(e)=>{if(e?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return e instanceof CryptoKey}catch{return!1}},st=(e)=>e?.[Symbol.toStringTag]==="KeyObject",Re=(e)=>M(e)||st(e);var L=(e)=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function _t(e,t){let r=e.byteLength<<3;if(r!==t)throw new f(`Invalid Content Encryption Key length. Expected ${t} bits, got ${r} bits`)}var Wr=(e)=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function Dt(e,t){if(t.length<<3!==e.ivBits)throw new f("Invalid Initialization Vector length")}async function Ut(e,t,r){if(!(t instanceof Uint8Array))throw TypeError(B(t,"Uint8Array"));let n=e.cekBits>>1,o=await crypto.subtle.importKey("raw",t.subarray(n>>3),"AES-CBC",!1,[r]),a=await crypto.subtle.importKey("raw",t.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[o,a,n]}async function Rt(e,t,r){return new Uint8Array((await crypto.subtle.sign("HMAC",e,t)).slice(0,r>>3))}async function Cr(e,t,r,n,o){let[a,i,s]=await Ut(e,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},a,t)),p=A(o,n,c,rt(o.length*8)),d=await Rt(i,p,s);return{ciphertext:c,tag:d,iv:n}}async function vr(e,t){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),o=await crypto.subtle.sign(r,n,e);return crypto.subtle.verify(r,n,o,t)}async function Tr(e,t,r,n,o,a){let[i,s,c]=await Ut(e,t,"decrypt"),p=A(a,n,r,rt(a.length*8)),d=await Rt(s,p,c);try{if(await vr(o,d))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},i,r))}catch{}throw new Oe}async function Pr(e,t,r,n,o){let a=r instanceof Uint8Array?await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(k(r,e.subtle,"encrypt"),r),i=new Uint8Array(await crypto.subtle.encrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},a,t)),s=i.slice(-16);return{ciphertext:i.slice(0,-16),tag:s,iv:n}}async function Ir(e,t,r,n,o,a){let i=t instanceof Uint8Array?await crypto.subtle.importKey("raw",t,"AES-GCM",!1,["decrypt"]):(k(t,e.subtle,"decrypt"),t);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:n,name:"AES-GCM",tagLength:128},i,A(r,o)))}catch{throw new Oe}}async function Ne(e,t,r,n,o){if(!M(r)&&!(r instanceof Uint8Array))throw TypeError(B(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n)Dt(e,n);else n=Wr(e);if(r instanceof Uint8Array)_t(r,e.cekBits);return e.cbc?Cr(e,t,r,n,o):Pr(e,t,r,n,o)}async function He(e,t,r,n,o,a){if(!M(t)&&!(t instanceof Uint8Array))throw TypeError(B(t,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new f("JWE Initialization Vector missing");if(!o)throw new f("JWE Authentication Tag missing");if(!e.cbc&&o.length!==16)throw new f("Invalid Authentication Tag length");if(Dt(e,n),t instanceof Uint8Array)_t(t,e.cekBits);return e.cbc?Tr(e,t,r,n,o,a):Ir(e,t,r,n,o,a)}var af={};Me(af,{decode:()=>D,encode:()=>ur});function ct(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function ke(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}var pt="The input to be decoded is not correctly encoded.";function D(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof e==="string"?e:q.decode(e),{alphabet:"base64url"})}catch(r){throw TypeError(pt,{cause:r})}let t=e;if(t instanceof Uint8Array)t=q.decode(t);if(t.includes("+")||t.includes("/"))throw TypeError(pt);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return ke(t)}catch{throw TypeError(pt)}}function ur(e){let t=e;if(typeof t==="string")t=ye.encode(t);if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:"base64url",omitPadding:!0});return ct(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Z(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function S(e){if(typeof e!=="object"||e===null||Object.prototype.toString.call(e)!=="[object Object]")return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Be(e){return S(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(S)}function Nt(...e){let t=new Set;for(let r of e){if(!r)continue;for(let n of Object.keys(r)){if(t.has(n))return!1;t.add(n)}}return!0}var Ht=Symbol();function Q(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function W(e,t,r){try{return D(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}function dt(e,t,r){try{return b(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}async function $e(e,t){let r=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,t))}function F(e,t,r){let n;try{n=JSON.parse(re.decode(D(e)))}catch{throw new t(r)}if(!S(n))throw new t(r);return n}async function j(e,t){if(t.kty==="RSA"&&"oth"in t&&t.oth!==void 0)throw new m('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,n=!!(t.d||t.priv),o={...t};if(o.kty!=="AKP")delete o.alg;return delete o.use,crypto.subtle.importKey("jwk",o,r,t.ext??!n,t.key_ops??e.usages[n?1:0])}function oe(e){return{__proto__:null,...e}}function Le(e){let t=oe(e);if(t.ext!==void 0&&typeof t.ext!=="boolean")throw TypeError('"ext" (Extractable) Parameter must be a boolean');if(t.key_ops!==void 0){let r=t.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some((o)=>typeof o!=="string")||new Set(n).size!==n.length)throw TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}var ft=(e)=>e[Symbol.toStringTag],Or=(e,t,r)=>{let{alg:n}=e;if(t.use!==void 0){let o=r==="sign"||r==="verify"?"sig":"enc";if(t.use!==o)throw TypeError(`Invalid key for this operation, its "use" must be "${o}" when present`)}if(t.alg!==void 0&&t.alg!==n)throw TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(t.key_ops)){let o=r==="encrypt"||r==="decrypt"?e.ops?.[r==="encrypt"?0:1]:r;if(o&&!t.key_ops.includes(o))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${o}" when present`)}};function _r(e,t,r){let{alg:n,secret:o}=e,a=r==="decrypt"||r==="sign";if(o&&t instanceof Uint8Array)return[Bt,t];if(S(t)){let i=Le(t);if(typeof i.kty!=="string")throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(o?i.kty==="oct"&&typeof i.k==="string":i.kty!=="oct"&&(a?i.kty==="AKP"&&typeof i.priv==="string"||typeof i.d==="string":i.d===void 0&&i.priv===void 0)))throw TypeError(o?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${a?"private":"public"} JWK`);return Or(e,i,r),[Lt,t,i]}if(!Re(t))throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(o){if(t.type!=="secret")throw TypeError(`${ft(t)} instances for symmetric algorithms must be of type "secret"`)}else{if(t.type==="secret")throw TypeError(`${ft(t)} instances for asymmetric algorithms must not be of type "secret"`);let i=a?"private":"public";if((t.type==="public"||t.type==="private")&&t.type!==i){let s=r==="sign"?"signing":r==="verify"?"verifying":`${r.slice(0,-1)}tion`;throw TypeError(`${ft(t)} instances for asymmetric algorithm ${s} must be of type "${i}"`)}}return M(t)?[Mt,t]:[$t,t]}var Bt=0,Mt=1,$t=2,Lt=3,ut,Dr={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function je(e,t,r){ut||=new WeakMap;let n=ut.get(e);if(r)if(n)n[t]=r;else ut.set(e,{[t]:r});return r??n?.[t]}var kt=async(e,t,r)=>je(e,r.alg)??je(e,r.alg,await j(r,{...t,alg:r.alg})),Ur=(e,t)=>{let r=je(e,t.alg);if(r)return r;let n=e.type==="public",o=t.usages[n?0:1],{asymmetricKeyType:a}=e,i=Dr[e.asymmetricKeyDetails?.namedCurve],s=t.resolve?.({crv:i,asymmetricKeyType:a})??t.subtle;return je(e,t.alg,e.toCryptoKey(s,n,o))};async function U(e,t,r){let n=_r(e,t,r);switch(n[0]){case Bt:case Mt:return n[1];case Lt:{let o=n[1],a=n[2];if(a.kty==="oct")return D(a.k);if(!Object.isFrozen(o)){let{key_ops:i}=o;if(Array.isArray(i))Object.freeze(i);Object.freeze(o)}return kt(o,a,e)}case $t:{let o=n[1];if(o.type==="secret")return o.export();if("toCryptoKey"in o&&typeof o.toCryptoKey==="function")return Ur(o,e);return kt(o,o.export({format:"jwk"}),e)}}}function ge(e){let t={__proto__:null};for(let r in e)t[r]={...e[r],alg:r};return t}var Rr=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Nr=[[],["deriveBits"]],Ge=[[],[]];function ze(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${e}`},usages:Rr,ops:["wrapKey","unwrapKey"]}}function Ve(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty:e,crv:t,asymmetricKeyType:r})=>{if(t==="X25519"||r==="x25519")return{name:"X25519"};if(e==="OKP")throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:t}},usages:Nr,ops:[void 0,"deriveBits"]}}function ie(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:Ge,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function lt(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:Ge,ops:["deriveBits","deriveBits"]}}var mt=ge({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:Ge,ops:["encrypt","decrypt"]},"RSA-OAEP":ze(1),"RSA-OAEP-256":ze(256),"RSA-OAEP-384":ze(384),"RSA-OAEP-512":ze(512),"ECDH-ES":Ve(),"ECDH-ES+A128KW":Ve(),"ECDH-ES+A192KW":Ve(),"ECDH-ES+A256KW":Ve(),A128KW:ie(128),A192KW:ie(192),A256KW:ie(256),A128GCMKW:ie(128,!0),A192GCMKW:ie(192,!0),A256GCMKW:ie(256,!0),"PBES2-HS256+A128KW":lt(),"PBES2-HS384+A192KW":lt(),"PBES2-HS512+A256KW":lt()}),Hr=["encrypt","decrypt"];function ae(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:Ge,ops:Hr,cekBits:e,ivBits:t?128:96,cbc:t}}var kr=ge({A128GCM:ae(128),A192GCM:ae(192),A256GCM:ae(256),"A128CBC-HS256":ae(256,!0),"A192CBC-HS384":ae(384,!0),"A256CBC-HS512":ae(512,!0)});function jt(e,t){throw new m(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function R(e){return(typeof e==="string"?mt[e]:void 0)??jt("alg","Algorithm")}function ee(e){return(typeof e==="string"?kr[e]:void 0)??jt("enc","Encryption Algorithm")}function zt(e,t){if(e.algorithm.name!=="ECDH"&&e.algorithm.name!=="X25519")throw TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");nt(e,t)}async function Gt(e,t,r){let n=R(t).subtle,o=e instanceof Uint8Array?await crypto.subtle.importKey("raw",e,"AES-KW",!0,[r]):e;return k(o,n,r),o}async function yt(e,t,r){let n=await Gt(t,e,"wrapKey"),o=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",o,n,"AES-KW"))}async function ht(e,t,r){let n=await Gt(t,e,"unwrapKey"),o=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",o))}function Ft(e,t,r){k(t,R(e).subtle,r),Ie(e,t)}function Br(e,t){if(e instanceof Uint8Array)return crypto.subtle.importKey("raw",e,"PBKDF2",!1,["deriveBits"]);return k(e,R(t).subtle,"deriveBits"),e}async function Xt(e,t,r,n){if(!(e instanceof Uint8Array)||e.length<8)throw new f("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new f("PBES2 Count Input must be a positive integer");let o=A(b(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),i={hash:`SHA-${t.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:o},s=await Br(n,t);return new Uint8Array(await crypto.subtle.deriveBits(i,s,a))}function wt(e){return A(Te(e.length),e)}async function Mr(e,t,r){let n=t>>3,o=32,a=Math.ceil(n/32),i=new Uint8Array(a*32);for(let s=1;s<=a;s++){let c=await $e("sha256",A(Te(s),e,r));i.set(c,(s-1)*32)}return i.slice(0,n)}async function Yt(e,t,r,n,o=new Uint8Array,a=new Uint8Array){zt(e),zt(t,"deriveBits");let i=A(wt(b(r)),wt(o),wt(a),Te(n)),s=new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name==="X25519"?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3));return Mr(s,n,i)}function qt(e){Ue(e);let t=e.algorithm.namedCurve;if(t!=="P-256"&&t!=="P-384"&&t!=="P-521"&&e.algorithm.name!=="X25519")throw new m("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function Ee(e){if(e===void 0)throw new f("JWE Encrypted Key missing")}function Vt(e){if(e!==void 0)throw new f("Encountered unexpected JWE Encrypted Key")}async function Zt(e,t,r,n,o,a){let i=R(e);if(e==="dir")return Vt(n),r;switch(i.subtle.name){case"ECDH":{if(e==="ECDH-ES")Vt(n);if(!S(o.epk))throw new f('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');qt(r);let s=await j(i,o.epk),c,p;if(o.apu!==void 0){if(typeof o.apu!=="string")throw new f('JOSE Header "apu" (Agreement PartyUInfo) invalid');c=W(o.apu,"apu",f)}if(o.apv!==void 0){if(typeof o.apv!=="string")throw new f('JOSE Header "apv" (Agreement PartyVInfo) invalid');p=W(o.apv,"apv",f)}let d=await Yt(s,r,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),c,p);if(e==="ECDH-ES")return d;return Ee(n),ht(e.slice(-6),d,n)}case"RSA-OAEP":return Ee(n),Ue(r),Ft(e,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(Ee(n),typeof o.p2c!=="number")throw new f('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=a||1e4;if(o.p2c>s)throw new f('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof o.p2s!