@vielzeug/archive 26.11.11 → 26.11.13

package/dist/auth/worker.js

@@ -1,14 +1,15 @@
 import { sha256Hex as e } from "../_crypto.js";
-import { ACCOUNT_HEADER as t, ARCHIVE_OPERATOR_ROLE as n, OPERATOR_SESSION_MAX_AGE_SECONDS as r, PUBLISHER_HEADER as i, REQUEST_MARKER_HEADER as a, SESSION_COOKIE_NAME as o, SESSION_MAX_AGE_SECONDS as s, archiveAuthHealthSchema as c, archiveErrorResponseSchema as l, isWellFormedText as u, sessionCookieValue as d, uuidSchema as f } from "../contract.js";
-import { serviceRequest as p } from "../worker/_service.js";
-import { ApiError as m, badRequest as h, expiredSessionCookie as g, forbidden as _, json as v, noStore as y, queryParams as b, readJsonBody as x, sessionToken as S, toErrorResponse as C, unauthenticated as w } from "../worker/http.js";
-import { confirmationPage as T, escapeHtml as E } from "./_confirmation.js";
-import { authConfig as D, isWellFormedEmail as O } from "./config.js";
-import { AuthOperationError as k } from "./errors.js";
-import { LINK_TTL_MS as A, authReadiness as j, consumeToken as M, deleteAccount as N, deleteToken as P, ensureUser as F, insertToken as I, readAccount as L, revokeSessions as R, spendLinkBudget as z, spendSignInBudget as B, sweep as V } from "./store.js";
-import { SignJWT as H, errors as U, jwtVerify as W } from "jose";
+import { ApiError as t, badRequest as n, expiredSessionCookie as r, forbidden as i, json as a, noStore as o, queryParams as s, readJsonBody as c, sessionToken as l, toErrorResponse as u, unauthenticated as d } from "../_server/http.js";
+import { serviceRequest as f } from "../_server/service.js";
+import { UUID_RE as p } from "../_server/uuid.js";
+import { ACCOUNT_HEADER as m, ARCHIVE_OPERATOR_ROLE as h, OPERATOR_SESSION_MAX_AGE_SECONDS as g, PUBLISHER_HEADER as _, REQUEST_MARKER_HEADER as v, SESSION_COOKIE_NAME as y, SESSION_MAX_AGE_SECONDS as b, archiveAuthHealthSchema as x, archiveErrorResponseSchema as S, isWellFormedText as C, sessionCookieValue as w, uuidSchema as T } from "../contract.js";
+import { confirmationPage as E, escapeHtml as D } from "./_confirmation.js";
+import { authConfig as O, isWellFormedEmail as k } from "./config.js";
+import { AuthOperationError as A } from "./errors.js";
+import { LINK_TTL_MS as j, authReadiness as M, consumeToken as N, deleteAccount as P, deleteToken as F, ensureUser as I, insertToken as L, readAccount as R, revokeSessions as z, spendLinkBudget as B, spendSignInBudget as V, sweep as H } from "./store.js";
+import { SignJWT as U, errors as W, jwtVerify as G } from "jose";
 // src/auth/worker.ts
-var G = {
+var K = {
 	account: /^\/api\/v1\/auth\/account$/,
 	health: /^\/api\/v1\/auth\/health$/,
 	jwks: /^\/api\/v1\/auth\/jwks\.json$/,
@@ -16,7 +17,7 @@ var G = {
 	signIn: /^\/api\/v1\/auth\/sign-in$/,
 	signOutAll: /^\/api\/v1\/auth\/sign-out-all$/,
 	verify: /^\/api\/v1\/auth\/verify$/
-}, K = {
+}, q = {
 	account: ["GET", "DELETE"],
 	health: ["GET"],
 	jwks: ["GET"],
@@ -24,7 +25,7 @@ var G = {
 	signIn: ["POST"],
 	signOutAll: ["POST"],
 	verify: ["GET", "POST"]
-}, q = {
+}, J = {
 	account: "/auth/account",
 	health: "/auth/health",
