@vercel/cli-support 65.10.0-snapshot-c80a43d75dc7 → 65.10.0

package/dist/chunks/chunk-AY523IYR.js

@@ -0,0 +1,7 @@
+import { createRequire as __createRequire } from 'node:module';
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirname_ } from 'node:path';
+const require = __createRequire(import.meta.url);
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __dirname_(__filename);
+import{__commonJS,__require}from"./chunk-BZENIQ7N.js";var require_digest=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/digest.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),digest=(algorithm,data)=>(0,node_crypto_1.createHash)(algorithm).update(data).digest();exports.default=digest}});var require_buffer_utils=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/buffer_utils.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decoder=exports.encoder=void 0;exports.concat=concat;exports.p2s=p2s;exports.uint64be=uint64be;exports.uint32be=uint32be;exports.lengthAndInput=lengthAndInput;exports.concatKdf=concatKdf;var digest_js_1=require_digest();exports.encoder=new TextEncoder;exports.decoder=new TextDecoder;var MAX_INT32=2**32;function concat(...buffers){let size=buffers.reduce((acc,{length})=>acc+length,0),buf=new Uint8Array(size),i=0;for(let buffer of buffers)buf.set(buffer,i),i+=buffer.length;return buf}function p2s(alg,p2sInput){return concat(exports.encoder.encode(alg),new Uint8Array([0]),p2sInput)}function writeUInt32BE(buf,value,offset){if(value<0||value>=MAX_INT32)throw new RangeError(`value must be >= 0 and <= ${MAX_INT32-1}. Received ${value}`);buf.set([value>>>24,value>>>16,value>>>8,value&255],offset)}function uint64be(value){let high=Math.floor(value/MAX_INT32),low=value%MAX_INT32,buf=new Uint8Array(8);return writeUInt32BE(buf,high,0),writeUInt32BE(buf,low,4),buf}function uint32be(value){let buf=new Uint8Array(4);return writeUInt32BE(buf,value),buf}function lengthAndInput(input){return concat(uint32be(input.length),input)}async function concatKdf(secret,bits,value){let iterations=Math.ceil((bits>>3)/32),res=new Uint8Array(iterations*32);for(let iter=0;iter<iterations;iter++){let buf=new Uint8Array(4+secret.length+value.length);buf.set(uint32be(iter+1)),buf.set(secret,4),buf.set(value,4+secret.length),res.set(await(0,digest_js_1.default)("sha256",buf),iter*32)}return res.slice(0,bits>>3)}}});var require_base64url=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/base64url.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decode=exports.encode=exports.encodeBase64=exports.decodeBase64=void 0;var node_buffer_1=__require("node:buffer"),buffer_utils_js_1=require_buffer_utils();function normalize(input){let encoded=input;return encoded instanceof Uint8Array&&(encoded=buffer_utils_js_1.decoder.decode(encoded)),encoded}var encode=input=>node_buffer_1.Buffer.from(input).toString("base64url");exports.encode=encode;var decodeBase64=input=>new Uint8Array(node_buffer_1.Buffer.from(input,"base64"));exports.decodeBase64=decodeBase64;var encodeBase64=input=>node_buffer_1.Buffer.from(input).toString("base64");exports.encodeBase64=encodeBase64;var decode=input=>new Uint8Array(node_buffer_1.Buffer.from(normalize(input),"base64url"));exports.decode=decode}});var require_errors=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/util/errors.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.JWSSignatureVerificationFailed=exports.JWKSTimeout=exports.JWKSMultipleMatchingKeys=exports.JWKSNoMatchingKey=exports.JWKSInvalid=exports.JWKInvalid=exports.JWTInvalid=exports.JWSInvalid=exports.JWEInvalid=exports.JWEDecryptionFailed=exports.JOSENotSupported=exports.JOSEAlgNotAllowed=exports.JWTExpired=exports.JWTClaimValidationFailed=exports.JOSEError=void 0;var JOSEError=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message,options){super(message,options),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}};exports.JOSEError=JOSEError;var JWTClaimValidationFailed=class extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}};exports.JWTClaimValidationFailed=JWTClaimValidationFailed;var JWTExpired=class extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message,payload,claim="unspecified",reason="unspecified"){super(message,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}};exports.JWTExpired=JWTExpired;var JOSEAlgNotAllowed=class extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"};exports.JOSEAlgNotAllowed=JOSEAlgNotAllowed;var JOSENotSupported=class extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"};exports.JOSENotSupported=JOSENotSupported;var JWEDecryptionFailed=class extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message="decryption operation failed",options){super(message,options)}};exports.JWEDecryptionFailed=JWEDecryptionFailed;var JWEInvalid=class extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"};exports.JWEInvalid=JWEInvalid;var JWSInvalid=class extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"};exports.JWSInvalid=JWSInvalid;var JWTInvalid=class extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"};exports.JWTInvalid=JWTInvalid;var JWKInvalid=class extends JOSEError{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"};exports.JWKInvalid=JWKInvalid;var JWKSInvalid=class extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"};exports.JWKSInvalid=JWKSInvalid;var JWKSNoMatchingKey=class extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message="no applicable key found in the JSON Web Key Set",options){super(message,options)}};exports.JWKSNoMatchingKey=JWKSNoMatchingKey;var JWKSMultipleMatchingKeys=class extends JOSEError{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message="multiple matching keys found in the JSON Web Key Set",options){super(message,options)}};exports.JWKSMultipleMatchingKeys=JWKSMultipleMatchingKeys;var JWKSTimeout=class extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message="request timed out",options){super(message,options)}};exports.JWKSTimeout=JWKSTimeout;var JWSSignatureVerificationFailed=class extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message="signature verification failed",options){super(message,options)}};exports.JWSSignatureVerificationFailed=JWSSignatureVerificationFailed}});var require_random=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/random.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=void 0;var node_crypto_1=__require("node:crypto");Object.defineProperty(exports,"default",{enumerable:!0,get:function(){return node_crypto_1.randomFillSync}})}});var require_iv=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/iv.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.bitLength=bitLength;var errors_js_1=require_errors(),random_js_1=require_random();function bitLength(alg){switch(alg){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`)}}exports.default=alg=>(0,random_js_1.default)(new Uint8Array(bitLength(alg)>>3))}});var require_check_iv_length=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/check_iv_length.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var errors_js_1=require_errors(),iv_js_1=require_iv(),checkIvLength=(enc,iv)=>{if(iv.length<<3!==(0,iv_js_1.bitLength)(enc))throw new errors_js_1.JWEInvalid("Invalid Initialization Vector length")};exports.default=checkIvLength}});var require_is_key_object=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/is_key_object.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var util=__require("node:util");exports.default=obj=>util.types.isKeyObject(obj)}});var require_check_cek_length=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/check_cek_length.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var errors_js_1=require_errors(),is_key_object_js_1=require_is_key_object(),checkCekLength=(enc,cek)=>{let expected;switch(enc){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":expected=parseInt(enc.slice(-3),10);break;case"A128GCM":case"A192GCM":case"A256GCM":expected=parseInt(enc.slice(1,4),10);break;default:throw new errors_js_1.JOSENotSupported(`Content Encryption Algorithm ${enc} is not supported either by JOSE or your javascript runtime`)}if(cek instanceof Uint8Array){let actual=cek.byteLength<<3;if(actual!==expected)throw new errors_js_1.JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);return}if((0,is_key_object_js_1.default)(cek)&&cek.type==="secret"){let actual=cek.symmetricKeySize<<3;if(actual!==expected)throw new errors_js_1.JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);return}throw new TypeError("Invalid Content Encryption Key type")};exports.default=checkCekLength}});var require_timing_safe_equal=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/timing_safe_equal.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),timingSafeEqual=node_crypto_1.timingSafeEqual;exports.default=timingSafeEqual}});var require_cbc_tag=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/cbc_tag.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=cbcTag;var node_crypto_1=__require("node:crypto"),buffer_utils_js_1=require_buffer_utils();function cbcTag(aad,iv,ciphertext,macSize,macKey,keySize){let macData=(0,buffer_utils_js_1.concat)(aad,iv,ciphertext,(0,buffer_utils_js_1.uint64be)(aad.length<<3)),hmac=(0,node_crypto_1.createHmac)(`sha${macSize}`,macKey);return hmac.update(macData),hmac.digest().slice(0,keySize>>3)}}});var require_webcrypto=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/webcrypto.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.isCryptoKey=void 0;var crypto=__require("node:crypto"),util=__require("node:util"),webcrypto=crypto.webcrypto;exports.default=webcrypto;var isCryptoKey=key=>util.types.isCryptoKey(key);exports.isCryptoKey=isCryptoKey}});var require_crypto_key=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/crypto_key.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.checkSigCryptoKey=checkSigCryptoKey;exports.checkEncCryptoKey=checkEncCryptoKey;function unusable(name,prop="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`)}function isAlgorithm(algorithm,name){return algorithm.name===name}function getHashLength(hash){return parseInt(hash.name.slice(4),10)}function getNamedCurve(alg){switch(alg){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function checkUsage(key,usages){if(usages.length&&!usages.some(expected=>key.usages.includes(expected))){let msg="CryptoKey does not support this operation, its usages must include ";if(usages.length>2){let last=usages.pop();msg+=`one of ${usages.join(", ")}, or ${last}.`}else usages.length===2?msg+=`one of ${usages[0]} or ${usages[1]}.`:msg+=`${usages[0]}.`;throw new TypeError(msg)}}function checkSigCryptoKey(key,alg,...usages){switch(alg){case"HS256":case"HS384":case"HS512":{if(!isAlgorithm(key.algorithm,"HMAC"))throw unusable("HMAC");let expected=parseInt(alg.slice(2),10);if(getHashLength(key.algorithm.hash)!==expected)throw unusable(`SHA-${expected}`,"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!isAlgorithm(key.algorithm,"RSASSA-PKCS1-v1_5"))throw unusable("RSASSA-PKCS1-v1_5");let expected=parseInt(alg.slice(2),10);if(getHashLength(key.algorithm.hash)!==expected)throw unusable(`SHA-${expected}`,"algorithm.hash");break}case"PS256":case"PS384":case"PS512":{if(!isAlgorithm(key.algorithm,"RSA-PSS"))throw unusable("RSA-PSS");let expected=parseInt(alg.slice(2),10);if(getHashLength(key.algorithm.hash)!==expected)throw unusable(`SHA-${expected}`,"algorithm.hash");break}case"EdDSA":{if(key.algorithm.name!=="Ed25519"&&key.algorithm.name!=="Ed448")throw unusable("Ed25519 or Ed448");break}case"ES256":case"ES384":case"ES512":{if(!isAlgorithm(key.algorithm,"ECDSA"))throw unusable("ECDSA");let expected=getNamedCurve(alg);if(key.algorithm.namedCurve!==expected)throw unusable(expected,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}checkUsage(key,usages)}function checkEncCryptoKey(key,alg,...usages){switch(alg){case"A128GCM":case"A192GCM":case"A256GCM":{if(!isAlgorithm(key.algorithm,"AES-GCM"))throw unusable("AES-GCM");let expected=parseInt(alg.slice(1,4),10);if(key.algorithm.length!==expected)throw unusable(expected,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!isAlgorithm(key.algorithm,"AES-KW"))throw unusable("AES-KW");let expected=parseInt(alg.slice(1,4),10);if(key.algorithm.length!==expected)throw unusable(expected,"algorithm.length");break}case"ECDH":{switch(key.algorithm.name){case"ECDH":case"X25519":case"X448":break;default:throw unusable("ECDH, X25519, or X448")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!isAlgorithm(key.algorithm,"PBKDF2"))throw unusable("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!isAlgorithm(key.algorithm,"RSA-OAEP"))throw unusable("RSA-OAEP");let expected=parseInt(alg.slice(9),10)||1;if(getHashLength(key.algorithm.hash)!==expected)throw unusable(`SHA-${expected}`,"algorithm.hash");break}default:throw new TypeError("CryptoKey does not support this operation")}checkUsage(key,usages)}}});var require_invalid_key_input=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/invalid_key_input.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.withAlg=withAlg;function message(msg,actual,...types){if(types=types.filter(Boolean),types.length>2){let last=types.pop();msg+=`one of type ${types.join(", ")}, or ${last}.`}else types.length===2?msg+=`one of type ${types[0]} or ${types[1]}.`:msg+=`of type ${types[0]}.`;return actual==null?msg+=` Received ${actual}`:typeof actual=="function"&&actual.name?msg+=` Received function ${actual.name}`:typeof actual=="object"&&actual!=null&&actual.constructor?.name&&(msg+=` Received an instance of ${actual.constructor.name}`),msg}exports.default=(actual,...types)=>message("Key must be ",actual,...types);function withAlg(alg,actual,...types){return message(`Key for the ${alg} algorithm must be `,actual,...types)}}});var require_ciphers=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/ciphers.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),ciphers;exports.default=algorithm=>(ciphers||=new Set((0,node_crypto_1.getCiphers)()),ciphers.has(algorithm))}});var require_is_key_like=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/is_key_like.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.types=void 0;var webcrypto_js_1=require_webcrypto(),is_key_object_js_1=require_is_key_object();exports.default=key=>(0,is_key_object_js_1.default)(key)||(0,webcrypto_js_1.isCryptoKey)(key);var types=["KeyObject"];exports.types=types;(globalThis.CryptoKey||webcrypto_js_1.default?.CryptoKey)&&types.push("CryptoKey")}});var require_decrypt=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/decrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),check_iv_length_js_1=require_check_iv_length(),check_cek_length_js_1=require_check_cek_length(),buffer_utils_js_1=require_buffer_utils(),errors_js_1=require_errors(),timing_safe_equal_js_1=require_timing_safe_equal(),cbc_tag_js_1=require_cbc_tag(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),ciphers_js_1=require_ciphers(),is_key_like_js_1=require_is_key_like();function cbcDecrypt(enc,cek,ciphertext,iv,tag,aad){let keySize=parseInt(enc.slice(1,4),10);(0,is_key_object_js_1.default)(cek)&&(cek=cek.export());let encKey=cek.subarray(keySize>>3),macKey=cek.subarray(0,keySize>>3),macSize=parseInt(enc.slice(-3),10),algorithm=`aes-${keySize}-cbc`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);let expectedTag=(0,cbc_tag_js_1.default)(aad,iv,ciphertext,macSize,macKey,keySize),macCheckPassed;try{macCheckPassed=(0,timing_safe_equal_js_1.default)(tag,expectedTag)}catch{}if(!macCheckPassed)throw new errors_js_1.JWEDecryptionFailed;let plaintext;try{let decipher=(0,node_crypto_1.createDecipheriv)(algorithm,encKey,iv);plaintext=(0,buffer_utils_js_1.concat)(decipher.update(ciphertext),decipher.final())}catch{}if(!plaintext)throw new errors_js_1.JWEDecryptionFailed;return plaintext}function gcmDecrypt(enc,cek,ciphertext,iv,tag,aad){let algorithm=`aes-${parseInt(enc.slice(1,4),10)}-gcm`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);try{let decipher=(0,node_crypto_1.createDecipheriv)(algorithm,cek,iv,{authTagLength:16});decipher.setAuthTag(tag),aad.byteLength&&decipher.setAAD(aad,{plaintextLength:ciphertext.length});let plaintext=decipher.update(ciphertext);return decipher.final(),plaintext}catch{throw new errors_js_1.JWEDecryptionFailed}}var decrypt=(enc,cek,ciphertext,iv,tag,aad)=>{let key;if((0,webcrypto_js_1.isCryptoKey)(cek))(0,crypto_key_js_1.checkEncCryptoKey)(cek,enc,"decrypt"),key=node_crypto_1.KeyObject.from(cek);else if(cek instanceof Uint8Array||(0,is_key_object_js_1.default)(cek))key=cek;else throw new TypeError((0,invalid_key_input_js_1.default)(cek,...is_key_like_js_1.types,"Uint8Array"));if(!iv)throw new errors_js_1.JWEInvalid("JWE Initialization Vector missing");if(!tag)throw new errors_js_1.JWEInvalid("JWE Authentication Tag missing");switch((0,check_cek_length_js_1.default)(enc,key),(0,check_iv_length_js_1.default)(enc,iv),enc){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return cbcDecrypt(enc,key,ciphertext,iv,tag,aad);case"A128GCM":case"A192GCM":case"A256GCM":return gcmDecrypt(enc,key,ciphertext,iv,tag,aad);default:throw new errors_js_1.JOSENotSupported("Unsupported JWE Content Encryption Algorithm")}};exports.default=decrypt}});var require_is_disjoint=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/is_disjoint.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var isDisjoint=(...headers)=>{let sources=headers.filter(Boolean);if(sources.length===0||sources.length===1)return!0;let acc;for(let header of sources){let parameters=Object.keys(header);if(!acc||acc.size===0){acc=new Set(parameters);continue}for(let parameter of parameters){if(acc.has(parameter))return!1;acc.add(parameter)}}return!0};exports.default=isDisjoint}});var require_is_object=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/is_object.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=isObject;function isObjectLike(value){return typeof value=="object"&&value!==null}function isObject(input){if(!isObjectLike(input)||Object.prototype.toString.call(input)!=="[object Object]")return!1;if(Object.getPrototypeOf(input)===null)return!0;let proto=input;for(;Object.getPrototypeOf(proto)!==null;)proto=Object.getPrototypeOf(proto);return Object.getPrototypeOf(input)===proto}}});var require_aeskw=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/aeskw.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.unwrap=exports.wrap=void 0;var node_buffer_1=__require("node:buffer"),node_crypto_1=__require("node:crypto"),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),ciphers_js_1=require_ciphers(),is_key_like_js_1=require_is_key_like();function checkKeySize(key,alg){if(key.symmetricKeySize<<3!==parseInt(alg.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${alg}`)}function ensureKeyObject(key,alg,usage){if((0,is_key_object_js_1.default)(key))return key;if(key instanceof Uint8Array)return(0,node_crypto_1.createSecretKey)(key);if((0,webcrypto_js_1.isCryptoKey)(key))return(0,crypto_key_js_1.checkEncCryptoKey)(key,alg,usage),node_crypto_1.KeyObject.from(key);throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types,"Uint8Array"))}var wrap=(alg,key,cek)=>{let algorithm=`aes${parseInt(alg.slice(1,4),10)}-wrap`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);let keyObject=ensureKeyObject(key,alg,"wrapKey");checkKeySize(keyObject,alg);let cipher=(0,node_crypto_1.createCipheriv)(algorithm,keyObject,node_buffer_1.Buffer.alloc(8,166));return(0,buffer_utils_js_1.concat)(cipher.update(cek),cipher.final())};exports.wrap=wrap;var unwrap=(alg,key,encryptedKey)=>{let algorithm=`aes${parseInt(alg.slice(1,4),10)}-wrap`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);let keyObject=ensureKeyObject(key,alg,"unwrapKey");checkKeySize(keyObject,alg);let cipher=(0,node_crypto_1.createDecipheriv)(algorithm,keyObject,node_buffer_1.Buffer.alloc(8,166));return(0,buffer_utils_js_1.concat)(cipher.update(encryptedKey),cipher.final())};exports.unwrap=unwrap}});var require_is_jwk=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/is_jwk.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.isJWK=isJWK;exports.isPrivateJWK=isPrivateJWK;exports.isPublicJWK=isPublicJWK;exports.isSecretJWK=isSecretJWK;var is_object_js_1=require_is_object();function isJWK(key){return(0,is_object_js_1.default)(key)&&typeof key.kty=="string"}function isPrivateJWK(key){return key.kty!=="oct"&&typeof key.d=="string"}function isPublicJWK(key){return key.kty!=="oct"&&typeof key.d>"u"}function isSecretJWK(key){return isJWK(key)&&key.kty==="oct"&&typeof key.k=="string"}}});var require_get_named_curve=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/get_named_curve.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.weakMap=void 0;var node_crypto_1=__require("node:crypto"),errors_js_1=require_errors(),webcrypto_js_1=require_webcrypto(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),is_jwk_js_1=require_is_jwk();exports.weakMap=new WeakMap;var namedCurveToJOSE=namedCurve=>{switch(namedCurve){case"prime256v1":return"P-256";case"secp384r1":return"P-384";case"secp521r1":return"P-521";case"secp256k1":return"secp256k1";default:throw new errors_js_1.JOSENotSupported("Unsupported key curve for this operation")}},getNamedCurve=(kee,raw)=>{let key;if((0,webcrypto_js_1.isCryptoKey)(kee))key=node_crypto_1.KeyObject.from(kee);else if((0,is_key_object_js_1.default)(kee))key=kee;else{if((0,is_jwk_js_1.isJWK)(kee))return kee.crv;throw new TypeError((0,invalid_key_input_js_1.default)(kee,...is_key_like_js_1.types))}if(key.type==="secret")throw new TypeError('only "private" or "public" type keys can be used for this operation');switch(key.asymmetricKeyType){case"ed25519":case"ed448":return`Ed${key.asymmetricKeyType.slice(2)}`;case"x25519":case"x448":return`X${key.asymmetricKeyType.slice(1)}`;case"ec":{let namedCurve=key.asymmetricKeyDetails.namedCurve;return raw?namedCurve:namedCurveToJOSE(namedCurve)}default:throw new TypeError("Invalid asymmetric key type for this operation")}};exports.default=getNamedCurve}});var require_ecdhes=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/ecdhes.