=="string")throw new f('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let c=W(o.p2s,"p2s",f),p=await Xt(c,e,o.p2c,r);return ht(e.slice(-6),p,n)}case"AES-KW":return Ee(n),ht(e,r,n);case"AES-GCM":{if(Ee(n),typeof o.iv!=="string")throw new f('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof o.tag!=="string")throw new f('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=W(o.iv,"iv",f);let c;return c=W(o.tag,"tag",f),He(ee(e.slice(0,-2)),r,n,s,c,new Uint8Array)}}}async function Qt(e,t,r,n,o={}){let a,i,s,c=R(e);if(e==="dir")return[r,void 0,void 0];switch(c.subtle.name){case"ECDH":{qt(r);let{apu:p,apv:d}=o;if(p!==void 0)Z(p,'"apu"');if(d!==void 0)Z(d,'"apv"');let u;if(o.epk!==void 0)u=await U(c,o.epk,"decrypt");else u=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let l=crypto.subtle,K=u;if(!K.extractable){if(typeof l.getPublicKey!=="function")throw TypeError('CryptoKey for "epk" must be extractable');K=await l.getPublicKey(u,[])}let{x:T,y:g,crv:h,kty:v}=await l.exportKey("jwk",K),y=await Yt(r,u,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),p,d);if(i={epk:{x:T,crv:h,kty:v}},v==="EC")i.epk.y=g;if(p)i.apu=ur(p);if(d)i.apv=ur(d);if(e==="ECDH-ES"){s=y;break}s=n||L(t);let J=e.slice(-6);a=await yt(J,y,s);break}case"RSA-OAEP":{s=n||L(t),Ue(r),Ft(e,r,"encrypt"),a=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",r,s));break}case"PBKDF2":{s=n||L(t);let{p2c:p=2048,p2s:d=crypto.getRandomValues(new Uint8Array(16))}=o,u=await Xt(d,e,p,r);a=await yt(e.slice(-6),u,s),i={p2c:p,p2s:ur(d)};break}case"AES-KW":{s=n||L(t),a=await yt(e,r,s);break}case"AES-GCM":{s=n||L(t);let{iv:p}=o,d=await Ne(ee(e.slice(0,-2)),s,r,p,new Uint8Array);a=d.ciphertext,i={iv:ur(d.iv),tag:ur(d.tag)};break}}return[s,a,i]}var se={__proto__:null,b64:!0},Fe={__proto__:null};function be(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some((r)=>typeof r!=="string")))throw TypeError(`"${e}" option must be an array of strings`);if(!t)return;return new Set(t)}function Xe(e,t){let{crit:r}=t??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function N(e,t,r,n,o){if(o.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some((i)=>typeof i!=="string"||i.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let a=r===void 0?t:{__proto__:null,...r,...t};for(let i of n.crit){if(!(i in a))throw new m(`Extension Header Parameter "${i}" is not recognized`);if(!Object.hasOwn(o,i)||o[i]===void 0)throw new e(`Extension Header Parameter "${i}" is missing`);if(a[i]&&(!Object.hasOwn(n,i)||n[i]===void 0))throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`)}return n.crit}function ce(e,t){if(t.includes("b64")){let r=e.b64;if(typeof r!=="boolean")throw new w('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function pe(e,t){let r,n;try{r=JSON.stringify(t),n=JSON.parse(r)}catch(o){throw new e("JOSE Header is not valid JSON",{cause:o})}if(!S(n))throw new e("JOSE Header is not a JSON object");return[n,r]}function Ye(e,t){if(e.zip!==void 0&&e.zip!=="DEF")throw new m('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(e.zip!==void 0&&!t?.zip)throw new f('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function er(e){if(typeof globalThis[e]>"u")throw new m(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function tr(e){er("CompressionStream");let t=new CompressionStream("deflate-raw"),r=t.writable.getWriter();r.write(e).catch(()=>{}),r.close().catch(()=>{});let n=[],o=t.readable.getReader();for(;;){let{value:a,done:i}=await o.read();if(i)break;n.push(a)}return A(...n)}async function rr(e,t){er("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let o=[],a=0,i=r.readable.getReader();for(;;){let{value:s,done:c}=await i.read();if(c)break;if(o.push(s),a+=s.byteLength,t!==1/0&&a>t)throw new f("Decompressed plaintext exceeded the configured limit")}return A(...o)}function nr(e){return[e&&be("keyManagementAlgorithms",e.keyManagementAlgorithms),e&&be("contentEncryptionAlgorithms",e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function $r(e,t,r,n,o){let[a,i,s,c,p]=r,[d,u,l,K,T]=t,{encrypted_key:g}=e;N(f,Fe,s,d,o),Ye(o,d);let{alg:h,enc:v}=o;if(typeof h!=="string"||!h)throw new f("missing JWE Algorithm (alg) in JWE Header");if(typeof v!=="string"||!v)throw new f("missing JWE Encryption Algorithm (enc) in JWE Header");if(a&&!a.has(h)||!a&&h.startsWith("PBES2"))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');if(i&&!i.has(v))throw new ne('"enc" (Encryption Algorithm) Header Parameter value not allowed');let y=ee(v),J;if(g!==void 0)J=W(g,"encrypted_key",f);let P=!1;if(typeof n==="function")n=await n(d,e),P=!0;let H=R(h),O=await U(h==="dir"?y:H,n,"decrypt"),I;try{if(I=await Zt(h,y,O,J,o,c),g!==void 0&&I instanceof Uint8Array&&I.byteLength<<3!==y.cekBits)I=L(y)}catch(C){if(C instanceof TypeError||C instanceof f||C instanceof m)throw C;I=L(y)}let X=await He(y,I,u,l,K,T);if(o.zip==="DEF"){let C=p??250000;if(C===0)throw new m('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(C!==1/0&&(!Number.isSafeInteger(C)||C<1))throw TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");X=await rr(X,C).catch((Y)=>{if(Y instanceof f)throw Y;throw new f("Failed to decompress plaintext",{cause:Y})})}return[X,d,O,P]}async function or(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new f("Compact JWE must be a string or Uint8Array");let{0:n,1:o,2:a,3:i,4:s,length:c}=e.split(".");if(c!==5)throw new f("Invalid Compact JWE");let p={ciphertext:i,iv:a||void 0,protected:n,tag:s||void 0,encrypted_key:o||void 0},d=F(n,f,"JWE Protected Header is invalid"),u=b(n),l=[d,W(i,"ciphertext",f),a?W(a,"iv",f):void 0,s?W(s,"tag",f):void 0,u];return $r(p,l,t,r,d)}function ir(e,t,r){if(!Nt(e,t,r))throw new f("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Lr(e){let[,t,r,n,o,a,i,s,c]=e;if(o!==void 0)Z(o,"JWE Additional Authenticated Data");if(a!==void 0)Z(a,"JWE Content Encryption Key");if(i!==void 0)Z(i,"JWE Initialization Vector");if(t!==void 0)t=pe(f,t)[0],e[1]=t;if(r!==void 0)r=pe(f,r)[0],e[2]=r;if(n!==void 0)n=pe(f,n)[0],e[3]=n;if(s!==void 0&&!S(s))throw TypeError("JWE Key Management Parameters must be an object");ir(t,r,n);let p={...t,...r,...n};Xe(f,t),N(f,Fe,c,t,p),Ye(p,t);let{alg:d,enc:u}=p;if(typeof d!=="string"||!d)throw new f('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof u!=="string"||!u)throw new f('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,d,u,ee(u)]}async function jr(e,t,r){let[n,o,,a]=t,[i,s,c,p,d,u,l,K,,T]=e,g=s,h=c;if(u&&(o==="dir"||o==="ECDH-ES"))throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let v=R(o),y=await U(o==="dir"?a:v,r,"encrypt"),[J,P,H]=await Qt(o,a,y,u,K);if(H){if(T)h=h?{...h,...H}:H;else g=g?{...g,...H}:H;ir(g,h,p)}let O,I;if(g)O=ur(JSON.stringify(g)),I=b(O);else O="",I=new Uint8Array;let X,C;if(d?.byteLength)C=ur(d),X=A(I,b("."),b(C));else X=I;let Y=i;if(n.zip==="DEF")Y=await tr(Y).catch((Jr)=>{throw new f("Failed to compress plaintext",{cause:Jr})});let{ciphertext:Kr,tag:Pt,iv:It}=await Ne(a,Y,J,l,X),G={ciphertext:ur(Kr)};if(It)G.iv=ur(It);if(Pt)G.tag=ur(Pt);if(P)G.encrypted_key=ur(P);if(C)G.aad=C;if(g)G.protected=O;if(p)G.unprotected=p;if(h)G.header=h;return G}async function ar(e,t,r){if(!e[1]&&!e[2]&&!e[3])throw new f("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(r!==void 0)e[8]=r?.crit,e[9]=r?Ht in r:!1;return jr(e,Lr(e),t)}async function sr(e,t,r){if(t instanceof Uint8Array)return crypto.subtle.importKey("raw",t,e.subtle,!1,[r]);if(k(t,e.subtle,r),e.minRsaBits)Ie(e.alg,t);return t}async function cr(e,t,r){let n=await sr(e,t,"sign"),o=await crypto.subtle.sign(e.signing,n,r);return new Uint8Array(o)}async function pr(e,t,r,n){let o=await sr(e,t,"verify");try{return await crypto.subtle.verify(e.signing,o,r,n)}catch{return!1}}var Se=[["verify"],["sign"]];function gt(e){let t={name:"HMAC",hash:`SHA-${e}`};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:Se}}function de(e,t){let n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${e}`};return{kty:["RSA"],subtle:n,signing:t?{...n,saltLength:t}:n,usages:Se,minRsaBits:2048}}function Et(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:`SHA-${t}`},usages:Se}}function dr(){let e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:Se}}function bt(e){let r={name:`ML-DSA-${e}`};return{kty:["AKP"],subtle:r,signing:r,usages:Se}}var Ae=ge({HS256:gt(256),HS384:gt(384),HS512:gt(512),RS256:de(256),RS384:de(384),RS512:de(512),PS256:de(256,32),PS384:de(384,48),PS512:de(512,64),ES256:Et("P-256",256),ES384:Et("P-384",384),ES512:Et("P-521",512),EdDSA:dr(),Ed25519:dr(),"ML-DSA-44":bt(44),"ML-DSA-65":bt(65),"ML-DSA-87":bt(87)});function qe(e){let t=typeof e==="string"?Ae[e]:void 0;if(!t)throw new m(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function fr(e){return[e&&be("algorithms",e.algorithms),e?.crit]}function Vr(e,t=e===void 0?{}:F(e,w,"JWS Protected Header is invalid")){return t}function Gr(e,t,r){let n=ce(e,N(w,se,r[1],e,t)),o=t.alg;if(typeof o!=="string"||!o)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(r[0]&&!r[0].has(o))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');return[n,o]}function Fr(e){try{return b(e)}catch{throw new w("JWS Compact Serialization payload must use only ASCII characters")}}async function Xr(e,t,r,n,o,a,i){let s=!1;if(typeof r==="function")r=await r(o,e),s=!0;let c=typeof i==="string",p=qe(a),d=A(n!==void 0?b(n):new Uint8Array,b("."),c?t[2]??=dt(i,"payload",w):i),u=W(e.signature,"signature",w),l=await U(p,r,"verify");if(!await pr(p,l,u,d))throw new at;return[c?W(i,"payload",w):i,o,c,l,s]}async function lr(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new w("Compact JWS must be a string or Uint8Array");let{0:n,1:o,2:a,length:i}=e.split(".");if(i!==3)throw new w("Invalid Compact JWS");let s={payload:o,protected:n,signature:a},c=Vr(n),[p,d]=Gr(c,c,t),u=p?o:Fr(o);return Xr(s,t,r,n,c,d,u)}var xe=(e)=>Math.floor(e.getTime()/1000),Yr={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},qr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fe="check_failed";function St(){throw TypeError("Invalid time period format")}function Ze(e){if(typeof e!=="string")St();let t=qr.exec(e);if(!t||t[4]&&t[1])St();let r=parseFloat(t[2]),n=Math.round(r*Yr[t[3][0].toLowerCase()]);if(!Number.isFinite(n))St();if(t[1]==="-"||t[4]==="ago")return-n;return n}function ue(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function At(e,t){if(typeof t!=="string")throw TypeError(`"${e}" claim must be a string`)}function Zr(e){if(typeof e!=="string"&&(!Array.isArray(e)||Array.from(e).some((t)=>typeof t!=="string")))throw TypeError('"aud" claim must be a string or an array of strings')}function xt(e,t){if(typeof e==="number")return ue(t,e);if(e instanceof Date)return ue(t,xe(e));return xe(new Date)+Ze(e)}var mr=(e)=>{let t=e.toLowerCase();return e.includes("/")?t:`application/${t}`},Qr=(e,t)=>{if(typeof e==="string")return t.includes(e);if(Array.isArray(e))return t.some((r)=>e.includes(r));return!1};function Kt(e,t,r=!1){let n=e[t];if(n===void 0&&!r)return;if(typeof n!=="number")throw new _(`"${t}" claim must be a number`,e,t,"invalid");return n}function Jt(e,t){throw new _(`unexpected "${t}" claim value`,e,t,fe)}function le(e,t,r={}){let n;try{n=JSON.parse(re.decode(t))}catch{}if(!S(n))throw new E("JWT Claims Set must be a top-level JSON object");let{typ:o}=r;if(o!==void 0&&(typeof e.typ!=="string"||mr(e.typ)!==mr(o)))throw new _('unexpected "typ" JWT header value',n,"typ",fe);let{requiredClaims:a=[],issuer:i,subject:s,audience:c,maxTokenAge:p}=r,d=[...a];if(p!==void 0)d.push("iat");if(c!==void 0)d.push("aud");if(s!==void 0)d.push("sub");if(i!==void 0)d.push("iss");for(let y of new Set(d.reverse()))if(!Object.hasOwn(n,y))throw new _(`missing required "${y}" claim`,n,y,"missing");if(i!==void 0&&!(Array.isArray(i)?i:[i]).includes(n.iss))Jt(n,"iss");if(s!==void 0&&n.sub!==s)Jt(n,"sub");if(c!==void 0&&!Qr(n.aud,typeof c==="string"?[c]:c))Jt(n,"aud");let{clockTolerance:u}=r,l=0;if(typeof u==="string")l=Ze(u);else if(u!==void 0){if(typeof u!=="number")throw TypeError("Invalid clockTolerance option type");l=u}ue("clockTolerance option",l);let{currentDate:K}=r,T=ue("currentDate option",xe(K===void 0?new Date:K)),g=Kt(n,"iat",p!