 	jwks: "/auth/jwks.json",
@@ -32,10 +33,10 @@ var G = {
 	signIn: "/auth/sign-in",
 	signOutAll: "/auth/sign-out-all",
 	verify: "/auth/verify"
-}, matchRoute = (e) => Object.keys(G).find((t) => G[t].test(new URL(e.url).pathname)), J = 32, Y = /^[A-Za-z0-9_-]{43}$/, X = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, Z = 256, Q = 5, randomToken = () => btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(J)))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, ""), unavailable = () => new k(503, "catalog");
+}, matchRoute = (e) => Object.keys(K).find((t) => K[t].test(new URL(e.url).pathname)), Y = 32, X = /^[A-Za-z0-9_-]{43}$/, Z = 256, Q = 5, randomToken = () => btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(Y)))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, ""), unavailable = () => new A(503, "catalog");
 function requireMutationGuard(e, t, n = !1) {
 	let r = e.headers.get("origin");
-	if (r === null || !t.allowedOrigins.has(r) && !(n && r === t.publicOrigin) || e.headers.get("x-archive-request") !== "1") throw _();
+	if (r === null || !t.allowedOrigins.has(r) && !(n && r === t.publicOrigin) || e.headers.get("x-archive-request") !== "1") throw i();
 	return r;
 }
 function corsHeaders(e, t) {
@@ -46,44 +47,44 @@ function corsHeaders(e, t) {
 		vary: "Origin"
 	};
 }
-function preflight(e, n, r) {
-	let o = corsHeaders(e, n);
-	if (Object.keys(o).length === 0) throw _();
+function preflight(e, t, n) {
+	let r = corsHeaders(e, t);
+	if (Object.keys(r).length === 0) throw i();
 	return new Response(null, {
 		headers: {
-			...o,
-			"access-control-allow-headers": `Content-Type, ${t}, ${i}, ${a}`,
-			"access-control-allow-methods": [...r, "OPTIONS"].join(", "),
+			...r,
+			"access-control-allow-headers": `Content-Type, ${m}, ${_}, ${v}`,
+			"access-control-allow-methods": [...n, "OPTIONS"].join(", "),
 			"access-control-max-age": "600"
 		},
 		status: 204
 	});
 }
 var secure = (e) => e.appEnv === "production";
-async function mintSession(e, t, i, a) {
-	let o = i ? r : s;
+async function mintSession(e, t, n, r) {
+	let i = n ? g : b;
 	return {
-		maxAge: o,
-		token: await new H({
-			sessionVersion: a,
-			...i ? { roles: [n] } : {}
+		maxAge: i,
+		token: await new U({
+			sessionVersion: r,
+			...n ? { roles: [h] } : {}
 		}).setProtectedHeader({
 			alg: "RS256",
 			kid: e.signing.kid,
 			typ: "JWT"
-		}).setIssuedAt().setJti(crypto.randomUUID()).setIssuer(e.issuer).setAudience(e.audience).setSubject(t).setExpirationTime(`${o}s`).sign(e.signing.key)
+		}).setIssuedAt().setJti(crypto.randomUUID()).setIssuer(e.issuer).setAudience(e.audience).setSubject(t).setExpirationTime(`${i}s`).sign(e.signing.key)
 	};
 }
 async function requireSession(e, t, n) {
-	let r = S(e);
-	if (r === null) throw w();
+	let r = l(e);
+	if (r === null) throw d();
 	try {
-		let { payload: e } = await W(r, t.verifier, {
+		let { payload: e } = await G(r, t.verifier, {
 			algorithms: ["RS256"],
 			audience: t.audience,
 			clockTolerance: Q,
 			issuer: t.issuer,
-			maxTokenAge: s,
+			maxTokenAge: b,
 			requiredClaims: [
 				"sub",
 				"iss",
@@ -93,89 +94,89 @@ async function requireSession(e, t, n) {