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.ecdhAllowed=void 0;exports.deriveKey=deriveKey;exports.generateEpk=generateEpk;var node_crypto_1=__require("node:crypto"),node_util_1=__require("node:util"),get_named_curve_js_1=require_get_named_curve(),buffer_utils_js_1=require_buffer_utils(),errors_js_1=require_errors(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),generateKeyPair=(0,node_util_1.promisify)(node_crypto_1.generateKeyPair);async function deriveKey(publicKee,privateKee,algorithm,keyLength,apu=new Uint8Array(0),apv=new Uint8Array(0)){let publicKey;if((0,webcrypto_js_1.isCryptoKey)(publicKee))(0,crypto_key_js_1.checkEncCryptoKey)(publicKee,"ECDH"),publicKey=node_crypto_1.KeyObject.from(publicKee);else if((0,is_key_object_js_1.default)(publicKee))publicKey=publicKee;else throw new TypeError((0,invalid_key_input_js_1.default)(publicKee,...is_key_like_js_1.types));let privateKey;if((0,webcrypto_js_1.isCryptoKey)(privateKee))(0,crypto_key_js_1.checkEncCryptoKey)(privateKee,"ECDH","deriveBits"),privateKey=node_crypto_1.KeyObject.from(privateKee);else if((0,is_key_object_js_1.default)(privateKee))privateKey=privateKee;else throw new TypeError((0,invalid_key_input_js_1.default)(privateKee,...is_key_like_js_1.types));let value=(0,buffer_utils_js_1.concat)((0,buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)),(0,buffer_utils_js_1.lengthAndInput)(apu),(0,buffer_utils_js_1.lengthAndInput)(apv),(0,buffer_utils_js_1.uint32be)(keyLength)),sharedSecret=(0,node_crypto_1.diffieHellman)({privateKey,publicKey});return(0,buffer_utils_js_1.concatKdf)(sharedSecret,keyLength,value)}async function generateEpk(kee){let key;if((0,webcrypto_js_1.isCryptoKey)(kee))key=node_crypto_1.KeyObject.from(kee);else if((0,is_key_object_js_1.default)(kee))key=kee;else throw new TypeError((0,invalid_key_input_js_1.default)(kee,...is_key_like_js_1.types));switch(key.asymmetricKeyType){case"x25519":return generateKeyPair("x25519");case"x448":return generateKeyPair("x448");case"ec":{let namedCurve=(0,get_named_curve_js_1.default)(key);return generateKeyPair("ec",{namedCurve})}default:throw new errors_js_1.JOSENotSupported("Invalid or unsupported EPK")}}var ecdhAllowed=key=>["P-256","P-384","P-521","X25519","X448"].includes((0,get_named_curve_js_1.default)(key));exports.ecdhAllowed=ecdhAllowed}});var require_check_p2s=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/check_p2s.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=checkP2s;var errors_js_1=require_errors();function checkP2s(p2s){if(!(p2s instanceof Uint8Array)||p2s.length<8)throw new errors_js_1.JWEInvalid("PBES2 Salt Input must be 8 or more octets")}}});var require_pbes2kw=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/pbes2kw.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decrypt=exports.encrypt=void 0;var node_util_1=__require("node:util"),node_crypto_1=__require("node:crypto"),random_js_1=require_random(),buffer_utils_js_1=require_buffer_utils(),base64url_js_1=require_base64url(),aeskw_js_1=require_aeskw(),check_p2s_js_1=require_check_p2s(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),pbkdf2=(0,node_util_1.promisify)(node_crypto_1.pbkdf2);function getPassword(key,alg){if((0,is_key_object_js_1.default)(key))return key.export();if(key instanceof Uint8Array)return key;if((0,webcrypto_js_1.isCryptoKey)(key))return(0,crypto_key_js_1.checkEncCryptoKey)(key,alg,"deriveBits","deriveKey"),node_crypto_1.KeyObject.from(key).export();throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types,"Uint8Array"))}var encrypt=async(alg,key,cek,p2c=2048,p2s=(0,random_js_1.default)(new Uint8Array(16)))=>{(0,check_p2s_js_1.default)(p2s);let salt=(0,buffer_utils_js_1.p2s)(alg,p2s),keylen=parseInt(alg.slice(13,16),10)>>3,password=getPassword(key,alg),derivedKey=await pbkdf2(password,salt,p2c,keylen,`sha${alg.slice(8,11)}`);return{encryptedKey:await(0,aeskw_js_1.wrap)(alg.slice(-6),derivedKey,cek),p2c,p2s:(0,base64url_js_1.encode)(p2s)}};exports.encrypt=encrypt;var decrypt=async(alg,key,encryptedKey,p2c,p2s)=>{(0,check_p2s_js_1.default)(p2s);let salt=(0,buffer_utils_js_1.p2s)(alg,p2s),keylen=parseInt(alg.slice(13,16),10)>>3,password=getPassword(key,alg),derivedKey=await pbkdf2(password,salt,p2c,keylen,`sha${alg.slice(8,11)}`);return(0,aeskw_js_1.unwrap)(alg.slice(-6),derivedKey,encryptedKey)};exports.decrypt=decrypt}});var require_check_key_length=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/check_key_length.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto");exports.default=(key,alg)=>{let modulusLength;try{key instanceof node_crypto_1.KeyObject?modulusLength=key.asymmetricKeyDetails?.modulusLength:modulusLength=Buffer.from(key.n,"base64url").byteLength<<3}catch{}if(typeof modulusLength!="number"||modulusLength<2048)throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}}});var require_rsaes=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/rsaes.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decrypt=exports.encrypt=void 0;var node_crypto_1=__require("node:crypto"),node_util_1=__require("node:util"),check_key_length_js_1=require_check_key_length(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),checkKey=(key,alg)=>{if(key.asymmetricKeyType!=="rsa")throw new TypeError("Invalid key for this operation, its asymmetricKeyType must be rsa");(0,check_key_length_js_1.default)(key,alg)},RSA1_5=(0,node_util_1.deprecate)(()=>node_crypto_1.constants.RSA_PKCS1_PADDING,'The RSA1_5 "alg" (JWE Algorithm) is deprecated and will be removed in the next major revision.'),resolvePadding=alg=>{switch(alg){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return node_crypto_1.constants.RSA_PKCS1_OAEP_PADDING;case"RSA1_5":return RSA1_5();default:return}},resolveOaepHash=alg=>{switch(alg){case"RSA-OAEP":return"sha1";case"RSA-OAEP-256":return"sha256";case"RSA-OAEP-384":return"sha384";case"RSA-OAEP-512":return"sha512";default:return}};function ensureKeyObject(key,alg,...usages){if((0,is_key_object_js_1.default)(key))return key;if((0,webcrypto_js_1.isCryptoKey)(key))return(0,crypto_key_js_1.checkEncCryptoKey)(key,alg,...usages),node_crypto_1.KeyObject.from(key);throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types))}var encrypt=(alg,key,cek)=>{let padding=resolvePadding(alg),oaepHash=resolveOaepHash(alg),keyObject=ensureKeyObject(key,alg,"wrapKey","encrypt");return checkKey(keyObject,alg),(0,node_crypto_1.publicEncrypt)({key:keyObject,oaepHash,padding},cek)};exports.encrypt=encrypt;var decrypt=(alg,key,encryptedKey)=>{let padding=resolvePadding(alg),oaepHash=resolveOaepHash(alg),keyObject=ensureKeyObject(key,alg,"unwrapKey","decrypt");return checkKey(keyObject,alg),(0,node_crypto_1.privateDecrypt)({key:keyObject,oaepHash,padding},encryptedKey)};exports.decrypt=decrypt}});var require_normalize_key=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/normalize_key.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default={}}});var require_cek=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/cek.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.bitLength=bitLength;var errors_js_1=require_errors(),random_js_1=require_random();function bitLength(alg){switch(alg){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`)}}exports.default=alg=>(0,random_js_1.default)(new Uint8Array(bitLength(alg)>>3))}});var require_asn1=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/asn1.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.fromX509=exports.fromSPKI=exports.fromPKCS8=exports.toPKCS8=exports.toSPKI=void 0;var node_crypto_1=__require("node:crypto"),node_buffer_1=__require("node:buffer"),webcrypto_js_1=require_webcrypto(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),genericExport=(keyType,keyFormat,key)=>{let keyObject;if((0,webcrypto_js_1.isCryptoKey)(key)){if(!key.extractable)throw new TypeError("CryptoKey is not extractable");keyObject=node_crypto_1.KeyObject.from(key)}else if((0,is_key_object_js_1.default)(key))keyObject=key;else throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types));if(keyObject.type!==keyType)throw new TypeError(`key is not a ${keyType} key`);return keyObject.export({format:"pem",type:keyFormat})},toSPKI=key=>genericExport("public","spki",key);exports.toSPKI=toSPKI;var toPKCS8=key=>genericExport("private","pkcs8",key);exports.toPKCS8=toPKCS8;var fromPKCS8=pem=>(0,node_crypto_1.createPrivateKey)({key:node_buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,""),"base64"),type:"pkcs8",format:"der"});exports.fromPKCS8=fromPKCS8;var fromSPKI=pem=>(0,node_crypto_1.createPublicKey)({key:node_buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,""),"base64"),type:"spki",format:"der"});exports.fromSPKI=fromSPKI;var fromX509=pem=>(0,node_crypto_1.createPublicKey)({key:pem,type:"spki",format:"pem"});exports.fromX509=fromX509}});var require_jwk_to_key=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/jwk_to_key.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),parse=key=>key.d?(0,node_crypto_1.createPrivateKey)({format:"jwk",key}):(0,node_crypto_1.createPublicKey)({format:"jwk",key});exports.default=parse}});var require_import=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/key/import.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.importSPKI=importSPKI;exports.importX509=importX509;exports.importPKCS8=importPKCS8;exports.importJWK=importJWK;var base64url_js_1=require_base64url(),asn1_js_1=require_asn1(),jwk_to_key_js_1=require_jwk_to_key(),errors_js_1=require_errors(),is_object_js_1=require_is_object();async function importSPKI(spki,alg,options){if(typeof spki!="string"||spki.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return(0,asn1_js_1.fromSPKI)(spki,alg,options)}async function importX509(x509,alg,options){if(typeof x509!="string"||x509.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return(0,asn1_js_1.fromX509)(x509,alg,options)}async function importPKCS8(pkcs8,alg,options){if(typeof pkcs8!="string"||pkcs8.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return(0,asn1_js_1.fromPKCS8)(pkcs8,alg,options)}async function importJWK(jwk,alg){if(!(0,is_object_js_1.default)(jwk))throw new TypeError("JWK must be an object");switch(alg||=jwk.alg,jwk.kty){case"oct":if(typeof jwk.k!="string"||!jwk.k)throw new TypeError('missing "k" (Key Value) Parameter value');return(0,base64url_js_1.decode)(jwk.k);case"RSA":if(jwk.oth!==void 0)throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return(0,jwk_to_key_js_1.default)({...jwk,alg});default:throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value')}}}});var require_check_key_type=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/check_key_type.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.checkKeyTypeWithJwk=void 0;var invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),jwk=require_is_jwk(),tag=key=>key?.[Symbol.toStringTag],jwkMatchesOp=(alg,key,usage)=>{if(key.use!==void 0&&key.use!=="sig")throw new TypeError("Invalid key for this operation, when present its use must be sig");if(key.key_ops!==void 0&&key.key_ops.includes?.(usage)!==!0)throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);if(key.alg!==void 0&&key.alg!==alg)throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);return!0},symmetricTypeCheck=(alg,key,usage,allowJwk)=>{if(!(key instanceof Uint8Array)){if(allowJwk&&jwk.isJWK(key)){if(jwk.isSecretJWK(key)&&jwkMatchesOp(alg,key,usage))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!(0,is_key_like_js_1.default)(key))throw new TypeError((0,invalid_key_input_js_1.withAlg)(alg,key,...is_key_like_js_1.types,"Uint8Array",allowJwk?"JSON Web Key":null));if(key.type!=="secret")throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}},asymmetricTypeCheck=(alg,key,usage,allowJwk)=>{if(allowJwk&&jwk.isJWK(key))switch(usage){case"sign":if(jwk.isPrivateJWK(key)&&jwkMatchesOp(alg,key,usage))return;throw new TypeError("JSON Web Key for this operation be a private JWK");case"verify":if(jwk.isPublicJWK(key)&&jwkMatchesOp(alg,key,usage))return;throw new TypeError("JSON Web Key for this operation be a public JWK")}if(!(0,is_key_like_js_1.default)(key))throw new TypeError((0,invalid_key_input_js_1.withAlg)(alg,key,...is_key_like_js_1.types,allowJwk?"JSON Web Key":null));if(key.type==="secret")throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);if(usage==="sign"&&key.type==="public")throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);if(usage==="decrypt"&&key.type==="public")throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);if(key.algorithm&&usage==="verify"&&key.type==="private")throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);if(key.algorithm&&usage==="encrypt"&&key.type==="private")throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`)};function checkKeyType(allowJwk,alg,key,usage){alg.startsWith("HS")||alg==="dir"||alg.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(alg)?symmetricTypeCheck(alg,key,usage,allowJwk):asymmetricTypeCheck(alg,key,usage,allowJwk)}exports.default=checkKeyType.bind(void 0,!1);exports.checkKeyTypeWithJwk=checkKeyType.bind(void 0,!0)}});var require_encrypt=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/encrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),check_iv_length_js_1=require_check_iv_length(),check_cek_length_js_1=require_check_cek_length(),buffer_utils_js_1=require_buffer_utils(),cbc_tag_js_1=require_cbc_tag(),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),iv_js_1=require_iv(),errors_js_1=require_errors(),ciphers_js_1=require_ciphers(),is_key_like_js_1=require_is_key_like();function cbcEncrypt(enc,plaintext,cek,iv,aad){let keySize=parseInt(enc.slice(1,4),10);(0,is_key_object_js_1.default)(cek)&&(cek=cek.export());let encKey=cek.subarray(keySize>>3),macKey=cek.subarray(0,keySize>>3),algorithm=`aes-${keySize}-cbc`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);let cipher=(0,node_crypto_1.createCipheriv)(algorithm,encKey,iv),ciphertext=(0,buffer_utils_js_1.concat)(cipher.update(plaintext),cipher.final()),macSize=parseInt(enc.slice(-3),10),tag=(0,cbc_tag_js_1.default)(aad,iv,ciphertext,macSize,macKey,keySize);return{ciphertext,tag,iv}}function gcmEncrypt(enc,plaintext,cek,iv,aad){let algorithm=`aes-${parseInt(enc.slice(1,4),10)}-gcm`;if(!(0,ciphers_js_1.default)(algorithm))throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);let cipher=(0,node_crypto_1.createCipheriv)(algorithm,cek,iv,{authTagLength:16});aad.byteLength&&cipher.setAAD(aad,{plaintextLength:plaintext.length});let ciphertext=cipher.update(plaintext);cipher.final();let tag=cipher.getAuthTag();return{ciphertext,tag,iv}}var encrypt=(enc,plaintext,cek,iv,aad)=>{let key;if((0,webcrypto_js_1.isCryptoKey)(cek))(0,crypto_key_js_1.checkEncCryptoKey)(cek,enc,"encrypt"),key=node_crypto_1.KeyObject.from(cek);else if(cek instanceof Uint8Array||(0,is_key_object_js_1.default)(cek))key=cek;else throw new TypeError((0,invalid_key_input_js_1.default)(cek,...is_key_like_js_1.types,"Uint8Array"));switch((0,check_cek_length_js_1.default)(enc,key),iv?(0,check_iv_length_js_1.default)(enc,iv):iv=(0,iv_js_1.default)(enc),enc){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return cbcEncrypt(enc,plaintext,key,iv,aad);case"A128GCM":case"A192GCM":case"A256GCM":return gcmEncrypt(enc,plaintext,key,iv,aad);default:throw new errors_js_1.JOSENotSupported("Unsupported JWE Content Encryption Algorithm")}};exports.default=encrypt}});var require_aesgcmkw=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/aesgcmkw.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.wrap=wrap;exports.unwrap=unwrap;var encrypt_js_1=require_encrypt(),decrypt_js_1=require_decrypt(),base64url_js_1=require_base64url();async function wrap(alg,key,cek,iv){let jweAlgorithm=alg.slice(0,7),wrapped=await(0,encrypt_js_1.default)(jweAlgorithm,cek,key,iv,new Uint8Array(0));return{encryptedKey:wrapped.ciphertext,iv:(0,base64url_js_1.encode)(wrapped.iv),tag:(0,base64url_js_1.encode)(wrapped.tag)}}async function unwrap(alg,key,encryptedKey,iv,tag){let jweAlgorithm=alg.slice(0,7);return(0,decrypt_js_1.default)(jweAlgorithm,key,encryptedKey,iv,tag,new Uint8Array(0))}}});var require_decrypt_key_management=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/decrypt_key_management.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var aeskw_js_1=require_aeskw(),ECDH=require_ecdhes(),pbes2kw_js_1=require_pbes2kw(),rsaes_js_1=require_rsaes(),base64url_js_1=require_base64url(),normalize_key_js_1=require_normalize_key(),errors_js_1=require_errors(),cek_js_1=require_cek(),import_js_1=require_import(),check_key_type_js_1=require_check_key_type(),is_object_js_1=require_is_object(),aesgcmkw_js_1=require_aesgcmkw();async function decryptKeyManagement(alg,key,encryptedKey,joseHeader,options){switch((0,check_key_type_js_1.default)(alg,key,"decrypt"),key=await normalize_key_js_1.default.normalizePrivateKey?.(key,alg)||key,alg){case"dir":{if(encryptedKey!==void 0)throw new errors_js_1.JWEInvalid("Encountered unexpected JWE Encrypted Key");return key}case"ECDH-ES":if(encryptedKey!==void 0)throw new errors_js_1.JWEInvalid("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!(0,is_object_js_1.default)(joseHeader.epk))throw new errors_js_1.JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(!ECDH.ecdhAllowed(key))throw new errors_js_1.JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");let epk=await(0,import_js_1.importJWK)(joseHeader.epk,alg),partyUInfo,partyVInfo;if(joseHeader.apu!==void 0){if(typeof joseHeader.apu!="string")throw new errors_js_1.JWEInvalid('JOSE Header "apu" (Agreement PartyUInfo) invalid');try{partyUInfo=(0,base64url_js_1.decode)(joseHeader.apu)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the apu")}}if(joseHeader.apv!==void 0){if(typeof joseHeader.apv!="string")throw new errors_js_1.JWEInvalid('JOSE Header "apv" (Agreement PartyVInfo) invalid');try{partyVInfo=(0,base64url_js_1.decode)(joseHeader.apv)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the apv")}}let sharedSecret=await ECDH.deriveKey(epk,key,alg==="ECDH-ES"?joseHeader.enc:alg,alg==="ECDH-ES"?(0,cek_js_1.bitLength)(joseHeader.enc):parseInt(alg.slice(-5,-2),10),partyUInfo,partyVInfo);if(alg==="ECDH-ES")return sharedSecret;if(encryptedKey===void 0)throw new errors_js_1.JWEInvalid("JWE Encrypted Key missing");return(0,aeskw_js_1.unwrap)(alg.slice(-6),sharedSecret,encryptedKey)}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(encryptedKey===void 0)throw new errors_js_1.JWEInvalid("JWE Encrypted Key missing");return(0,rsaes_js_1.decrypt)(alg,key,encryptedKey)}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(encryptedKey===void 0)throw new errors_js_1.JWEInvalid("JWE Encrypted Key missing");if(typeof joseHeader.p2c!="number")throw new errors_js_1.JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');let p2cLimit=options?.maxPBES2Count||1e4;if(joseHeader.p2c>p2cLimit)throw new errors_js_1.JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof joseHeader.p2s!="string")throw new errors_js_1.JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let p2s;try{p2s=(0,base64url_js_1.decode)(joseHeader.p2s)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the p2s")}return(0,pbes2kw_js_1.decrypt)(alg,key,encryptedKey,joseHeader.p2c,p2s)}case"A128KW":case"A192KW":case"A256KW":{if(encryptedKey===void 0)throw new errors_js_1.JWEInvalid("JWE Encrypted Key missing");return(0,aeskw_js_1.unwrap)(alg,key,encryptedKey)}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(encryptedKey===void 0)throw new errors_js_1.JWEInvalid("JWE Encrypted Key missing");if(typeof joseHeader.iv!="string")throw new errors_js_1.JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof joseHeader.tag!="string")throw new errors_js_1.JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');let iv;try{iv=(0,base64url_js_1.decode)(joseHeader.iv)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the iv")}let tag;try{tag=(0,base64url_js_1.decode)(joseHeader.tag)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the tag")}return(0,aesgcmkw_js_1.unwrap)(alg,key,encryptedKey,iv,tag)}default:throw new errors_js_1.JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value')}}exports.default=decryptKeyManagement}});var require_validate_crit=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/validate_crit.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var errors_js_1=require_errors();function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==void 0&&protectedHeader?.crit===void 0)throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');if(!protectedHeader||protectedHeader.crit===void 0)return new Set;if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some(input=>typeof input!="string"||input.length===0))throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let recognized;recognizedOption!==void 0?recognized=new Map([...Object.entries(recognizedOption),...recognizedDefault.entries()]):recognized=recognizedDefault;for(let parameter of protectedHeader.crit){if(!recognized.has(parameter))throw new errors_js_1.JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);if(joseHeader[parameter]===void 0)throw new Err(`Extension Header Parameter "${parameter}" is missing`);if(recognized.get(parameter)&&protectedHeader[parameter]===void 0)throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}return new Set(protectedHeader.crit)}exports.default=validateCrit}});var require_validate_algorithms=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/validate_algorithms.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var validateAlgorithms=(option,algorithms)=>{if(algorithms!==void 0&&(!Array.isArray(algorithms)||algorithms.some(s=>typeof s!="string")))throw new TypeError(`"${option}" option must be an array of strings`);if(algorithms)return new Set(algorithms)};exports.default=validateAlgorithms}});var require_decrypt2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/flattened/decrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.flattenedDecrypt=flattenedDecrypt;var base64url_js_1=require_base64url(),decrypt_js_1=require_decrypt(),errors_js_1=require_errors(),is_disjoint_js_1=require_is_disjoint(),is_object_js_1=require_is_object(),decrypt_key_management_js_1=require_decrypt_key_management(),buffer_utils_js_1=require_buffer_utils(),cek_js_1=require_cek(),validate_crit_js_1=require_validate_crit(),validate_algorithms_js_1=require_validate_algorithms();async function flattenedDecrypt(jwe,key,options){if(!(0,is_object_js_1.default)(jwe))throw new errors_js_1.JWEInvalid("Flattened JWE must be an object");if(jwe.protected===void 0&&jwe.header===void 0&&jwe.unprotected===void 0)throw new errors_js_1.JWEInvalid("JOSE Header missing");if(jwe.iv!==void 0&&typeof jwe.iv!="string")throw new errors_js_1.JWEInvalid("JWE Initialization Vector incorrect type");if(typeof jwe.ciphertext!="string")throw new errors_js_1.JWEInvalid("JWE Ciphertext missing or incorrect type");if(jwe.tag!==void 0&&typeof jwe.tag!="string")throw new errors_js_1.JWEInvalid("JWE Authentication Tag incorrect type");if(jwe.protected!==void 0&&typeof jwe.protected!="string")throw new errors_js_1.JWEInvalid("JWE Protected Header incorrect type");if(jwe.encrypted_key!==void 0&&typeof jwe.encrypted_key!="string")throw new errors_js_1.JWEInvalid("JWE Encrypted Key incorrect type");if(jwe.aad!==void 0&&typeof jwe.aad!="string")throw new errors_js_1.JWEInvalid("JWE AAD incorrect type");if(jwe.header!==void 0&&!(0,is_object_js_1.default)(jwe.header))throw new errors_js_1.JWEInvalid("JWE Shared Unprotected Header incorrect type");if(jwe.unprotected!==void 0&&!(0,is_object_js_1.default)(jwe.unprotected))throw new errors_js_1.JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");let parsedProt;if(jwe.protected)try{let protectedHeader2=(0,base64url_js_1.decode)(jwe.protected);parsedProt=JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader2))}catch{throw new errors_js_1.JWEInvalid("JWE Protected Header is invalid")}if(!(0,is_disjoint_js_1.default)(parsedProt,jwe.header,jwe.unprotected))throw new errors_js_1.JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let joseHeader={...parsedProt,...jwe.header,...jwe.unprotected};if((0,validate_crit_js_1.default)(errors_js_1.JWEInvalid,new Map,options?.crit,parsedProt,joseHeader),joseHeader.zip!==void 0)throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');let{alg,enc}=joseHeader;if(typeof alg!