==void 0),h=Kt(n,"nbf");if(h!==void 0){if(h>T+l)throw new _('"nbf" claim timestamp check failed',n,"nbf",fe)}let v=Kt(n,"exp");if(v!==void 0){if(v<=T-l)throw new Wa('"exp" claim timestamp check failed',n,"exp",fe)}if(p!==void 0){let y=T-g,J=ue("maxTokenAge option",typeof p==="number"?p:Ze(p));if(y-l>J)throw new Wa('"iat" claim timestamp check failed (too far in the past)',n,"iat",fe);if(y<-l)throw new _('"iat" claim timestamp check failed (it should be in the past)',n,"iat",fe)}return n}var yr;function z(e){return yr.get(e)}function me(e){let t=z(e);for(let r of["iat","nbf","exp"]){let n=t[r];if(typeof n==="number"&&!Number.isFinite(n))throw TypeError(`"${r}" claim must be a finite number`)}return ye.encode(JSON.stringify(t))}function Qe(e,t){return z(e)[t]}class te{constructor(e={}){if(!S(e))throw TypeError("JWT Claims Set MUST be an object");(yr||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return At("iss",e),z(this).iss=e,this}setSubject(e){return At("sub",e),z(this).sub=e,this}setAudience(e){return Zr(e),z(this).aud=e,this}setJti(e){return At("jti",e),z(this).jti=e,this}setNotBefore(e){return z(this).nbf=xt(e,"setNotBefore"),this}setExpirationTime(e){return z(this).exp=xt(e,"setExpirationTime"),this}setIssuedAt(e){let t=z(this);if(e===void 0)t.iat=xe(new Date);else if(typeof e==="string")t.iat=ue("setIssuedAt",xe(new Date)+Ze(e));else t.iat=xt(e,"setIssuedAt");return this}}async function Dn(e,t,r){let n=await lr(e,fr(r),t);if(!n[2])throw new E("JWTs MUST NOT use unencoded payload");let a={payload:le(n[1],n[0],r),protectedHeader:n[1]};if(typeof t==="function")return{...a,key:n[3]};return a}async function lc(e,t,r){let n=await or(e,nr(r),t),o=n[1],a=le(o,n[0],r);for(let s of["iss","sub","aud"])if(o[s]!==void 0&&(s==="aud"?JSON.stringify(o.aud)!==JSON.stringify(a.aud):o[s]!==a[s]))throw new _(`replicated "${s}" claim header parameter mismatch`,a,s,"mismatch");let i={payload:a,protectedHeader:o};if(typeof t==="function")return{...i,key:n[2]};return i}function en(e){if(e===void 0)return[void 0,""];let t=pe(w,e);return[t[0],ur(t[1])]}function tn(e,t,r){return Xe(w,e),ce(e,N(w,se,r,e,t))}function rn(e){let t=e.alg;if(typeof t!=="string"||!t)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');return qe(t)}async function nn(e,t,r,n){let o=A(b(e),b("."),t),a=await U(r,n,"sign");return ur(await cr(r,a,o))}async function hr(e,t,r,n,o){let[a,i]=en(t);if(!a)throw new w("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!tn(a,a,r))o();let c=rn(a),p=ur(e),d=await nn(i,b(p),c,n);return`${i}.${p}.${d}`}var on=te;class cc extends on{#e;setProtectedHeader(e){return Q(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,t){return hr(me(this),this.#e,t?.crit,e,()=>{throw new E("JWTs MUST NOT use unencoded payload")})}}var an=te;class uc extends an{#e;#r;#n;#t;#o;#i;#a;setProtectedHeader(e){return Q(this.#t,"setProtectedHeader"),this.#t=e,this}setKeyManagementParameters(e){return Q(this.#n,"setKeyManagementParameters"),this.#n=e,this}setContentEncryptionKey(e){return Q(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Q(this.#r,"setInitializationVector"),this.#r=e,this}replicateIssuerAsHeader(){return this.#o=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,t){let r=me(this);if(this.#t&&(this.#o||this.#i||this.#a))this.#t={...this.#t,iss:this.#o?Qe(this,"iss"):void 0,sub:this.#i?Qe(this,"sub"):void 0,aud:this.#a?Qe(this,"aud"):void 0};let n=await ar([r,this.#t,void 0,void 0,void 0,this.#e,this.#r,this.#n,void 0,!1],e,t);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}var Wt='"alg" (Algorithm)';function Ct(e='JWK "alg" (Algorithm) Parameter'){throw new m(`Invalid or unsupported ${e} value`)}function Ke(e,t){return(typeof e==="string"?Ae[e]??mt[e]:void 0)??Ct(t)}function et(e){if(e!==void 0&&typeof e!=="boolean")throw TypeError('"extractable" option must be a boolean');return e}var Je=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let r=0;r<e.byteLength;r++)if(e[r]!==t[r])return!1;return!0},sn=(e)=>({data:e,pos:0}),vt=(e)=>{let t=e.data[e.pos++];if(t===void 0)throw Error("Unexpected end of ASN.1 input");return t},We=(e)=>{let t=vt(e);if(t&128){let r=t&127,n=0;for(let o=0;o<r;o++)n=n<<8|vt(e);return n}return t};var Ce=(e,t,r)=>{if(vt(e)!==t)throw Error(r)},wr=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error("Unexpected end of ASN.1 input");let r=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,r},cn=(e)=>{Ce(e,6,"Expected algorithm OID");let t=We(e);return wr(e,t)};function pn(e,t){if(Ce(e,48,`Invalid ${t==="spki"?"SPKI":"PKCS#8"} structure`),We(e),t==="pkcs8"){Ce(e,2,"Expected version field");let r=We(e);e.pos+=r}Ce(e,48,"Expected algorithm identifier"),We(e)}var dn=(e)=>{let t=cn(e);if(Je(t,[43,101,110]))return"X25519";if(!Je(t,[42,134,72,206,61,2,1]))throw Error("Unsupported key algorithm");Ce(e,6,"Expected curve OID");let r=We(e),n=wr(e,r);if(Je(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Je(n,[43,129,4,0,34]))return"P-384";if(Je(n,[43,129,4,0,35]))return"P-521";throw Error("Unsupported named curve")},fn=async(e,t,r,n)=>{let o=et(n?.extractable),a=Ke(r,Wt);if(a.secret)Ct(Wt);let i=e==="spki",s;if(a.resolve)try{let c=sn(t);pn(c,e),s=a.resolve({crv:dn(c)})}catch{throw new m("Invalid or unsupported key format")}else s=a.subtle;return crypto.subtle.importKey(e,t,s,o??i,a.usages[i?0:1])},un=(e,t)=>ke(e.replace(t,"")),gr=(e,t,r)=>{let n=un(e,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return fn("pkcs8",n,t,r)};function ln(e){return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0))}async function mn(e){if(st(e))if(e.type==="secret")e=e.export();else return e.export({format:"jwk"});if(e instanceof Uint8Array)return{kty:"oct",k:ur(e)};if(!M(e))throw TypeError(B(e,"CryptoKey","KeyObject","Uint8Array"));if(!e.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:t,key_ops:r,alg:n,use:o,...a}=ln(await crypto.subtle.exportKey("jwk",e));if(a.kty==="AKP")a.alg=n;return a}function Er(e){return mn(e)}var V=(e,t)=>{if(typeof e!=="string"||!e)throw new _e(`${t} missing or invalid`)};async function dc(e,t){let r;if(S(e)){if(r=oe(e),typeof r.kty!=="string")throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"))}else if(Re(e))r=oe(await Er(e));else throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"));if(t??="sha256",t!=="sha256"&&t!=="sha384"&&t!=="sha512")throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":V(r.alg,'"alg" (Algorithm) Parameter'),V(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":V(r.crv,'"crv" (Curve) Parameter'),V(r.x,'"x" (X Coordinate) Parameter'),V(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":V(r.crv,'"crv" (Subtype of Key Pair) Parameter'),V(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":V(r.e,'"e" (Exponent) Parameter'),V(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!=="string")throw new _e('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new m('"kty" (Key Type) Parameter missing or unsupported')}let o=b(JSON.stringify(n));return ur(await $e(t,o))}function yn(e,t,r,n){let{kty:o,key_ops:a,ext:i,kid:s,alg:c,use:p,crv:d}=oe(e),u=Array.isArray(a)?[...a]:a;return(i===void 0||typeof i==="boolean")&&(u===void 0||Array.isArray(u)&&u.every((l,K)=>typeof l==="string"&&u.indexOf(l)===K)&&u.includes("verify"))&&t.kty.includes(o)&&(n===void 0||typeof n==="string"&&n===s)&&(c===void 0?o!=="AKP":r===c)&&(p===void 0||p==="sig")&&(!t.crv||d===t.crv)}async function br(e,t,r){let n=e.get(t)||e.set(t,{}).get(t),{alg:o}=r;if(n[o]===void 0){let a=await j(r,{...t,alg:o,ext:!0});if(a.type!=="public")throw new De("JSON Web Key Set members must be public keys");n[o]=a}return n[o]}function bu(e){let t;try{t=structuredClone(e)}catch{}if(!Be(t))throw new De("JSON Web Key Set malformed");let r=new WeakMap;return Object.defineProperty(async(o,a)=>{let{alg:i,kid:s}={...o,...a?.header},c=typeof i==="string"?Ae[i]:void 0;if(!c||c.secret)throw new m('Unsupported "alg" value for a JSON Web Key Set');let p=t.keys.filter((l)=>yn(l,c,i,s)),{0:d,length:u}=p;if(!u)throw new we;if(u!==1){let l=new ot;throw l[Symbol.asyncIterator]=async function*(){for(let K of p)try{yield await br(r,K,c)}catch{}},l}return br(r,d,c)},"jwks",{value:()=>structuredClone(t)})}function hn(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var Tt;if(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))Tt="jose/v6.2.10";var Ar=Symbol();async function wn(e,t,r,n=fetch){let o=await n(e,{method:"GET",signal:r,redirect:"manual",headers:t}).catch((a)=>{if(a.name==="TimeoutError")throw new it;throw a});if(o.status!==200)throw new x("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch{throw new x("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var xr=Symbol();function ve(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Sr(e,t,r){if(Number.isNaN(e))throw TypeError(`"${r}" option must not be NaN`);return typeof e==="number"?e:t}function vu(e,t){if(!(e instanceof URL))throw TypeError("url must be an instance of URL");let r=new URL(e.href).href,n=t??{},o=n.timeoutDuration;if(typeof o==="number"&&(!Number.isInteger(o)||o<0))throw TypeError('"timeoutDuration" option must be a non-negative integer');let a=typeof o==="number"?o:5000,i=Sr(n.cooldownDuration,30000,"cooldownDuration"),s=Sr(n.cacheMaxAge,600000,"cacheMaxAge"),c=new Headers(n.headers);if(Tt&&!c.has("User-Agent"))c.set("User-Agent",Tt);if(!c.has("accept"))c.set("accept","application/json, application/jwk-set+json");let p=n[Ar],d=n[xr],u,l,K=0,T=0,g;if(d&&typeof d==="object"){let{uat:y,jwks:J}=d;if(ve(y,s)&&Be(J))u=y,g=bu(J)}let h=async()=>{if(l&&hn())l=void 0;if(!l){let y=++K,J=l=wn(r,c,AbortSignal.timeout(a),p).then((P)=>{let H=bu(P);if(y<=T)return;g=H;let O=Date.now();if(d)d.uat=O,d.jwks=P;u=O,T=y}).finally(()=>{if(l===J)l=void 0})}await l};return Object.defineProperties(async(y,J)=>{if(!g||!ve(u,s))await h();try{return await g(y,J)}catch(P){if(P instanceof we&&!ve(u,i))return await h(),g(y,J);throw P}},{coolingDown:{get:()=>ve(u,i),enumerable:!0},fresh:{get:()=>ve(u,s),enumerable:!0},reload:{value:h,enumerable:!0},reloading:{get:()=>!!l,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}var gn=te;class dm extends gn{encode(){let e=ur(JSON.stringify({alg:"none"})),t=ur(me(this));return`${e}.${t}.`}static decode(e,t){if(typeof e!=="string")throw new E("Unsecured JWT must be a string");let{0:r,1:n,2:o,length:a}=e.split(".");if(a!==3||o!=="")throw new E("Invalid Unsecured JWT");let i,s;try{i=F(r,w,"JWS Protected Header is invalid");let p=N(w,se,void 0,i,i);s=ce(i,p)}catch(p){if(!(p instanceof w))throw p;throw new E("Invalid Unsecured JWT",{cause:p})}if(i.alg!=="none")throw new E("Invalid Unsecured JWT");if(!s)throw new E("JWTs MUST NOT use unencoded payload");return{payload:le(i,W(n,"payload",E),t),header:i}}}async function MA(e,t,r){if(typeof e!=="string"||e.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw TypeError('"pkcs8" must be PKCS#8 formatted string');return gr(e,t,r)}async function Ss(e,t,r){if(!S(e))throw TypeError("JWK must be an object");let n=Le(e),o=et(r?.extractable),{alg:a}=n;t??=a;let i=o??n.ext;if(n.kty!=="oct"&&!t)throw TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!=="string")throw TypeError('missing "k" (Key Value) Parameter value');return D(n.k);case"AKP":{if(typeof a!=="string"||!a)throw TypeError('missing "alg" (Algorithm) Parameter value');if(t!==a)throw TypeError("JWK alg and alg option value mismatch");return j(Ke(t),{...n,ext:i})}case"RSA":case"EC":case"OKP":return j(Ke(t),{...n,alg:t,ext:i});default:throw new m('Unsupported "kty" (Key Type) Parameter value')}}function jo(e){let t;if(typeof e==="string"){let n=e.split(".");if(n.length===3||n.length===5)[t]=n}else if(typeof e==="object"&&e)if("protected"in e)t=e.protected;else throw TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof t!=="string"||!t)throw TypeError(r);return F(t,TypeError,r)}function zr(e){if(typeof e!=="string")throw new E("JWTs must use Compact JWS serialization, JWT must be a string");let{1:t,length:r}=e.split(".");if(r===5)throw new E("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new E("Invalid JWT");if(!t)throw new E("JWTs must contain a payload");let n;try{n=D(t)}catch{throw new E("Failed to base64url decode the payload")}let o;try{o=JSON.parse(re.decode(n))}catch{throw new E("Failed to parse the decoded payload as JSON")}if(!S(o))throw new E("Invalid JWT Claims Set");return o}export{Wa,ur,af,Dn,lc,cc,uc,dc,bu,vu,dm,MA,Ss,jo,zr};

