@zuplo/graphql 5.1555.0 → 5.1556.0

package/index.minified.js

@@ -56,13 +56,13 @@
 `)}o(lT,"messagesToMultilineText");Fe.messagesToMultilineText=lT;function tf(t){return typeof t=="string"?t:JSON.stringify(t)}o(tf,"stringifyNonString");Fe.stringifyNonString=tf;function rf(t){return typeof t=="string"?t:t===null?"null":typeof t>"u"?"undefined":typeof t=="number"||typeof t=="boolean"||typeof t=="bigint"||typeof t=="symbol"?t.toString():typeof t=="function"?`[function ${t.name}]`:typeof t=="object"&&Array.isArray(t)?`[array ${t.length}]`:t instanceof Error?`${t.name??"Error"}: ${t.message??"unknown"}`:typeof t=="object"?(0,ef.toString)(t):"unknown"}o(rf,"stringifyNonStringToText");Fe.stringifyNonStringToText=rf});var L,se,Te=I(()=>{L=crypto,se=o(t=>t instanceof CryptoKey,"isCryptoKey")});var dT,Do,Uu=I(()=>{Te();dT=o(async(t,e)=>{let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await L.subtle.digest(r,e))},"digest"),Do=dT});function Se(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;return t.forEach(i=>{r.set(i,n),n+=i.length}),r}function nf(t,e){return Se(Y.encode(t),new Uint8Array([0]),e)}function Mu(t,e,r){if(e<0||e>=Uo)throw new RangeError(`value must be >= 0 and <= ${Uo-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Mo(t){let e=Math.floor(t/Uo),r=t%Uo,n=new Uint8Array(8);return Mu(n,e,0),Mu(n,r,4),n}function ko(t){let e=new Uint8Array(4);return Mu(e,t),e}function Fo(t){return Se(ko(t.length),t)}async function of(t,e,r){let n=Math.ceil((e>>3)/32),i=new Uint8Array(n*32);for(let s=0;s<n;s++){let a=new Uint8Array(4+t.length+r.length);a.set(ko(s+1)),a.set(t,4),a.set(r,4+t.length),i.set(await Do("sha256",a),s*32)}return i.slice(0,e>>3)}var Y,ce,Uo,ye=I(()=>{Uu();Y=new TextEncoder,ce=new TextDecoder,Uo=2**32;o(Se,"concat");o(nf,"p2s");o(Mu,"writeUInt32BE");o(Mo,"uint64be");o(ko,"uint32be");o(Fo,"lengthAndInput");o(of,"concatKdf")});var Ho,Z,ku,te,Ie=I(()=>{ye();Ho=o(t=>{let e=t;typeof e=="string"&&(e=Y.encode(e));let r=32768,n=[];for(let i=0;i<e.length;i+=r)n.push(String.fromCharCode.apply(null,e.subarray(i,i+r)));return btoa(n.join(""))},"encodeBase64"),Z=o(t=>Ho(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"),"encode"),ku=o(t=>{let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r},"decodeBase64"),te=o(t=>{let e=t;e instanceof Uint8Array&&(e=ce.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return ku(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}},"decode")});var Fu={};Vi(Fu,{JOSEAlgNotAllowed:()=>zt,JOSEError:()=>pe,JOSENotSupported:()=>U,JWEDecryptionFailed:()=>Ct,JWEInvalid:()=>P,JWKInvalid:()=>Zn,JWKSInvalid:()=>Wt,JWKSMultipleMatchingKeys:()=>Xn,JWKSNoMatchingKey:()=>Pr,JWKSTimeout:()=>ei,JWSInvalid:()=>z,JWSSignatureVerificationFailed:()=>Rr,JWTClaimValidationFailed:()=>ge,JWTExpired:()=>Kr,JWTInvalid:()=>ue});var pe,ge,Kr,zt,U,Ct,P,z,ue,Zn,Wt,Pr,Xn,ei,Rr,V=I(()=>{pe=class extends Error{static{o(this,"JOSEError")}static get code(){return"ERR_JOSE_GENERIC"}constructor(e){var r;super(e),this.code="ERR_JOSE_GENERIC",this.name=this.constructor.name,(r=Error.captureStackTrace)===null||r===void 0||r.call(Error,this,this.constructor)}},ge=class extends pe{static{o(this,"JWTClaimValidationFailed")}static get code(){return"ERR_JWT_CLAIM_VALIDATION_FAILED"}constructor(e,r="unspecified",n="unspecified"){super(e),this.code="ERR_JWT_CLAIM_VALIDATION_FAILED",this.claim=r,this.reason=n}},Kr=class extends pe{static{o(this,"JWTExpired")}static get