 				"sessionVersion"
 			]
 		}), i = e.sub ?? "";
-		if (i.length === 0 || i.length > Z || !u(i)) throw w();
+		if (i.length === 0 || i.length > Z || !C(i)) throw d();
 		let a = e.sessionVersion;
-		if (typeof a != "number" || !Number.isSafeInteger(a) || a < 0 || typeof e.iat != "number" || e.iat > Date.now() / 1e3 + Q || Array.isArray(e.roles) && e.roles.includes("archive-operator") && (typeof e.exp != "number" || e.exp - e.iat > 3600 || Date.now() / 1e3 - e.iat > 3600 + Q)) throw w();
-		let o = await L(n.AUTH_DB, i);
-		if (o === null || o.session_version !== a) throw w();
+		if (typeof a != "number" || !Number.isSafeInteger(a) || a < 0 || typeof e.iat != "number" || e.iat > Date.now() / 1e3 + Q || Array.isArray(e.roles) && e.roles.includes("archive-operator") && (typeof e.exp != "number" || e.exp - e.iat > 3600 || Date.now() / 1e3 - e.iat > 3600 + Q)) throw d();
+		let o = await R(n.AUTH_DB, i);
+		if (o === null || o.session_version !== a) throw d();
 		return {
 			sessionVersion: a,
 			subject: i,
 			token: r
 		};
 	} catch (e) {
-		throw e instanceof U.JOSEError ? w() : e;
+		throw e instanceof W.JOSEError ? d() : e;
 	}
 }
 async function sendLink(e, t, n, r) {
-	let i = t.appName, a = `The link works once and expires in ${A / 6e4} minutes. If you did not request it, ignore this email.`;
+	let i = t.appName, a = `The link works once and expires in ${j / 6e4} minutes. If you did not request it, ignore this email.`;
 	await e.AUTH_EMAIL.send({
 		from: t.senderAddress,
-		html: `<p>Open this link to sign in to ${E(i)}:</p><p><a href="${E(r)}">${E(r)}</a></p><p>${a}</p>`,
+		html: `<p>Open this link to sign in to ${D(i)}:</p><p><a href="${D(r)}">${D(r)}</a></p><p>${a}</p>`,
 		subject: `Your ${i} sign-in link`,
 		text: `Open this link to sign in to ${i}:\n\n${r}\n\n${a}`,
 		to: n
 	});
 }
-async function handleSignIn(t, n, r) {
-	requireMutationGuard(t, r);
-	let i = await x(t);
-	if (typeof i != "object" || !i || Array.isArray(i)) throw h();
-	let a = Object.keys(i), o = Reflect.get(i, "email");
-	if (a.length !== 1 || a[0] !== "email" || typeof o != "string") throw h();
-	let s = o.trim().toLowerCase();
-	if (!O(s)) throw h();
-	let c = Date.now(), l = await B(n.AUTH_DB, c);
-	if (l !== null) throw new m(429, "rate-limited", "Too many sign-in requests. Try again later.", { retryAfterSeconds: l });
-	let u = await F(n.AUTH_DB, s), d = await z(n.AUTH_DB, u.id, c);
-	if (d !== null) throw new m(429, "rate-limited", "Too many sign-in emails. Try again later.", { retryAfterSeconds: d });
-	let f = randomToken(), p = await e(f);
-	await I(n.AUTH_DB, p, u.id, c);
+async function handleSignIn(r, i, s) {
+	requireMutationGuard(r, s);
+	let l = await c(r);
+	if (typeof l != "object" || !l || Array.isArray(l)) throw n();
+	let u = Object.keys(l), d = Reflect.get(l, "email");
+	if (u.length !== 1 || u[0] !== "email" || typeof d != "string") throw n();
+	let f = d.trim().toLowerCase();
+	if (!k(f)) throw n();
+	let p = Date.now(), m = await V(i.AUTH_DB, p);
+	if (m !== null) throw new t(429, "rate-limited", "Too many sign-in requests. Try again later.", { retryAfterSeconds: m });