package/bin/{chunk-9va1mzeq.js → chunk-7hmt2gs5.js}

@@ -1,2 +1,2 @@
-import{I}from"./chunk-q6jsw0rr.js";var c=[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z",key:"1ngwbx"}]],Co=I("wrench",c);
-export{Co};
+import{I}from"./chunk-17k9a427.js";var c=[["path",{d:"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.106-3.105c.32-.322.863-.22.983.218a6 6 0 0 1-8.259 7.057l-7.91 7.91a1 1 0 0 1-2.999-3l7.91-7.91a6 6 0 0 1 7.057-8.259c.438.12.54.662.219.984z",key:"1ngwbx"}]],Io=I("wrench",c);
+export{Io};

package/bin/{chunk-3h9c5ak3.js → chunk-7zfyrt40.js}

@@ -1,3 +1,3 @@
 // @bun
-import{G}from"./chunk-yqvhgtez.js";var n=null;function c(e){if(typeof process>"u"||!process.versions?.bun||Object.keys(process.env).length>0)return;if(n===null){n=new Map;try{let{readFileSync:t}=G("fs"),s=t("/proc/self/environ","utf-8");for(let r of s.split("\x00")){let o=r.indexOf("=");if(o>0)n.set(r.slice(0,o),r.slice(o+1))}}catch{}}return n.get(e)}function cr(e,t){return t?.[e]||(typeof process<"u"?process.env[e]:void 0)||c(e)||void 0}
+import{G}from"./chunk-jxfz4h24.js";var n=null;function c(e){if(typeof process>"u"||!process.versions?.bun||Object.keys(process.env).length>0)return;if(n===null){n=new Map;try{let{readFileSync:t}=G("fs"),s=t("/proc/self/environ","utf-8");for(let r of s.split("\x00")){let o=r.indexOf("=");if(o>0)n.set(r.slice(0,o),r.slice(o+1))}}catch{}}return n.get(e)}function cr(e,t){return t?.[e]||(typeof process<"u"?process.env[e]:void 0)||c(e)||void 0}
 export{cr};

package/bin/{chunk-fvgb6rps.js → chunk-82cg5497.js}

@@ -1,3 +1,3 @@
 // @bun
-import{w,G}from"./chunk-yqvhgtez.js";var Ki=w(function(ar,D){var{defineProperty:k,getOwnPropertyDescriptor:re,getOwnPropertyNames:te}=Object,oe=Object.prototype.hasOwnProperty,ne=(e,r)=>{for(var t in r)k(e,t,{get:r[t],enumerable:!0})},se=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of te(r))if(!oe.call(e,o)&&o!==t)k(e,o,{get:()=>r[o],enumerable:!(n=re(r,o))||n.enumerable})}return e},ie=(e)=>se(k({},"__esModule",{value:!0}),e),E={};ne(E,{VercelOidcTokenError:()=>m});D.exports=ie(E);class m extends Error{constructor(e,r){super(e);this.name="VercelOidcTokenError",this.cause=r}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var V=w(function(cr,S){var{create:ae,defineProperty:_,getOwnPropertyDescriptor:ce,getOwnPropertyNames:ue,getPrototypeOf:pe}=Object,le=Object.prototype.hasOwnProperty,fe=(e,r)=>{for(var t in r)_(e,t,{get:r[t],enumerable:!0})},x=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of ue(r))if(!le.call(e,o)&&o!==t)_(e,o,{get:()=>r[o],enumerable:!(n=ce(r,o))||n.enumerable})}return e},g=(e,r,t)=>(t=e!=null?ae(pe(e)):{},x(r||!e||!e.__esModule?_(t,"default",{value:e,enumerable:!0}):t,e)),_e=(e)=>x(_({},"__esModule",{value:!0}),e),A={};fe(A,{findRootDir:()=>ve,getUserDataDir:()=>ke});S.exports=_e(A);var p=g(G("path")),de=g(G("fs")),y=g(G("os")),he=Ki();function ve(){try{let e=process.cwd();while(e!==p.default.dirname(e)){let r=p.default.join(e,".vercel");if(de.default.existsSync(r))return e;e=p.default.dirname(e)}}catch(e){throw new he.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function ke(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(y.default.platform()){case"darwin":return p.default.join(y.default.homedir(),"Library/Application Support");case"linux":return p.default.join(y.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var F=w(function(ur,q){var{create:ye,defineProperty:d,getOwnPropertyDescriptor:we,getOwnPropertyNames:ge,getPrototypeOf:Oe}=Object,Pe=Object.prototype.hasOwnProperty,be=(e,r)=>{for(var t in r)d(e,t,{get:r[t],enumerable:!0})},C=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of ge(r))if(!Pe.call(e,o)&&o!==t)d(e,o,{get:()=>r[o],enumerable:!(n=we(r,o))||n.enumerable})}return e},R=(e,r,t)=>(t=e!=null?ye(Oe(e)):{},C(r||!e||!e.__esModule?d(t,"default",{value:e,enumerable:!0}):t,e)),je=(e)=>C(d({},"__esModule",{value:!0}),e),M={};be(M,{isValidAccessToken:()=>De,readAuthConfig:()=>Ee,writeAuthConfig:()=>me});q.exports=je(M);var l=R(G("fs")),I=R(G("path")),Te=Wi();function N(){let e=(0,Te.getVercelDataDir)();if(!e)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return I.join(e,"auth.json")}function Ee(){try{let e=N();if(!l.existsSync(e))return null;let r=l.readFileSync(e,"utf8");if(!r)return null;return JSON.parse(r)}catch(e){return null}}function me(e){let r=N(),t=I.dirname(r);if(!l.existsSync(t))l.mkdirSync(t,{mode:504,recursive:!0});l.writeFileSync(r,JSON.stringify(e,null,2),{mode:384})}function De(e,r=0){if(!e.token)return!1;if(typeof e.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),n=r/1000;return e.expiresAt>=t+n}});var B=w(function(pr,L){var{defineProperty:b,getOwnPropertyDescriptor:xe,getOwnPropertyNames:Ae}=Object,Se=Object.prototype.hasOwnProperty,Ve=(e,r)=>{for(var t in r)b(e,t,{get:r[t],enumerable:!0})},Ce=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Ae(r))if(!Se.call(e,o)&&o!==t)b(e,o,{get:()=>r[o],enumerable:!(n=xe(r,o))||n.enumerable})}return e},Re=(e)=>Ce(b({},"__esModule",{value:!0}),e),U={};Ve(U,{processTokenResponse:()=>Fe,refreshTokenRequest:()=>qe});L.exports=Re(U);var O=G("os"),Me="https://vercel.com",Ie="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",J=`@vercel/oidc node-${process.version} ${(0,O.platform)()} (${(0,O.arch)()}) ${(0,O.hostname)()}`,P=null;async function Ne(){if(P)return P;let e=`${Me}/.well-known/openid-configuration`,r=await fetch(e,{headers:{"user-agent":J}});if(!r.ok)throw Error("Failed to discover OAuth endpoints");let t=await r.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let n=t.token_endpoint;return P=n,n}async function qe(e){let r=await Ne();return await fetch(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":J},body:new URLSearchParams({client_id:Ie,grant_type:"refresh_token",...e})})}async function Fe(e){let r=await e.json();if(!e.ok){let t=typeof r==="object"&&r&&"error"in r?String(r.error):"Token refresh failed";return[Error(t)]}if(typeof r!=="object"||r===null)return[Error("Invalid token response")];if(typeof r.access_token!=="string")return[Error("Missing access_token in response")];if(r.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof r.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,r]}});var of=w(function(lr,Y){var{defineProperty:j,getOwnPropertyDescriptor:$e,getOwnPropertyNames:Ue}=Object,Je=Object.prototype.hasOwnProperty,Le=(e,r)=>{for(var t in r)j(e,t,{get:r[t],enumerable:!0})},Be=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Ue(r))if(!Je.call(e,o)&&o!==t)j(e,o,{get:()=>r[o],enumerable:!(n=$e(r,o))||n.enumerable})}return e},He=(e)=>Be(j({},"__esModule",{value:!0}),e),H={};Le(H,{AccessTokenMissingError:()=>z,RefreshAccessTokenFailedError:()=>X});Y.exports=He(H);class z extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class X extends Error{constructor(e){super("Failed to refresh authentication token.",{cause:e});this.name="RefreshAccessTokenFailedError"}}});var Wi=w(function(fr,ee){var{create:ze,defineProperty:h,getOwnPropertyDescriptor:Ge,getOwnPropertyNames:Xe,getPrototypeOf:Ye}=Object,Qe=Object.prototype.hasOwnProperty,Ze=(e,r)=>{for(var t in r)h(e,t,{get:r[t],enumerable:!0})},Z=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Xe(r))if(!Qe.call(e,o)&&o!==t)h(e,o,{get:()=>r[o],enumerable:!(n=Ge(r,o))||n.enumerable})}return e},K=(e,r,t)=>(t=e!=null?ze(Ye(e)):{},Z(r||!e||!e.__esModule?h(t,"default",{value:e,enumerable:!0}):t,e)),Ke=(e)=>Z(h({},"__esModule",{value:!0}),e),W={};Ze(W,{assertVercelOidcTokenResponse:()=>T,findProjectInfo:()=>tr,getTokenPayload:()=>sr,getVercelDataDir:()=>We,getVercelOidcToken:()=>rr,getVercelToken:()=>er,isExpired:()=>ir,loadToken:()=>nr,saveToken:()=>or});ee.exports=Ke(W);var f=K(G("path")),s=K(G("fs")),u=Ki(),v=V(),a=F(),Q=B(),c=of();function We(){let r=(0,v.getUserDataDir)();if(!r)return null;return f.join(r,"com.vercel.cli")}async function er(e){let r=(0,a.readAuthConfig)();if(!r?.token)throw new c.AccessTokenMissingError;if((0,a.isValidAccessToken)(r,e?.expirationBufferMs))return r.token;if(!r.refreshToken)throw(0,a.writeAuthConfig)({}),new c.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Q.refreshTokenRequest)({refresh_token:r.refreshToken}),[n,o]=await(0,Q.processTokenResponse)(t);if(n||!o)throw(0,a.writeAuthConfig)({}),new c.RefreshAccessTokenFailedError(n);let i={token:o.access_token,expiresAt:Math.floor(Date.now()/1000)+o.expires_in};if(o.refresh_token)i.refreshToken=o.refresh_token;return(0,a.writeAuthConfig)(i),i.token}catch(t){if((0,a.writeAuthConfig)({}),t instanceof c.AccessTokenMissingError||t instanceof c.RefreshAccessTokenFailedError)throw t;throw new c.RefreshAccessTokenFailedError(t)}}async function rr(e,r,t){let n=`https://api.vercel.com/v1/projects/${r}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,o=await fetch(n,{method:"POST",headers:{Authorization:`Bearer ${e}`}});if(!o.ok)throw new u.VercelOidcTokenError(`Failed to refresh OIDC token: ${o.statusText}`);let i=await o.json();return T(i),i}function T(e){if(!e||typeof e!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in e)||typeof e.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function tr(){let e=(0,v.findRootDir)();if(!e)throw new u.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let r=f.join(e,".vercel","project.json");if(!s.existsSync(r))throw new u.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(s.readFileSync(r,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function or(e,r){let t=(0,v.getUserDataDir)();if(!t)throw new u.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let n=f.join(t,"com.vercel.token",`${r}.json`),o=JSON.stringify(e);s.mkdirSync(f.dirname(n),{mode:504,recursive:!0}),s.writeFileSync(n,o),s.chmodSync(n,432);return}function nr(e){let r=(0,v.getUserDataDir)();if(!r)throw new u.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=f.join(r,"com.vercel.token",`${e}.json`);if(!s.existsSync(t))return null;let n=JSON.parse(s.readFileSync(t,"utf8"));return T(n),n}function sr(e){let r=e.split(".");if(r.length!==3)throw new u.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=r[1].replace(/-/g,"+").replace(/_/g,"/"),n=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(n,"base64").toString("utf8"))}function ir(e,r=0){return e.exp*1000<Date.now()+r}});
-export{Ki,of,Wi};