="string"||!alg)throw new errors_js_1.JWEInvalid("missing JWE Algorithm (alg) in JWE Header");if(typeof enc!="string"||!enc)throw new errors_js_1.JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header");let keyManagementAlgorithms=options&&(0,validate_algorithms_js_1.default)("keyManagementAlgorithms",options.keyManagementAlgorithms),contentEncryptionAlgorithms=options&&(0,validate_algorithms_js_1.default)("contentEncryptionAlgorithms",options.contentEncryptionAlgorithms);if(keyManagementAlgorithms&&!keyManagementAlgorithms.has(alg)||!keyManagementAlgorithms&&alg.startsWith("PBES2"))throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(contentEncryptionAlgorithms&&!contentEncryptionAlgorithms.has(enc))throw new errors_js_1.JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');let encryptedKey;if(jwe.encrypted_key!==void 0)try{encryptedKey=(0,base64url_js_1.decode)(jwe.encrypted_key)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the encrypted_key")}let resolvedKey=!1;typeof key=="function"&&(key=await key(parsedProt,jwe),resolvedKey=!0);let cek;try{cek=await(0,decrypt_key_management_js_1.default)(alg,key,encryptedKey,joseHeader,options)}catch(err){if(err instanceof TypeError||err instanceof errors_js_1.JWEInvalid||err instanceof errors_js_1.JOSENotSupported)throw err;cek=(0,cek_js_1.default)(enc)}let iv,tag;if(jwe.iv!==void 0)try{iv=(0,base64url_js_1.decode)(jwe.iv)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the iv")}if(jwe.tag!==void 0)try{tag=(0,base64url_js_1.decode)(jwe.tag)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the tag")}let protectedHeader=buffer_utils_js_1.encoder.encode(jwe.protected??""),additionalData;jwe.aad!==void 0?additionalData=(0,buffer_utils_js_1.concat)(protectedHeader,buffer_utils_js_1.encoder.encode("."),buffer_utils_js_1.encoder.encode(jwe.aad)):additionalData=protectedHeader;let ciphertext;try{ciphertext=(0,base64url_js_1.decode)(jwe.ciphertext)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the ciphertext")}let result={plaintext:await(0,decrypt_js_1.default)(enc,cek,ciphertext,iv,tag,additionalData)};if(jwe.protected!==void 0&&(result.protectedHeader=parsedProt),jwe.aad!==void 0)try{result.additionalAuthenticatedData=(0,base64url_js_1.decode)(jwe.aad)}catch{throw new errors_js_1.JWEInvalid("Failed to base64url decode the aad")}return jwe.unprotected!==void 0&&(result.sharedUnprotectedHeader=jwe.unprotected),jwe.header!==void 0&&(result.unprotectedHeader=jwe.header),resolvedKey?{...result,key}:result}}});var require_decrypt3=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/compact/decrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.compactDecrypt=compactDecrypt;var decrypt_js_1=require_decrypt2(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils();async function compactDecrypt(jwe,key,options){if(jwe instanceof Uint8Array&&(jwe=buffer_utils_js_1.decoder.decode(jwe)),typeof jwe!="string")throw new errors_js_1.JWEInvalid("Compact JWE must be a string or Uint8Array");let{0:protectedHeader,1:encryptedKey,2:iv,3:ciphertext,4:tag,length}=jwe.split(".");if(length!==5)throw new errors_js_1.JWEInvalid("Invalid Compact JWE");let decrypted=await(0,decrypt_js_1.flattenedDecrypt)({ciphertext,iv:iv||void 0,protected:protectedHeader,tag:tag||void 0,encrypted_key:encryptedKey||void 0},key,options),result={plaintext:decrypted.plaintext,protectedHeader:decrypted.protectedHeader};return typeof key=="function"?{...result,key:decrypted.key}:result}}});var require_decrypt4=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/general/decrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.generalDecrypt=generalDecrypt;var decrypt_js_1=require_decrypt2(),errors_js_1=require_errors(),is_object_js_1=require_is_object();async function generalDecrypt(jwe,key,options){if(!(0,is_object_js_1.default)(jwe))throw new errors_js_1.JWEInvalid("General JWE must be an object");if(!Array.isArray(jwe.recipients)||!jwe.recipients.every(is_object_js_1.default))throw new errors_js_1.JWEInvalid("JWE Recipients missing or incorrect type");if(!jwe.recipients.length)throw new errors_js_1.JWEInvalid("JWE Recipients has no members");for(let recipient of jwe.recipients)try{return await(0,decrypt_js_1.flattenedDecrypt)({aad:jwe.aad,ciphertext:jwe.ciphertext,encrypted_key:recipient.encrypted_key,header:recipient.header,iv:jwe.iv,protected:jwe.protected,tag:jwe.tag,unprotected:jwe.unprotected},key,options)}catch{}throw new errors_js_1.JWEDecryptionFailed}}});var require_private_symbols=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/private_symbols.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.unprotected=void 0;exports.unprotected=Symbol()}});var require_key_to_jwk=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/key_to_jwk.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var node_crypto_1=__require("node:crypto"),base64url_js_1=require_base64url(),errors_js_1=require_errors(),webcrypto_js_1=require_webcrypto(),is_key_object_js_1=require_is_key_object(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),keyToJWK=key=>{let keyObject;if((0,webcrypto_js_1.isCryptoKey)(key)){if(!key.extractable)throw new TypeError("CryptoKey is not extractable");keyObject=node_crypto_1.KeyObject.from(key)}else if((0,is_key_object_js_1.default)(key))keyObject=key;else{if(key instanceof Uint8Array)return{kty:"oct",k:(0,base64url_js_1.encode)(key)};throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types,"Uint8Array"))}if(keyObject.type!=="secret"&&!["rsa","ec","ed25519","x25519","ed448","x448"].includes(keyObject.asymmetricKeyType))throw new errors_js_1.JOSENotSupported("Unsupported key asymmetricKeyType");return keyObject.export({format:"jwk"})};exports.default=keyToJWK}});var require_export=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/key/export.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.exportSPKI=exportSPKI;exports.exportPKCS8=exportPKCS8;exports.exportJWK=exportJWK;var asn1_js_1=require_asn1(),asn1_js_2=require_asn1(),key_to_jwk_js_1=require_key_to_jwk();async function exportSPKI(key){return(0,asn1_js_1.toSPKI)(key)}async function exportPKCS8(key){return(0,asn1_js_2.toPKCS8)(key)}async function exportJWK(key){return(0,key_to_jwk_js_1.default)(key)}}});var require_encrypt_key_management=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/encrypt_key_management.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var aeskw_js_1=require_aeskw(),ECDH=require_ecdhes(),pbes2kw_js_1=require_pbes2kw(),rsaes_js_1=require_rsaes(),base64url_js_1=require_base64url(),normalize_key_js_1=require_normalize_key(),cek_js_1=require_cek(),errors_js_1=require_errors(),export_js_1=require_export(),check_key_type_js_1=require_check_key_type(),aesgcmkw_js_1=require_aesgcmkw();async function encryptKeyManagement(alg,enc,key,providedCek,providedParameters={}){let encryptedKey,parameters,cek;switch((0,check_key_type_js_1.default)(alg,key,"encrypt"),key=await normalize_key_js_1.default.normalizePublicKey?.(key,alg)||key,alg){case"dir":{cek=key;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!ECDH.ecdhAllowed(key))throw new errors_js_1.JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu,apv}=providedParameters,{epk:ephemeralKey}=providedParameters;ephemeralKey||=(await ECDH.generateEpk(key)).privateKey;let{x,y,crv,kty}=await(0,export_js_1.exportJWK)(ephemeralKey),sharedSecret=await ECDH.deriveKey(key,ephemeralKey,alg==="ECDH-ES"?enc:alg,alg==="ECDH-ES"?(0,cek_js_1.bitLength)(enc):parseInt(alg.slice(-5,-2),10),apu,apv);if(parameters={epk:{x,crv,kty}},kty==="EC"&&(parameters.epk.y=y),apu&&(parameters.apu=(0,base64url_js_1.encode)(apu)),apv&&(parameters.apv=(0,base64url_js_1.encode)(apv)),alg==="ECDH-ES"){cek=sharedSecret;break}cek=providedCek||(0,cek_js_1.default)(enc);let kwAlg=alg.slice(-6);encryptedKey=await(0,aeskw_js_1.wrap)(kwAlg,sharedSecret,cek);break}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{cek=providedCek||(0,cek_js_1.default)(enc),encryptedKey=await(0,rsaes_js_1.encrypt)(alg,key,cek);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{cek=providedCek||(0,cek_js_1.default)(enc);let{p2c,p2s}=providedParameters;({encryptedKey,...parameters}=await(0,pbes2kw_js_1.encrypt)(alg,key,cek,p2c,p2s));break}case"A128KW":case"A192KW":case"A256KW":{cek=providedCek||(0,cek_js_1.default)(enc),encryptedKey=await(0,aeskw_js_1.wrap)(alg,key,cek);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{cek=providedCek||(0,cek_js_1.default)(enc);let{iv}=providedParameters;({encryptedKey,...parameters}=await(0,aesgcmkw_js_1.wrap)(alg,key,cek,iv));break}default:throw new errors_js_1.JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value')}return{cek,encryptedKey,parameters}}exports.default=encryptKeyManagement}});var require_encrypt2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/flattened/encrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.FlattenedEncrypt=void 0;var base64url_js_1=require_base64url(),private_symbols_js_1=require_private_symbols(),encrypt_js_1=require_encrypt(),encrypt_key_management_js_1=require_encrypt_key_management(),errors_js_1=require_errors(),is_disjoint_js_1=require_is_disjoint(),buffer_utils_js_1=require_buffer_utils(),validate_crit_js_1=require_validate_crit(),FlattenedEncrypt=class{_plaintext;_protectedHeader;_sharedUnprotectedHeader;_unprotectedHeader;_aad;_cek;_iv;_keyManagementParameters;constructor(plaintext){if(!(plaintext instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this._plaintext=plaintext}setKeyManagementParameters(parameters){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=parameters,this}setProtectedHeader(protectedHeader){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=protectedHeader,this}setSharedUnprotectedHeader(sharedUnprotectedHeader){if(this._sharedUnprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._sharedUnprotectedHeader=sharedUnprotectedHeader,this}setUnprotectedHeader(unprotectedHeader){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=unprotectedHeader,this}setAdditionalAuthenticatedData(aad){return this._aad=aad,this}setContentEncryptionKey(cek){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=cek,this}setInitializationVector(iv){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=iv,this}async encrypt(key,options){if(!this._protectedHeader&&!this._unprotectedHeader&&!this._sharedUnprotectedHeader)throw new errors_js_1.JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!(0,is_disjoint_js_1.default)(this._protectedHeader,this._unprotectedHeader,this._sharedUnprotectedHeader))throw new errors_js_1.JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let joseHeader={...this._protectedHeader,...this._unprotectedHeader,...this._sharedUnprotectedHeader};if((0,validate_crit_js_1.default)(errors_js_1.JWEInvalid,new Map,options?.crit,this._protectedHeader,joseHeader),joseHeader.zip!==void 0)throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');let{alg,enc}=joseHeader;if(typeof alg!="string"||!alg)throw new errors_js_1.JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof enc!="string"||!enc)throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let encryptedKey;if(this._cek&&(alg==="dir"||alg==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);let cek;{let parameters;({cek,encryptedKey,parameters}=await(0,encrypt_key_management_js_1.default)(alg,enc,key,this._cek,this._keyManagementParameters)),parameters&&(options&&private_symbols_js_1.unprotected in options?this._unprotectedHeader?this._unprotectedHeader={...this._unprotectedHeader,...parameters}:this.setUnprotectedHeader(parameters):this._protectedHeader?this._protectedHeader={...this._protectedHeader,...parameters}:this.setProtectedHeader(parameters))}let additionalData,protectedHeader,aadMember;this._protectedHeader?protectedHeader=buffer_utils_js_1.encoder.encode((0,base64url_js_1.encode)(JSON.stringify(this._protectedHeader))):protectedHeader=buffer_utils_js_1.encoder.encode(""),this._aad?(aadMember=(0,base64url_js_1.encode)(this._aad),additionalData=(0,buffer_utils_js_1.concat)(protectedHeader,buffer_utils_js_1.encoder.encode("."),buffer_utils_js_1.encoder.encode(aadMember))):additionalData=protectedHeader;let{ciphertext,tag,iv}=await(0,encrypt_js_1.default)(enc,this._plaintext,cek,this._iv,additionalData),jwe={ciphertext:(0,base64url_js_1.encode)(ciphertext)};return iv&&(jwe.iv=(0,base64url_js_1.encode)(iv)),tag&&(jwe.tag=(0,base64url_js_1.encode)(tag)),encryptedKey&&(jwe.encrypted_key=(0,base64url_js_1.encode)(encryptedKey)),aadMember&&(jwe.aad=aadMember),this._protectedHeader&&(jwe.protected=buffer_utils_js_1.decoder.decode(protectedHeader)),this._sharedUnprotectedHeader&&(jwe.unprotected=this._sharedUnprotectedHeader),this._unprotectedHeader&&(jwe.header=this._unprotectedHeader),jwe}};exports.FlattenedEncrypt=FlattenedEncrypt}});var require_encrypt3=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/general/encrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.GeneralEncrypt=void 0;var encrypt_js_1=require_encrypt2(),private_symbols_js_1=require_private_symbols(),errors_js_1=require_errors(),cek_js_1=require_cek(),is_disjoint_js_1=require_is_disjoint(),encrypt_key_management_js_1=require_encrypt_key_management(),base64url_js_1=require_base64url(),validate_crit_js_1=require_validate_crit(),IndividualRecipient=class{parent;unprotectedHeader;key;options;constructor(enc,key,options){this.parent=enc,this.key=key,this.options=options}setUnprotectedHeader(unprotectedHeader){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=unprotectedHeader,this}addRecipient(...args){return this.parent.addRecipient(...args)}encrypt(...args){return this.parent.encrypt(...args)}done(){return this.parent}},GeneralEncrypt=class{_plaintext;_recipients=[];_protectedHeader;_unprotectedHeader;_aad;constructor(plaintext){this._plaintext=plaintext}addRecipient(key,options){let recipient=new IndividualRecipient(this,key,{crit:options?.crit});return this._recipients.push(recipient),recipient}setProtectedHeader(protectedHeader){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=protectedHeader,this}setSharedUnprotectedHeader(sharedUnprotectedHeader){if(this._unprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._unprotectedHeader=sharedUnprotectedHeader,this}setAdditionalAuthenticatedData(aad){return this._aad=aad,this}async encrypt(){if(!this._recipients.length)throw new errors_js_1.JWEInvalid("at least one recipient must be added");if(this._recipients.length===1){let[recipient]=this._recipients,flattened=await new encrypt_js_1.FlattenedEncrypt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(recipient.unprotectedHeader).encrypt(recipient.key,{...recipient.options}),jwe2={ciphertext:flattened.ciphertext,iv:flattened.iv,recipients:[{}],tag:flattened.tag};return flattened.aad&&(jwe2.aad=flattened.aad),flattened.protected&&(jwe2.protected=flattened.protected),flattened.unprotected&&(jwe2.unprotected=flattened.unprotected),flattened.encrypted_key&&(jwe2.recipients[0].encrypted_key=flattened.encrypted_key),flattened.header&&(jwe2.recipients[0].header=flattened.header),jwe2}let enc;for(let i=0;i<this._recipients.length;i++){let recipient=this._recipients[i];if(!(0,is_disjoint_js_1.default)(this._protectedHeader,this._unprotectedHeader,recipient.unprotectedHeader))throw new errors_js_1.JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let joseHeader={...this._protectedHeader,...this._unprotectedHeader,...recipient.unprotectedHeader},{alg}=joseHeader;if(typeof alg!="string"||!alg)throw new errors_js_1.JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(alg==="dir"||alg==="ECDH-ES")throw new errors_js_1.JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof joseHeader.enc!="string"||!joseHeader.enc)throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!enc)enc=joseHeader.enc;else if(enc!==joseHeader.enc)throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if((0,validate_crit_js_1.default)(errors_js_1.JWEInvalid,new Map,recipient.options.crit,this._protectedHeader,joseHeader),joseHeader.zip!==void 0)throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.')}let cek=(0,cek_js_1.default)(enc),jwe={ciphertext:"",iv:"",recipients:[],tag:""};for(let i=0;i<this._recipients.length;i++){let recipient=this._recipients[i],target={};jwe.recipients.push(target);let p2c={...this._protectedHeader,...this._unprotectedHeader,...recipient.unprotectedHeader}.alg.startsWith("PBES2")?2048+i:void 0;if(i===0){let flattened=await new encrypt_js_1.FlattenedEncrypt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setContentEncryptionKey(cek).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(recipient.unprotectedHeader).setKeyManagementParameters({p2c}).encrypt(recipient.key,{...recipient.options,[private_symbols_js_1.unprotected]:!0});jwe.ciphertext=flattened.ciphertext,jwe.iv=flattened.iv,jwe.tag=flattened.tag,flattened.aad&&(jwe.aad=flattened.aad),flattened.protected&&(jwe.protected=flattened.protected),flattened.unprotected&&(jwe.unprotected=flattened.unprotected),target.encrypted_key=flattened.encrypted_key,flattened.header&&(target.header=flattened.header);continue}let{encryptedKey,parameters}=await(0,encrypt_key_management_js_1.default)(recipient.unprotectedHeader?.alg||this._protectedHeader?.alg||this._unprotectedHeader?.alg,enc,recipient.key,cek,{p2c});target.encrypted_key=(0,base64url_js_1.encode)(encryptedKey),(recipient.unprotectedHeader||parameters)&&(target.header={...recipient.unprotectedHeader,...parameters})}return jwe}};exports.GeneralEncrypt=GeneralEncrypt}});var require_dsa_digest=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/dsa_digest.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=dsaDigest;var errors_js_1=require_errors();function dsaDigest(alg){switch(alg){case"PS256":case"RS256":case"ES256":case"ES256K":return"sha256";case"PS384":case"RS384":case"ES384":return"sha384";case"PS512":case"RS512":case"ES512":return"sha512";case"EdDSA":return;default:throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`)}}}});var require_node_key=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/node_key.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=keyForCrypto;var node_crypto_1=__require("node:crypto"),get_named_curve_js_1=require_get_named_curve(),errors_js_1=require_errors(),check_key_length_js_1=require_check_key_length(),ecCurveAlgMap=new Map([["ES256","P-256"],["ES256K","secp256k1"],["ES384","P-384"],["ES512","P-521"]]);function keyForCrypto(alg,key){let asymmetricKeyType,asymmetricKeyDetails,isJWK;if(key instanceof node_crypto_1.KeyObject)asymmetricKeyType=key.asymmetricKeyType,asymmetricKeyDetails=key.asymmetricKeyDetails;else switch(isJWK=!0,key.kty){case"RSA":asymmetricKeyType="rsa";break;case"EC":asymmetricKeyType="ec";break;case"OKP":{if(key.crv==="Ed25519"){asymmetricKeyType="ed25519";break}if(key.crv==="Ed448"){asymmetricKeyType="ed448";break}throw new TypeError("Invalid key for this operation, its crv must be Ed25519 or Ed448")}default:throw new TypeError("Invalid key for this operation, its kty must be RSA, OKP, or EC")}let options;switch(alg){case"EdDSA":if(!["ed25519","ed448"].includes(asymmetricKeyType))throw new TypeError("Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448");break;case"RS256":case"RS384":case"RS512":if(asymmetricKeyType!=="rsa")throw new TypeError("Invalid key for this operation, its asymmetricKeyType must be rsa");(0,check_key_length_js_1.default)(key,alg);break;case"PS256":case"PS384":case"PS512":if(asymmetricKeyType==="rsa-pss"){let{hashAlgorithm,mgf1HashAlgorithm,saltLength}=asymmetricKeyDetails,length=parseInt(alg.slice(-3),10);if(hashAlgorithm!==void 0&&(hashAlgorithm!==`sha${length}`||mgf1HashAlgorithm!==hashAlgorithm))throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);if(saltLength!==void 0&&saltLength>length>>3)throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`)}else if(asymmetricKeyType!=="rsa")throw new TypeError("Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss");(0,check_key_length_js_1.default)(key,alg),options={padding:node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,saltLength:node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST};break;case"ES256":case"ES256K":case"ES384":case"ES512":{if(asymmetricKeyType!=="ec")throw new TypeError("Invalid key for this operation, its asymmetricKeyType must be ec");let actual=(0,get_named_curve_js_1.default)(key),expected=ecCurveAlgMap.get(alg);if(actual!==expected)throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);options={dsaEncoding:"ieee-p1363"};break}default:throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`)}return isJWK?{format:"jwk",key,...options}:options?{...options,key}:key}}});var require_hmac_digest=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/hmac_digest.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=hmacDigest;var errors_js_1=require_errors();function hmacDigest(alg){switch(alg){case"HS256":return"sha256";case"HS384":return"sha384";case"HS512":return"sha512";default:throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`)}}}});var require_get_sign_verify_key=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/get_sign_verify_key.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=getSignVerifyKey;var node_crypto_1=__require("node:crypto"),webcrypto_js_1=require_webcrypto(),crypto_key_js_1=require_crypto_key(),invalid_key_input_js_1=require_invalid_key_input(),is_key_like_js_1=require_is_key_like(),jwk=require_is_jwk();function getSignVerifyKey(alg,key,usage){if(key instanceof Uint8Array){if(!alg.startsWith("HS"))throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types));return(0,node_crypto_1.createSecretKey)(key)}if(key instanceof node_crypto_1.KeyObject)return key;if((0,webcrypto_js_1.isCryptoKey)(key))return(0,crypto_key_js_1.checkSigCryptoKey)(key,alg,usage),node_crypto_1.KeyObject.from(key);if(jwk.isJWK(key))return alg.startsWith("HS")?(0,node_crypto_1.createSecretKey)(Buffer.from(key.k,"base64url")):key;throw new TypeError((0,invalid_key_input_js_1.default)(key,...is_key_like_js_1.types,"Uint8Array","JSON Web Key"))}}});var require_sign=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/sign.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var crypto=__require("node:crypto"),node_util_1=__require("node:util"),dsa_digest_js_1=require_dsa_digest(),hmac_digest_js_1=require_hmac_digest(),node_key_js_1=require_node_key(),get_sign_verify_key_js_1=require_get_sign_verify_key(),oneShotSign=(0,node_util_1.promisify)(crypto.sign),sign=async(alg,key,data)=>{let k=(0,get_sign_verify_key_js_1.default)(alg,key,"sign");if(alg.startsWith("HS")){let hmac=crypto.createHmac((0,hmac_digest_js_1.default)(alg),k);return hmac.update(data),hmac.digest()}return oneShotSign((0,dsa_digest_js_1.default)(alg),data,(0,node_key_js_1.default)(alg,k))};exports.default=sign}});var require_verify=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/verify.