code(){return"ERR_JWT_EXPIRED"}constructor(e,r="unspecified",n="unspecified"){super(e),this.code="ERR_JWT_EXPIRED",this.claim=r,this.reason=n}},zt=class extends pe{static{o(this,"JOSEAlgNotAllowed")}constructor(){super(...arguments),this.code="ERR_JOSE_ALG_NOT_ALLOWED"}static get code(){return"ERR_JOSE_ALG_NOT_ALLOWED"}},U=class extends pe{static{o(this,"JOSENotSupported")}constructor(){super(...arguments),this.code="ERR_JOSE_NOT_SUPPORTED"}static get code(){return"ERR_JOSE_NOT_SUPPORTED"}},Ct=class extends pe{static{o(this,"JWEDecryptionFailed")}constructor(){super(...arguments),this.code="ERR_JWE_DECRYPTION_FAILED",this.message="decryption operation failed"}static get code(){return"ERR_JWE_DECRYPTION_FAILED"}},P=class extends pe{static{o(this,"JWEInvalid")}constructor(){super(...arguments),this.code="ERR_JWE_INVALID"}static get code(){return"ERR_JWE_INVALID"}},z=class extends pe{static{o(this,"JWSInvalid")}constructor(){super(...arguments),this.code="ERR_JWS_INVALID"}static get code(){return"ERR_JWS_INVALID"}},ue=class extends pe{static{o(this,"JWTInvalid")}constructor(){super(...arguments),this.code="ERR_JWT_INVALID"}static get code(){return"ERR_JWT_INVALID"}},Zn=class extends pe{static{o(this,"JWKInvalid")}constructor(){super(...arguments),this.code="ERR_JWK_INVALID"}static get code(){return"ERR_JWK_INVALID"}},Wt=class extends pe{static{o(this,"JWKSInvalid")}constructor(){super(...arguments),this.code="ERR_JWKS_INVALID"}static get code(){return"ERR_JWKS_INVALID"}},Pr=class extends pe{static{o(this,"JWKSNoMatchingKey")}constructor(){super(...arguments),this.code="ERR_JWKS_NO_MATCHING_KEY",this.message="no applicable key found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_NO_MATCHING_KEY"}},Xn=class extends pe{static{o(this,"JWKSMultipleMatchingKeys")}constructor(){super(...arguments),this.code="ERR_JWKS_MULTIPLE_MATCHING_KEYS",this.message="multiple matching keys found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_MULTIPLE_MATCHING_KEYS"}},ei=class extends pe{static{o(this,"JWKSTimeout")}constructor(){super(...arguments),this.code="ERR_JWKS_TIMEOUT",this.message="request timed out"}static get code(){return"ERR_JWKS_TIMEOUT"}},Rr=class extends pe{static{o(this,"JWSSignatureVerificationFailed")}constructor(){super(...arguments),this.code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED",this.message="signature verification failed"}static get code(){return"ERR_JWS_SIGNATURE_VERIFICATION_FAILED"}}});var Qt,ti=I(()=>{Te();Qt=L.getRandomValues.bind(L)});function Hu(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new U(`Unsupported JWE Algorithm: ${t}`)}}var qo,$o=I(()=>{V();ti();o(Hu,"bitLength");qo=o(t=>Qt(new Uint8Array(Hu(t)>>3)),"default")});var pT,jo,qu=I(()=>{V();$o();pT=o((t,e)=>{if(e.length<<3!==Hu(t))throw new P("Invalid Initialization Vector length")},"checkIvLength"),jo=pT});var hT,Jr,$u=I(()=>{V();hT=o((t,e)=>{let r=t.byteLength<<3;if(r!==e)throw new P(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)},"checkCekLength"),Jr=hT});var fT,af,cf=I(()=>{fT=o((t,e)=>{if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");if(t.length!==e.length)throw new TypeError("Input buffers must have the same length");let r=t.length,n=0,i=-1;for(;++i<r;)n|=t[i]^e[i];return n===0},"timingSafeEqual"),af=fT});function Ae(t,e="algorithm.name"){return new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)}function Yt(t,e){return t.name===e}function Vo(t){return parseInt(t.name.slice(4),10)}function mT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function uf(t,e){if(e.length&&!e.some(r=>t.usages.includes(r))){let r="CryptoKey does not support this operation, its usages must include ";if(e.length>2){let n=e.pop();r+=`one of ${e.join(", ")}, or ${n}.