+import{w,G}from"./chunk-jxfz4h24.js";var Ya=w(function(ar,D){var{defineProperty:k,getOwnPropertyDescriptor:re,getOwnPropertyNames:te}=Object,oe=Object.prototype.hasOwnProperty,ne=(e,r)=>{for(var t in r)k(e,t,{get:r[t],enumerable:!0})},se=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of te(r))if(!oe.call(e,o)&&o!==t)k(e,o,{get:()=>r[o],enumerable:!(n=re(r,o))||n.enumerable})}return e},ie=(e)=>se(k({},"__esModule",{value:!0}),e),E={};ne(E,{VercelOidcTokenError:()=>m});D.exports=ie(E);class m extends Error{constructor(e,r){super(e);this.name="VercelOidcTokenError",this.cause=r}toString(){if(this.cause)return`${this.name}: ${this.message}: ${this.cause}`;return`${this.name}: ${this.message}`}}});var V=w(function(cr,S){var{create:ae,defineProperty:_,getOwnPropertyDescriptor:ce,getOwnPropertyNames:ue,getPrototypeOf:pe}=Object,le=Object.prototype.hasOwnProperty,fe=(e,r)=>{for(var t in r)_(e,t,{get:r[t],enumerable:!0})},x=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of ue(r))if(!le.call(e,o)&&o!==t)_(e,o,{get:()=>r[o],enumerable:!(n=ce(r,o))||n.enumerable})}return e},g=(e,r,t)=>(t=e!=null?ae(pe(e)):{},x(r||!e||!e.__esModule?_(t,"default",{value:e,enumerable:!0}):t,e)),_e=(e)=>x(_({},"__esModule",{value:!0}),e),A={};fe(A,{findRootDir:()=>ve,getUserDataDir:()=>ke});S.exports=_e(A);var p=g(G("path")),de=g(G("fs")),y=g(G("os")),he=Ya();function ve(){try{let e=process.cwd();while(e!==p.default.dirname(e)){let r=p.default.join(e,".vercel");if(de.default.existsSync(r))return e;e=p.default.dirname(e)}}catch(e){throw new he.VercelOidcTokenError("Token refresh only supported in node server environments")}return null}function ke(){if(process.env.XDG_DATA_HOME)return process.env.XDG_DATA_HOME;switch(y.default.platform()){case"darwin":return p.default.join(y.default.homedir(),"Library/Application Support");case"linux":return p.default.join(y.default.homedir(),".local/share");case"win32":if(process.env.LOCALAPPDATA)return process.env.LOCALAPPDATA;return null;default:return null}}});var F=w(function(ur,q){var{create:ye,defineProperty:d,getOwnPropertyDescriptor:we,getOwnPropertyNames:ge,getPrototypeOf:Oe}=Object,Pe=Object.prototype.hasOwnProperty,be=(e,r)=>{for(var t in r)d(e,t,{get:r[t],enumerable:!0})},C=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of ge(r))if(!Pe.call(e,o)&&o!==t)d(e,o,{get:()=>r[o],enumerable:!(n=we(r,o))||n.enumerable})}return e},R=(e,r,t)=>(t=e!=null?ye(Oe(e)):{},C(r||!e||!e.__esModule?d(t,"default",{value:e,enumerable:!0}):t,e)),je=(e)=>C(d({},"__esModule",{value:!0}),e),M={};be(M,{isValidAccessToken:()=>De,readAuthConfig:()=>Ee,writeAuthConfig:()=>me});q.exports=je(M);var l=R(G("fs")),I=R(G("path")),Te=Ja();function N(){let e=(0,Te.getVercelDataDir)();if(!e)throw Error(`Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`);return I.join(e,"auth.json")}function Ee(){try{let e=N();if(!l.existsSync(e))return null;let r=l.readFileSync(e,"utf8");if(!r)return null;return JSON.parse(r)}catch(e){return null}}function me(e){let r=N(),t=I.dirname(r);if(!l.existsSync(t))l.mkdirSync(t,{mode:504,recursive:!0});l.writeFileSync(r,JSON.stringify(e,null,2),{mode:384})}function De(e,r=0){if(!e.token)return!1;if(typeof e.expiresAt!=="number")return!0;let t=Math.floor(Date.now()/1000),n=r/1000;return e.expiresAt>=t+n}});var B=w(function(pr,L){var{defineProperty:b,getOwnPropertyDescriptor:xe,getOwnPropertyNames:Ae}=Object,Se=Object.prototype.hasOwnProperty,Ve=(e,r)=>{for(var t in r)b(e,t,{get:r[t],enumerable:!0})},Ce=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Ae(r))if(!Se.call(e,o)&&o!==t)b(e,o,{get:()=>r[o],enumerable:!(n=xe(r,o))||n.enumerable})}return e},Re=(e)=>Ce(b({},"__esModule",{value:!0}),e),U={};Ve(U,{processTokenResponse:()=>Fe,refreshTokenRequest:()=>qe});L.exports=Re(U);var O=G("os"),Me="https://vercel.com",Ie="cl_HYyOPBNtFMfHhaUn9L4QPfTZz6TP47bp",J=`@vercel/oidc node-${process.version} ${(0,O.platform)()} (${(0,O.arch)()}) ${(0,O.hostname)()}`,P=null;async function Ne(){if(P)return P;let e=`${Me}/.well-known/openid-configuration`,r=await fetch(e,{headers:{"user-agent":J}});if(!r.ok)throw Error("Failed to discover OAuth endpoints");let t=await r.json();if(!t||typeof t.token_endpoint!=="string")throw Error("Invalid OAuth discovery response");let n=t.token_endpoint;return P=n,n}async function qe(e){let r=await Ne();return await fetch(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded","user-agent":J},body:new URLSearchParams({client_id:Ie,grant_type:"refresh_token",...e})})}async function Fe(e){let r=await e.json();if(!e.ok){let t=typeof r==="object"&&r&&"error"in r?String(r.error):"Token refresh failed";return[Error(t)]}if(typeof r!=="object"||r===null)return[Error("Invalid token response")];if(typeof r.access_token!=="string")return[Error("Missing access_token in response")];if(r.token_type!=="Bearer")return[Error("Invalid token_type in response")];if(typeof r.expires_in!=="number")return[Error("Missing expires_in in response")];return[null,r]}});var lf=w(function(lr,Y){var{defineProperty:j,getOwnPropertyDescriptor:$e,getOwnPropertyNames:Ue}=Object,Je=Object.prototype.hasOwnProperty,Le=(e,r)=>{for(var t in r)j(e,t,{get:r[t],enumerable:!0})},Be=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Ue(r))if(!Je.call(e,o)&&o!==t)j(e,o,{get:()=>r[o],enumerable:!(n=$e(r,o))||n.enumerable})}return e},He=(e)=>Be(j({},"__esModule",{value:!0}),e),H={};Le(H,{AccessTokenMissingError:()=>z,RefreshAccessTokenFailedError:()=>X});Y.exports=He(H);class z extends Error{constructor(){super("No authentication found. Please log in with the Vercel CLI (vercel login).");this.name="AccessTokenMissingError"}}class X extends Error{constructor(e){super("Failed to refresh authentication token.",{cause:e});this.name="RefreshAccessTokenFailedError"}}});var Ja=w(function(fr,ee){var{create:ze,defineProperty:h,getOwnPropertyDescriptor:Ge,getOwnPropertyNames:Xe,getPrototypeOf:Ye}=Object,Qe=Object.prototype.hasOwnProperty,Ze=(e,r)=>{for(var t in r)h(e,t,{get:r[t],enumerable:!0})},Z=(e,r,t,n)=>{if(r&&typeof r==="object"||typeof r==="function"){for(let o of Xe(r))if(!Qe.call(e,o)&&o!==t)h(e,o,{get:()=>r[o],enumerable:!(n=Ge(r,o))||n.enumerable})}return e},K=(e,r,t)=>(t=e!=null?ze(Ye(e)):{},Z(r||!e||!e.__esModule?h(t,"default",{value:e,enumerable:!0}):t,e)),Ke=(e)=>Z(h({},"__esModule",{value:!0}),e),W={};Ze(W,{assertVercelOidcTokenResponse:()=>T,findProjectInfo:()=>tr,getTokenPayload:()=>sr,getVercelDataDir:()=>We,getVercelOidcToken:()=>rr,getVercelToken:()=>er,isExpired:()=>ir,loadToken:()=>nr,saveToken:()=>or});ee.exports=Ke(W);var f=K(G("path")),s=K(G("fs")),u=Ya(),v=V(),a=F(),Q=B(),c=lf();function We(){let r=(0,v.getUserDataDir)();if(!r)return null;return f.join(r,"com.vercel.cli")}async function er(e){let r=(0,a.readAuthConfig)();if(!r?.token)throw new c.AccessTokenMissingError;if((0,a.isValidAccessToken)(r,e?.expirationBufferMs))return r.token;if(!r.refreshToken)throw(0,a.writeAuthConfig)({}),new c.RefreshAccessTokenFailedError("No refresh token available");try{let t=await(0,Q.refreshTokenRequest)({refresh_token:r.refreshToken}),[n,o]=await(0,Q.processTokenResponse)(t);if(n||!o)throw(0,a.writeAuthConfig)({}),new c.RefreshAccessTokenFailedError(n);let i={token:o.access_token,expiresAt:Math.floor(Date.now()/1000)+o.expires_in};if(o.refresh_token)i.refreshToken=o.refresh_token;return(0,a.writeAuthConfig)(i),i.token}catch(t){if((0,a.writeAuthConfig)({}),t instanceof c.AccessTokenMissingError||t instanceof c.RefreshAccessTokenFailedError)throw t;throw new c.RefreshAccessTokenFailedError(t)}}async function rr(e,r,t){let n=`https://api.vercel.com/v1/projects/${r}/token?source=vercel-oidc-refresh${t?`&teamId=${t}`:""}`,o=await fetch(n,{method:"POST",headers:{Authorization:`Bearer ${e}`}});if(!o.ok)throw new u.VercelOidcTokenError(`Failed to refresh OIDC token: ${o.statusText}`);let i=await o.json();return T(i),i}function T(e){if(!e||typeof e!=="object")throw TypeError("Vercel OIDC token is malformed. Expected an object. Please run `vc env pull` and try again");if(!("token"in e)||typeof e.token!=="string")throw TypeError("Vercel OIDC token is malformed. Expected a string-valued token property. Please run `vc env pull` and try again")}function tr(){let e=(0,v.findRootDir)();if(!e)throw new u.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");let r=f.join(e,".vercel","project.json");if(!s.existsSync(r))throw new u.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");let t=JSON.parse(s.readFileSync(r,"utf8"));if(typeof t.projectId!=="string"&&typeof t.orgId!=="string")throw TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");return{projectId:t.projectId,teamId:t.orgId}}function or(e,r){let t=(0,v.getUserDataDir)();if(!t)throw new u.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let n=f.join(t,"com.vercel.token",`${r}.json`),o=JSON.stringify(e);s.mkdirSync(f.dirname(n),{mode:504,recursive:!0}),s.writeFileSync(n,o),s.chmodSync(n,432);return}function nr(e){let r=(0,v.getUserDataDir)();if(!r)throw new u.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");let t=f.join(r,"com.vercel.token",`${e}.json`);if(!s.existsSync(t))return null;let n=JSON.parse(s.readFileSync(t,"utf8"));return T(n),n}function sr(e){let r=e.split(".");if(r.length!==3)throw new u.VercelOidcTokenError("Invalid token. Please run `vc env pull` and try again");let t=r[1].replace(/-/g,"+").replace(/_/g,"/"),n=t.padEnd(t.length+(4-t.length%4)%4,"=");return JSON.parse(Buffer.from(n,"base64").toString("utf8"))}function ir(e,r=0){return e.exp*1000<Date.now()+r}});
+export{Ya,lf,Ja};

package/bin/{chunk-628k58ek.js → chunk-8mhj6r2q.js}

@@ -1,3 +1,3 @@
 // @bun
-function c(e){if(!(e instanceof Error)||!("status"in e)||!("headers"in e))return!1;return(e.status===void 0||typeof e.status==="number")&&(e.headers===void 0||e.headers instanceof Headers)}function d(e){let t=e.headers?.get("x-should-retry");if(t==="true")return!0;if(t==="false")return!1;if(e.status===void 0)return!0;return e.status===408||e.status===409||e.status===429||typeof e.status==="number"&&e.status>=500}function o(e,t,a){let r=t??60000;if(r>0&&e>r)throw Error(`Server requested ${Math.ceil(e/1000)}s retry delay (max: ${Math.ceil(r/1000)}s). ${a}`);return e}function l(e,t,a){let r=e.headers?.get("retry-after-ms");if(r){let s=Number.parseFloat(r);if(!Number.isNaN(s))return o(s,a,e.message)}let n=e.headers?.get("retry-after");if(n){let s=Number.parseFloat(n),f=Number.isNaN(s)?Date.parse(n)-Date.now():s*1000;return o(f,a,e.message)}return Math.min(0.5*2**t,8)*1000*(1-Math.random()*0.25)}function i(){let e=Error("Request aborted");return e.name="AbortError",e}function m(e,t){return new Promise((a,r)=>{if(t?.aborted){r(i());return}let n=()=>{clearTimeout(u),r(i())},u=setTimeout(()=>{t?.removeEventListener("abort",n),a()},Math.max(0,e));t?.addEventListener("abort",n,{once:!0})})}async function as(e,t={}){let a=t.maxRetries??0,r=a;for(;;)try{return await e()}catch(n){if(t.signal?.aborted)throw i();if(r<=0||!c(n)||!d(n))throw n;let u=a-r;r--,await m(l(n,u,t.maxRetryDelayMs),t.signal)}}
-export{as};
+function c(e){if(!(e instanceof Error)||!("status"in e)||!("headers"in e))return!1;return(e.status===void 0||typeof e.status==="number")&&(e.headers===void 0||e.headers instanceof Headers)}function d(e){let t=e.headers?.get("x-should-retry");if(t==="true")return!0;if(t==="false")return!1;if(e.status===void 0)return!0;return e.status===408||e.status===409||e.status===429||typeof e.status==="number"&&e.status>=500}function o(e,t,a){let r=t??60000;if(r>0&&e>r)throw Error(`Server requested ${Math.ceil(e/1000)}s retry delay (max: ${Math.ceil(r/1000)}s). ${a}`);return e}function l(e,t,a){let r=e.headers?.get("retry-after-ms");if(r){let s=Number.parseFloat(r);if(!Number.isNaN(s))return o(s,a,e.message)}let n=e.headers?.get("retry-after");if(n){let s=Number.parseFloat(n),f=Number.isNaN(s)?Date.parse(n)-Date.now():s*1000;return o(f,a,e.message)}return Math.min(0.5*2**t,8)*1000*(1-Math.random()*0.25)}function i(){let e=Error("Request aborted");return e.name="AbortError",e}function m(e,t){return new Promise((a,r)=>{if(t?.aborted){r(i());return}let n=()=>{clearTimeout(u),r(i())},u=setTimeout(()=>{t?.removeEventListener("abort",n),a()},Math.max(0,e));t?.addEventListener("abort",n,{once:!0})})}async function is(e,t={}){let a=t.maxRetries??0,r=a;for(;;)try{return await e()}catch(n){if(t.signal?.aborted)throw i();if(r<=0||!c(n)||!d(n))throw n;let u=a-r;r--,await m(l(n,u,t.maxRetryDelayMs),t.signal)}}
+export{is};

package/bin/{chunk-radcwage.js → chunk-8mjb093y.js}

@@ -1,3 +1,3 @@
 // @bun
-var f=-1/0,e=0;function a(n){if(globalThis.crypto?.getRandomValues){globalThis.crypto.getRandomValues(n);return}for(let i=0;i<n.length;i++)n[i]=Math.floor(Math.random()*256)}function Yi(){let n=new Uint8Array(16);a(n);let i=Date.now();if(i>f)e=n[6]*16777216+n[7]*65536+n[8]*256+n[9],f=i;else if(e=e+1>>>0,e===0)f++;let t=new Uint8Array(16);t[0]=f/1099511627776&255,t[1]=f/4294967296&255,t[2]=f/16777216&255,t[3]=f/65536&255,t[4]=f/256&255,t[5]=f&255,t[6]=112|e>>>28&15,t[7]=e>>>20&255,t[8]=128|e>>>14&63,t[9]=e>>>6&255,t[10]=(e&63)<<2|n[10]&3,t[11]=n[11],t[12]=n[12],t[13]=n[13],t[14]=n[14],t[15]=n[15];let o=Array.from(t,(x)=>x.toString(16).padStart(2,"0"));return`${o.slice(0,4).join("")}-${o.slice(4,6).join("")}-${o.slice(6,8).join("")}-${o.slice(8,10).join("")}-${o.slice(10,16).join("")}`}
-export{Yi};