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var crypto=__require("node:crypto"),node_util_1=__require("node:util"),dsa_digest_js_1=require_dsa_digest(),node_key_js_1=require_node_key(),sign_js_1=require_sign(),get_sign_verify_key_js_1=require_get_sign_verify_key(),oneShotVerify=(0,node_util_1.promisify)(crypto.verify),verify=async(alg,key,signature,data)=>{let k=(0,get_sign_verify_key_js_1.default)(alg,key,"verify");if(alg.startsWith("HS")){let expected=await(0,sign_js_1.default)(alg,k,data),actual=signature;try{return crypto.timingSafeEqual(actual,expected)}catch{return!1}}let algorithm=(0,dsa_digest_js_1.default)(alg),keyInput=(0,node_key_js_1.default)(alg,k);try{return await oneShotVerify(algorithm,data,keyInput,signature)}catch{return!1}};exports.default=verify}});var require_verify2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/flattened/verify.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.flattenedVerify=flattenedVerify;var base64url_js_1=require_base64url(),verify_js_1=require_verify(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),is_disjoint_js_1=require_is_disjoint(),is_object_js_1=require_is_object(),check_key_type_js_1=require_check_key_type(),validate_crit_js_1=require_validate_crit(),validate_algorithms_js_1=require_validate_algorithms(),is_jwk_js_1=require_is_jwk(),import_js_1=require_import();async function flattenedVerify(jws,key,options){if(!(0,is_object_js_1.default)(jws))throw new errors_js_1.JWSInvalid("Flattened JWS must be an object");if(jws.protected===void 0&&jws.header===void 0)throw new errors_js_1.JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');if(jws.protected!==void 0&&typeof jws.protected!="string")throw new errors_js_1.JWSInvalid("JWS Protected Header incorrect type");if(jws.payload===void 0)throw new errors_js_1.JWSInvalid("JWS Payload missing");if(typeof jws.signature!="string")throw new errors_js_1.JWSInvalid("JWS Signature missing or incorrect type");if(jws.header!==void 0&&!(0,is_object_js_1.default)(jws.header))throw new errors_js_1.JWSInvalid("JWS Unprotected Header incorrect type");let parsedProt={};if(jws.protected)try{let protectedHeader=(0,base64url_js_1.decode)(jws.protected);parsedProt=JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader))}catch{throw new errors_js_1.JWSInvalid("JWS Protected Header is invalid")}if(!(0,is_disjoint_js_1.default)(parsedProt,jws.header))throw new errors_js_1.JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let joseHeader={...parsedProt,...jws.header},extensions=(0,validate_crit_js_1.default)(errors_js_1.JWSInvalid,new Map([["b64",!0]]),options?.crit,parsedProt,joseHeader),b64=!0;if(extensions.has("b64")&&(b64=parsedProt.b64,typeof b64!="boolean"))throw new errors_js_1.JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg}=joseHeader;if(typeof alg!="string"||!alg)throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');let algorithms=options&&(0,validate_algorithms_js_1.default)("algorithms",options.algorithms);if(algorithms&&!algorithms.has(alg))throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');if(b64){if(typeof jws.payload!="string")throw new errors_js_1.JWSInvalid("JWS Payload must be a string")}else if(typeof jws.payload!="string"&&!(jws.payload instanceof Uint8Array))throw new errors_js_1.JWSInvalid("JWS Payload must be a string or an Uint8Array instance");let resolvedKey=!1;typeof key=="function"?(key=await key(parsedProt,jws),resolvedKey=!0,(0,check_key_type_js_1.checkKeyTypeWithJwk)(alg,key,"verify"),(0,is_jwk_js_1.isJWK)(key)&&(key=await(0,import_js_1.importJWK)(key,alg))):(0,check_key_type_js_1.checkKeyTypeWithJwk)(alg,key,"verify");let data=(0,buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode(jws.protected??""),buffer_utils_js_1.encoder.encode("."),typeof jws.payload=="string"?buffer_utils_js_1.encoder.encode(jws.payload):jws.payload),signature;try{signature=(0,base64url_js_1.decode)(jws.signature)}catch{throw new errors_js_1.JWSInvalid("Failed to base64url decode the signature")}if(!await(0,verify_js_1.default)(alg,key,signature,data))throw new errors_js_1.JWSSignatureVerificationFailed;let payload;if(b64)try{payload=(0,base64url_js_1.decode)(jws.payload)}catch{throw new errors_js_1.JWSInvalid("Failed to base64url decode the payload")}else typeof jws.payload=="string"?payload=buffer_utils_js_1.encoder.encode(jws.payload):payload=jws.payload;let result={payload};return jws.protected!==void 0&&(result.protectedHeader=parsedProt),jws.header!==void 0&&(result.unprotectedHeader=jws.header),resolvedKey?{...result,key}:result}}});var require_verify3=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/compact/verify.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.compactVerify=compactVerify;var verify_js_1=require_verify2(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils();async function compactVerify(jws,key,options){if(jws instanceof Uint8Array&&(jws=buffer_utils_js_1.decoder.decode(jws)),typeof jws!="string")throw new errors_js_1.JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3)throw new errors_js_1.JWSInvalid("Invalid Compact JWS");let verified=await(0,verify_js_1.flattenedVerify)({payload,protected:protectedHeader,signature},key,options),result={payload:verified.payload,protectedHeader:verified.protectedHeader};return typeof key=="function"?{...result,key:verified.key}:result}}});var require_verify4=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/general/verify.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.generalVerify=generalVerify;var verify_js_1=require_verify2(),errors_js_1=require_errors(),is_object_js_1=require_is_object();async function generalVerify(jws,key,options){if(!(0,is_object_js_1.default)(jws))throw new errors_js_1.JWSInvalid("General JWS must be an object");if(!Array.isArray(jws.signatures)||!jws.signatures.every(is_object_js_1.default))throw new errors_js_1.JWSInvalid("JWS Signatures missing or incorrect type");for(let signature of jws.signatures)try{return await(0,verify_js_1.flattenedVerify)({header:signature.header,payload:jws.payload,protected:signature.protected,signature:signature.signature},key,options)}catch{}throw new errors_js_1.JWSSignatureVerificationFailed}}});var require_epoch=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/epoch.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default=date=>Math.floor(date.getTime()/1e3)}});var require_secs=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/secs.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var minute=60,hour=minute*60,day=hour*24,week=day*7,year=day*365.25,REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;exports.default=str=>{let matched=REGEX.exec(str);if(!matched||matched[4]&&matched[1])throw new TypeError("Invalid time period format");let value=parseFloat(matched[2]),unit=matched[3].toLowerCase(),numericDate;switch(unit){case"sec":case"secs":case"second":case"seconds":case"s":numericDate=Math.round(value);break;case"minute":case"minutes":case"min":case"mins":case"m":numericDate=Math.round(value*minute);break;case"hour":case"hours":case"hr":case"hrs":case"h":numericDate=Math.round(value*hour);break;case"day":case"days":case"d":numericDate=Math.round(value*day);break;case"week":case"weeks":case"w":numericDate=Math.round(value*week);break;default:numericDate=Math.round(value*year);break}return matched[1]==="-"||matched[4]==="ago"?-numericDate:numericDate}}});var require_jwt_claims_set=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/lib/jwt_claims_set.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),epoch_js_1=require_epoch(),secs_js_1=require_secs(),is_object_js_1=require_is_object(),normalizeTyp=value=>value.toLowerCase().replace(/^application\//,""),checkAudiencePresence=(audPayload,audOption)=>typeof audPayload=="string"?audOption.includes(audPayload):Array.isArray(audPayload)?audOption.some(Set.prototype.has.bind(new Set(audPayload))):!1;exports.default=(protectedHeader,encodedPayload,options={})=>{let payload;try{payload=JSON.parse(buffer_utils_js_1.decoder.decode(encodedPayload))}catch{}if(!(0,is_object_js_1.default)(payload))throw new errors_js_1.JWTInvalid("JWT Claims Set must be a top-level JSON object");let{typ}=options;if(typ&&(typeof protectedHeader.typ!="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ)))throw new errors_js_1.JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ","check_failed");let{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options,presenceCheck=[...requiredClaims];maxTokenAge!==void 0&&presenceCheck.push("iat"),audience!==void 0&&presenceCheck.push("aud"),subject!==void 0&&presenceCheck.push("sub"),issuer!==void 0&&presenceCheck.push("iss");for(let claim of new Set(presenceCheck.reverse()))if(!(claim in payload))throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing");if(issuer&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss))throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value',payload,"iss","check_failed");if(subject&&payload.sub!==subject)throw new errors_js_1.JWTClaimValidationFailed('unexpected "sub" claim value',payload,"sub","check_failed");if(audience&&!checkAudiencePresence(payload.aud,typeof audience=="string"?[audience]:audience))throw new errors_js_1.JWTClaimValidationFailed('unexpected "aud" claim value',payload,"aud","check_failed");let tolerance;switch(typeof options.clockTolerance){case"string":tolerance=(0,secs_js_1.default)(options.clockTolerance);break;case"number":tolerance=options.clockTolerance;break;case"undefined":tolerance=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate}=options,now=(0,epoch_js_1.default)(currentDate||new Date);if((payload.iat!==void 0||maxTokenAge)&&typeof payload.iat!="number")throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number',payload,"iat","invalid");if(payload.nbf!==void 0){if(typeof payload.nbf!="number")throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim must be a number',payload,"nbf","invalid");if(payload.nbf>now+tolerance)throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf","check_failed")}if(payload.exp!==void 0){if(typeof payload.exp!="number")throw new errors_js_1.JWTClaimValidationFailed('"exp" claim must be a number',payload,"exp","invalid");if(payload.exp<=now-tolerance)throw new errors_js_1.JWTExpired('"exp" claim timestamp check failed',payload,"exp","check_failed")}if(maxTokenAge){let age=now-payload.iat,max=typeof maxTokenAge=="number"?maxTokenAge:(0,secs_js_1.default)(maxTokenAge);if(age-tolerance>max)throw new errors_js_1.JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat","check_failed");if(age<0-tolerance)throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat","check_failed")}return payload}}});var require_verify5=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/verify.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.jwtVerify=jwtVerify;var verify_js_1=require_verify3(),jwt_claims_set_js_1=require_jwt_claims_set(),errors_js_1=require_errors();async function jwtVerify(jwt,key,options){let verified=await(0,verify_js_1.compactVerify)(jwt,key,options);if(verified.protectedHeader.crit?.includes("b64")&&verified.protectedHeader.b64===!1)throw new errors_js_1.JWTInvalid("JWTs MUST NOT use unencoded payload");let result={payload:(0,jwt_claims_set_js_1.default)(verified.protectedHeader,verified.payload,options),protectedHeader:verified.protectedHeader};return typeof key=="function"?{...result,key:verified.key}:result}}});var require_decrypt5=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/decrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.jwtDecrypt=jwtDecrypt;var decrypt_js_1=require_decrypt3(),jwt_claims_set_js_1=require_jwt_claims_set(),errors_js_1=require_errors();async function jwtDecrypt(jwt,key,options){let decrypted=await(0,decrypt_js_1.compactDecrypt)(jwt,key,options),payload=(0,jwt_claims_set_js_1.default)(decrypted.protectedHeader,decrypted.plaintext,options),{protectedHeader}=decrypted;if(protectedHeader.iss!==void 0&&protectedHeader.iss!==payload.iss)throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch',payload,"iss","mismatch");if(protectedHeader.sub!==void 0&&protectedHeader.sub!==payload.sub)throw new errors_js_1.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch',payload,"sub","mismatch");if(protectedHeader.aud!==void 0&&JSON.stringify(protectedHeader.aud)!==JSON.stringify(payload.aud))throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch',payload,"aud","mismatch");let result={payload,protectedHeader};return typeof key=="function"?{...result,key:decrypted.key}:result}}});var require_encrypt4=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwe/compact/encrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.CompactEncrypt=void 0;var encrypt_js_1=require_encrypt2(),CompactEncrypt=class{_flattened;constructor(plaintext){this._flattened=new encrypt_js_1.FlattenedEncrypt(plaintext)}setContentEncryptionKey(cek){return this._flattened.setContentEncryptionKey(cek),this}setInitializationVector(iv){return this._flattened.setInitializationVector(iv),this}setProtectedHeader(protectedHeader){return this._flattened.setProtectedHeader(protectedHeader),this}setKeyManagementParameters(parameters){return this._flattened.setKeyManagementParameters(parameters),this}async encrypt(key,options){let jwe=await this._flattened.encrypt(key,options);return[jwe.protected,jwe.encrypted_key,jwe.iv,jwe.ciphertext,jwe.tag].join(".")}};exports.CompactEncrypt=CompactEncrypt}});var require_sign2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/flattened/sign.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.FlattenedSign=void 0;var base64url_js_1=require_base64url(),sign_js_1=require_sign(),is_disjoint_js_1=require_is_disjoint(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),check_key_type_js_1=require_check_key_type(),validate_crit_js_1=require_validate_crit(),FlattenedSign=class{_payload;_protectedHeader;_unprotectedHeader;constructor(payload){if(!(payload instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this._payload=payload}setProtectedHeader(protectedHeader){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=protectedHeader,this}setUnprotectedHeader(unprotectedHeader){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=unprotectedHeader,this}async sign(key,options){if(!this._protectedHeader&&!this._unprotectedHeader)throw new errors_js_1.JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!(0,is_disjoint_js_1.default)(this._protectedHeader,this._unprotectedHeader))throw new errors_js_1.JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let joseHeader={...this._protectedHeader,...this._unprotectedHeader},extensions=(0,validate_crit_js_1.default)(errors_js_1.JWSInvalid,new Map([["b64",!0]]),options?.crit,this._protectedHeader,joseHeader),b64=!0;if(extensions.has("b64")&&(b64=this._protectedHeader.b64,typeof b64!="boolean"))throw new errors_js_1.JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg}=joseHeader;if(typeof alg!="string"||!alg)throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');(0,check_key_type_js_1.checkKeyTypeWithJwk)(alg,key,"sign");let payload=this._payload;b64&&(payload=buffer_utils_js_1.encoder.encode((0,base64url_js_1.encode)(payload)));let protectedHeader;this._protectedHeader?protectedHeader=buffer_utils_js_1.encoder.encode((0,base64url_js_1.encode)(JSON.stringify(this._protectedHeader))):protectedHeader=buffer_utils_js_1.encoder.encode("");let data=(0,buffer_utils_js_1.concat)(protectedHeader,buffer_utils_js_1.encoder.encode("."),payload),signature=await(0,sign_js_1.default)(alg,key,data),jws={signature:(0,base64url_js_1.encode)(signature),payload:""};return b64&&(jws.payload=buffer_utils_js_1.decoder.decode(payload)),this._unprotectedHeader&&(jws.header=this._unprotectedHeader),this._protectedHeader&&(jws.protected=buffer_utils_js_1.decoder.decode(protectedHeader)),jws}};exports.FlattenedSign=FlattenedSign}});var require_sign3=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/compact/sign.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.CompactSign=void 0;var sign_js_1=require_sign2(),CompactSign=class{_flattened;constructor(payload){this._flattened=new sign_js_1.FlattenedSign(payload)}setProtectedHeader(protectedHeader){return this._flattened.setProtectedHeader(protectedHeader),this}async sign(key,options){let jws=await this._flattened.sign(key,options);if(jws.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${jws.protected}.${jws.payload}.${jws.signature}`}};exports.CompactSign=CompactSign}});var require_sign4=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jws/general/sign.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.GeneralSign=void 0;var sign_js_1=require_sign2(),errors_js_1=require_errors(),IndividualSignature=class{parent;protectedHeader;unprotectedHeader;options;key;constructor(sig,key,options){this.parent=sig,this.key=key,this.options=options}setProtectedHeader(protectedHeader){if(this.protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this.protectedHeader=protectedHeader,this}setUnprotectedHeader(unprotectedHeader){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=unprotectedHeader,this}addSignature(...args){return this.parent.addSignature(...args)}sign(...args){return this.parent.sign(...args)}done(){return this.parent}},GeneralSign=class{_payload;_signatures=[];constructor(payload){this._payload=payload}addSignature(key,options){let signature=new IndividualSignature(this,key,options);return this._signatures.push(signature),signature}async sign(){if(!this._signatures.length)throw new errors_js_1.JWSInvalid("at least one signature must be added");let jws={signatures:[],payload:""};for(let i=0;i<this._signatures.length;i++){let signature=this._signatures[i],flattened=new sign_js_1.FlattenedSign(this._payload);flattened.setProtectedHeader(signature.protectedHeader),flattened.setUnprotectedHeader(signature.unprotectedHeader);let{payload,...rest}=await flattened.sign(signature.key,signature.options);if(i===0)jws.payload=payload;else if(jws.payload!==payload)throw new errors_js_1.JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");jws.signatures.push(rest)}return jws}};exports.GeneralSign=GeneralSign}});var require_produce=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/produce.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.ProduceJWT=void 0;var epoch_js_1=require_epoch(),is_object_js_1=require_is_object(),secs_js_1=require_secs();function validateInput(label,input){if(!Number.isFinite(input))throw new TypeError(`Invalid ${label} input`);return input}var ProduceJWT=class{_payload;constructor(payload={}){if(!(0,is_object_js_1.default)(payload))throw new TypeError("JWT Claims Set MUST be an object");this._payload=payload}setIssuer(issuer){return this._payload={...this._payload,iss:issuer},this}setSubject(subject){return this._payload={...this._payload,sub:subject},this}setAudience(audience){return this._payload={...this._payload,aud:audience},this}setJti(jwtId){return this._payload={...this._payload,jti:jwtId},this}setNotBefore(input){return typeof input=="number"?this._payload={...this._payload,nbf:validateInput("setNotBefore",input)}:input instanceof Date?this._payload={...this._payload,nbf:validateInput("setNotBefore",(0,epoch_js_1.default)(input))}:this._payload={...this._payload,nbf:(0,epoch_js_1.default)(new Date)+(0,secs_js_1.default)(input)},this}setExpirationTime(input){return typeof input=="number"?this._payload={...this._payload,exp:validateInput("setExpirationTime",input)}:input instanceof Date?this._payload={...this._payload,exp:validateInput("setExpirationTime",(0,epoch_js_1.default)(input))}:this._payload={...this._payload,exp:(0,epoch_js_1.default)(new Date)+(0,secs_js_1.default)(input)},this}setIssuedAt(input){return typeof input>"u"?this._payload={...this._payload,iat:(0,epoch_js_1.default)(new Date)}:input instanceof Date?this._payload={...this._payload,iat:validateInput("setIssuedAt",(0,epoch_js_1.default)(input))}:typeof input=="string"?this._payload={...this._payload,iat:validateInput("setIssuedAt",(0,epoch_js_1.default)(new Date)+(0,secs_js_1.default)(input))}:this._payload={...this._payload,iat:validateInput("setIssuedAt",input)},this}};exports.ProduceJWT=ProduceJWT}});var require_sign5=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/sign.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.SignJWT=void 0;var sign_js_1=require_sign3(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),produce_js_1=require_produce(),SignJWT=class extends produce_js_1.ProduceJWT{_protectedHeader;setProtectedHeader(protectedHeader){return this._protectedHeader=protectedHeader,this}async sign(key,options){let sig=new sign_js_1.CompactSign(buffer_utils_js_1.encoder.encode(JSON.stringify(this._payload)));if(sig.setProtectedHeader(this._protectedHeader),Array.isArray(this._protectedHeader?.crit)&&this._protectedHeader.crit.includes("b64")&&this._protectedHeader.b64===!1)throw new errors_js_1.JWTInvalid("JWTs MUST NOT use unencoded payload");return sig.sign(key,options)}};exports.SignJWT=SignJWT}});var require_encrypt5=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/encrypt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.EncryptJWT=void 0;var encrypt_js_1=require_encrypt4(),buffer_utils_js_1=require_buffer_utils(),produce_js_1=require_produce(),EncryptJWT=class extends produce_js_1.ProduceJWT{_cek;_iv;_keyManagementParameters;_protectedHeader;_replicateIssuerAsHeader;_replicateSubjectAsHeader;_replicateAudienceAsHeader;setProtectedHeader(protectedHeader){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=protectedHeader,this}setKeyManagementParameters(parameters){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=parameters,this}setContentEncryptionKey(cek){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=cek,this}setInitializationVector(iv){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=iv,this}replicateIssuerAsHeader(){return this._replicateIssuerAsHeader=!0,this}replicateSubjectAsHeader(){return this._replicateSubjectAsHeader=!0,this}replicateAudienceAsHeader(){return this._replicateAudienceAsHeader=!0,this}async encrypt(key,options){let enc=new encrypt_js_1.CompactEncrypt(buffer_utils_js_1.encoder.encode(JSON.stringify(this._payload)));return this._replicateIssuerAsHeader&&(this._protectedHeader={...this._protectedHeader,iss:this._payload.iss}),this._replicateSubjectAsHeader&&(this._protectedHeader={...this._protectedHeader,sub:this._payload.sub}),this._replicateAudienceAsHeader&&(this._protectedHeader={...this._protectedHeader,aud:this._payload.aud}),enc.setProtectedHeader(this._protectedHeader),this._iv&&enc.setInitializationVector(this._iv),this._cek&&enc.setContentEncryptionKey(this._cek),this._keyManagementParameters&&enc.setKeyManagementParameters(this._keyManagementParameters),enc.encrypt(key,options)}};exports.EncryptJWT=EncryptJWT}});var require_thumbprint=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwk/thumbprint.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.calculateJwkThumbprint=calculateJwkThumbprint;exports.calculateJwkThumbprintUri=calculateJwkThumbprintUri;var digest_js_1=require_digest(),base64url_js_1=require_base64url(),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),is_object_js_1=require_is_object(),check=(value,description)=>{if(typeof value!="string"||!value)throw new errors_js_1.JWKInvalid(`${description} missing or invalid`)};async function calculateJwkThumbprint(jwk,digestAlgorithm){if(!(0,is_object_js_1.default)(jwk))throw new TypeError("JWK must be an object");if(digestAlgorithm??="sha256",digestAlgorithm!=="sha256"&&digestAlgorithm!=="sha384"&&digestAlgorithm!