+	let h = await I(i.AUTH_DB, f), g = await B(i.AUTH_DB, h.id, p);
+	if (g !== null) throw new t(429, "rate-limited", "Too many sign-in emails. Try again later.", { retryAfterSeconds: g });
+	let _ = randomToken(), v = await e(_);
+	await L(i.AUTH_DB, v, h.id, p);
 	try {
-		await sendLink(n, r, u.email, `${r.publicOrigin}/api/v1/auth/verify?token=${f}`);
+		await sendLink(i, s, h.email, `${s.publicOrigin}/api/v1/auth/verify?token=${_}`);
 	} catch (e) {
-		throw await P(n.AUTH_DB, p).catch(() => void 0), new k(503, "email", { cause: e });
+		throw await F(i.AUTH_DB, v).catch(() => void 0), new A(503, "email", { cause: e });
 	}
-	return v(202, { ok: !0 }, y);
+	return a(202, { ok: !0 }, o);
 }
-async function handleVerify(t, n, r) {
-	if (t.method === "GET") {
-		let e = b(new URL(t.url), ["token"]).get("token") ?? "";
-		if (!Y.test(e)) throw h("The link is not valid.");
-		return T({
-			...r,
+async function handleVerify(r, i, a) {
+	if (r.method === "GET") {
+		let e = s(new URL(r.url), ["token"]).get("token") ?? "";
+		if (!X.test(e)) throw n("The link is not valid.");
+		return E({
+			...a,
 			nonce: randomToken(),
 			token: e
 		});
 	}
-	requireMutationGuard(t, r, !0), b(new URL(t.url), []);
-	let i = await x(t);
-	if (typeof i != "object" || !i || Array.isArray(i) || Object.keys(i).length !== 1) throw h("The link is not valid.");
-	let a = Reflect.get(i, "token");
-	if (typeof a != "string" || !Y.test(a)) throw h("The link is not valid.");
-	let o = await M(n.AUTH_DB, await e(a), Date.now());
-	if (o === null) throw new m(410, "gone", "That link has expired or was already used.");
-	let s = await mintSession(r, o.id, r.operatorEmails.has(o.email), o.sessionVersion);
+	requireMutationGuard(r, a, !0), s(new URL(r.url), []);
+	let l = await c(r);
+	if (typeof l != "object" || !l || Array.isArray(l) || Object.keys(l).length !== 1) throw n("The link is not valid.");
+	let u = Reflect.get(l, "token");
+	if (typeof u != "string" || !X.test(u)) throw n("The link is not valid.");
+	let d = await N(i.AUTH_DB, await e(u), Date.now());
+	if (d === null) throw new t(410, "gone", "That link has expired or was already used.");
+	let f = await mintSession(a, d.id, a.operatorEmails.has(d.email), d.sessionVersion);
 	return new Response(null, {
 		headers: {
-			...y,
-			"set-cookie": d(s.token, {
-				maxAgeSeconds: s.maxAge,
-				secure: secure(r)
+			...o,
+			"set-cookie": w(f.token, {
+				maxAgeSeconds: f.maxAge,
+				secure: secure(a)
 			})
 		},
 		status: 204
 	});
 }
 async function handleExport(e, t, n) {
-	let { subject: r } = await requireSession(e, n, t), i = await L(t.AUTH_DB, r);
-	if (i === null) throw w();
-	return v(200, {
+	let { subject: r } = await requireSession(e, n, t), i = await R(t.AUTH_DB, r);
+	if (i === null) throw d();
+	return a(200, {
 		createdAt: i.created_at,
 		email: i.email,
 		id: i.id,
 		lastSignInAt: i.last_sign_in_at
-	}, y);
+	}, o);
 }
 async function archiveFailure(e) {
 	let t = await e.text().catch(() => ""), n = null;
@@ -184,109 +185,109 @@ async function archiveFailure(e) {
 	} catch {
 		n = null;
 	}
-	let r = l.safeParse(n);