+var f=-1/0,e=0;function a(n){if(globalThis.crypto?.getRandomValues){globalThis.crypto.getRandomValues(n);return}for(let i=0;i<n.length;i++)n[i]=Math.floor(Math.random()*256)}function Xa(){let n=new Uint8Array(16);a(n);let i=Date.now();if(i>f)e=n[6]*16777216+n[7]*65536+n[8]*256+n[9],f=i;else if(e=e+1>>>0,e===0)f++;let t=new Uint8Array(16);t[0]=f/1099511627776&255,t[1]=f/4294967296&255,t[2]=f/16777216&255,t[3]=f/65536&255,t[4]=f/256&255,t[5]=f&255,t[6]=112|e>>>28&15,t[7]=e>>>20&255,t[8]=128|e>>>14&63,t[9]=e>>>6&255,t[10]=(e&63)<<2|n[10]&3,t[11]=n[11],t[12]=n[12],t[13]=n[13],t[14]=n[14],t[15]=n[15];let o=Array.from(t,(x)=>x.toString(16).padStart(2,"0"));return`${o.slice(0,4).join("")}-${o.slice(4,6).join("")}-${o.slice(6,8).join("")}-${o.slice(8,10).join("")}-${o.slice(10,16).join("")}`}
+export{Xa};

package/bin/{chunk-h3wr8nnk.js → chunk-8r9q7xcv.js}

@@ -1,2 +1,2 @@
 // @bun
-import{bi}from"./chunk-zr11zfwc.js";import{ks,Go}from"./chunk-typ46eqd.js";import{Vo}from"./chunk-vx66rms0.js";import{Qo,Ao,Dt}from"./chunk-s30fjvzs.js";import{un,ar,$e,Xr,Jt,yo,qt}from"./chunk-781990k7.js";var{awsEndpointFunctions:it,emitWarningIfUnsupportedVersion:at,createDefaultUserAgentProvider:ct,NODE_APP_ID_CONFIG_OPTIONS:ut,getAwsRegionExtensionConfiguration:dt,resolveAwsRegionExtensionConfiguration:lt,resolveUserAgentConfig:pt,resolveHostHeaderConfig:gt,getUserAgentPlugin:ht,getHostHeaderPlugin:mt,getLoggerPlugin:Pt,getRecursionDetectionPlugin:ft,setCredentialFeature:B,stsRegionDefaultResolver:St}=Dt(),{NoAuthSigner:le,getHttpAuthSchemeEndpointRuleSetPlugin:At,DefaultIdentityProviderConfig:Et,getHttpSigningPlugin:vt}=Ao(),{normalizeProvider:pe,getSmithyContext:ge,ServiceException:yt,NoOpLogger:It,emitWarningIfUnsupportedVersion:Rt,loadConfigsForDefaultMode:_t,getDefaultExtensionConfiguration:Ct,resolveDefaultRuntimeConfig:xt,Client:he,makeBuilder:wt,createAggregatedClient:Tt}=ar(),{Command:bt}=ar();var Wn=bt,Hn=he;var{resolveDefaultsModeConfig:$t,loadConfig:A,NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS:kt,NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS:Ot,NODE_REGION_CONFIG_OPTIONS:Nt,NODE_REGION_CONFIG_FILE_OPTIONS:Wt,resolveRegionConfig:Ht}=$e(),{BinaryDecisionDiagram:Ut,EndpointCache:Ft,decideEndpoint:Lt,customEndpointFunctions:Kt,resolveParams:Mt,resolveEndpointConfig:jt,getEndpointPlugin:Gt}=Xr(),{parseUrl:Vt,getHttpHandlerExtensionConfiguration:zt,resolveHttpHandlerRuntimeConfig:Bt,getContentLengthPlugin:Qt}=qt(),{DEFAULT_RETRY_MODE:Yt,NODE_RETRY_MODE_CONFIG_OPTIONS:Xt,NODE_MAX_ATTEMPT_CONFIG_OPTIONS:Zt,resolveRetryConfig:es,getRetryPlugin:ts}=Qo(),{TypeRegistry:me,getSchemaSerdePlugin:ss}=un(),{resolveAwsSdkSigV4Config:ns,resolveAwsSdkSigV4AConfig:os,AwsSdkSigV4Signer:Pe,AwsSdkSigV4ASigner:fe,NODE_SIGV4A_CONFIG_OPTIONS:rs,NODE_AUTH_SCHEME_PREFERENCE_OPTIONS:is}=Go(),{SignatureV4MultiRegion:Se}=bi(),{toUtf8:as,fromUtf8:cs,toBase64:us,fromBase64:ds,calculateBodyLength:ls}=Jt(),{streamCollector:ps,NodeHttpHandler:gs}=Vo(),{AwsQueryProtocol:hs}=ks(),{Sha256:ms}=yo(),D="ref",y=-1,b=!0,ne="isSet",Ae="PartitionResult",k="booleanEquals",u="stringEquals",V="getAttr",oe="us-east-1",re="sigv4",ie="sts",ae="https://sts.{Region}.{PartitionResult#dnsSuffix}",ce={[D]:"Endpoint"},d={[D]:"Region"},z={[D]:Ae},T={},ue=[d],de={conditions:[[ne,[ce]],[ne,ue],["aws.partition",ue,Ae],[k,[{[D]:"UseFIPS"},b]],[k,[{[D]:"UseDualStack"},b]],[u,[d,"aws-global"]],[k,[{[D]:"UseGlobalEndpoint"},b]],[u,[d,"eu-central-1"]],[k,[{fn:V,argv:[z,"supportsDualStack"]},b]],[k,[{fn:V,argv:[z,"supportsFIPS"]},b]],[u,[d,"ap-south-1"]],[u,[d,"eu-north-1"]],[u,[d,"eu-west-1"]],[u,[d,"eu-west-2"]],[u,[d,"eu-west-3"]],[u,[d,"sa-east-1"]],[u,[d,oe]],[u,[d,"us-east-2"]],[u,[d,"us-west-2"]],[u,[d,"us-west-1"]],[u,[d,"ca-central-1"]],[u,[d,"ap-southeast-1"]],[u,[d,"ap-northeast-1"]],[u,[d,"ap-southeast-2"]],[u,[{fn:V,argv:[z,"name"]},"aws-us-gov"]]],results:[[y],["https://sts.amazonaws.com",{authSchemes:[{name:re,signingName:ie,signingRegion:oe}]}],[ae,{authSchemes:[{name:re,signingName:ie,signingRegion:"{Region}"}]}],[y,"Invalid Configuration: FIPS and custom endpoint are not supported"],[y,"Invalid Configuration: Dualstack and custom endpoint are not supported"],[ce,T],["https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",T],[y,"FIPS and DualStack are enabled, but this partition does not support one or both"],["https://sts.{Region}.amazonaws.com",T],["https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",T],[y,"FIPS is enabled but this partition does not support FIPS"],["https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",T],[y,"DualStack is enabled but this partition does not support DualStack"],[ae,T],[y,"Invalid Configuration: Missing Region"]]},Ps=2,o=1e8,fs=new Int32Array([-1,1,-1,0,30,3,1,4,o+14,2,5,o+14,3,25,6,4,24,7,5,o+1,8,6,9,o+13,7,o+1,10,10,o+1,11,11,o+1,12,12,o+1,13,13,o+1,14,14,o+1,15,15,o+1,16,16,o+1,17,17,o+1,18,18,o+1,19,19,o+1,20,20,o+1,21,21,o+1,22,22,o+1,23,23,o+1,o+2,8,o+11,o+12,4,28,26,9,27,o+10,24,o+8,o+9,8,29,o+7,9,o+6,o+7,3,o+3,31,4,o+4,o+5]),Ss=Ut.from(fs,Ps,de.conditions,de.results),As=new Ft({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),Ee=(e,t={})=>As.get(e,()=>Lt(Ss,{endpointParams:e,logger:t.logger}));Kt.aws=it;var Es=(e)=>async(t,s,i)=>{if(!i)throw Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");let n=await e(t,s,i),c=ge(s)?.commandInstance?.constructor?.getEndpointParameterInstructions;if(!c)throw Error(`getEndpointParameterInstructions() is not defined on '${s.commandName}'`);let r=await Mt(i,{getEndpointParameterInstructions:c},t);return Object.assign(n,r)},vs=async(e,t,s)=>({operation:ge(t).operation,region:await pe(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}),ys=Es(vs);function ve(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,s)=>({signingProperties:{config:t,context:s}})}}function Q(e){return{schemeId:"aws.auth#sigv4a",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,s)=>({signingProperties:{config:t,context:s}})}}function ye(e){return{schemeId:"smithy.api#noAuth"}}var Is=(e,t,s)=>(n)=>{let r=e(n).properties?.authSchemes;if(!r)return t(n);let l=[];for(let m of r){let{name:p,properties:P={},...v}=m,f=p.toLowerCase();if(p!==f)console.warn(`HttpAuthScheme has been normalized with lowercasing: '${p}' to '${f}'`);let h;if(f==="sigv4a"){h="aws.auth#sigv4a";let j=r.find((G)=>{let se=G.name.toLowerCase();return se!=="sigv4a"&&se.startsWith("sigv4")});if(Se.sigv4aDependency()==="none"&&j)continue}else if(f.startsWith("sigv4"))h="aws.auth#sigv4";else throw Error(`Unknown HttpAuthScheme found in '@smithy.rules#endpointRuleSet': '${f}'`);let w=s[h];if(!w)throw Error(`Could not find HttpAuthOption create function for '${h}'`);let S=w(n);S.schemeId=h,S.signingProperties={...S.signingProperties||{},...v,...P},l.push(S)}return l},Rs=(e)=>{let t=[];switch(e.operation){case"AssumeRoleWithWebIdentity":{t.push(ye()),t.push(Q(e));break}default:t.push(ve(e)),t.push(Q(e))}return t},_s=Is(Ee,Rs,{"aws.auth#sigv4":ve,"aws.auth#sigv4a":Q,"smithy.api#noAuth":ye}),Cs=(e)=>{let t=ns(e),s=os(t);return Object.assign(s,{authSchemePreference:pe(e.authSchemePreference??[])})},xs=(e)=>Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,useGlobalEndpoint:e.useGlobalEndpoint??!1,defaultSigningName:"sts"}),ws={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Ts="3.997.43",Ds={version:Ts};class g extends yt{constructor(e){super(e);Object.setPrototypeOf(this,g.prototype)}}class N extends g{name="ExpiredTokenException";$fault="client";constructor(e){super({name:"ExpiredTokenException",$fault:"client",...e});Object.setPrototypeOf(this,N.prototype)}}class W extends g{name="MalformedPolicyDocumentException";$fault="client";constructor(e){super({name:"MalformedPolicyDocumentException",$fault:"client",...e});Object.setPrototypeOf(this,W.prototype)}}class H extends g{name="PackedPolicyTooLargeException";$fault="client";constructor(e){super({name:"PackedPolicyTooLargeException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}class U extends g{name="RegionDisabledException";$fault="client";constructor(e){super({name:"RegionDisabledException",$fault:"client",...e});Object.setPrototypeOf(this,U.prototype)}}class q extends g{name="IDPRejectedClaimException";$fault="client";constructor(e){super({name:"IDPRejectedClaimException",$fault:"client",...e});Object.setPrototypeOf(this,q.prototype)}}class F extends g{name="InvalidIdentityTokenException";$fault="client";constructor(e){super({name:"InvalidIdentityTokenException",$fault:"client",...e});Object.setPrototypeOf(this,F.prototype)}}class L extends g{name="IDPCommunicationErrorException";$fault="client";$retryable={};constructor(e){super({name:"IDPCommunicationErrorException",$fault:"client",...e});Object.setPrototypeOf(this,L.prototype)}}var bs="Arn",$s="AccessKeyId",Os="AssumeRole",Ns="AssumedRoleId",Ws="AssumeRoleRequest",Hs="AssumeRoleResponse",Y="AssumedRoleUser",Us="AssumeRoleWithWebIdentity",qs="AssumeRoleWithWebIdentityRequest",Fs="AssumeRoleWithWebIdentityResponse",Ls="Audience",X="Credentials",Ks="ContextAssertion",Ie="DurationSeconds",Ms="Expiration",js="ExternalId",Gs="ExpiredTokenException",Vs="IDPCommunicationErrorException",zs="IDPRejectedClaimException",Bs="InvalidIdentityTokenException",Qs="Key",Ys="MalformedPolicyDocumentException",Re="Policy",_e="PolicyArns",Xs="ProviderArn",Js="ProvidedContexts",Zs="ProvidedContextsListType",en="ProvidedContext",tn="PolicyDescriptorType",sn="ProviderId",Ce="PackedPolicySize",nn="PackedPolicyTooLargeException",on="Provider",xe="RoleArn",rn="RegionDisabledException",we="RoleSessionName",an="SecretAccessKey",cn="SubjectFromWebIdentityToken",J="SourceIdentity",dn="SerialNumber",ln="SessionToken",pn="Tags",gn="TokenCode",hn="TransitiveTagKeys",mn="Tag",Pn="Value",fn="WebIdentityToken",Sn="arn",An="accessKeySecretType",I="awsQueryError",R="client",En="clientTokenType",_="error",C="httpError",x="message",vn="policyDescriptorListType",Te="smithy.ts.sdk.synthetic.com.amazonaws.sts",yn="tagListType",a="com.amazonaws.sts",De=me.for(Te),be=[-3,Te,"STSServiceException",0,[],[]];De.registerError(be,g);var E=me.for(a),ke=[-3,a,Gs,{[I]:["ExpiredTokenException",400],[_]:R,[C]:400},[x],[0]];E.registerError(ke,N);var Oe=[-3,a,Vs,{[I]:["IDPCommunicationError",400],[_]:R,[C]:400},[x],[0]];E.registerError(Oe,L);var Ne=[-3,a,zs,{[I]:["IDPRejectedClaim",403],[_]:R,[C]:403},[x],[0]];E.registerError(Ne,q);var We=[-3,a,Bs,{[I]:["InvalidIdentityToken",400],[_]:R,[C]:400},[x],[0]];E.registerError(We,F);var He=[-3,a,Ys,{[I]:["MalformedPolicyDocument",400],[_]:R,[C]:400},[x],[0]];E.registerError(He,W);var Ue=[-3,a,nn,{[I]:["PackedPolicyTooLarge",400],[_]:R,[C]:400},[x],[0]];E.registerError(Ue,H);var qe=[-3,a,rn,{[I]:["RegionDisabledException",403],[_]:R,[C]:403},[x],[0]];E.registerError(qe,U);var Fe=[De,E],In=[0,a,An,8,0],Rn=[0,a,En,8,0],Z=[3,a,Y,0,[Ns,bs],[0,0],2],Le=[3,a,Ws,0,[xe,we,_e,Re,Ie,pn,hn,js,dn,gn,J,Js],[0,0,()=>Be,0,1,()=>Cn,64,0,0,0,0,()=>_n],2],Ke=[3,a,Hs,0,[X,Y,Ce,J],[[()=>ee,0],()=>Z,1,0]],Me=[3,a,qs,0,[xe,we,fn,sn,_e,Re,Ie],[0,0,[()=>Rn,0],0,()=>Be,0,1],3],je=[3,a,Fs,0,[X,cn,Y,Ce,on,Ls,J],[[()=>ee,0],0,()=>Z,1,0,0,0]],ee=[3,a,X,0,[$s,an,ln,Ms],[0,[()=>In,0],0,4],4],Ge=[3,a,tn,0,[Sn],[0]],Ve=[3,a,en,0,[Xs,Ks],[0,0]],ze=[3,a,mn,0,[Qs,Pn],[0,0],2],Be=[1,a,vn,0,()=>Ge],_n=[1,a,Zs,0,()=>Ve],Cn=[1,a,yn,0,()=>ze],Qe=[9,a,Os,0,()=>Le,()=>Ke],Ye=[9,a,Us,0,()=>Me,()=>je],xn=(e)=>({apiVersion:"2011-06-15",base64Decoder:e?.base64Decoder??ds,base64Encoder:e?.base64Encoder??us,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ee,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??_s,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new Pe},{schemeId:"aws.auth#sigv4a",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4a"),signer:new fe},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new le}],logger:e?.logger??new It,protocol:e?.protocol??hs,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:Fe,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:e?.serviceId??"STS",sha256:e?.sha256??ms,signerConstructor:e?.signerConstructor??Se,urlParser:e?.urlParser??Vt,utf8Decoder:e?.utf8Decoder??cs,utf8Encoder:e?.utf8Encoder??as}),wn=(e)=>{Rt(process.version);let t=$t(e),s=()=>t().then(_t),i=xn(e);at(process.version);let n={profile:e?.profile,logger:i.logger};return{...i,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??A(is,n),bodyLengthChecker:e?.bodyLengthChecker??ls,defaultUserAgentProvider:e?.defaultUserAgentProvider??ct({serviceId:i.serviceId,clientVersion:Ds.version}),httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(c)=>c.getIdentityProvider("aws.auth#sigv4")||(async(r)=>await e.credentialDefaultProvider(r?.