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let components;switch(jwk.kty){case"EC":check(jwk.crv,'"crv" (Curve) Parameter'),check(jwk.x,'"x" (X Coordinate) Parameter'),check(jwk.y,'"y" (Y Coordinate) Parameter'),components={crv:jwk.crv,kty:jwk.kty,x:jwk.x,y:jwk.y};break;case"OKP":check(jwk.crv,'"crv" (Subtype of Key Pair) Parameter'),check(jwk.x,'"x" (Public Key) Parameter'),components={crv:jwk.crv,kty:jwk.kty,x:jwk.x};break;case"RSA":check(jwk.e,'"e" (Exponent) Parameter'),check(jwk.n,'"n" (Modulus) Parameter'),components={e:jwk.e,kty:jwk.kty,n:jwk.n};break;case"oct":check(jwk.k,'"k" (Key Value) Parameter'),components={k:jwk.k,kty:jwk.kty};break;default:throw new errors_js_1.JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported')}let data=buffer_utils_js_1.encoder.encode(JSON.stringify(components));return(0,base64url_js_1.encode)(await(0,digest_js_1.default)(digestAlgorithm,data))}async function calculateJwkThumbprintUri(jwk,digestAlgorithm){digestAlgorithm??="sha256";let thumbprint=await calculateJwkThumbprint(jwk,digestAlgorithm);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`}}});var require_embedded=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwk/embedded.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.EmbeddedJWK=EmbeddedJWK;var import_js_1=require_import(),is_object_js_1=require_is_object(),errors_js_1=require_errors();async function EmbeddedJWK(protectedHeader,token){let joseHeader={...protectedHeader,...token?.header};if(!(0,is_object_js_1.default)(joseHeader.jwk))throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let key=await(0,import_js_1.importJWK)({...joseHeader.jwk,ext:!0},joseHeader.alg);if(key instanceof Uint8Array||key.type!=="public")throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');return key}}});var require_local=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwks/local.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.createLocalJWKSet=createLocalJWKSet;var import_js_1=require_import(),errors_js_1=require_errors(),is_object_js_1=require_is_object();function getKtyFromAlg(alg){switch(typeof alg=="string"&&alg.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set')}}function isJWKSLike(jwks){return jwks&&typeof jwks=="object"&&Array.isArray(jwks.keys)&&jwks.keys.every(isJWKLike)}function isJWKLike(key){return(0,is_object_js_1.default)(key)}function clone(obj){return typeof structuredClone=="function"?structuredClone(obj):JSON.parse(JSON.stringify(obj))}var LocalJWKSet=class{_jwks;_cached=new WeakMap;constructor(jwks){if(!isJWKSLike(jwks))throw new errors_js_1.JWKSInvalid("JSON Web Key Set malformed");this._jwks=clone(jwks)}async getKey(protectedHeader,token){let{alg,kid}={...protectedHeader,...token?.header},kty=getKtyFromAlg(alg),candidates=this._jwks.keys.filter(jwk2=>{let candidate=kty===jwk2.kty;if(candidate&&typeof kid=="string"&&(candidate=kid===jwk2.kid),candidate&&typeof jwk2.alg=="string"&&(candidate=alg===jwk2.alg),candidate&&typeof jwk2.use=="string"&&(candidate=jwk2.use==="sig"),candidate&&Array.isArray(jwk2.key_ops)&&(candidate=jwk2.key_ops.includes("verify")),candidate&&alg==="EdDSA"&&(candidate=jwk2.crv==="Ed25519"||jwk2.crv==="Ed448"),candidate)switch(alg){case"ES256":candidate=jwk2.crv==="P-256";break;case"ES256K":candidate=jwk2.crv==="secp256k1";break;case"ES384":candidate=jwk2.crv==="P-384";break;case"ES512":candidate=jwk2.crv==="P-521";break}return candidate}),{0:jwk,length}=candidates;if(length===0)throw new errors_js_1.JWKSNoMatchingKey;if(length!==1){let error=new errors_js_1.JWKSMultipleMatchingKeys,{_cached}=this;throw error[Symbol.asyncIterator]=async function*(){for(let jwk2 of candidates)try{yield await importWithAlgCache(_cached,jwk2,alg)}catch{}},error}return importWithAlgCache(this._cached,jwk,alg)}};async function importWithAlgCache(cache,jwk,alg){let cached=cache.get(jwk)||cache.set(jwk,{}).get(jwk);if(cached[alg]===void 0){let key=await(0,import_js_1.importJWK)({...jwk,ext:!0},alg);if(key instanceof Uint8Array||key.type!=="public")throw new errors_js_1.JWKSInvalid("JSON Web Key Set members must be public keys");cached[alg]=key}return cached[alg]}function createLocalJWKSet(jwks){let set=new LocalJWKSet(jwks),localJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);return Object.defineProperties(localJWKSet,{jwks:{value:()=>clone(set._jwks),enumerable:!0,configurable:!1,writable:!1}}),localJWKSet}}});var require_fetch_jwks=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/fetch_jwks.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var http=__require("node:http"),https=__require("node:https"),node_events_1=__require("node:events"),errors_js_1=require_errors(),buffer_utils_js_1=require_buffer_utils(),fetchJwks=async(url,timeout,options)=>{let get;switch(url.protocol){case"https:":get=https.get;break;case"http:":get=http.get;break;default:throw new TypeError("Unsupported URL protocol.")}let{agent,headers}=options,req=get(url.href,{agent,timeout,headers}),[response]=await Promise.race([(0,node_events_1.once)(req,"response"),(0,node_events_1.once)(req,"timeout")]);if(!response)throw req.destroy(),new errors_js_1.JWKSTimeout;if(response.statusCode!==200)throw new errors_js_1.JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");let parts=[];for await(let part of response)parts.push(part);try{return JSON.parse(buffer_utils_js_1.decoder.decode((0,buffer_utils_js_1.concat)(...parts)))}catch{throw new errors_js_1.JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}};exports.default=fetchJwks}});var require_remote=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwks/remote.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.experimental_jwksCache=exports.jwksCache=void 0;exports.createRemoteJWKSet=createRemoteJWKSet;var fetch_jwks_js_1=require_fetch_jwks(),errors_js_1=require_errors(),local_js_1=require_local(),is_object_js_1=require_is_object();function isCloudflareWorkers(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var USER_AGENT;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(USER_AGENT="jose/v5.9.6");exports.jwksCache=Symbol();function isFreshJwksCache(input,cacheMaxAge){return!(typeof input!="object"||input===null||!("uat"in input)||typeof input.uat!="number"||Date.now()-input.uat>=cacheMaxAge||!("jwks"in input)||!(0,is_object_js_1.default)(input.jwks)||!Array.isArray(input.jwks.keys)||!Array.prototype.every.call(input.jwks.keys,is_object_js_1.default))}var RemoteJWKSet=class{_url;_timeoutDuration;_cooldownDuration;_cacheMaxAge;_jwksTimestamp;_pendingFetch;_options;_local;_cache;constructor(url,options){if(!(url instanceof URL))throw new TypeError("url must be an instance of URL");this._url=new URL(url.href),this._options={agent:options?.agent,headers:options?.headers},this._timeoutDuration=typeof options?.timeoutDuration=="number"?options?.timeoutDuration:5e3,this._cooldownDuration=typeof options?.cooldownDuration=="number"?options?.cooldownDuration:3e4,this._cacheMaxAge=typeof options?.cacheMaxAge=="number"?options?.cacheMaxAge:6e5,options?.[exports.jwksCache]!==void 0&&(this._cache=options?.[exports.jwksCache],isFreshJwksCache(options?.[exports.jwksCache],this._cacheMaxAge)&&(this._jwksTimestamp=this._cache.uat,this._local=(0,local_js_1.createLocalJWKSet)(this._cache.jwks)))}coolingDown(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cooldownDuration:!1}fresh(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cacheMaxAge:!1}async getKey(protectedHeader,token){(!this._local||!this.fresh())&&await this.reload();try{return await this._local(protectedHeader,token)}catch(err){if(err instanceof errors_js_1.JWKSNoMatchingKey&&this.coolingDown()===!1)return await this.reload(),this._local(protectedHeader,token);throw err}}async reload(){this._pendingFetch&&isCloudflareWorkers()&&(this._pendingFetch=void 0);let headers=new Headers(this._options.headers);USER_AGENT&&!headers.has("User-Agent")&&(headers.set("User-Agent",USER_AGENT),this._options.headers=Object.fromEntries(headers.entries())),this._pendingFetch||=(0,fetch_jwks_js_1.default)(this._url,this._timeoutDuration,this._options).then(json=>{this._local=(0,local_js_1.createLocalJWKSet)(json),this._cache&&(this._cache.uat=Date.now(),this._cache.jwks=json),this._jwksTimestamp=Date.now(),this._pendingFetch=void 0}).catch(err=>{throw this._pendingFetch=void 0,err}),await this._pendingFetch}};function createRemoteJWKSet(url,options){let set=new RemoteJWKSet(url,options),remoteJWKSet=async(protectedHeader,token)=>set.getKey(protectedHeader,token);return Object.defineProperties(remoteJWKSet,{coolingDown:{get:()=>set.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>set.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>set.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>!!set._pendingFetch,enumerable:!0,configurable:!1},jwks:{value:()=>set._local?.jwks(),enumerable:!0,configurable:!1,writable:!1}}),remoteJWKSet}exports.experimental_jwksCache=exports.jwksCache}});var require_unsecured=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/jwt/unsecured.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.UnsecuredJWT=void 0;var base64url=require_base64url(),buffer_utils_js_1=require_buffer_utils(),errors_js_1=require_errors(),jwt_claims_set_js_1=require_jwt_claims_set(),produce_js_1=require_produce(),UnsecuredJWT=class extends produce_js_1.ProduceJWT{encode(){let header=base64url.encode(JSON.stringify({alg:"none"})),payload=base64url.encode(JSON.stringify(this._payload));return`${header}.${payload}.`}static decode(jwt,options){if(typeof jwt!="string")throw new errors_js_1.JWTInvalid("Unsecured JWT must be a string");let{0:encodedHeader,1:encodedPayload,2:signature,length}=jwt.split(".");if(length!==3||signature!=="")throw new errors_js_1.JWTInvalid("Invalid Unsecured JWT");let header;try{if(header=JSON.parse(buffer_utils_js_1.decoder.decode(base64url.decode(encodedHeader))),header.alg!=="none")throw new Error}catch{throw new errors_js_1.JWTInvalid("Invalid Unsecured JWT")}return{payload:(0,jwt_claims_set_js_1.default)(header,base64url.decode(encodedPayload),options),header}}};exports.UnsecuredJWT=UnsecuredJWT}});var require_base64url2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/util/base64url.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decode=exports.encode=void 0;var base64url=require_base64url();exports.encode=base64url.encode;exports.decode=base64url.decode}});var require_decode_protected_header=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/util/decode_protected_header.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decodeProtectedHeader=decodeProtectedHeader;var base64url_js_1=require_base64url2(),buffer_utils_js_1=require_buffer_utils(),is_object_js_1=require_is_object();function decodeProtectedHeader(token){let protectedB64u;if(typeof token=="string"){let parts=token.split(".");(parts.length===3||parts.length===5)&&([protectedB64u]=parts)}else if(typeof token=="object"&&token)if("protected"in token)protectedB64u=token.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof protectedB64u!="string"||!protectedB64u)throw new Error;let result=JSON.parse(buffer_utils_js_1.decoder.decode((0,base64url_js_1.decode)(protectedB64u)));if(!(0,is_object_js_1.default)(result))throw new Error;return result}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}}});var require_decode_jwt=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/util/decode_jwt.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.decodeJwt=decodeJwt;var base64url_js_1=require_base64url2(),buffer_utils_js_1=require_buffer_utils(),is_object_js_1=require_is_object(),errors_js_1=require_errors();function decodeJwt(jwt){if(typeof jwt!="string")throw new errors_js_1.JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");let{1:payload,length}=jwt.split(".");if(length===5)throw new errors_js_1.JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");if(length!==3)throw new errors_js_1.JWTInvalid("Invalid JWT");if(!payload)throw new errors_js_1.JWTInvalid("JWTs must contain a payload");let decoded;try{decoded=(0,base64url_js_1.decode)(payload)}catch{throw new errors_js_1.JWTInvalid("Failed to base64url decode the payload")}let result;try{result=JSON.parse(buffer_utils_js_1.decoder.decode(decoded))}catch{throw new errors_js_1.JWTInvalid("Failed to parse the decoded payload as JSON")}if(!(0,is_object_js_1.default)(result))throw new errors_js_1.JWTInvalid("Invalid JWT Claims Set");return result}}});var require_generate=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/generate.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.generateSecret=generateSecret;exports.generateKeyPair=generateKeyPair;var node_crypto_1=__require("node:crypto"),node_util_1=__require("node:util"),random_js_1=require_random(),errors_js_1=require_errors(),generate=(0,node_util_1.promisify)(node_crypto_1.generateKeyPair);async function generateSecret(alg,options){let length;switch(alg){case"HS256":case"HS384":case"HS512":case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":length=parseInt(alg.slice(-3),10);break;case"A128KW":case"A192KW":case"A256KW":case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":length=parseInt(alg.slice(1,4),10);break;default:throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return(0,node_crypto_1.createSecretKey)((0,random_js_1.default)(new Uint8Array(length>>3)))}async function generateKeyPair(alg,options){switch(alg){case"RS256":case"RS384":case"RS512":case"PS256":case"PS384":case"PS512":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":case"RSA1_5":{let modulusLength=options?.modulusLength??2048;if(typeof modulusLength!="number"||modulusLength<2048)throw new errors_js_1.JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return await generate("rsa",{modulusLength,publicExponent:65537})}case"ES256":return generate("ec",{namedCurve:"P-256"});case"ES256K":return generate("ec",{namedCurve:"secp256k1"});case"ES384":return generate("ec",{namedCurve:"P-384"});case"ES512":return generate("ec",{namedCurve:"P-521"});case"EdDSA":switch(options?.crv){case void 0:case"Ed25519":return generate("ed25519");case"Ed448":return generate("ed448");default:throw new errors_js_1.JOSENotSupported("Invalid or unsupported crv option provided, supported values are Ed25519 and Ed448")}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let crv=options?.crv??"P-256";switch(crv){case void 0:case"P-256":case"P-384":case"P-521":return generate("ec",{namedCurve:crv});case"X25519":return generate("x25519");case"X448":return generate("x448");default:throw new errors_js_1.JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448")}}default:throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}}}});var require_generate_key_pair=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/key/generate_key_pair.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.generateKeyPair=generateKeyPair;var generate_js_1=require_generate();async function generateKeyPair(alg,options){return(0,generate_js_1.generateKeyPair)(alg,options)}}});var require_generate_secret=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/key/generate_secret.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.generateSecret=generateSecret;var generate_js_1=require_generate();async function generateSecret(alg,options){return(0,generate_js_1.generateSecret)(alg,options)}}});var require_runtime=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/runtime/runtime.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.default="node:crypto"}});var require_runtime2=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/util/runtime.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});var runtime_js_1=require_runtime();exports.default=runtime_js_1.default}});var require_cjs=__commonJS({"../../node_modules/.pnpm/jose@5.9.6/node_modules/jose/dist/node/cjs/index.js"(exports){"use strict";Object.defineProperty(exports,"__esModule",{value:!0});exports.cryptoRuntime=exports.base64url=exports.generateSecret=exports.generateKeyPair=exports.errors=exports.decodeJwt=exports.decodeProtectedHeader=exports.importJWK=exports.importX509=exports.importPKCS8=exports.importSPKI=exports.exportJWK=exports.exportSPKI=exports.exportPKCS8=exports.UnsecuredJWT=exports.experimental_jwksCache=exports.jwksCache=exports.createRemoteJWKSet=exports.createLocalJWKSet=exports.EmbeddedJWK=exports.calculateJwkThumbprintUri=exports.calculateJwkThumbprint=exports.EncryptJWT=exports.SignJWT=exports.GeneralSign=exports.FlattenedSign=exports.CompactSign=exports.FlattenedEncrypt=exports.CompactEncrypt=exports.jwtDecrypt=exports.jwtVerify=exports.generalVerify=exports.flattenedVerify=exports.compactVerify=exports.GeneralEncrypt=exports.generalDecrypt=exports.flattenedDecrypt=exports.compactDecrypt=void 0;var decrypt_js_1=require_decrypt3();Object.defineProperty(exports,"compactDecrypt",{enumerable:!0,get:function(){return decrypt_js_1.compactDecrypt}});var decrypt_js_2=require_decrypt2();Object.defineProperty(exports,"flattenedDecrypt",{enumerable:!0,get:function(){return decrypt_js_2.flattenedDecrypt}});var decrypt_js_3=require_decrypt4();Object.defineProperty(exports,"generalDecrypt",{enumerable:!0,get:function(){return decrypt_js_3.generalDecrypt}});var encrypt_js_1=require_encrypt3();Object.defineProperty(exports,"GeneralEncrypt",{enumerable:!0,get:function(){return encrypt_js_1.GeneralEncrypt}});var verify_js_1=require_verify3();Object.defineProperty(exports,"compactVerify",{enumerable:!0,get:function(){return verify_js_1.compactVerify}});var verify_js_2=require_verify2();Object.defineProperty(exports,"flattenedVerify",{enumerable:!0,get:function(){return verify_js_2.flattenedVerify}});var verify_js_3=require_verify4();Object.defineProperty(exports,"generalVerify",{enumerable:!0,get:function(){return verify_js_3.generalVerify}});var verify_js_4=require_verify5();Object.defineProperty(exports,"jwtVerify",{enumerable:!0,get:function(){return verify_js_4.jwtVerify}});var decrypt_js_4=require_decrypt5();Object.defineProperty(exports,"jwtDecrypt",{enumerable:!0,get:function(){return decrypt_js_4.jwtDecrypt}});var encrypt_js_2=require_encrypt4();Object.defineProperty(exports,"CompactEncrypt",{enumerable:!0,get:function(){return encrypt_js_2.CompactEncrypt}});var encrypt_js_3=require_encrypt2();Object.defineProperty(exports,"FlattenedEncrypt",{enumerable:!0,get:function(){return encrypt_js_3.FlattenedEncrypt}});var sign_js_1=require_sign3();Object.defineProperty(exports,"CompactSign",{enumerable:!0,get:function(){return sign_js_1.CompactSign}});var sign_js_2=require_sign2();Object.defineProperty(exports,"FlattenedSign",{enumerable:!0,get:function(){return sign_js_2.FlattenedSign}});var sign_js_3=require_sign4();Object.defineProperty(exports,"GeneralSign",{enumerable:!0,get:function(){return sign_js_3.GeneralSign}});var sign_js_4=require_sign5();Object.defineProperty(exports,"SignJWT",{enumerable:!0,get:function(){return sign_js_4.SignJWT}});var encrypt_js_4=require_encrypt5();Object.defineProperty(exports,"EncryptJWT",{enumerable:!0,get:function(){return encrypt_js_4.EncryptJWT}});var thumbprint_js_1=require_thumbprint();Object.defineProperty(exports,"calculateJwkThumbprint",{enumerable:!0,get:function(){return thumbprint_js_1.calculateJwkThumbprint}});Object.defineProperty(exports,"calculateJwkThumbprintUri",{enumerable:!0,get:function(){return thumbprint_js_1.calculateJwkThumbprintUri}});var embedded_js_1=require_embedded();Object.defineProperty(exports,"EmbeddedJWK",{enumerable:!0,get:function(){return embedded_js_1.EmbeddedJWK}});var local_js_1=require_local();Object.defineProperty(exports,"createLocalJWKSet",{enumerable:!0,get:function(){return local_js_1.createLocalJWKSet}});var remote_js_1=require_remote();Object.defineProperty(exports,"createRemoteJWKSet",{enumerable:!0,get:function(){return remote_js_1.createRemoteJWKSet}});Object.defineProperty(exports,"jwksCache",{enumerable:!0,get:function(){return remote_js_1.jwksCache}});Object.defineProperty(exports,"experimental_jwksCache",{enumerable:!0,get:function(){return remote_js_1.experimental_jwksCache}});var unsecured_js_1=require_unsecured();Object.defineProperty(exports,"UnsecuredJWT",{enumerable:!0,get:function(){return unsecured_js_1.UnsecuredJWT}});var export_js_1=require_export();Object.defineProperty(exports,"exportPKCS8",{enumerable:!0,get:function(){return export_js_1.exportPKCS8}});Object.defineProperty(exports,"exportSPKI",{enumerable:!0,get:function(){return export_js_1.exportSPKI}});Object.defineProperty(exports,"exportJWK",{enumerable:!0,get:function(){return export_js_1.exportJWK}});var import_js_1=require_import();Object.defineProperty(exports,"importSPKI",{enumerable:!0,get:function(){return import_js_1.importSPKI}});Object.defineProperty(exports,"importPKCS8",{enumerable:!0,get:function(){return import_js_1.importPKCS8}});Object.defineProperty(exports,"importX509",{enumerable:!0,get:function(){return import_js_1.importX509}});Object.defineProperty(exports,"importJWK",{enumerable:!0,get:function(){return import_js_1.importJWK}});var decode_protected_header_js_1=require_decode_protected_header();Object.defineProperty(exports,"decodeProtectedHeader",{enumerable:!0,get:function(){return decode_protected_header_js_1.decodeProtectedHeader}});var decode_jwt_js_1=require_decode_jwt();Object.defineProperty(exports,"decodeJwt",{enumerable:!0,get:function(){return decode_jwt_js_1.decodeJwt}});exports.errors=require_errors();var generate_key_pair_js_1=require_generate_key_pair();Object.defineProperty(exports,"generateKeyPair",{enumerable:!0,get:function(){return generate_key_pair_js_1.generateKeyPair}});var generate_secret_js_1=require_generate_secret();Object.defineProperty(exports,"generateSecret",{enumerable:!0,get:function(){return generate_secret_js_1.generateSecret}});exports.base64url=require_base64url2();var runtime_js_1=require_runtime2();Object.defineProperty(exports,"cryptoRuntime",{enumerable:!0,get:function(){return runtime_js_1.default}})}});export{require_cjs};

package/dist/chunks/{chunk-DBPN2VGJ.js → chunk-B4XGTAFO.js}

@@ -4,7 +4,7 @@ import { dirname as __dirname_ } from 'node:path';
 const require = __createRequire(import.meta.url);
 const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