`}else e.length===2?r+=`one of ${e[0]} or ${e[1]}.`:r+=`${e[0]}.`;throw new TypeError(r)}}function lf(t,e,...r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Yt(t.algorithm,"HMAC"))throw Ae("HMAC");let n=parseInt(e.slice(2),10);if(Vo(t.algorithm.hash)!==n)throw Ae(`SHA-${n}`,"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!Yt(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Ae("RSASSA-PKCS1-v1_5");let n=parseInt(e.slice(2),10);if(Vo(t.algorithm.hash)!==n)throw Ae(`SHA-${n}`,"algorithm.hash");break}case"PS256":case"PS384":case"PS512":{if(!Yt(t.algorithm,"RSA-PSS"))throw Ae("RSA-PSS");let n=parseInt(e.slice(2),10);if(Vo(t.algorithm.hash)!==n)throw Ae(`SHA-${n}`,"algorithm.hash");break}case"EdDSA":{if(t.algorithm.name!=="Ed25519"&&t.algorithm.name!=="Ed448")throw Ae("Ed25519 or Ed448");break}case"ES256":case"ES384":case"ES512":{if(!Yt(t.algorithm,"ECDSA"))throw Ae("ECDSA");let n=mT(e);if(t.algorithm.namedCurve!==n)throw Ae(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}uf(t,r)}function He(t,e,...r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Yt(t.algorithm,"AES-GCM"))throw Ae("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Ae(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Yt(t.algorithm,"AES-KW"))throw Ae("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Ae(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":case"X448":break;default:throw Ae("ECDH, X25519, or X448")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Yt(t.algorithm,"PBKDF2"))throw Ae("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Yt(t.algorithm,"RSA-OAEP"))throw Ae("RSA-OAEP");let n=parseInt(e.slice(9),10)||1;if(Vo(t.algorithm.hash)!==n)throw Ae(`SHA-${n}`,"algorithm.hash");break}default:throw new TypeError("CryptoKey does not support this operation")}uf(t,r)}var Zt=I(()=>{o(Ae,"unusable");o(Yt,"isAlgorithm");o(Vo,"getHashLength");o(mT,"getNamedCurve");o(uf,"checkUsage");o(lf,"checkSigCryptoKey");o(He,"checkEncCryptoKey")});function df(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor&&e.constructor.name&&(t+=` Received an instance of ${e.constructor.name}`),t}function ju(t,e,...r){return df(`Key for the ${t} algorithm must be `,e,...r)}var ie,ot=I(()=>{o(df,"message");ie=o((t,...e)=>df("Key must be ",t,...e),"default");o(ju,"withAlg")});var Vu,W,st=I(()=>{Te();Vu=o(t=>se(t),"default"),W=["CryptoKey"]});async function yT(t,e,r,n,i,s){if(!(e instanceof Uint8Array))throw new TypeError(ie(e,"Uint8Array"));let a=parseInt(t.slice(1,4),10),c=await L.subtle.importKey("raw",e.subarray(a>>3),"AES-CBC",!1,["decrypt"]),u=await L.subtle.importKey("raw",e.subarray(0,a>>3),{hash:`SHA-${a<<1}`,name:"HMAC"},!1,["sign"]),l=Se(s,n,r,Mo(s.length<<3)),d=new Uint8Array((await L.subtle.sign("HMAC",u,l)).slice(0,a>>3)),p;try{p=af(i,d)}catch{}if(!p)throw new Ct;let y;try{y=new Uint8Array(await L.subtle.decrypt({iv:n,name:"AES-CBC"},c,r))}catch{}if(!y)throw new Ct;return y}async function gT(t,e,r,n,i,s){let a;e instanceof Uint8Array?a=await L.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(He(e,t,"decrypt"),a=e);try{return new Uint8Array(await L.