+	let r = S.safeParse(n);
 	if (!r.success || e.status < 400 || e.status > 599) throw unavailable();
-	let { code: i, message: a, requestId: o } = r.data.error, s = e.headers.get("retry-after");
-	return v(e.status, { error: {
+	let { code: i, message: s, requestId: c } = r.data.error, l = e.headers.get("retry-after");
+	return a(e.status, { error: {
 		code: i,
-		message: a,
-		requestId: o
-	} }, s !== null && /^\d{1,6}$/.test(s) ? {
-		...y,
-		"retry-after": s
-	} : y);
+		message: s,
+		requestId: c
+	} }, l !== null && /^\d{1,6}$/.test(l) ? {
+		...o,
+		"retry-after": l
+	} : o);
 }
-async function handleErase(e, n, r) {
-	let s = requireMutationGuard(e, r), { subject: c, token: l } = await requireSession(e, r, n), u = e.headers.get(t);
-	if (u === null || !f.safeParse(u).success) throw h();
-	if (u !== c) throw new m(409, "account-changed", "The signed-in account changed since this request was prepared.");
+async function handleErase(e, i, a) {
+	let s = requireMutationGuard(e, a), { subject: c, token: l } = await requireSession(e, a, i), u = e.headers.get(m);
+	if (u === null || !T.safeParse(u).success) throw n();
+	if (u !== c) throw new t(409, "account-changed", "The signed-in account changed since this request was prepared.");
 	let d = new Headers({
-		cookie: `${o}=${l}`,
+		cookie: `${y}=${l}`,
 		origin: s,
-		[a]: "1"
-	}), _ = e.headers.get(i);
-	if (_ !== null) {
-		if (!X.test(_)) throw h();
-		d.set(i, _);
+		[v]: "1"
+	}), h = e.headers.get(_);
+	if (h !== null) {
+		if (!p.test(h)) throw n();
+		d.set(_, h);
 	}
-	let v;
+	let g;
 	try {
-		v = await p(n.AUTH_ARCHIVE, new Request(`${r.publicOrigin}/api/v1/me/account`, {
+		g = await f(i.AUTH_ARCHIVE, new Request(`${a.publicOrigin}/api/v1/me/account`, {
 			headers: d,
 			method: "DELETE",
 			redirect: "manual"
 		}), async (e) => e.status === 204 ? (await e.body?.cancel(), e) : archiveFailure(e));
 	} catch (e) {
-		throw new k(503, "catalog", { cause: e });
+		throw new A(503, "catalog", { cause: e });
 	}
-	return v.status === 204 ? (await N(n.AUTH_DB, c), new Response(null, {
+	return g.status === 204 ? (await P(i.AUTH_DB, c), new Response(null, {
 		headers: {
-			...y,
-			"set-cookie": g(secure(r))
+			...o,
+			"set-cookie": r(secure(a))
 		},
 		status: 204
-	})) : v;
+	})) : g;
 }
-async function handleSignOutAll(e, n, r) {
-	requireMutationGuard(e, r);
-	let { subject: i, sessionVersion: a } = await requireSession(e, r, n), o = e.headers.get(t);
-	if (o === null || !f.safeParse(o).success) throw h();
-	if (o !== i) throw new m(409, "account-changed", "The signed-in account changed since this request was prepared.");
-	if (await R(n.AUTH_DB, i, a) === null) throw w();
-	return v(200, { ok: !0 }, {
-		...y,
-		"set-cookie": g(secure(r))
+async function handleSignOutAll(e, i, s) {
+	requireMutationGuard(e, s);
+	let { subject: c, sessionVersion: l } = await requireSession(e, s, i), u = e.headers.get(m);
+	if (u === null || !T.safeParse(u).success) throw n();
+	if (u !== c) throw new t(409, "account-changed", "The signed-in account changed since this request was prepared.");
+	if (await z(i.AUTH_DB, c, l) === null) throw d();