-import{getResolvedOrderMetadata,getRollupColumnName}from"./chunk-YO6SJCZP.js";import{formatGranularity}from"./chunk-IVSSTHB6.js";import{indent_default}from"./chunk-GZNDA6SV.js";import{ellipsizeMiddle}from"./chunk-TOTTVS5P.js";import{table}from"./chunk-375JVQYK.js";import{elapsed}from"./chunk-Q7D7RGXM.js";import{require_ms}from"./chunk-MXTC4ZAQ.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var CANONICAL_AGGREGATIONS=["count","sum","avg","min","max","p50","p75","p90","p95","p99","stddev"];function isCanonicalAggregation(aggregation){return CANONICAL_AGGREGATIONS.includes(aggregation)}var DURATION_UNITS=new Set(["nanoseconds","microseconds","milliseconds","seconds","minutes","hours","days"]);function normalizeMetricUnit(unit){return unit.trim().toLowerCase().replace(/[_\s]+/g," ")}function getPreferredCustomMetricAggregation(unit){let normalizedUnit=normalizeMetricUnit(unit);return DURATION_UNITS.has(normalizedUnit)?"p75":normalizedUnit==="percent"?"avg":"sum"}function getDefaultCustomMetricAggregation(unit,aggregations){let preferredAggregation=getPreferredCustomMetricAggregation(unit);return aggregations?.includes(preferredAggregation)?preferredAggregation:aggregations?.includes("sum")?"sum":aggregations?.find(isCanonicalAggregation)}var import_ms=__toESM(require_ms(),1),MINUTE_MS=60*1e3,HOUR_MS=60*MINUTE_MS,DAY_MS=24*HOUR_MS;function toGranularityDuration(input){let milliseconds=(0,import_ms.default)(input);if(milliseconds===void 0)throw new Error(`Invalid granularity format "${input}". Use 1m, 5m, 15m, 1h, 4h, 1d.`);return milliseconds>=DAY_MS?{days:milliseconds/DAY_MS}:milliseconds>=HOUR_MS?{hours:milliseconds/HOUR_MS}:{minutes:milliseconds/MINUTE_MS}}function toGranularityMs(input){let milliseconds=(0,import_ms.default)(input);if(milliseconds===void 0)throw new Error(`Invalid granularity format "${input}".`);return milliseconds}var GRANULARITY_THRESHOLDS=[[1*HOUR_MS,"1m","1m"],[2*HOUR_MS,"5m","5m"],[12*HOUR_MS,"15m","5m"],[3*DAY_MS,"1h","1h"],[30*DAY_MS,"4h","4h"]],FALLBACK_GRANULARITY="1d";function getAutoGranularity(rangeMs){for(let[maxRange,defaultG]of GRANULARITY_THRESHOLDS)if(rangeMs<=maxRange)return defaultG;return FALLBACK_GRANULARITY}function getMinGranularity(rangeMs){for(let[maxRange,,minG]of GRANULARITY_THRESHOLDS)if(rangeMs<=maxRange)return minG;return FALLBACK_GRANULARITY}function computeGranularity(rangeMs,explicit){if(!explicit){let auto=getAutoGranularity(rangeMs);return{duration:toGranularityDuration(auto),adjusted:!1}}let minG=getMinGranularity(rangeMs),explicitMs=toGranularityMs(explicit),minMs=toGranularityMs(minG);if(explicitMs<minMs){let rangeDays=Math.round(rangeMs/DAY_MS),rangeHours=Math.round(rangeMs/HOUR_MS),rangeLabel=rangeDays>=1?`${rangeDays}-day`:`${rangeHours}-hour`;return{duration:toGranularityDuration(minG),adjusted:!0,notice:`Granularity adjusted from ${explicit} to ${minG} for a ${rangeLabel} time range.`}}return{duration:toGranularityDuration(explicit),adjusted:!1}}function toGranularityMsFromDuration(duration){return"minutes"in duration?duration.minutes*MINUTE_MS:"hours"in duration?duration.hours*HOUR_MS:duration.days*DAY_MS}var import_chalk=__toESM(require_source(),1);var GROUP_KEY_DELIMITER="",MAX_SPARKLINE_LENGTH=120,DURATION_SCALE_MS={seconds:1e3,minutes:6e4,hours:36e5,days:864e5},BYTE_SCALE={bytes:1,kilobytes:1e3,megabytes:1e6,gigabytes:1e9,terabytes:1e12,petabytes:1e15},COMPACT_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{notation:"compact",compactDisplay:"short"}),TWO_FRACTION_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{maximumFractionDigits:2}),TWO_SIGNIFICANT_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{minimumSignificantDigits:2,maximumSignificantDigits:2,maximumFractionDigits:2}),PERCENTAGE_FORMATTER=new Intl.NumberFormat("en-US",{style:"unit",unit:"percent",unitDisplay:"narrow",maximumFractionDigits:1}),USD_FORMATTER=new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",minimumFractionDigits:2,maximumFractionDigits:2}),BLOCKS=["\u2581","\u2582","\u2583","\u2584","\u2585","\u2586","\u2587","\u2588"],MISSING_CHAR="\xB7";function isAggregationWithDimension(aggregation){let[,dimension]=aggregation.split("/");return!!dimension}function toGroupKey(groupValues){return groupValues.length===0?"":groupValues.join(GROUP_KEY_DELIMITER)}function pad2(n){return String(n).padStart(2,"0")}function pad4(n){return String(n).padStart(4,"0")}function formatHumanMinute(date){return`${pad4(date.getUTCFullYear())}-${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`}function formatPeriodBound(input){let date=new Date(input);return isNaN(date.getTime())?input:formatHumanMinute(date)}function formatPeriodSpan(startInput,endInput){let start=Date.parse(startInput),durationMs=Date.parse(endInput)-start;return!Number.isFinite(durationMs)||durationMs<=0?null:elapsed(durationMs)}function getStatColumns(aggregation){return aggregation==="sum"||aggregation==="count"?["total","avg","min","max"]:["avg","min","max"]}function toNumericValue(value){if(value==null)return null;if(typeof value=="number")return Number.isFinite(value)?value:null;let parsed=Number(value);return Number.isFinite(parsed)?parsed:null}function isNonNullNumber(value){return value!==null}function isPointWithValue(point){return point.value!==null}function getOrCreate(map,key,make){let existing=map.get(key);if(existing!==void 0)return existing;let created=make();return map.set(key,created),created}function getGroupFieldValue(row,field){let value=row[field];return value==null||value===""?"(not set)":String(value)}function normalizeTimestampToIso(timestamp){let parsed=Date.parse(timestamp);return isNaN(parsed)?null:new Date(parsed).toISOString()}function formatStatCell(column,stats,periodStart,periodEnd,formatValue){switch(column){case"total":return formatValue(stats.total);case"avg":return formatValue(stats.avg,{preserveFractionalCount:!0});case"min":{let ts=formatMinMaxTimestamp(new Date(stats.min.timestamp),periodStart,periodEnd);return`${formatValue(stats.min.value)} at ${ts}`}case"max":{let ts=formatMinMaxTimestamp(new Date(stats.max.timestamp),periodStart,periodEnd);return`${formatValue(stats.max.value)} at ${ts}`}}}function buildExpectedTimestamps(periodStart,periodEnd,granularityMs){let start=Date.parse(periodStart),end=Date.parse(periodEnd);if(isNaN(start)||isNaN(end)||granularityMs<=0||end<=start)return[];let timestamps=[];for(let current=start;current<end;current+=granularityMs)timestamps.push(new Date(current).toISOString());return timestamps}function buildObservedTimestamps(observedTimestamps,granularityMs){let timestamps=[...observedTimestamps].map(timestamp=>Date.parse(timestamp)).filter(Number.isFinite).sort((a,b)=>a-b);if(timestamps.length===0||granularityMs<=0)return[];let start=timestamps[0],end=timestamps[timestamps.length-1]+granularityMs;return buildExpectedTimestamps(new Date(start).toISOString(),new Date(end).toISOString(),granularityMs)}function buildSeriesTimestamps(periodStart,periodEnd,granularityMs,observedTimestamps){let expectedTimestamps=buildExpectedTimestamps(periodStart,periodEnd,granularityMs);return observedTimestamps.size===0||expectedTimestamps.some(timestamp=>observedTimestamps.has(timestamp))?expectedTimestamps:buildObservedTimestamps(observedTimestamps,granularityMs)}function formatCount(n){return Math.round(n).toLocaleString("en-US")}function formatDecimal(n){if(!Number.isFinite(n))return String(n);if(n===0||Object.is(n,-0))return"0";let sign=n<0?"-":"",abs=Math.abs(n);if(abs>=1)return`${sign}${abs.toFixed(1)}`;let exponent=Math.floor(Math.log10(abs)),decimals=Math.min(20,Math.max(2,-exponent+1)),trimmed=abs.toFixed(decimals).replace(/(\.\d*?[1-9])0+$/,"$1").replace(/\.0+$/,"").replace(/\.$/,"");return`${sign}${trimmed}`}function formatDuration(durationMs){let durationSeconds=durationMs/1e3;return durationMs<1e3?`${durationMs.toFixed(0)}ms`:durationMs<5e3?`${Math.round(durationSeconds*100)/100}s`:durationSeconds<60?`${durationSeconds.toFixed(0)}s`:durationSeconds<3600?`${(durationSeconds/60).toFixed(0)}m`:`${(durationSeconds/3600).toFixed(0)}h`}function formatBytes(bytes){if(bytes===0)return"0 Bytes";let units=["Bytes","KB","MB","GB","TB","PB"],absoluteBytes=Math.abs(bytes),unitIndex=Math.min(units.length-1,Math.max(0,Math.floor(Math.log(absoluteBytes)/Math.log(1e3)))),value=bytes/1e3**unitIndex;return(unitIndex===1||unitIndex===2)&&(value=Math.round(value),Math.abs(value)===1e3&&unitIndex<units.length-1&&(value/=1e3,unitIndex+=1)),`${TWO_FRACTION_NUMBER_FORMATTER.format(value)} ${units[unitIndex]}`}function formatMetricValue(value,baseUnit,aggregation,opts){let formatCountValue=()=>opts?.preserveFractionalCount&&!Number.isInteger(value)?formatDecimal(value):formatCount(value);if(isAggregationWithDimension(aggregation)||aggregation==="count")return formatCountValue();let unit=normalizeMetricUnit(baseUnit??"units");if(aggregation==="percent"||unit==="percent")return PERCENTAGE_FORMATTER.format(value);if(aggregation==="unique")return COMPACT_NUMBER_FORMATTER.format(value);let withRateSuffix=formatted2=>aggregation==="persecond"?`${formatted2}/s`:formatted2;if(unit==="milliseconds")return withRateSuffix(formatDuration(value));let durationScale=DURATION_SCALE_MS[unit];if(durationScale)return withRateSuffix(formatDuration(value*durationScale));if(unit==="nanoseconds"||unit==="microseconds"){let suffix=unit==="nanoseconds"?" ns":" \xB5s",formatted2=TWO_FRACTION_NUMBER_FORMATTER.format(value);return withRateSuffix(`${formatted2}${suffix}`)}let byteScale=BYTE_SCALE[unit];if(byteScale)return withRateSuffix(formatBytes(value*byteScale));if(unit==="gigabyte hour"||unit==="gigabyte hours"){let formatted2=TWO_SIGNIFICANT_NUMBER_FORMATTER.format(value);return withRateSuffix(`${formatted2} GB-hrs`)}if(unit==="usd"||unit==="us dollars"||unit==="dollars")return withRateSuffix(USD_FORMATTER.format(value));if(unit==="count"&&aggregation==="sum")return formatCountValue();let formatted=COMPACT_NUMBER_FORMATTER.format(value),unitLabel=baseUnit?.trim();return withRateSuffix(!unitLabel||unit==="units"||unit==="count"||unit==="ratio"?formatted:`${formatted} ${unitLabel}`)}function formatMinMaxTimestamp(date,periodStart,periodEnd){return periodStart.getUTCFullYear()===periodEnd.getUTCFullYear()&&periodStart.getUTCMonth()===periodEnd.getUTCMonth()&&periodStart.getUTCDate()===periodEnd.getUTCDate()?`${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`:periodStart.getUTCFullYear()===periodEnd.getUTCFullYear()?`${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`:`${pad4(date.getUTCFullYear())}-${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`}function extractGroupedSeries(data,groupBy,rollupColumn,periodStart,periodEnd,granularityMs){let groups=[],groupValues=new Map,valueByGroup=new Map,observedTimestamps=new Set;for(let row of data){let values=groupBy.map(field=>getGroupFieldValue(row,field)),key=toGroupKey(values);groupValues.has(key)||(groups.push(key),groupValues.set(key,values));let groupMap=getOrCreate(valueByGroup,key,()=>new Map),rawTimestamp=row.timestamp;if(rawTimestamp.length===0)continue;let timestamp=normalizeTimestampToIso(rawTimestamp);if(!timestamp)continue;observedTimestamps.add(timestamp);let numeric=toNumericValue(row[rollupColumn]);groupMap.set(timestamp,numeric)}let expectedTimestamps=buildSeriesTimestamps(periodStart,periodEnd,granularityMs,observedTimestamps),series=new Map;for(let key of groups){let byTimestamp=valueByGroup.get(key);if(!byTimestamp)continue;let points=expectedTimestamps.map(timestamp=>({timestamp,value:byTimestamp.has(timestamp)?byTimestamp.get(timestamp)??null:null}));series.set(key,points)}return{groups,series,groupValues}}function computeGroupStats(points){let present=points.filter(isPointWithValue);if(present.length===0)return{total:0,avg:0,min:{value:0,timestamp:""},max:{value:0,timestamp:""},count:0,allMissing:!0};let total=0,min=present[0],max=present[0];for(let point of present)total+=point.value,point.value<min.value&&(min=point),point.value>max.value&&(max=point);return{total,avg:total/present.length,min:{value:min.value,timestamp:min.timestamp},max:{value:max.value,timestamp:max.timestamp},count:present.length,allMissing:!1}}var MAX_GROUP_VALUE_LENGTH=60;function downsample(values,maxLen){if(maxLen<=0)return[];if(values.length<=maxLen)return[...values];let result=[];for(let i=0;i<maxLen;i++){let start=Math.floor(i*values.length/maxLen),end=Math.floor((i+1)*values.length/maxLen),bucket=values.slice(start,Math.max(start+1,end)),nullCount=bucket.filter(value=>value===null).length;if(nullCount===bucket.length||nullCount>bucket.length/2){result.push(null);continue}let present=bucket.filter(isNonNullNumber),avg=present.reduce((sum,value)=>sum+value,0)/present.length;result.push(avg)}return result}function generateSparkline(values){let sampled=downsample(values,MAX_SPARKLINE_LENGTH);if(sampled.length===0)return"";let present=sampled.filter(isNonNullNumber);if(present.length===0)return sampled.map(()=>MISSING_CHAR).join("");let min=Math.min(...present),max=Math.max(...present);if(min===max){let block=min===0?BLOCKS[0]:BLOCKS[BLOCKS.length-1];return sampled.map(value=>value===null?MISSING_CHAR:block).join("")}let range=max-min;return sampled.map(value=>{if(value===null)return MISSING_CHAR;let ratio=(value-min)/range,index=Math.max(0,Math.min(BLOCKS.length-1,Math.round(ratio*(BLOCKS.length-1))));return BLOCKS[index]}).join("")}function formatMetadataHeader(opts){let periodSpan=opts.compact?formatPeriodSpan(opts.periodStart,opts.periodEnd):null,rows=[];return opts.compact||rows.push({key:"Metric",value:`${opts.metric} ${opts.aggregation}`}),rows.push({key:"Period",value:`${formatPeriodBound(opts.periodStart)} to ${formatPeriodBound(opts.periodEnd)} (UTC)${periodSpan?` ${periodSpan}`:""}`},{key:"Interval",value:"days"in opts.granularity?`${formatGranularity(opts.granularity)} (${opts.bucketTimezone??"UTC"})`:formatGranularity(opts.granularity)}),typeof opts.periodUnique=="number"&&rows.push({key:"Unique (period)",value:formatCount(opts.periodUnique)}),!opts.compact&&opts.filter&&rows.push({key:"Filter",value:opts.filter}),!opts.compact&&opts.orderBy&&opts.orderDirection&&rows.push({key:"Order By",value:`${opts.orderBy} ${opts.orderDirection}${opts.orderBy==="count"?" (default)":""}`}),opts.scope.type==="project"?rows.push({key:"Project",value:`${opts.projectName??opts.scope.projectIds[0]} (${opts.teamName??opts.scope.ownerId})`}):rows.push({key:"Team",value:`${opts.teamName??opts.scope.ownerId} (all projects)`}),!opts.compact&&typeof opts.groupCount=="number"&&rows.push({key:"Groups",value:String(opts.groupCount)}),rows.map(row=>`> ${import_chalk.default.gray(`${row.key}:`)} ${row.value}`).join(`
+import{getResolvedOrderMetadata,getRollupColumnName}from"./chunk-WYGOYE6C.js";import{formatGranularity}from"./chunk-IVSSTHB6.js";import{indent_default}from"./chunk-GZNDA6SV.js";import{ellipsizeMiddle}from"./chunk-TOTTVS5P.js";import{table}from"./chunk-375JVQYK.js";import{elapsed}from"./chunk-Q7D7RGXM.js";import{require_ms}from"./chunk-MXTC4ZAQ.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var CANONICAL_AGGREGATIONS=["count","sum","avg","min","max","p50","p75","p90","p95","p99","stddev"];function isCanonicalAggregation(aggregation){return CANONICAL_AGGREGATIONS.includes(aggregation)}var DURATION_UNITS=new Set(["nanoseconds","microseconds","milliseconds","seconds","minutes","hours","days"]);function normalizeMetricUnit(unit){return unit.trim().toLowerCase().replace(/[_\s]+/g," ")}function getPreferredCustomMetricAggregation(unit){let normalizedUnit=normalizeMetricUnit(unit);return DURATION_UNITS.has(normalizedUnit)?"p75":normalizedUnit==="percent"?"avg":"sum"}function getDefaultCustomMetricAggregation(unit,aggregations){let preferredAggregation=getPreferredCustomMetricAggregation(unit);return aggregations?.includes(preferredAggregation)?preferredAggregation:aggregations?.includes("sum")?"sum":aggregations?.find(isCanonicalAggregation)}var import_ms=__toESM(require_ms(),1),MINUTE_MS=60*1e3,HOUR_MS=60*MINUTE_MS,DAY_MS=24*HOUR_MS;function toGranularityDuration(input){let milliseconds=(0,import_ms.default)(input);if(milliseconds===void 0)throw new Error(`Invalid granularity format "${input}". Use 1m, 5m, 15m, 1h, 4h, 1d.`);return milliseconds>=DAY_MS?{days:milliseconds/DAY_MS}:milliseconds>=HOUR_MS?{hours:milliseconds/HOUR_MS}:{minutes:milliseconds/MINUTE_MS}}function toGranularityMs(input){let milliseconds=(0,import_ms.default)(input);if(milliseconds===void 0)throw new Error(`Invalid granularity format "${input}".`);return milliseconds}var GRANULARITY_THRESHOLDS=[[1*HOUR_MS,"1m","1m"],[2*HOUR_MS,"5m","5m"],[12*HOUR_MS,"15m","5m"],[3*DAY_MS,"1h","1h"],[30*DAY_MS,"4h","4h"]],FALLBACK_GRANULARITY="1d";function getAutoGranularity(rangeMs){for(let[maxRange,defaultG]of GRANULARITY_THRESHOLDS)if(rangeMs<=maxRange)return defaultG;return FALLBACK_GRANULARITY}function getMinGranularity(rangeMs){for(let[maxRange,,minG]of GRANULARITY_THRESHOLDS)if(rangeMs<=maxRange)return minG;return FALLBACK_GRANULARITY}function computeGranularity(rangeMs,explicit){if(!explicit){let auto=getAutoGranularity(rangeMs);return{duration:toGranularityDuration(auto),adjusted:!1}}let minG=getMinGranularity(rangeMs),explicitMs=toGranularityMs(explicit),minMs=toGranularityMs(minG);if(explicitMs<minMs){let rangeDays=Math.round(rangeMs/DAY_MS),rangeHours=Math.round(rangeMs/HOUR_MS),rangeLabel=rangeDays>=1?`${rangeDays}-day`:`${rangeHours}-hour`;return{duration:toGranularityDuration(minG),adjusted:!0,notice:`Granularity adjusted from ${explicit} to ${minG} for a ${rangeLabel} time range.`}}return{duration:toGranularityDuration(explicit),adjusted:!1}}function toGranularityMsFromDuration(duration){return"minutes"in duration?duration.minutes*MINUTE_MS:"hours"in duration?duration.hours*HOUR_MS:duration.days*DAY_MS}var import_chalk=__toESM(require_source(),1);var GROUP_KEY_DELIMITER="",MAX_SPARKLINE_LENGTH=120,DURATION_SCALE_MS={seconds:1e3,minutes:6e4,hours:36e5,days:864e5},BYTE_SCALE={bytes:1,kilobytes:1e3,megabytes:1e6,gigabytes:1e9,terabytes:1e12,petabytes:1e15},COMPACT_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{notation:"compact",compactDisplay:"short"}),TWO_FRACTION_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{maximumFractionDigits:2}),TWO_SIGNIFICANT_NUMBER_FORMATTER=new Intl.NumberFormat("en-US",{minimumSignificantDigits:2,maximumSignificantDigits:2,maximumFractionDigits:2}),PERCENTAGE_FORMATTER=new Intl.NumberFormat("en-US",{style:"unit",unit:"percent",unitDisplay:"narrow",maximumFractionDigits:1}),USD_FORMATTER=new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",minimumFractionDigits:2,maximumFractionDigits:2}),BLOCKS=["\u2581","\u2582","\u2583","\u2584","\u2585","\u2586","\u2587","\u2588"],MISSING_CHAR="\xB7";function isAggregationWithDimension(aggregation){let[,dimension]=aggregation.split("/");return!!dimension}function toGroupKey(groupValues){return groupValues.length===0?"":groupValues.join(GROUP_KEY_DELIMITER)}function pad2(n){return String(n).padStart(2,"0")}function pad4(n){return String(n).padStart(4,"0")}function formatHumanMinute(date){return`${pad4(date.getUTCFullYear())}-${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`}function formatPeriodBound(input){let date=new Date(input);return isNaN(date.getTime())?input:formatHumanMinute(date)}function formatPeriodSpan(startInput,endInput){let start=Date.parse(startInput),durationMs=Date.parse(endInput)-start;return!Number.isFinite(durationMs)||durationMs<=0?null:elapsed(durationMs)}function getStatColumns(aggregation){return aggregation==="sum"||aggregation==="count"?["total","avg","min","max"]:["avg","min","max"]}function toNumericValue(value){if(value==null)return null;if(typeof value=="number")return Number.isFinite(value)?value:null;let parsed=Number(value);return Number.isFinite(parsed)?parsed:null}function isNonNullNumber(value){return value!==null}function isPointWithValue(point){return point.value!==null}function getOrCreate(map,key,make){let existing=map.get(key);if(existing!==void 0)return existing;let created=make();return map.set(key,created),created}function getGroupFieldValue(row,field){let value=row[field];return value==null||value===""?"(not set)":String(value)}function normalizeTimestampToIso(timestamp){let parsed=Date.parse(timestamp);return isNaN(parsed)?null:new Date(parsed).toISOString()}function formatStatCell(column,stats,periodStart,periodEnd,formatValue){switch(column){case"total":return formatValue(stats.total);case"avg":return formatValue(stats.avg,{preserveFractionalCount:!0});case"min":{let ts=formatMinMaxTimestamp(new Date(stats.min.timestamp),periodStart,periodEnd);return`${formatValue(stats.min.value)} at ${ts}`}case"max":{let ts=formatMinMaxTimestamp(new Date(stats.max.timestamp),periodStart,periodEnd);return`${formatValue(stats.max.value)} at ${ts}`}}}function buildExpectedTimestamps(periodStart,periodEnd,granularityMs){let start=Date.parse(periodStart),end=Date.parse(periodEnd);if(isNaN(start)||isNaN(end)||granularityMs<=0||end<=start)return[];let timestamps=[];for(let current=start;current<end;current+=granularityMs)timestamps.push(new Date(current).toISOString());return timestamps}function buildObservedTimestamps(observedTimestamps,granularityMs){let timestamps=[...observedTimestamps].map(timestamp=>Date.parse(timestamp)).filter(Number.isFinite).sort((a,b)=>a-b);if(timestamps.length===0||granularityMs<=0)return[];let start=timestamps[0],end=timestamps[timestamps.length-1]+granularityMs;return buildExpectedTimestamps(new Date(start).toISOString(),new Date(end).toISOString(),granularityMs)}function buildSeriesTimestamps(periodStart,periodEnd,granularityMs,observedTimestamps){let expectedTimestamps=buildExpectedTimestamps(periodStart,periodEnd,granularityMs);return observedTimestamps.size===0||expectedTimestamps.some(timestamp=>observedTimestamps.has(timestamp))?expectedTimestamps:buildObservedTimestamps(observedTimestamps,granularityMs)}function formatCount(n){return Math.round(n).toLocaleString("en-US")}function formatDecimal(n){if(!Number.isFinite(n))return String(n);if(n===0||Object.is(n,-0))return"0";let sign=n<0?"-":"",abs=Math.abs(n);if(abs>=1)return`${sign}${abs.toFixed(1)}`;let exponent=Math.floor(Math.log10(abs)),decimals=Math.min(20,Math.max(2,-exponent+1)),trimmed=abs.toFixed(decimals).replace(/(\.\d*?[1-9])0+$/,"$1").replace(/\.0+$/,"").replace(/\.$/,"");return`${sign}${trimmed}`}function formatDuration(durationMs){let durationSeconds=durationMs/1e3;return durationMs<1e3?`${durationMs.toFixed(0)}ms`:durationMs<5e3?`${Math.round(durationSeconds*100)/100}s`:durationSeconds<60?`${durationSeconds.toFixed(0)}s`:durationSeconds<3600?`${(durationSeconds/60).toFixed(0)}m`:`${(durationSeconds/3600).toFixed(0)}h`}function formatBytes(bytes){if(bytes===0)return"0 Bytes";let units=["Bytes","KB","MB","GB","TB","PB"],absoluteBytes=Math.abs(bytes),unitIndex=Math.min(units.length-1,Math.max(0,Math.floor(Math.log(absoluteBytes)/Math.log(1e3)))),value=bytes/1e3**unitIndex;return(unitIndex===1||unitIndex===2)&&(value=Math.round(value),Math.abs(value)===1e3&&unitIndex<units.length-1&&(value/=1e3,unitIndex+=1)),`${TWO_FRACTION_NUMBER_FORMATTER.format(value)} ${units[unitIndex]}`}function formatMetricValue(value,baseUnit,aggregation,opts){let formatCountValue=()=>opts?.preserveFractionalCount&&!Number.isInteger(value)?formatDecimal(value):formatCount(value);if(isAggregationWithDimension(aggregation)||aggregation==="count")return formatCountValue();let unit=normalizeMetricUnit(baseUnit??"units");if(aggregation==="percent"||unit==="percent")return PERCENTAGE_FORMATTER.format(value);if(aggregation==="unique")return COMPACT_NUMBER_FORMATTER.format(value);let withRateSuffix=formatted2=>aggregation==="persecond"?`${formatted2}/s`:formatted2;if(unit==="milliseconds")return withRateSuffix(formatDuration(value));let durationScale=DURATION_SCALE_MS[unit];if(durationScale)return withRateSuffix(formatDuration(value*durationScale));if(unit==="nanoseconds"||unit==="microseconds"){let suffix=unit==="nanoseconds"?" ns":" \xB5s",formatted2=TWO_FRACTION_NUMBER_FORMATTER.format(value);return withRateSuffix(`${formatted2}${suffix}`)}let byteScale=BYTE_SCALE[unit];if(byteScale)return withRateSuffix(formatBytes(value*byteScale));if(unit==="gigabyte hour"||unit==="gigabyte hours"){let formatted2=TWO_SIGNIFICANT_NUMBER_FORMATTER.format(value);return withRateSuffix(`${formatted2} GB-hrs`)}if(unit==="usd"||unit==="us dollars"||unit==="dollars")return withRateSuffix(USD_FORMATTER.format(value));if(unit==="count"&&aggregation==="sum")return formatCountValue();let formatted=COMPACT_NUMBER_FORMATTER.format(value),unitLabel=baseUnit?.trim();return withRateSuffix(!unitLabel||unit==="units"||unit==="count"||unit==="ratio"?formatted:`${formatted} ${unitLabel}`)}function formatMinMaxTimestamp(date,periodStart,periodEnd){return periodStart.getUTCFullYear()===periodEnd.getUTCFullYear()&&periodStart.getUTCMonth()===periodEnd.getUTCMonth()&&periodStart.getUTCDate()===periodEnd.getUTCDate()?