__config||{})()),signer:new Pe},{schemeId:"aws.auth#sigv4a",identityProvider:(c)=>c.getIdentityProvider("aws.auth#sigv4a"),signer:new fe},{schemeId:"smithy.api#noAuth",identityProvider:(c)=>c.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new le}],maxAttempts:e?.maxAttempts??A(Zt,e),region:e?.region??A(Nt,{...Wt,...n}),requestHandler:gs.create(e?.requestHandler??s),retryMode:e?.retryMode??A({...Xt,default:async()=>(await s()).retryMode||Yt},e),sigv4aSigningRegionSet:e?.sigv4aSigningRegionSet??A(rs,n),streamCollector:e?.streamCollector??ps,useDualstackEndpoint:e?.useDualstackEndpoint??A(Ot,n),useFipsEndpoint:e?.useFipsEndpoint??A(kt,n),userAgentAppId:e?.userAgentAppId??A(ut,n)}},Tn=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:s,credentials:i}=e;return{setHttpAuthScheme(n){let c=t.findIndex((r)=>r.schemeId===n.schemeId);if(c===-1)t.push(n);else t.splice(c,1,n)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(n){s=n},httpAuthSchemeProvider(){return s},setCredentials(n){i=n},credentials(){return i}}},Dn=(e)=>({httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}),bn=(e,t)=>{let s=Object.assign(dt(e),Ct(e),zt(e),Tn(e));return t.forEach((i)=>i.configure(s)),Object.assign(e,lt(s),xt(s),Bt(s),Dn(s))};class O extends he{config;constructor(...[e]){let t=wn(e||{});super(t);this.initConfig=t;let s=xs(t),i=pt(s),n=es(i),c=Ht(n),r=gt(c),l=jt(r),m=Cs(l),p=bn(m,e?.extensions||[]);this.config=p,this.middlewareStack.use(ss(this.config)),this.middlewareStack.use(ht(this.config)),this.middlewareStack.use(ts(this.config)),this.middlewareStack.use(Qt(this.config)),this.middlewareStack.use(mt(this.config)),this.middlewareStack.use(Pt(this.config)),this.middlewareStack.use(ft(this.config)),this.middlewareStack.use(At(this.config,{httpAuthSchemeParametersProvider:ys,identityProviderConfigProvider:async(P)=>new Et({"aws.auth#sigv4":P.credentials,"aws.auth#sigv4a":P.credentials})})),this.middlewareStack.use(vt(this.config))}destroy(){super.destroy()}}var Xe=wt(ws,"AWSSecurityTokenServiceV20110615","STSClient",Gt),Je={},Ze=(e,t,s,i)=>[];class K extends Xe(Je,Ze,"AssumeRole",Qe){}class M extends Xe(Je,Ze,"AssumeRoleWithWebIdentity",Ye){}var $n={AssumeRoleCommand:K,AssumeRoleWithWebIdentityCommand:M};class te extends O{}Tt($n,te);var et=(e)=>{if(typeof e?.Arn==="string"){let t=e.Arn.split(":");if(t.length>4&&t[4]!=="")return t[4]}return},tt=async(e,t,s,i={})=>{let n=typeof e==="function"?await e():e,c=typeof t==="function"?await t():t,r="",l=n??c??(r=await St(i)());return s?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${n} (credential provider clientConfig)`,`${c} (contextual client)`,`${r} (STS default: AWS_REGION, profile region, or us-east-1)`),l},kn=(e,t)=>{let s,i;return async(n,c)=>{if(i=n,!s){let{logger:P=e?.parentClientConfig?.logger,profile:v=e?.parentClientConfig?.profile,region:f,requestHandler:h=e?.parentClientConfig?.requestHandler,credentialProviderLogger:w,userAgentAppId:S=e?.parentClientConfig?.userAgentAppId}=e,j=await tt(f,e?.parentClientConfig?.region,w,{logger:P,profile:v}),G=!st(h);s=new t({...e,userAgentAppId:S,profile:v,credentialDefaultProvider:()=>async()=>i,region:j,requestHandler:G?h:void 0,logger:P})}let{Credentials:r,AssumedRoleUser:l}=await s.send(new K(c));if(!r||!r.AccessKeyId||!r.SecretAccessKey)throw Error(`Invalid response from STS.assumeRole call with role ${c.RoleArn}`);let m=et(l),p={accessKeyId:r.AccessKeyId,secretAccessKey:r.SecretAccessKey,sessionToken:r.SessionToken,expiration:r.Expiration,...r.CredentialScope&&{credentialScope:r.CredentialScope},...m&&{accountId:m}};return B(p,"CREDENTIALS_STS_ASSUME_ROLE","i"),p}},On=(e,t)=>{let s;return async(i)=>{if(!s){let{logger:m=e?.parentClientConfig?.logger,profile:p=e?.parentClientConfig?.profile,region:P,requestHandler:v=e?.parentClientConfig?.requestHandler,credentialProviderLogger:f,userAgentAppId:h=e?.parentClientConfig?.userAgentAppId}=e,w=await tt(P,e?.parentClientConfig?.region,f,{logger:m,profile:p}),S=!st(v);s=new t({...e,userAgentAppId:h,profile:p,region:w,requestHandler:S?v:void 0,logger:m})}let{Credentials:n,AssumedRoleUser:c}=await s.send(new M(i));if(!n||!n.AccessKeyId||!n.SecretAccessKey)throw Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${i.RoleArn}`);let r=et(c),l={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,sessionToken:n.SessionToken,expiration:n.Expiration,...n.CredentialScope&&{credentialScope:n.CredentialScope},...r&&{accountId:r}};if(r)B(l,"RESOLVED_ACCOUNT_ID","T");return B(l,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),l}},st=(e)=>e?.metadata?.handlerProtocol==="h2",nt=(e,t)=>{if(!t)return e;else return class extends e{constructor(i){super(i);for(let n of t)this.middlewareStack.use(n)}}},ot=(e={},t)=>kn(e,nt(O,t)),rt=(e={},t)=>On(e,nt(O,t)),Nn=(e)=>(t)=>e({roleAssumer:ot(t),roleAssumerWithWebIdentity:rt(t),...t});var Un=Qe,qn=K,Fn=Le,Ln=Ke,Kn=Ye,Mn=M,jn=Me,Gn=je,Vn=Z,zn=ee,Bn=N,Qn=ke,Yn=L,Xn=Oe,Jn=q,Zn=Ne,eo=F,to=We,so=W,no=He,oo=H,ro=Ue,io=Ge,ao=Ve,co=U,uo=qe,lo=te,po=O,go=g,ho=be,mo=ze,Po=Nn,fo=Fe,So=ot,Eo=rt;export{Wn as $Command,Hn as __Client,Un as AssumeRole$,qn as AssumeRoleCommand,Fn as AssumeRoleRequest$,Ln as AssumeRoleResponse$,Kn as AssumeRoleWithWebIdentity$,Mn as AssumeRoleWithWebIdentityCommand,jn as AssumeRoleWithWebIdentityRequest$,Gn as AssumeRoleWithWebIdentityResponse$,Vn as AssumedRoleUser$,zn as Credentials$,Bn as ExpiredTokenException,Qn as ExpiredTokenException$,Yn as IDPCommunicationErrorException,Xn as IDPCommunicationErrorException$,Jn as IDPRejectedClaimException,Zn as IDPRejectedClaimException$,eo as InvalidIdentityTokenException,to as InvalidIdentityTokenException$,so as MalformedPolicyDocumentException,no as MalformedPolicyDocumentException$,oo as PackedPolicyTooLargeException,ro as PackedPolicyTooLargeException$,io as PolicyDescriptorType$,ao as ProvidedContext$,co as RegionDisabledException,uo as RegionDisabledException$,lo as STS,po as STSClient,go as STSServiceException,ho as STSServiceException$,mo as Tag$,Po as decorateDefaultCredentialProvider,fo as errorTypeRegistries,So as getDefaultRoleAssumer,Eo as getDefaultRoleAssumerWithWebIdentity};
+import{va}from"./chunk-ckd5hnd0.js";import{ks,Go}from"./chunk-d70acjwn.js";import{Vo}from"./chunk-v2vdm22x.js";import{Qo,Ao,Pt}from"./chunk-fw5xzcnf.js";import{un,ir,Ge,Xr,Jt,yo,qt}from"./chunk-0g7ayjb5.js";var{awsEndpointFunctions:it,emitWarningIfUnsupportedVersion:at,createDefaultUserAgentProvider:ct,NODE_APP_ID_CONFIG_OPTIONS:ut,getAwsRegionExtensionConfiguration:dt,resolveAwsRegionExtensionConfiguration:lt,resolveUserAgentConfig:pt,resolveHostHeaderConfig:gt,getUserAgentPlugin:ht,getHostHeaderPlugin:mt,getLoggerPlugin:ft,getRecursionDetectionPlugin:St,setCredentialFeature:B,stsRegionDefaultResolver:At}=Pt(),{NoAuthSigner:le,getHttpAuthSchemeEndpointRuleSetPlugin:Et,DefaultIdentityProviderConfig:vt,getHttpSigningPlugin:yt}=Ao(),{normalizeProvider:pe,getSmithyContext:ge,ServiceException:It,NoOpLogger:Rt,emitWarningIfUnsupportedVersion:_t,loadConfigsForDefaultMode:Ct,getDefaultExtensionConfiguration:xt,resolveDefaultRuntimeConfig:wt,Client:he,makeBuilder:Tt,createAggregatedClient:Dt}=ir(),{Command:bt}=ir();var Wn=bt,Hn=he;var{resolveDefaultsModeConfig:$t,loadConfig:A,NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS:kt,NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS:Ot,NODE_REGION_CONFIG_OPTIONS:Nt,NODE_REGION_CONFIG_FILE_OPTIONS:Wt,resolveRegionConfig:Ht}=Ge(),{BinaryDecisionDiagram:Ut,EndpointCache:Ft,decideEndpoint:Lt,customEndpointFunctions:Kt,resolveParams:Mt,resolveEndpointConfig:jt,getEndpointPlugin:Gt}=Xr(),{parseUrl:Vt,getHttpHandlerExtensionConfiguration:zt,resolveHttpHandlerRuntimeConfig:Bt,getContentLengthPlugin:Qt}=qt(),{DEFAULT_RETRY_MODE:Yt,NODE_RETRY_MODE_CONFIG_OPTIONS:Xt,NODE_MAX_ATTEMPT_CONFIG_OPTIONS:Zt,resolveRetryConfig:es,getRetryPlugin:ts}=Qo(),{TypeRegistry:me,getSchemaSerdePlugin:ss}=un(),{resolveAwsSdkSigV4Config:ns,resolveAwsSdkSigV4AConfig:os,AwsSdkSigV4Signer:Pe,AwsSdkSigV4ASigner:fe,NODE_SIGV4A_CONFIG_OPTIONS:rs,NODE_AUTH_SCHEME_PREFERENCE_OPTIONS:is}=Go(),{SignatureV4MultiRegion:Se}=va(),{toUtf8:as,fromUtf8:cs,toBase64:us,fromBase64:ds,calculateBodyLength:ls}=Jt(),{streamCollector:ps,NodeHttpHandler:gs}=Vo(),{AwsQueryProtocol:hs}=ks(),{Sha256:ms}=yo(),D="ref",y=-1,b=!0,ne="isSet",Ae="PartitionResult",k="booleanEquals",u="stringEquals",V="getAttr",oe="us-east-1",re="sigv4",ie="sts",ae="https://sts.{Region}.{PartitionResult#dnsSuffix}",ce={[D]:"Endpoint"},d={[D]:"Region"},z={[D]:Ae},T={},ue=[d],de={conditions:[[ne,[ce]],[ne,ue],["aws.partition",ue,Ae],[k,[{[D]:"UseFIPS"},b]],[k,[{[D]:"UseDualStack"},b]],[u,[d,"aws-global"]],[k,[{[D]:"UseGlobalEndpoint"},b]],[u,[d,"eu-central-1"]],[k,[{fn:V,argv:[z,"supportsDualStack"]},b]],[k,[{fn:V,argv:[z,"supportsFIPS"]},b]],[u,[d,"ap-south-1"]],[u,[d,"eu-north-1"]],[u,[d,"eu-west-1"]],[u,[d,"eu-west-2"]],[u,[d,"eu-west-3"]],[u,[d,"sa-east-1"]],[u,[d,oe]],[u,[d,"us-east-2"]],[u,[d,"us-west-2"]],[u,[d,"us-west-1"]],[u,[d,"ca-central-1"]],[u,[d,"ap-southeast-1"]],[u,[d,"ap-northeast-1"]],[u,[d,"ap-southeast-2"]],[u,[{fn:V,argv:[z,"name"]},"aws-us-gov"]]],results:[[y],["https://sts.amazonaws.com",{authSchemes:[{name:re,signingName:ie,signingRegion:oe}]}],[ae,{authSchemes:[{name:re,signingName:ie,signingRegion:"{Region}"}]}],[y,"Invalid Configuration: FIPS and custom endpoint are not supported"],[y,"Invalid Configuration: Dualstack and custom endpoint are not supported"],[ce,T],["https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",T],[y,"FIPS and DualStack are enabled, but this partition does not support one or both"],["https://sts.{Region}.amazonaws.com",T],["https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",T],[y,"FIPS is enabled but this partition does not support FIPS"],["https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",T],[y,"DualStack is enabled but this partition does not support DualStack"],[ae,T],[y,"Invalid Configuration: Missing Region"]]},Ps=2,o=1e8,fs=new Int32Array([-1,1,-1,0,30,3,1,4,o+14,2,5,o+14,3,25,6,4,24,7,5,o+1,8,6,9,o+13,7,o+1,10,10,o+1,11,11,o+1,12,12,o+1,13,13,o+1,14,14,o+1,15,15,o+1,16,16,o+1,17,17,o+1,18,18,o+1,19,19,o+1,20,20,o+1,21,21,o+1,22,22,o+1,23,23,o+1,o+2,8,o+11,o+12,4,28,26,9,27,o+10,24,o+8,o+9,8,29,o+7,9,o+6,o+7,3,o+3,31,4,o+4,o+5]),Ss=Ut.from(fs,Ps,de.conditions,de.results),As=new Ft({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),Ee=(e,t={})=>As.get(e,()=>Lt(Ss,{endpointParams:e,logger:t.logger}));Kt.aws=it;var Es=(e)=>async(t,s,i)=>{if(!i)throw Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");let n=await e(t,s,i),c=ge(s)?.commandInstance?.constructor?.getEndpointParameterInstructions;if(!c)throw Error(`getEndpointParameterInstructions() is not defined on '${s.commandName}'`);let r=await Mt(i,{getEndpointParameterInstructions:c},t);return Object.assign(n,r)},vs=async(e,t,s)=>({operation:ge(t).operation,region:await pe(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}),ys=Es(vs);function ve(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,s)=>({signingProperties:{config:t,context:s}})}}function Q(e){return{schemeId:"aws.auth#sigv4a",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,s)=>({signingProperties:{config:t,context:s}})}}function ye(e){return{schemeId:"smithy.api#noAuth"}}var Is=(e,t,s)=>(n)=>{let r=e(n).properties?.authSchemes;if(!r)return t(n);let l=[];for(let m of r){let{name:p,properties:P={},...v}=m,f=p.toLowerCase();if(p!==f)console.warn(`HttpAuthScheme has been normalized with lowercasing: '${p}' to '${f}'`);let h;if(f==="sigv4a"){h="aws.auth#sigv4a";let j=r.find((G)=>{let se=G.name.toLowerCase();return se!