+	return a(200, { ok: !0 }, {
+		...o,
+		"set-cookie": r(secure(s))
 	});
 }
 async function handleHealth(e) {
 	let t = null, n = null;
 	try {
-		await D(e);
+		await O(e);
 	} catch {
 		t = "configuration-unavailable";
 	}
 	if (t === null) try {
-		n = await j(e.AUTH_DB), n !== 1 && (t = "schema-mismatch");
+		n = await M(e.AUTH_DB), n !== 1 && (t = "schema-mismatch");
 	} catch {
 		t = "database-unavailable";
 	}
-	return v(t === null ? 200 : 503, c.parse({
+	return a(t === null ? 200 : 503, x.parse({
 		dbSchemaVersion: n,
 		reason: t,
 		schemaVersion: 1,
 		status: t === null ? "ok" : "degraded"
-	}), y);
+	}), o);
 }
-async function route(e, t) {
-	let n = e.method.toUpperCase(), r = matchRoute(e);
-	if (r === void 0) throw new m(404, "not-found", "No such route.");
-	if (r === "health" && n === "GET") return handleHealth(t);
-	let i = await D(t), a = corsHeaders(e, i);
-	if (n === "OPTIONS") return preflight(e, i, K[r]);
-	if (!K[r].includes(n)) throw new m(405, "method-not-allowed", "That method is not allowed here.");
-	let o;
-	switch (r) {
+async function route(e, n) {
+	let r = e.method.toUpperCase(), i = matchRoute(e);
+	if (i === void 0) throw new t(404, "not-found", "No such route.");
+	if (i === "health" && r === "GET") return handleHealth(n);
+	let s = await O(n), c = corsHeaders(e, s);
+	if (r === "OPTIONS") return preflight(e, s, q[i]);
+	if (!q[i].includes(r)) throw new t(405, "method-not-allowed", "That method is not allowed here.");
+	let l;
+	switch (i) {
 		case "health":
-			o = await handleHealth(t);
+			l = await handleHealth(n);
 			break;
 		case "session":
-			await requireSession(e, i, t), o = v(200, { ok: !0 }, y);
+			await requireSession(e, s, n), l = a(200, { ok: !0 }, o);
 			break;
 		case "signOutAll":
-			o = await handleSignOutAll(e, t, i);
+			l = await handleSignOutAll(e, n, s);
 			break;
 		case "jwks":
-			o = v(200, { keys: i.jwks }, y);
+			l = a(200, { keys: s.jwks }, o);
 			break;
 		case "signIn":
-			o = await handleSignIn(e, t, i);
+			l = await handleSignIn(e, n, s);
 			break;
 		case "verify":
-			o = await handleVerify(e, t, i);
+			l = await handleVerify(e, n, s);
 			break;
-		case "account": o = n === "GET" ? await handleExport(e, t, i) : await handleErase(e, t, i);
+		case "account": l = r === "GET" ? await handleExport(e, n, s) : await handleErase(e, n, s);
 	}
-	return withCors(o, a);
+	return withCors(l, c);
 }
 function withCors(e, t) {
 	if (Object.keys(t).length === 0) return e;
@@ -294,7 +295,7 @@ function withCors(e, t) {
 	for (let [e, r] of Object.entries(t)) n.headers.set(e, r);
 	return n;
 }
-var diagnostic = (e) => e instanceof k ? e.authDiagnostic : { kind: "internal" };
+var diagnostic = (e) => e instanceof A ? e.authDiagnostic : { kind: "internal" };
 function createAuthWorker() {
 	let e = /* @__PURE__ */ new Set(), emit = (t) => {
 		for (let n of e) try {
@@ -302,37 +303,37 @@ function createAuthWorker() {
 		} catch {}
 	};
 	return {
-		async fetch(t, n) {
-			let r = crypto.randomUUID(), i = Date.now(), a, o;
+		async fetch(n, r) {
+			let i = crypto.randomUUID(), a = Date.now(), o, s;