`${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`:periodStart.getUTCFullYear()===periodEnd.getUTCFullYear()?`${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`:`${pad4(date.getUTCFullYear())}-${pad2(date.getUTCMonth()+1)}-${pad2(date.getUTCDate())} ${pad2(date.getUTCHours())}:${pad2(date.getUTCMinutes())}`}function extractGroupedSeries(data,groupBy,rollupColumn,periodStart,periodEnd,granularityMs){let groups=[],groupValues=new Map,valueByGroup=new Map,observedTimestamps=new Set;for(let row of data){let values=groupBy.map(field=>getGroupFieldValue(row,field)),key=toGroupKey(values);groupValues.has(key)||(groups.push(key),groupValues.set(key,values));let groupMap=getOrCreate(valueByGroup,key,()=>new Map),rawTimestamp=row.timestamp;if(rawTimestamp.length===0)continue;let timestamp=normalizeTimestampToIso(rawTimestamp);if(!timestamp)continue;observedTimestamps.add(timestamp);let numeric=toNumericValue(row[rollupColumn]);groupMap.set(timestamp,numeric)}let expectedTimestamps=buildSeriesTimestamps(periodStart,periodEnd,granularityMs,observedTimestamps),series=new Map;for(let key of groups){let byTimestamp=valueByGroup.get(key);if(!byTimestamp)continue;let points=expectedTimestamps.map(timestamp=>({timestamp,value:byTimestamp.has(timestamp)?byTimestamp.get(timestamp)??null:null}));series.set(key,points)}return{groups,series,groupValues}}function computeGroupStats(points){let present=points.filter(isPointWithValue);if(present.length===0)return{total:0,avg:0,min:{value:0,timestamp:""},max:{value:0,timestamp:""},count:0,allMissing:!0};let total=0,min=present[0],max=present[0];for(let point of present)total+=point.value,point.value<min.value&&(min=point),point.value>max.value&&(max=point);return{total,avg:total/present.length,min:{value:min.value,timestamp:min.timestamp},max:{value:max.value,timestamp:max.timestamp},count:present.length,allMissing:!1}}var MAX_GROUP_VALUE_LENGTH=60;function downsample(values,maxLen){if(maxLen<=0)return[];if(values.length<=maxLen)return[...values];let result=[];for(let i=0;i<maxLen;i++){let start=Math.floor(i*values.length/maxLen),end=Math.floor((i+1)*values.length/maxLen),bucket=values.slice(start,Math.max(start+1,end)),nullCount=bucket.filter(value=>value===null).length;if(nullCount===bucket.length||nullCount>bucket.length/2){result.push(null);continue}let present=bucket.filter(isNonNullNumber),avg=present.reduce((sum,value)=>sum+value,0)/present.length;result.push(avg)}return result}function generateSparkline(values){let sampled=downsample(values,MAX_SPARKLINE_LENGTH);if(sampled.length===0)return"";let present=sampled.filter(isNonNullNumber);if(present.length===0)return sampled.map(()=>MISSING_CHAR).join("");let min=Math.min(...present),max=Math.max(...present);if(min===max){let block=min===0?BLOCKS[0]:BLOCKS[BLOCKS.length-1];return sampled.map(value=>value===null?MISSING_CHAR:block).join("")}let range=max-min;return sampled.map(value=>{if(value===null)return MISSING_CHAR;let ratio=(value-min)/range,index=Math.max(0,Math.min(BLOCKS.length-1,Math.round(ratio*(BLOCKS.length-1))));return BLOCKS[index]}).join("")}function formatMetadataHeader(opts){let periodSpan=opts.compact?formatPeriodSpan(opts.periodStart,opts.periodEnd):null,rows=[];return opts.compact||rows.push({key:"Metric",value:`${opts.metric} ${opts.aggregation}`}),rows.push({key:"Period",value:`${formatPeriodBound(opts.periodStart)} to ${formatPeriodBound(opts.periodEnd)} (UTC)${periodSpan?` ${periodSpan}`:""}`},{key:"Interval",value:"days"in opts.granularity?`${formatGranularity(opts.granularity)} (${opts.bucketTimezone??"UTC"})`:formatGranularity(opts.granularity)}),typeof opts.periodUnique=="number"&&rows.push({key:"Unique (period)",value:formatCount(opts.periodUnique)}),!opts.compact&&opts.filter&&rows.push({key:"Filter",value:opts.filter}),!opts.compact&&opts.orderBy&&opts.orderDirection&&rows.push({key:"Order By",value:`${opts.orderBy} ${opts.orderDirection}${opts.orderBy==="count"?" (default)":""}`}),opts.scope.type==="project"?rows.push({key:"Project",value:`${opts.projectName??opts.scope.projectIds[0]} (${opts.teamName??opts.scope.ownerId})`}):rows.push({key:"Team",value:`${opts.teamName??opts.scope.ownerId} (all projects)`}),!opts.compact&&typeof opts.groupCount=="number"&&rows.push({key:"Groups",value:String(opts.groupCount)}),rows.map(row=>`> ${import_chalk.default.gray(`${row.key}:`)} ${row.value}`).join(`
 `)}function formatSummaryTable(opts){let statColumns=getStatColumns(opts.aggregation),header=[...opts.groupByFields,...statColumns],rows=[header.map(name=>import_chalk.default.bold(import_chalk.default.cyan(name)))];for(let row of opts.rows){let nextRow=row.groupValues.map(v=>ellipsizeMiddle(v,MAX_GROUP_VALUE_LENGTH,opts.ansiAwareGroupValues));if(row.stats.allMissing){nextRow.push(...statColumns.map(()=>"--")),rows.push(nextRow);continue}nextRow.push(...statColumns.map(column=>formatStatCell(column,row.stats,opts.periodStart,opts.periodEnd,opts.formatValue))),rows.push(nextRow)}let centeredColumns=new Set(["min","max"]),align=header.map(col=>centeredColumns.has(col)?"c":"r");return indent_default(table(rows,{align,hsep:2}),2)}function formatSparklineSection(groupRows,sparklines,groupByFields,compact=!1){if(groupRows.length===0){let sparkline=sparklines[0],chart2=sparkline?indent_default(sparkline,2):"";return compact?chart2:["sparklines:",chart2].filter(Boolean).join(`
 `)}let rows=[[...groupByFields,compact?"":"sparkline"].map(name=>import_chalk.default.bold(import_chalk.default.cyan(name))),...groupRows.map((groupValues,index)=>[...groupValues.map(v=>ellipsizeMiddle(v,MAX_GROUP_VALUE_LENGTH,compact)),sparklines[index]??""])],align=groupByFields.map(()=>"r");align.push("l");let chart=indent_default(table(rows,{align,hsep:2}),2);return compact?chart:`sparklines:
 ${chart}`}function formatText(response,opts){let rollupColumn=getRollupColumnName(opts.metric,opts.aggregation),formatValue=(value,formatOptions)=>formatMetricValue(value,opts.metricUnit,opts.aggregation,formatOptions),granularityMs=toGranularityMsFromDuration(opts.granularity),orderMetadata=getResolvedOrderMetadata(opts,response),{groups,series,groupValues}=extractGroupedSeries(response.data??[],opts.groupBy,rollupColumn,opts.periodStart,opts.periodEnd,granularityMs),periodUnique;if(isAggregationWithDimension(opts.aggregation)&&opts.groupBy.length===0){let summaryValue=toNumericValue(response.summary?.[0]?.[rollupColumn]);summaryValue!==null&&(periodUnique=summaryValue)}let metadata=formatMetadataHeader({metric:opts.metric,aggregation:opts.aggregation,periodStart:opts.periodStart,periodEnd:opts.periodEnd,granularity:opts.granularity,periodUnique,bucketTimezone:opts.bucketTimezone,filter:opts.filter,...opts.groupBy.length>0?orderMetadata:{},scope:opts.scope,projectName:opts.projectName,teamName:opts.teamName,groupCount:opts.groupBy.length>0?groups.length:void 0,compact:opts.presentation?.compact});if(groups.length===0)return`${metadata}

package/dist/chunks/{chunk-DRLGZXAL.js → chunk-BIRSJSAO.js}

@@ -4,4 +4,4 @@ import { dirname as __dirname_ } from 'node:path';
 const require = __createRequire(import.meta.url);
 const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
-import{collectContactInformation,getDomainPrice,getDomainStatus,purchaseDomain}from"./chunk-22UXDTCE.js";import{stamp_default}from"./chunk-A2RZZQEP.js";import{param}from"./chunk-3G3FQYMW.js";import{require_pluralize}from"./chunk-KNAOHPOI.js";import{DomainNotAvailable,DomainNotFound,UnsupportedTLD,UserAborted}from"./chunk-T2FCF46I.js";import{eraseLines,output_manager_default}from"./chunk-W634OFUG.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var import_chalk=__toESM(require_source(),1),import_pluralize=__toESM(require_pluralize(),1);var isTTY=process.stdout.isTTY;async function purchaseDomainIfAvailable(client,domain,contextName){output_manager_default.spinner(`Checking status of ${import_chalk.default.bold(domain)}`);let buyDomainStamp=stamp_default(),{available}=await getDomainStatus(client,domain);if(available){if(!isTTY)return new DomainNotFound(domain);output_manager_default.debug(`Domain ${domain} is available to be purchased`);let domainPrice=await getDomainPrice(client,domain).finally(()=>{output_manager_default.stopSpinner()});if(domainPrice instanceof UnsupportedTLD)return domainPrice;if(domainPrice instanceof Error)throw domainPrice;let{purchasePrice,years}=domainPrice;if(purchasePrice===null)return output_manager_default.error(`The domain ${param(domain)} is ${import_chalk.default.underline("unavailable")}! ${buyDomainStamp()}`),new DomainNotAvailable(domain);if(output_manager_default.log(`Domain not found, but you can buy it under ${import_chalk.default.bold(contextName)}! ${buyDomainStamp()}`),!await client.input.confirm(`Buy ${import_chalk.default.underline(domain)} for ${import_chalk.default.bold(`$${purchasePrice}`)} (${(0,import_pluralize.default)("yr",years,!0)})?`,!1))return output_manager_default.print(eraseLines(1)),new UserAborted;output_manager_default.print(eraseLines(1));let contactInformation=await collectContactInformation(client),result=await purchaseDomain(client,domain,purchasePrice,years,!0,contactInformation);return result instanceof Error?result:!0}return output_manager_default.debug(`Domain ${domain} is not available to be purchased`),!1}export{purchaseDomainIfAvailable};
+import{collectContactInformation,getDomainPrice,getDomainStatus,purchaseDomain}from"./chunk-NZRBJB6T.js";import{stamp_default}from"./chunk-A2RZZQEP.js";import{param}from"./chunk-3G3FQYMW.js";import{require_pluralize}from"./chunk-6NUH6ZPE.js";import{DomainNotAvailable,DomainNotFound,UnsupportedTLD,UserAborted}from"./chunk-T2FCF46I.js";import{eraseLines,output_manager_default}from"./chunk-GZLYNPNU.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var import_chalk=__toESM(require_source(),1),import_pluralize=__toESM(require_pluralize(),1);var isTTY=process.stdout.isTTY;async function purchaseDomainIfAvailable(client,domain,contextName){output_manager_default.spinner(`Checking status of ${import_chalk.default.bold(domain)}`);let buyDomainStamp=stamp_default(),{available}=await getDomainStatus(client,domain);if(available){if(!isTTY)return new DomainNotFound(domain);output_manager_default.debug(`Domain ${domain} is available to be purchased`);let domainPrice=await getDomainPrice(client,domain).finally(()=>{output_manager_default.stopSpinner()});if(domainPrice instanceof UnsupportedTLD)return domainPrice;if(domainPrice instanceof Error)throw domainPrice;let{purchasePrice,years}=domainPrice;if(purchasePrice===null)return output_manager_default.error(`The domain ${param(domain)} is ${import_chalk.default.underline("unavailable")}! ${buyDomainStamp()}`),new DomainNotAvailable(domain);if(output_manager_default.log(`Domain not found, but you can buy it under ${import_chalk.default.bold(contextName)}! ${buyDomainStamp()}`),!await client.input.confirm(`Buy ${import_chalk.default.underline(domain)} for ${import_chalk.default.bold(`$${purchasePrice}`)} (${(0,import_pluralize.default)("yr",years,!0)})?`,!1))return output_manager_default.print(eraseLines(1)),new UserAborted;output_manager_default.print(eraseLines(1));let contactInformation=await collectContactInformation(client),result=await purchaseDomain(client,domain,purchasePrice,years,!0,contactInformation);return result instanceof Error?result:!0}return output_manager_default.debug(`Domain ${domain} is not available to be purchased`),!1}export{purchaseDomainIfAvailable};

package/dist/chunks/{chunk-WHUZRBYL.js → chunk-BK3TNLWO.js}

@@ -4,7 +4,7 @@ import { dirname as __dirname_ } from 'node:path';
 const require = __createRequire(import.meta.url);
 const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
-import{getEnvRecords,parseEnv,pullEnvRecords}from"./chunk-7ULLVH2G.js";import{require_frameworks}from"./chunk-6Y2ZL5XJ.js";import{parseTarget}from"./chunk-D4TD2KWH.js";import{STANDARD_ENVIRONMENTS}from"./chunk-7YKFF6CE.js";import{resolveProjectContext}from"./chunk-DX2OHM56.js";import{formatProject}from"./chunk-TD7AL545.js";import{require_json_parse_better_errors}from"./chunk-25565AGS.js";import{ensureLink}from"./chunk-HR462OEG.js";import{getDeployment}from"./chunk-VU3RBRDH.js";import{getRenamedOption,renameOptionInArgs,reportRenamedOptionError}from"./chunk-V32V4SXB.js";import{pullSubcommand}from"./chunk-CUBRYWA2.js";import{printError}from"./chunk-Q4GX2UTG.js";import{param}from"./chunk-3G3FQYMW.js";import{TelemetryClient}from"./chunk-VPUYTI5E.js";import{buildCommandWithYes,getPreservedArgsForEnvPull,outputActionRequired,outputAgentError}from"./chunk-ZUI5EMXD.js";import{addToGitIgnore,require_lib}from"./chunk-KNAOHPOI.js";import{printAlignedLabel}from"./chunk-64UCX5JM.js";import{parseArguments}from"./chunk-C4N4LKPM.js";import{getCommandName,getCommandNamePlain}from"./chunk-VRH7LWOC.js";import{output_manager_default}from"./chunk-W634OFUG.js";import{require_dist}from"./chunk-RM3ZDRYE.js";import{getFlagsSpecification}from"./chunk-CKTLP5GX.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var import_chalk2=__toESM(require_source(),1),import_fs_extra2=__toESM(require_lib(),1);import{closeSync,openSync,readSync}from"fs";import{resolve}from"path";var import_fs_extra=__toESM(require_lib(),1);var import_chalk=__toESM(require_source(),1);async function createEnvObject(envPath){let envArr=(await(0,import_fs_extra.readFile)(envPath,"utf-8")).replace(/"/g,"").split(/\r?\n|\r/).filter(line=>/^[^#]/.test(line)).filter(line=>/=/i.test(line)),parsedEnv=parseEnv(envArr);if(Object.keys(parsedEnv).length===0){output_manager_default.debug("Failed to parse env file.");return}return parsedEnv}function findChanges(oldEnv,newEnv){let added=[],changed=[];for(let key of Object.keys(newEnv))oldEnv[key]===void 0?added.push(key):oldEnv[key]!==newEnv[key]&&changed.push(key),delete oldEnv[key];let removed=Object.keys(oldEnv);return{added,changed,removed}}function buildDeltaString(oldEnv,newEnv){let{added,changed,removed}=findChanges(oldEnv,newEnv),deltaString="";return deltaString+=import_chalk.default.green(addDeltaSection("+",changed,!0)),deltaString+=import_chalk.default.green(addDeltaSection("+",added)),deltaString+=import_chalk.default.red(addDeltaSection("-",removed)),deltaString&&import_chalk.default.gray(`  Changes:
+import{getEnvRecords,parseEnv,pullEnvRecords}from"./chunk-5RYQH3XW.js";import{require_frameworks}from"./chunk-6Y2ZL5XJ.js";import{parseTarget}from"./chunk-YZKARZ2B.js";import{STANDARD_ENVIRONMENTS}from"./chunk-7YKFF6CE.js";import{resolveProjectContext}from"./chunk-SR7BZA6N.js";import{formatProject}from"./chunk-NE6PKR2J.js";import{require_json_parse_better_errors}from"./chunk-25565AGS.js";import{ensureLink}from"./chunk-6YAYCEDT.js";import{getDeployment}from"./chunk-VU3RBRDH.js";import{getRenamedOption,renameOptionInArgs,reportRenamedOptionError}from"./chunk-GQ4CQDIL.js";import{pullSubcommand}from"./chunk-BZIC36KP.js";import{printError}from"./chunk-PKZK23PR.js";import{param}from"./chunk-3G3FQYMW.js";import{TelemetryClient}from"./chunk-MBXLL2HF.js";import{buildCommandWithYes,getPreservedArgsForEnvPull,outputActionRequired,outputAgentError}from"./chunk-AUIV7YJO.js";import{addToGitIgnore,require_lib}from"./chunk-6NUH6ZPE.js";import{printAlignedLabel}from"./chunk-PKNEWN4W.js";import{parseArguments}from"./chunk-US7YJ2RQ.js";import{getCommandName,getCommandNamePlain}from"./chunk-VRH7LWOC.js";import{output_manager_default}from"./chunk-GZLYNPNU.js";import{require_dist}from"./chunk-RM3ZDRYE.js";import{getFlagsSpecification}from"./chunk-AMPJ6RWT.js";import{require_source}from"./chunk-NB2WLB3J.js";import{__toESM}from"./chunk-BZENIQ7N.js";var import_chalk2=__toESM(require_source(),1),import_fs_extra2=__toESM(require_lib(),1);import{closeSync,openSync,readSync}from"fs";import{resolve}from"path";var import_fs_extra=__toESM(require_lib(),1);var import_chalk=__toESM(require_source(),1);async function createEnvObject(envPath){let envArr=(await(0,import_fs_extra.readFile)(envPath,"utf-8")).replace(/"/g,"").split(/\r?\n|\r/).filter(line=>/^[^#]/.test(line)).filter(line=>/=/i.test(line)),parsedEnv=parseEnv(envArr);if(Object.keys(parsedEnv).length===0){output_manager_default.debug("Failed to parse env file.");return}return parsedEnv}function findChanges(oldEnv,newEnv){let added=[],changed=[];for(let key of Object.keys(newEnv))oldEnv[key]===void 0?added.push(key):oldEnv[key]!==newEnv[key]&&changed.push(key),delete oldEnv[key];let removed=Object.keys(oldEnv);return{added,changed,removed}}function buildDeltaString(oldEnv,newEnv){let{added,changed,removed}=findChanges(oldEnv,newEnv),deltaString="";return deltaString+=import_chalk.default.green(addDeltaSection("+",changed,!0)),deltaString+=import_chalk.default.green(addDeltaSection("+",added)),deltaString+=import_chalk.default.red(addDeltaSection("-",removed)),deltaString&&import_chalk.default.gray(`  Changes:
 `)+deltaString+`
 `}function addDeltaSection(prefix,arr,changed=!1){return arr.length===0?"":arr.sort().map(item=>`  ${prefix} ${item}${changed?" (Updated)":""}`).join(`
 `)+`
@@ -15,9 +15,9 @@ import{getEnvRecords,parseEnv,pullEnvRecords}from"./chunk-7ULLVH2G.js";import{re
 `)||valueWithoutTrailingNewline.includes("\r")?{value,strippedTrailingNewline:!1}:{value:valueWithoutTrailingNewline,strippedTrailingNewline:!0}}function getPublicPrefix(key){let upperKey=key.toUpperCase();return PUBLIC_PREFIXES.find(p=>upperKey.startsWith(p))||null}function getFrameworkPublicPrefix(frameworkSlug,key){let prefix=import_frameworks.frameworkList.find(framework=>framework.slug===frameworkSlug)?.envPrefix;return prefix&&key.toUpperCase().startsWith(prefix.toUpperCase())?prefix:null}function getApiPublicPrefix(key){let upperKey=key.toUpperCase();return API_PUBLIC_PREFIXES.find(prefix=>upperKey.startsWith(prefix))??null}function parseSvelteKitPublicEnvVarPrefix(config){if(!config.includes("publicPrefix"))return{status:"ready",prefix:null};let match=/publicPrefix:\s*(?:'(?<single>[^']*)'|"(?<double>[^"]*)"|`(?<template>[^`$]*)`)/.exec(config),prefix=match?.groups?.single??match?.groups?.double??match?.groups?.template;return prefix===void 0?{status:"unavailable"}:{status:"ready",prefix}}async function getLocalSvelteKitPublicPrefixes(cwd,rootDirectory){let projectRoot=rootDirectory?join(cwd,rootDirectory):cwd,config;try{config=await readFile2(join(projectRoot,"svelte.config.js"),"utf8")}catch{return}let parsed=parseSvelteKitPublicEnvVarPrefix(config);if(parsed.status!=="unavailable")return[parsed.prefix??"PUBLIC_","VITE_"]}function removePublicPrefix(key){let prefix=getPublicPrefix(key);return prefix?key.slice(prefix.length):key}async function validateEnvValue(opts){let finalValue=opts.initialValue,alreadyConfirmed=!1;if(opts.skipConfirm){let valueWarnings=getEnvValueWarnings(finalValue),warningMessage=formatWarnings(valueWarnings);warningMessage&&opts.showWarning(warningMessage)}else{let valueAccepted=!1;for(;!valueAccepted;){let valueWarnings=getEnvValueWarnings(finalValue),warningMessage=formatWarnings(valueWarnings);if(!warningMessage){valueAccepted=!0;break}opts.showWarning(warningMessage);let choices=hasOnlyWhitespaceWarnings(valueWarnings)?[{name:"Leave as is",value:"c"},{name:"Re-enter",value:"r"},{name:"Trim whitespace",value:"t"}]:[{name:"Leave as is",value:"c"},{name:"Re-enter",value:"r"}],action=await opts.selectAction(choices);action==="c"?(valueAccepted=!0,valueWarnings.some(w=>w.requiresConfirmation)&&(alreadyConfirmed=!0)):action==="t"?(finalValue=trimValue(finalValue),opts.showLog("Trimmed whitespace")):finalValue=await opts.promptForValue()}}return{finalValue,alreadyConfirmed}}function getEnvKeyWarnings(key){let warnings=[],matchingPrefix=getPublicPrefix(key);if(matchingPrefix){let nameWithoutPrefix=key.slice(matchingPrefix.length);looksLikeSecret(nameWithoutPrefix)&&getMatchingServerOnlyKey(nameWithoutPrefix)?warnings.push({message:`\`${matchingPrefix}\` exposes \`${key}\` to anyone visiting your site`,requiresConfirmation:!0}):warnings.push({message:`\`${matchingPrefix}\` exposes this value to anyone visiting your site`,requiresConfirmation:!1})}return warnings}var ENV_VISIBILITY_DEPRECATION_MESSAGE="`--visibility` is deprecated. Use `--type` instead.";function invalidTypeOptionError(optionName,value){if(!(value==="config"||value==="secret"))return value==="sensitive"?`The \`${optionName}\` option accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` option.`:value==="plain"||value==="encrypted"?`The \`${optionName}\` option accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.`:`The \`${optionName}\` option must be either \`config\` or \`secret\`.`}function resolveEnvVarTypeOption(options){let usedDeprecatedVisibility=options.visibility!==void 0;if(options.type!==void 0){let error=invalidTypeOptionError("--type",options.type);if(error)return{usedDeprecatedVisibility,error,errorReason:"invalid_type"}}if(options.visibility!==void 0){let error=invalidTypeOptionError("--visibility",options.visibility);if(error)return{usedDeprecatedVisibility,error,errorReason:"invalid_visibility"}}return options.type!==void 0&&options.visibility!==void 0&&options.type!==options.visibility?{usedDeprecatedVisibility,error:`\`--type ${options.type}\` conflicts with \`--visibility ${options.visibility}\`. \`--visibility\` is a deprecated alias of \`--type\`; remove it.`,errorReason:"conflicting_type_visibility"}:options.type!==void 0?{explicitVisibility:options.type,source:"type",usedDeprecatedVisibility}:options.visibility!==void 0?{explicitVisibility:options.visibility,source:"visibility",usedDeprecatedVisibility}:{usedDeprecatedVisibility}}function isSecretEnvVar(env){return env.type==="sensitive"||env.visibility==="secret"}function formatVisibilityLabel(visibility,type){let resolved=visibility??visibilityFromEnvType(type);if(resolved==="config")return"Config";if(resolved==="secret")return"Secret"}function visibilityFromEnvType(type){if(type==="sensitive")return"secret";if(type==="plain"||type==="encrypted")return"config"}function hasNonDevelopmentTarget(envTargets){return envTargets.some(target=>target!=="development")}function getPublicPrefixSecretVisibilityError(key,options){let publicPrefix=getApiPublicPrefix(key);if(!publicPrefix||!(options.visibility==="secret"||options.type==="sensitive"))return null;let privateKey=key.slice(publicPrefix.length);return options.context==="update"?`\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, add \`${privateKey}\` as a Secret, then remove \`${key}\`. If the value is safe to expose, keep it as Config.`:`\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, rename the variable to \`${privateKey}\` and keep the Secret type. If the value is safe to expose, use \`--type config\`.`}function shouldOmitInferredVisibility(key,envTargets,teamSensitivePolicyOn){return!getApiPublicPrefix(key)||!hasNonDevelopmentTarget(envTargets)?!1:teamSensitivePolicyOn}function resolveEnvVarVisibility(options){if(options.explicitVisibility!==void 0){if(options.explicitVisibility!=="config"&&options.explicitVisibility!=="secret"){let optionName=options.explicitOptionSource==="visibility"?"--visibility":"--type";return{error:options.explicitVisibility==="sensitive"?`The \`${optionName}\` option accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` option.`:options.explicitVisibility==="plain"||options.explicitVisibility==="encrypted"?`The \`${optionName}\` option accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.`:`The \`${optionName}\` option must be either \`config\` or \`secret\`.`}}let publicPrefixError2=getPublicPrefixSecretVisibilityError(options.key,{visibility:options.explicitVisibility,type:options.type,context:options.context});return publicPrefixError2?{error:publicPrefixError2}:{visibility:options.explicitVisibility}}let inferred=visibilityFromEnvType(options.type);if(inferred===void 0)return{};if(shouldOmitInferredVisibility(options.key,options.envTargets,options.teamSensitivePolicyOn))return{};let publicPrefixError=getPublicPrefixSecretVisibilityError(options.key,{visibility:inferred,type:options.type,context:options.context});return publicPrefixError?{error:publicPrefixError}:{visibility:inferred}}function getUnavailableSecretValuesMessage(environment,count){let values=count===1?"value":"values";return environment==="development"?`${count} Development Secret ${values} ${count===1?"was":"were"} not returned by Vercel.`:`${count} Secret ${values} cannot be pulled from the \`${environment}\` Environment.`}function getLocalSecretFallbackMessage(count){return` Define ${count===1?"it":"them"} in a local .env file.`}var CONTENTS_HEADER="# Created by Vercel CLI";function updateOidcTokenContents(existing,token){let assignment=`${VERCEL_OIDC_TOKEN}="${escapeValue(token)}"`,oidcAssignment=new RegExp(`^(\\uFEFF?)[\\t ]*(?:export[\\t ]+)?${VERCEL_OIDC_TOKEN}[\\t ]*=[^\\r\\n]*(\\r\\n|\\n|\\r|$)`,"gm"),tokenWritten=!1,withoutDuplicates=existing.replace(oidcAssignment,(_match,byteOrderMark,lineEnding2)=>token!==void 0&&!tokenWritten?(tokenWritten=!0,`${byteOrderMark}${assignment}${lineEnding2}`):byteOrderMark);if(token===void 0||tokenWritten)return withoutDuplicates;let lineEnding=withoutDuplicates.match(/\r\n|\n|\r/)?.[0]??`