=="sigv4a"&&se.startsWith("sigv4")});if(Se.sigv4aDependency()==="none"&&j)continue}else if(f.startsWith("sigv4"))h="aws.auth#sigv4";else throw Error(`Unknown HttpAuthScheme found in '@smithy.rules#endpointRuleSet': '${f}'`);let w=s[h];if(!w)throw Error(`Could not find HttpAuthOption create function for '${h}'`);let S=w(n);S.schemeId=h,S.signingProperties={...S.signingProperties||{},...v,...P},l.push(S)}return l},Rs=(e)=>{let t=[];switch(e.operation){case"AssumeRoleWithWebIdentity":{t.push(ye()),t.push(Q(e));break}default:t.push(ve(e)),t.push(Q(e))}return t},_s=Is(Ee,Rs,{"aws.auth#sigv4":ve,"aws.auth#sigv4a":Q,"smithy.api#noAuth":ye}),Cs=(e)=>{let t=ns(e),s=os(t);return Object.assign(s,{authSchemePreference:pe(e.authSchemePreference??[])})},xs=(e)=>Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,useGlobalEndpoint:e.useGlobalEndpoint??!1,defaultSigningName:"sts"}),ws={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Ts="3.997.43",Ds={version:Ts};class g extends It{constructor(e){super(e);Object.setPrototypeOf(this,g.prototype)}}class N extends g{name="ExpiredTokenException";$fault="client";constructor(e){super({name:"ExpiredTokenException",$fault:"client",...e});Object.setPrototypeOf(this,N.prototype)}}class W extends g{name="MalformedPolicyDocumentException";$fault="client";constructor(e){super({name:"MalformedPolicyDocumentException",$fault:"client",...e});Object.setPrototypeOf(this,W.prototype)}}class H extends g{name="PackedPolicyTooLargeException";$fault="client";constructor(e){super({name:"PackedPolicyTooLargeException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}class U extends g{name="RegionDisabledException";$fault="client";constructor(e){super({name:"RegionDisabledException",$fault:"client",...e});Object.setPrototypeOf(this,U.prototype)}}class q extends g{name="IDPRejectedClaimException";$fault="client";constructor(e){super({name:"IDPRejectedClaimException",$fault:"client",...e});Object.setPrototypeOf(this,q.prototype)}}class F extends g{name="InvalidIdentityTokenException";$fault="client";constructor(e){super({name:"InvalidIdentityTokenException",$fault:"client",...e});Object.setPrototypeOf(this,F.prototype)}}class L extends g{name="IDPCommunicationErrorException";$fault="client";$retryable={};constructor(e){super({name:"IDPCommunicationErrorException",$fault:"client",...e});Object.setPrototypeOf(this,L.prototype)}}var bs="Arn",$s="AccessKeyId",Os="AssumeRole",Ns="AssumedRoleId",Ws="AssumeRoleRequest",Hs="AssumeRoleResponse",Y="AssumedRoleUser",Us="AssumeRoleWithWebIdentity",qs="AssumeRoleWithWebIdentityRequest",Fs="AssumeRoleWithWebIdentityResponse",Ls="Audience",X="Credentials",Ks="ContextAssertion",Ie="DurationSeconds",Ms="Expiration",js="ExternalId",Gs="ExpiredTokenException",Vs="IDPCommunicationErrorException",zs="IDPRejectedClaimException",Bs="InvalidIdentityTokenException",Qs="Key",Ys="MalformedPolicyDocumentException",Re="Policy",_e="PolicyArns",Xs="ProviderArn",Js="ProvidedContexts",Zs="ProvidedContextsListType",en="ProvidedContext",tn="PolicyDescriptorType",sn="ProviderId",Ce="PackedPolicySize",nn="PackedPolicyTooLargeException",on="Provider",xe="RoleArn",rn="RegionDisabledException",we="RoleSessionName",an="SecretAccessKey",cn="SubjectFromWebIdentityToken",J="SourceIdentity",dn="SerialNumber",ln="SessionToken",pn="Tags",gn="TokenCode",hn="TransitiveTagKeys",mn="Tag",Pn="Value",fn="WebIdentityToken",Sn="arn",An="accessKeySecretType",I="awsQueryError",R="client",En="clientTokenType",_="error",C="httpError",x="message",vn="policyDescriptorListType",Te="smithy.ts.sdk.synthetic.com.amazonaws.sts",yn="tagListType",a="com.amazonaws.sts",De=me.for(Te),be=[-3,Te,"STSServiceException",0,[],[]];De.registerError(be,g);var E=me.for(a),$e=[-3,a,Gs,{[I]:["ExpiredTokenException",400],[_]:R,[C]:400},[x],[0]];E.registerError($e,N);var ke=[-3,a,Vs,{[I]:["IDPCommunicationError",400],[_]:R,[C]:400},[x],[0]];E.registerError(ke,L);var Oe=[-3,a,zs,{[I]:["IDPRejectedClaim",403],[_]:R,[C]:403},[x],[0]];E.registerError(Oe,q);var Ne=[-3,a,Bs,{[I]:["InvalidIdentityToken",400],[_]:R,[C]:400},[x],[0]];E.registerError(Ne,F);var We=[-3,a,Ys,{[I]:["MalformedPolicyDocument",400],[_]:R,[C]:400},[x],[0]];E.registerError(We,W);var He=[-3,a,nn,{[I]:["PackedPolicyTooLarge",400],[_]:R,[C]:400},[x],[0]];E.registerError(He,H);var Ue=[-3,a,rn,{[I]:["RegionDisabledException",403],[_]:R,[C]:403},[x],[0]];E.registerError(Ue,U);var qe=[De,E],In=[0,a,An,8,0],Rn=[0,a,En,8,0],Z=[3,a,Y,0,[Ns,bs],[0,0],2],Fe=[3,a,Ws,0,[xe,we,_e,Re,Ie,pn,hn,js,dn,gn,J,Js],[0,0,()=>Be,0,1,()=>Cn,64,0,0,0,0,()=>_n],2],Le=[3,a,Hs,0,[X,Y,Ce,J],[[()=>ee,0],()=>Z,1,0]],Ke=[3,a,qs,0,[xe,we,fn,sn,_e,Re,Ie],[0,0,[()=>Rn,0],0,()=>Be,0,1],3],Me=[3,a,Fs,0,[X,cn,Y,Ce,on,Ls,J],[[()=>ee,0],0,()=>Z,1,0,0,0]],ee=[3,a,X,0,[$s,an,ln,Ms],[0,[()=>In,0],0,4],4],je=[3,a,tn,0,[Sn],[0]],Ve=[3,a,en,0,[Xs,Ks],[0,0]],ze=[3,a,mn,0,[Qs,Pn],[0,0],2],Be=[1,a,vn,0,()=>je],_n=[1,a,Zs,0,()=>Ve],Cn=[1,a,yn,0,()=>ze],Qe=[9,a,Os,0,()=>Fe,()=>Le],Ye=[9,a,Us,0,()=>Ke,()=>Me],xn=(e)=>({apiVersion:"2011-06-15",base64Decoder:e?.base64Decoder??ds,base64Encoder:e?.base64Encoder??us,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ee,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??_s,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new Pe},{schemeId:"aws.auth#sigv4a",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4a"),signer:new fe},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new le}],logger:e?.logger??new Rt,protocol:e?.protocol??hs,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:qe,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:e?.serviceId??"STS",sha256:e?.sha256??ms,signerConstructor:e?.signerConstructor??Se,urlParser:e?.urlParser??Vt,utf8Decoder:e?.utf8Decoder??cs,utf8Encoder:e?.utf8Encoder??as}),wn=(e)=>{_t(process.version);let t=$t(e),s=()=>t().then(Ct),i=xn(e);at(process.version);let n={profile:e?.profile,logger:i.logger};return{...i,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??A(is,n),bodyLengthChecker:e?.bodyLengthChecker??ls,defaultUserAgentProvider:e?.defaultUserAgentProvider??ct({serviceId:i.serviceId,clientVersion:Ds.version}),httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(c)=>c.getIdentityProvider("aws.auth#sigv4")||(async(r)=>await e.credentialDefaultProvider(r?.__config||{})()),signer:new Pe},{schemeId:"aws.auth#sigv4a",identityProvider:(c)=>c.getIdentityProvider("aws.auth#sigv4a"),signer:new fe},{schemeId:"smithy.api#noAuth",identityProvider:(c)=>c.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new le}],maxAttempts:e?.maxAttempts??A(Zt,e),region:e?.region??A(Nt,{...Wt,...n}),requestHandler:gs.create(e?.requestHandler??s),retryMode:e?.retryMode??A({...Xt,default:async()=>(await s()).retryMode||Yt},e),sigv4aSigningRegionSet:e?.sigv4aSigningRegionSet??A(rs,n),streamCollector:e?.streamCollector??ps,useDualstackEndpoint:e?.useDualstackEndpoint??A(Ot,n),useFipsEndpoint:e?.useFipsEndpoint??A(kt,n),userAgentAppId:e?.userAgentAppId??A(ut,n)}},Tn=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:s,credentials:i}=e;return{setHttpAuthScheme(n){let c=t.findIndex((r)=>r.schemeId===n.schemeId);if(c===-1)t.push(n);else t.splice(c,1,n)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(n){s=n},httpAuthSchemeProvider(){return s},setCredentials(n){i=n},credentials(){return i}}},Dn=(e)=>({httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}),bn=(e,t)=>{let s=Object.assign(dt(e),xt(e),zt(e),Tn(e));return t.forEach((i)=>i.configure(s)),Object.assign(e,lt(s),wt(s),Bt(s),Dn(s))};class O extends he{config;constructor(...[e]){let t=wn(e||{});super(t);this.initConfig=t;let s=xs(t),i=pt(s),n=es(i),c=Ht(n),r=gt(c),l=jt(r),m=Cs(l),p=bn(m,e?.extensions||[]);this.config=p,this.middlewareStack.use(ss(this.config)),this.middlewareStack.use(ht(this.config)),this.middlewareStack.use(ts(this.config)),this.middlewareStack.use(Qt(this.config)),this.middlewareStack.use(mt(this.config)),this.middlewareStack.use(ft(this.config)),this.middlewareStack.use(St(this.config)),this.middlewareStack.use(Et(this.config,{httpAuthSchemeParametersProvider:ys,identityProviderConfigProvider:async(P)=>new vt({"aws.auth#sigv4":P.credentials,"aws.auth#sigv4a":P.credentials})})),this.middlewareStack.use(yt(this.config))}destroy(){super.destroy()}}var Xe=Tt(ws,"AWSSecurityTokenServiceV20110615","STSClient",Gt),Je={},Ze=(e,t,s,i)=>[];class K extends Xe(Je,Ze,"AssumeRole",Qe){}class M extends Xe(Je,Ze,"AssumeRoleWithWebIdentity",Ye){}var $n={AssumeRoleCommand:K,AssumeRoleWithWebIdentityCommand:M};class te extends O{}Dt($n,te);var et=(e)=>{if(typeof e?.Arn==="string"){let t=e.Arn.split(":");if(t.length>4&&t[4]!=="")return t[4]}return},tt=async(e,t,s,i={})=>{let n=typeof e==="function"?await e():e,c=typeof t==="function"?await t():t,r="",l=n??c??(r=await At(i)());return s?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${n} (credential provider clientConfig)`,`${c} (contextual client)`,`${r} (STS default: AWS_REGION, profile region, or us-east-1)`),l},kn=(e,t)=>{let s,i;return async(n,c)=>{if(i=n,!s){let{logger:P=e?.parentClientConfig?.logger,profile:v=e?.parentClientConfig?.profile,region:f,requestHandler:h=e?.parentClientConfig?.requestHandler,credentialProviderLogger:w,userAgentAppId:S=e?.parentClientConfig?.userAgentAppId}=e,j=await tt(f,e?.parentClientConfig?.region,w,{logger:P,profile:v}),G=!st(h);s=new t({...e,userAgentAppId:S,profile:v,credentialDefaultProvider:()=>async()=>i,region:j,requestHandler:G?h:void 0,logger:P})}let{Credentials:r,AssumedRoleUser:l}=await s.send(new K(c));if(!r||!r.AccessKeyId||!r.SecretAccessKey)throw Error(`Invalid response from STS.assumeRole call with role ${c.RoleArn}`);let m=et(l),p={accessKeyId:r.AccessKeyId,secretAccessKey:r.SecretAccessKey,sessionToken:r.SessionToken,expiration:r.Expiration,...r.CredentialScope&&{credentialScope:r.CredentialScope},...m&&{accountId:m}};return B(p,"CREDENTIALS_STS_ASSUME_ROLE","i"),p}},On=(e,t)=>{let s;return async(i)=>{if(!s){let{logger:m=e?.parentClientConfig?.logger,profile:p=e?.parentClientConfig?.profile,region:P,requestHandler:v=e?.parentClientConfig?.requestHandler,credentialProviderLogger:f,userAgentAppId:h=e?.parentClientConfig?.userAgentAppId}=e,w=await tt(P,e?.parentClientConfig?.region,f,{logger:m,profile:p}),S=!st(v);s=new t({...e,userAgentAppId:h,profile:p,region:w,requestHandler:S?v:void 0,logger:m})}let{Credentials:n,AssumedRoleUser:c}=await s.send(new M(i));if(!n||!n.AccessKeyId||!n.SecretAccessKey)throw Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${i.RoleArn}`);let r=et(c),l={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,sessionToken:n.SessionToken,expiration:n.Expiration,...n.CredentialScope&&{credentialScope:n.CredentialScope},...r&&{accountId:r}};if(r)B(l,"RESOLVED_ACCOUNT_ID","T");return B(l,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),l}},st=(e)=>e?.metadata?.handlerProtocol==="h2",nt=(e,t)=>{if(!t)return e;else return class extends e{constructor(i){super(i);for(let n of t)this.middlewareStack.use(n)}}},ot=(e={},t)=>kn(e,nt(O,t)),rt=(e={},t)=>On(e,nt(O,t)),Nn=(e)=>(t)=>e({roleAssumer:ot(t),roleAssumerWithWebIdentity:rt(t),...t});var Un=Qe,qn=K,Fn=Fe,Ln=Le,Kn=Ye,Mn=M,jn=Ke,Gn=Me,Vn=Z,zn=ee,Bn=N,Qn=$e,Yn=L,Xn=ke,Jn=q,Zn=Oe,eo=F,to=Ne,so=W,no=We,oo=H,ro=He,io=je,ao=Ve,co=U,uo=Ue,lo=te,po=O,go=g,ho=be,mo=ze,Po=Nn,fo=qe,So=ot,Eo=rt;export{Wn as $Command,Hn as __Client,Un as AssumeRole$,qn as AssumeRoleCommand,Fn as AssumeRoleRequest$,Ln as AssumeRoleResponse$,Kn as AssumeRoleWithWebIdentity$,Mn as AssumeRoleWithWebIdentityCommand,jn as AssumeRoleWithWebIdentityRequest$,Gn as AssumeRoleWithWebIdentityResponse$,Vn as AssumedRoleUser$,zn as Credentials$,Bn as ExpiredTokenException,Qn as ExpiredTokenException$,Yn as IDPCommunicationErrorException,Xn as IDPCommunicationErrorException$,Jn as IDPRejectedClaimException,Zn as IDPRejectedClaimException$,eo as InvalidIdentityTokenException,to as InvalidIdentityTokenException$,so as MalformedPolicyDocumentException,no as MalformedPolicyDocumentException$,oo as PackedPolicyTooLargeException,ro as PackedPolicyTooLargeException$,io as PolicyDescriptorType$,ao as ProvidedContext$,co as RegionDisabledException,uo as RegionDisabledException$,lo as STS,po as STSClient,go as STSServiceException,ho as STSServiceException$,mo as Tag$,Po as decorateDefaultCredentialProvider,fo as errorTypeRegistries,So as getDefaultRoleAssumer,Eo as getDefaultRoleAssumerWithWebIdentity};