 			try {
-				a = await route(t, n);
+				o = await route(n, r);
 			} catch (e) {
-				o = e, a = C(e, r);
-				let i = await D(n).catch(() => null);
-				i !== null && (matchRoute(t) === "verify" && t.method === "GET" && e instanceof m && e.status === 400 && (a = T({
-					...i,
+				s = e, o = u(e, i);
+				let a = await O(r).catch(() => null);
+				a !== null && (matchRoute(n) === "verify" && n.method === "GET" && e instanceof t && e.status === 400 && (o = E({
+					...a,
 					nonce: randomToken(),
 					token: null
-				})), a = withCors(a, corsHeaders(t, i)));
+				})), o = withCors(o, corsHeaders(n, a)));
 			}
-			if (matchRoute(t) === "verify" && (a.headers.set("cache-control", "no-store"), a.headers.set("referrer-policy", "no-referrer"), a.headers.set("x-content-type-options", "nosniff"), a.headers.has("content-security-policy") || a.headers.set("content-security-policy", "default-src 'none'; base-uri 'none'; frame-ancestors 'none'")), e.size > 0) {
-				let e = matchRoute(t), n = a.status < 400 ? "ok" : e === "health" ? "unavailable" : o instanceof m ? o.code : "internal", s = o === void 0 && a.status >= 400 ? l.safeParse(await a.clone().json().catch(() => null)) : null, u = e === "health" && a.status === 503 ? c.safeParse(await a.clone().json().catch(() => null)) : null;
+			if (matchRoute(n) === "verify" && (o.headers.set("cache-control", "no-store"), o.headers.set("referrer-policy", "no-referrer"), o.headers.set("x-content-type-options", "nosniff"), o.headers.has("content-security-policy") || o.headers.set("content-security-policy", "default-src 'none'; base-uri 'none'; frame-ancestors 'none'")), e.size > 0) {
+				let e = matchRoute(n), r = o.status < 400 ? "ok" : e === "health" ? "unavailable" : s instanceof t ? s.code : "internal", c = s === void 0 && o.status >= 400 ? S.safeParse(await o.clone().json().catch(() => null)) : null, l = e === "health" && o.status === 503 ? x.safeParse(await o.clone().json().catch(() => null)) : null;
 				emit({
-					code: s?.success ? s.data.error.code : n,
-					ms: Math.max(0, Date.now() - i),
-					requestId: r,
-					route: e === void 0 ? "unmatched" : q[e],
-					status: a.status,
+					code: c?.success ? c.data.error.code : r,
+					ms: Math.max(0, Date.now() - a),
+					requestId: i,
+					route: e === void 0 ? "unmatched" : J[e],
+					status: o.status,
 					type: "request",
-					...a.status >= 500 ? { diagnostic: u?.success ? { kind: u.data.reason === "configuration-unavailable" ? "configuration" : u.data.reason === "schema-mismatch" ? "schema" : "database" } : o === void 0 ? { kind: "catalog" } : diagnostic(o) } : {}
+					...o.status >= 500 ? { diagnostic: l?.success ? { kind: l.data.reason === "configuration-unavailable" ? "configuration" : l.data.reason === "schema-mismatch" ? "schema" : "database" } : s === void 0 ? { kind: "catalog" } : diagnostic(s) } : {}
 				});
 			}
-			return a;
+			return o;
 		},
 		async scheduled(t, n) {
 			try {
-				await D(n);
-				let t = await V(n.AUTH_DB, Date.now());
+				await O(n);
+				let t = await H(n.AUTH_DB, Date.now());
 				e.size > 0 && emit({
 					removed: t,
 					status: "ok",