 `,hasTrailingLineEnding=/(?:\r\n|\n|\r)$/.test(withoutDuplicates),hasTrailingBlankLine=/(?:\r\n|\n|\r){2}$/.test(withoutDuplicates),separator=withoutDuplicates.length===0||hasTrailingBlankLine?"":hasTrailingLineEnding?lineEnding:`${lineEnding}${lineEnding}`;return`${withoutDuplicates}${separator}${CONTENTS_HEADER}${lineEnding}${assignment}${lineEnding}`}function escapeValue(value){return value?value.replace(/\n/g,"\\n").replace(/\r/g,"\\r"):""}var import_error_utils=__toESM(require_dist(),1);var import_json_parse_better_errors=__toESM(require_json_parse_better_errors(),1);var EnvPullTelemetryClient=class extends TelemetryClient{trackCliArgumentFilename(filename){filename&&this.trackCliArgument({arg:"filename",value:this.redactedValue})}trackCliOptionEnvironment(environment){environment&&this.trackCliOption({option:"environment",value:STANDARD_ENVIRONMENTS.includes(environment)?environment:this.redactedValue})}trackCliOptionGitBranch(gitBranch){gitBranch&&this.trackCliOption({option:"git-branch",value:this.redactedValue})}trackCliFlagYes(yes){yes&&this.trackCliFlag("yes")}trackCliOptionDeployment(deployment){deployment&&this.trackCliOption({option:"deployment",value:this.redactedValue})}trackCliOptionId(id){id&&this.trackCliOption({option:"id",value:this.redactedValue})}};var CONTENTS_PREFIX=`# Created by Vercel CLI
 `;function printEnvPullWarning(message){output_manager_default.print(`${import_chalk2.default.yellow("!")} ${message}
-`)}function readHeadSync(path,length){let buffer=Buffer.alloc(length),fd=openSync(path,"r");try{readSync(fd,buffer,0,buffer.length,null)}finally{closeSync(fd)}return buffer.toString()}function tryReadHeadSync(path,length){try{return readHeadSync(path,length)}catch(err){if(!(0,import_error_utils.isErrnoException)(err)||err.code!=="ENOENT")throw err}}var VARIABLES_TO_IGNORE=["VERCEL_ANALYTICS_ID","VERCEL_SPEED_INSIGHTS_ID","VERCEL_WEB_ANALYTICS_ID"],SENSITIVE_PLACEHOLDER=SENSITIVE_ENV_VALUE_PLACEHOLDER;async function getRedactedSensitiveKeys(client,projectId,source,target,gitBranch,records){let emptyKeys=Object.keys(records).filter(key=>!records[key]);if(!projectId||emptyKeys.length===0)return new Set;try{let{envs}=await getEnvRecords(client,projectId,source,{target,gitBranch}),sensitiveKeys=new Set(envs.filter(isSecretEnvVar).map(env=>env.key));return new Set(emptyKeys.filter(key=>sensitiveKeys.has(key)))}catch{return new Set}}async function pull(client,argv,source="vercel-cli:env:pull",options={}){let telemetryClient=new EnvPullTelemetryClient({opts:{store:client.telemetryEventStore}}),parsedArgs,flagsSpecification=getFlagsSpecification(pullSubcommand.options);try{parsedArgs=parseArguments(argv,flagsSpecification)}catch(err){return printError(err),2}let{args,flags:opts}=parsedArgs;if(args.length>1)return output_manager_default.error(`Invalid number of arguments. Usage: ${getCommandName("env pull <file>")}`),2;let[rawFilename]=args,filename=rawFilename||".env.local",skipConfirmation=opts["--yes"],gitBranch=opts["--git-branch"];telemetryClient.trackCliArgumentFilename(args[0]),telemetryClient.trackCliFlagYes(skipConfirmation),telemetryClient.trackCliOptionGitBranch(gitBranch),telemetryClient.trackCliOptionEnvironment(opts["--environment"]),telemetryClient.trackCliOptionDeployment(opts["--deployment"]),telemetryClient.trackCliOptionId(opts["--id"]),telemetryClient.trackCliOptionProject(opts["--project"]);let deploymentFlag=getRenamedOption(opts,"--deployment","--id");if("error"in deploymentFlag)return reportRenamedOptionError(client,deploymentFlag.error);let link=await resolveProjectContext({client,projectNameOrId:opts["--project"],skipOwnerLookup:!0});if(link.status==="error")return link.exitCode;if(link.status==="not_linked"){if(client.nonInteractive){let argv2=renameOptionInArgs(client.argv,"--id","--deployment"),preserved=getPreservedArgsForEnvPull(argv2),linkArgv=[...argv2.slice(0,2),"link","--scope","<scope>",...preserved];outputAgentError(client,{status:"error",reason:"not_linked",message:`Your codebase isn't linked to a project on Vercel. Run \`${getCommandNamePlain("link")}\` to begin. Use \`--yes\` for non-interactive; use \`--scope\` or \`--project\` to specify team or project.`,next:[{command:buildCommandWithYes(linkArgv)},{command:buildCommandWithYes(argv2)}]},1)}if(!client.nonInteractive&&client.stdin.isTTY&&!skipConfirmation){let ensuredLink=await ensureLink("env pull",client,client.cwd,{link,pullEnv:!1});if(typeof ensuredLink=="number")return ensuredLink;link=ensuredLink}else return output_manager_default.error(`Your codebase isn\u2019t linked to a project on Vercel. Run ${getCommandName("link")} to begin.`),1}client.config.currentTeam=link.org.type==="team"?link.org.id:void 0;let deploymentId=deploymentFlag.value;if(deploymentId&&opts["--project"]){let deployment=await getDeployment(client,link.org.slug||link.org.id,deploymentId);if(deployment.projectId&&deployment.projectId!==link.project.id)return output_manager_default.error(`Deployment ${import_chalk2.default.bold(deploymentId)} does not belong to project ${import_chalk2.default.bold(link.project.name)}.`),1}let environment=parseTarget({flagName:"environment",flags:opts})||"development";return await envPullCommandLogic(client,filename,!!skipConfirmation,environment,link,gitBranch,client.cwd,source,deploymentId,options),0}async function envPullCommandLogic(client,filename,skipConfirmation,environment,link,gitBranch,cwd,source,deploymentId,{oidcTokenOnly=!1}={}){let fullPath=resolve(cwd,filename),head=tryReadHeadSync(fullPath,Buffer.byteLength(CONTENTS_PREFIX)),exists=typeof head<"u";if(head===CONTENTS_PREFIX&&!oidcTokenOnly)output_manager_default.log(`Overwriting existing ${import_chalk2.default.bold(filename)} file`);else if(exists&&!skipConfirmation&&!oidcTokenOnly){if(client.nonInteractive){let preserved=getPreservedArgsForEnvPull(renameOptionInArgs(client.argv,"--id","--deployment")).filter(arg=>arg!=="--yes"&&arg!=="-y"),suffix=preserved.length>0?` ${preserved.join(" ")}`:"";outputActionRequired(client,{status:"action_required",reason:"env_file_exists",message:`File ${param(filename)} already exists and was not created by Vercel CLI. Use --yes to overwrite or specify a different filename.`,next:[{command:getCommandNamePlain(`env pull ${filename} --yes${suffix}`),when:"Overwrite this file"},{command:getCommandNamePlain(`env pull <filename>${suffix}`),when:"Use a different filename"}]})}if(!await client.input.confirm(`Found existing file ${param(filename)}. Do you want to overwrite?`,!1)){output_manager_default.log("Canceled");return}}let projectSlugLink=link.org.slug?formatProject(link.org.slug,link.project.name):import_chalk2.default.bold(link.project.name),downloadMessage=oidcTokenOnly?`Downloading a fresh \`${import_chalk2.default.cyan(VERCEL_OIDC_TOKEN)}\` for ${projectSlugLink}`:gitBranch?`Downloading \`${import_chalk2.default.cyan(environment)}\` environment variables for ${projectSlugLink} and any overrides for branch ${import_chalk2.default.cyan(gitBranch)}`:`Downloading \`${import_chalk2.default.cyan(environment)}\` environment variables for ${projectSlugLink}`;output_manager_default.log(downloadMessage),output_manager_default.spinner("Downloading");let pullId=deploymentId||link.project.id,pullResult=await pullEnvRecords(client,pullId,source,{target:environment||"development",gitBranch}),records=deploymentId?pullResult.buildEnv:pullResult.env,deltaString="",oldEnv;exists&&!oidcTokenOnly&&(oldEnv=await createEnvObject(fullPath));let contents,fileChanged=!0,keptLocalKeys=[],preservedLocalSecretKeys=[],redactedSecretCount=0,placeholderSecretCount=0;if(oidcTokenOnly){let existingContents=exists?await(0,import_fs_extra2.readFile)(fullPath,"utf8"):"";contents=updateOidcTokenContents(existingContents,records[VERCEL_OIDC_TOKEN]||void 0),fileChanged=contents!==existingContents}else{let sensitiveKeys=await getRedactedSensitiveKeys(client,deploymentId?void 0:link.project.id,source,environment,gitBranch,records);redactedSecretCount=sensitiveKeys.size;let mergedRecords={...records};for(let key of sensitiveKeys){let localValue=oldEnv?.[key];localValue&&localValue!==SENSITIVE_PLACEHOLDER?(mergedRecords[key]=localValue,preservedLocalSecretKeys.push(key)):(mergedRecords[key]=SENSITIVE_PLACEHOLDER,placeholderSecretCount++)}if(oldEnv)for(let[key,value]of Object.entries(oldEnv))!(key in mergedRecords)&&key!==VERCEL_OIDC_TOKEN&&!VARIABLES_TO_IGNORE.includes(key)&&(mergedRecords[key]=value,keptLocalKeys.push(key));if(contents=CONTENTS_PREFIX+Object.keys(mergedRecords).sort().filter(key=>!VARIABLES_TO_IGNORE.includes(key)).map(key=>`${key}="${escapeValue2(mergedRecords[key])}"`).join(`
+`)}function readHeadSync(path,length){let buffer=Buffer.alloc(length),fd=openSync(path,"r");try{readSync(fd,buffer,0,buffer.length,null)}finally{closeSync(fd)}return buffer.toString()}function tryReadHeadSync(path,length){try{return readHeadSync(path,length)}catch(err){if(!(0,import_error_utils.isErrnoException)(err)||err.code!=="ENOENT")throw err}}var VARIABLES_TO_IGNORE=["VERCEL_ANALYTICS_ID","VERCEL_SPEED_INSIGHTS_ID","VERCEL_WEB_ANALYTICS_ID"],SENSITIVE_PLACEHOLDER=SENSITIVE_ENV_VALUE_PLACEHOLDER;async function getRedactedSensitiveKeys(client,projectId,source,target,gitBranch,records){let emptyKeys=Object.keys(records).filter(key=>!records[key]);if(!projectId||emptyKeys.length===0)return new Set;try{let{envs}=await getEnvRecords(client,projectId,source,{target,gitBranch}),sensitiveKeys=new Set(envs.filter(isSecretEnvVar).map(env=>env.key));return new Set(emptyKeys.filter(key=>sensitiveKeys.has(key)))}catch{return new Set}}async function pull(client,argv,source="vercel-cli:env:pull",options={}){let telemetryClient=new EnvPullTelemetryClient({opts:{store:client.telemetryEventStore}}),parsedArgs,flagsSpecification=getFlagsSpecification(pullSubcommand.options);try{parsedArgs=parseArguments(argv,flagsSpecification)}catch(err){return printError(err),2}let{args,flags:opts}=parsedArgs;if(args.length>1)return output_manager_default.error(`Invalid number of arguments. Usage: ${getCommandName("env pull <file>")}`),2;let[rawFilename]=args,filename=rawFilename||".env.local",skipConfirmation=opts["--yes"],gitBranch=opts["--git-branch"];telemetryClient.trackCliArgumentFilename(args[0]),telemetryClient.trackCliFlagYes(skipConfirmation),telemetryClient.trackCliOptionGitBranch(gitBranch),telemetryClient.trackCliOptionEnvironment(opts["--environment"]),telemetryClient.trackCliOptionDeployment(opts["--deployment"]),telemetryClient.trackCliOptionId(opts["--id"]),telemetryClient.trackCliOptionProject(opts["--project"]);let deploymentFlag=getRenamedOption(opts,"--deployment","--id");if("error"in deploymentFlag)return reportRenamedOptionError(client,deploymentFlag.error);let link=await resolveProjectContext({client,projectNameOrId:opts["--project"],skipOwnerLookup:!0});if(link.status==="error")return link.exitCode;if(link.status==="not_linked"){if(client.nonInteractive){let argv2=renameOptionInArgs(client.argv,"--id","--deployment"),preserved=getPreservedArgsForEnvPull(argv2),linkArgv=[...argv2.slice(0,2),"link","--scope","<scope>",...preserved];outputAgentError(client,{status:"error",reason:"not_linked",message:`Your codebase isn't linked to a project on Vercel. Run \`${getCommandNamePlain("link")}\` to begin. Use \`--yes\` for non-interactive; use \`--scope\` or \`--project\` to specify team or project.`,next:[{command:buildCommandWithYes(linkArgv)},{command:buildCommandWithYes(argv2)}]},1)}if(!client.nonInteractive&&client.stdin.isTTY&&!skipConfirmation){let ensuredLink=await ensureLink("env pull",client,client.cwd,{link,pullEnv:!1});if(typeof ensuredLink=="number")return ensuredLink;link=ensuredLink}else return output_manager_default.error(`Your codebase isn\u2019t linked to a project on Vercel. Run ${getCommandName("link")} to begin.`),1}client.config.currentTeam=link.org.type==="team"?link.org.id:void 0;let deploymentId=deploymentFlag.value;if(deploymentId&&opts["--project"]){let deployment=await getDeployment(client,link.org.slug||link.org.id,deploymentId);if(deployment.projectId&&deployment.projectId!==link.project.id)return output_manager_default.error(`Deployment ${import_chalk2.default.bold(deploymentId)} does not belong to project ${import_chalk2.default.bold(link.project.name)}.`),1}let environment=parseTarget({flagName:"environment",flags:opts})||"development";return await envPullCommandLogic(client,filename,!!skipConfirmation,environment,link,gitBranch,client.cwd,source,deploymentId,options),0}async function envPullCommandLogic(client,filename,skipConfirmation,environment,link,gitBranch,cwd,source,deploymentId,{oidcTokenOnly=!1}={}){let fullPath=resolve(cwd,filename),head=tryReadHeadSync(fullPath,Buffer.byteLength(CONTENTS_PREFIX)),exists=typeof head<"u";if(head===CONTENTS_PREFIX&&!oidcTokenOnly)output_manager_default.log(`Overwriting existing ${import_chalk2.default.bold(filename)} file`);else if(exists&&!skipConfirmation&&!oidcTokenOnly){if(client.nonInteractive){let preserved=getPreservedArgsForEnvPull(renameOptionInArgs(client.argv,"--id","--deployment")).filter(arg=>arg!=="--yes"&&arg!=="-y"),suffix=preserved.length>0?` ${preserved.join(" ")}`:"";outputActionRequired(client,{status:"action_required",reason:"env_file_exists",message:`File ${param(filename)} already exists and was not created by Vercel CLI. Use --yes to overwrite or specify a different filename.`,next:[{command:getCommandNamePlain(`env pull ${filename} --yes${suffix}`),when:"Overwrite this file"},{command:getCommandNamePlain(`env pull <filename>${suffix}`),when:"Use a different filename"}]})}if(!await client.input.confirm(`Found existing file ${param(filename)}. Do you want to overwrite?`,!1)){output_manager_default.log("Canceled");return}}let projectSlugLink=link.org.slug?formatProject(link.org.slug,link.project.name):import_chalk2.default.bold(link.project.name),downloadMessage=oidcTokenOnly?`Downloading a fresh \`${import_chalk2.default.cyan(VERCEL_OIDC_TOKEN)}\` for ${projectSlugLink}`:gitBranch?`Downloading \`${import_chalk2.default.cyan(environment)}\` environment variables for ${projectSlugLink} and any overrides for branch ${import_chalk2.default.cyan(gitBranch)}`:`Downloading \`${import_chalk2.default.cyan(environment)}\` environment variables for ${projectSlugLink}`;output_manager_default.log(downloadMessage),output_manager_default.spinner("Downloading");let pullId=deploymentId||link.project.id,pullResult=await pullEnvRecords(client,pullId,source,{target:environment||"development",gitBranch}),records=deploymentId?pullResult.buildEnv:pullResult.env,deltaString="",oldEnv;exists&&!oidcTokenOnly&&(oldEnv=await createEnvObject(fullPath));let contents,variables=[],secretNotReturnedWarning,fileChanged=!0,keptLocalKeys=[],preservedLocalSecretKeys=[],redactedSecretCount=0,placeholderSecretCount=0;if(oidcTokenOnly){let existingContents=exists?await(0,import_fs_extra2.readFile)(fullPath,"utf8"):"";contents=updateOidcTokenContents(existingContents,records[VERCEL_OIDC_TOKEN]||void 0),fileChanged=contents!==existingContents}else{let sensitiveKeys=await getRedactedSensitiveKeys(client,deploymentId?void 0:link.project.id,source,environment,gitBranch,records);redactedSecretCount=sensitiveKeys.size;let mergedRecords={...records};for(let key of sensitiveKeys){let localValue=oldEnv?.[key];localValue&&localValue!==SENSITIVE_PLACEHOLDER?(mergedRecords[key]=localValue,preservedLocalSecretKeys.push(key)):(mergedRecords[key]=SENSITIVE_PLACEHOLDER,placeholderSecretCount++)}if(oldEnv)for(let[key,value]of Object.entries(oldEnv))!(key in mergedRecords)&&key!==VERCEL_OIDC_TOKEN&&!VARIABLES_TO_IGNORE.includes(key)&&(mergedRecords[key]=value,keptLocalKeys.push(key));if(variables=Object.keys(mergedRecords).sort().filter(key=>!VARIABLES_TO_IGNORE.includes(key)),contents=CONTENTS_PREFIX+variables.map(key=>`${key}="${escapeValue2(mergedRecords[key])}"`).join(`
 `)+`
 `,oldEnv){let newEnv=(0,import_json_parse_better_errors.default)(JSON.stringify(mergedRecords).replace(/\\"/g,""));deltaString=buildDeltaString(oldEnv,newEnv)}}if(fileChanged&&await(0,import_fs_extra2.outputFile)(fullPath,contents,"utf8"),deltaString?output_manager_default.print(`
-`+deltaString):oldEnv&&exists&&output_manager_default.log("No changes found."),keptLocalKeys.length>0&&output_manager_default.log(`Kept ${keptLocalKeys.sort().map(key=>import_chalk2.default.bold(key)).join(", ")} (defined locally, not found in the ${import_chalk2.default.cyan(environment)} Environment)`),redactedSecretCount>0){let preservedMessage=preservedLocalSecretKeys.length>0?` Kept ${preservedLocalSecretKeys.length} existing local ${preservedLocalSecretKeys.length===1?"value":"values"}.`:"",placeholderMessage=placeholderSecretCount>0?` Wrote "${SENSITIVE_PLACEHOLDER}" ${placeholderSecretCount===1?"as a placeholder":"as placeholders"} for the remaining ${placeholderSecretCount===1?"value":"values"}; replace ${placeholderSecretCount===1?"it":"them"} with local-only values.`:"";printEnvPullWarning(`${getUnavailableSecretValuesMessage(environment,redactedSecretCount)}${preservedMessage}${placeholderMessage}`)}let isGitIgnoreUpdated=!1,fileExistsAfterPull=exists||contents.length>0;if(filename===".env.local"&&fileExistsAfterPull){let rootPath=link.repoRoot??cwd;isGitIgnoreUpdated=await addToGitIgnore(rootPath,".env*")}if(!fileChanged&&!isGitIgnoreUpdated){output_manager_default.stopSpinner();return}if(output_manager_default.print(`
-`),!fileChanged){printAlignedLabel("Updated",`.gitignore for ${filename}`,{gutter:"\u2713"});return}printAlignedLabel(exists?"Updated":"Created",`${filename} file${isGitIgnoreUpdated?" and added it to .gitignore":""}`,{gutter:"\u2713"})}function escapeValue2(value){return value?value.replace(new RegExp(`
-`,"g"),"\\n").replace(new RegExp("\r","g"),"\\r"):""}export{createEnvObject,VERCEL_OIDC_TOKEN,SENSITIVE_ENV_VALUE_PLACEHOLDER,looksLikeSecret,looksLikeSecretValue,shouldConfirmRotationBeforeDelete,isFlagsSecretNeedingSplit,normalizeStdinEnvValue,getPublicPrefix,getFrameworkPublicPrefix,getApiPublicPrefix,getLocalSvelteKitPublicPrefixes,removePublicPrefix,validateEnvValue,getEnvKeyWarnings,ENV_VISIBILITY_DEPRECATION_MESSAGE,resolveEnvVarTypeOption,isSecretEnvVar,formatVisibilityLabel,getPublicPrefixSecretVisibilityError,resolveEnvVarVisibility,getUnavailableSecretValuesMessage,getLocalSecretFallbackMessage,SENSITIVE_PLACEHOLDER,pull,envPullCommandLogic};
+`+deltaString):oldEnv&&exists&&output_manager_default.log("No changes found."),keptLocalKeys.length>0&&output_manager_default.log(`Kept ${keptLocalKeys.sort().map(key=>import_chalk2.default.bold(key)).join(", ")} (defined locally, not found in the ${import_chalk2.default.cyan(environment)} Environment)`),redactedSecretCount>0){let preservedMessage=preservedLocalSecretKeys.length>0?` Kept ${preservedLocalSecretKeys.length} existing local ${preservedLocalSecretKeys.length===1?"value":"values"}.`:"",placeholderMessage=placeholderSecretCount>0?` Wrote "${SENSITIVE_PLACEHOLDER}" ${placeholderSecretCount===1?"as a placeholder":"as placeholders"} for the remaining ${placeholderSecretCount===1?"value":"values"}; replace ${placeholderSecretCount===1?"it":"them"} with local-only values.`:"";secretNotReturnedWarning=`${getUnavailableSecretValuesMessage(environment,redactedSecretCount)}${preservedMessage}${placeholderMessage}`,printEnvPullWarning(secretNotReturnedWarning)}let result={path:fullPath,variables,...secretNotReturnedWarning?{secretNotReturnedWarning}:{}},isGitIgnoreUpdated=!1,fileExistsAfterPull=exists||contents.length>0;if(filename===".env.local"&&fileExistsAfterPull){let rootPath=link.repoRoot??cwd;isGitIgnoreUpdated=await addToGitIgnore(rootPath,".env*")}return!fileChanged&&!isGitIgnoreUpdated?(output_manager_default.stopSpinner(),result):(output_manager_default.print(`
+`),fileChanged?(printAlignedLabel(exists?"Updated":"Created",`${filename} file${isGitIgnoreUpdated?" and added it to .gitignore":""}`,{gutter:"\u2713"}),result):(printAlignedLabel("Updated",`.gitignore for ${filename}`,{gutter:"\u2713"}),result))}function escapeValue2(value){return value?value.replace(new RegExp(`
+`,"g"),"\\n").replace(new RegExp("\r","g"),"\\r"):""}export{createEnvObject,VERCEL_OIDC_TOKEN,SENSITIVE_ENV_VALUE_PLACEHOLDER,looksLikeSecret,looksLikeSecretValue,shouldConfirmRotationBeforeDelete,isFlagsSecretNeedingSplit,normalizeStdinEnvValue,getPublicPrefix,getFrameworkPublicPrefix,getApiPublicPrefix,getLocalSvelteKitPublicPrefixes,removePublicPrefix,validateEnvValue,getEnvKeyWarnings,ENV_VISIBILITY_DEPRECATION_MESSAGE,resolveEnvVarTypeOption,isSecretEnvVar,formatVisibilityLabel,visibilityFromEnvType,getPublicPrefixSecretVisibilityError,resolveEnvVarVisibility,getUnavailableSecretValuesMessage,getLocalSecretFallbackMessage,SENSITIVE_PLACEHOLDER,pull,envPullCommandLogic};