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},a,Se(r,i)))}catch{throw new Ct}}var _T,Go,Gu=I(()=>{ye();qu();$u();cf();V();Te();Zt();ot();st();o(yT,"cbcDecrypt");o(gT,"gcmDecrypt");_T=o(async(t,e,r,n,i,s)=>{if(!se(e)&&!(e instanceof Uint8Array))throw new TypeError(ie(e,...W,"Uint8Array"));switch(jo(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Jr(e,parseInt(t.slice(-3),10)),yT(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Jr(e,parseInt(t.slice(1,4),10)),gT(t,e,r,n,i,s);default:throw new U("Unsupported JWE Content Encryption Algorithm")}},"decrypt"),Go=_T});var pf,hf,Bu=I(()=>{V();pf=o(async()=>{throw new U('JWE "zip" (Compression Algorithm) Header Parameter is not supported by your javascript runtime. You need to use the `inflateRaw` decrypt option to provide Inflate Raw implementation.')},"inflate"),hf=o(async()=>{throw new U('JWE "zip" (Compression Algorithm) Header Parameter is not supported by your javascript runtime. You need to use the `deflateRaw` encrypt option to provide Deflate Raw implementation.')},"deflate")});var bT,yt,zr=I(()=>{bT=o((...t)=>{let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0},"isDisjoint"),yt=bT});function ET(t){return typeof t=="object"&&t!==null}function Q(t){if(!ET(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}var qe=I(()=>{o(ET,"isObjectLike");o(Q,"isObject")});var wT,Wr,Ku=I(()=>{wT=[{hash:"SHA-256",name:"HMAC"},!0,["sign"]],Wr=wT});function ff(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function mf(t,e,r){if(se(t))return He(t,e,r),t;if(t instanceof Uint8Array)return L.subtle.importKey("raw",t,"AES-KW",!0,[r]);throw new TypeError(ie(t,...W,"Uint8Array"))}var ri,ni,Bo=I(()=>{Ku();Te();Zt();ot();st();o(ff,"checkKeySize");o(mf,"getCryptoKey");ri=o(async(t,e,r)=>{let n=await mf(e,t,"wrapKey");ff(n,t);let i=await L.subtle.importKey("raw",r,...Wr);return new Uint8Array(await L.subtle.wrapKey("raw",i,n,"AES-KW"))},"wrap"),ni=o(async(t,e,r)=>{let n=await mf(e,t,"unwrapKey");ff(n,t);let i=await L.subtle.unwrapKey("raw",r,n,"AES-KW",...Wr);return new Uint8Array(await L.subtle.exportKey("raw",i))},"unwrap")});async function Ko(t,e,r,n,i=new Uint8Array(0),s=new Uint8Array(0)){if(!se(t))throw new TypeError(ie(t,...W));if(He(t,"ECDH"),!se(e))throw new TypeError(ie(e,...W));He(e,"ECDH","deriveBits");let a=Se(Fo(Y.encode(r)),Fo(i),Fo(s),ko(n)),c;t.algorithm.name==="X25519"?c=256:t.algorithm.name==="X448"?c=448:c=Math.ceil(parseInt(t.algorithm.namedCurve.substr(-3),10)/8)<<3;let u=new Uint8Array(await L.subtle.deriveBits({name:t.algorithm.name,public:t},e,c));return of(u,n,a)}async function yf(t){if(!se(t))throw new TypeError(ie(t,...W));return L.subtle.generateKey(t.algorithm,!0,["deriveBits"])}function Jo(t){if(!se(t))throw new TypeError(ie(t,...W));return["P-256","P-384","P-521"].includes(t.algorithm.namedCurve)||t.algorithm.name==="X25519"||t.algorithm.name==="X448"}var Ju=I(()=>{ye();Te();Zt();ot();st();o(Ko,"deriveKey");o(yf,"generateEpk");o(Jo,"ecdhAllowed")});function zu(t){if(!(t instanceof Uint8Array)||t.length<8)throw new P("PBES2 Salt Input must be 8 or more octets")}var _f=I(()=>{V();o(zu,"checkP2s")});function vT(t,e){if(t instanceof Uint8Array)return L.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]);if(se(t))return He(t,e,"deriveBits","deriveKey"),t;throw new TypeError(ie(t,...W,"Uint8Array"))}async function bf(t,e,r,n){zu(t);let i=nf(e,t),s=parseInt(e.slice(13,16),10),a={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},c={length:s,name:"AES-KW"},u=await vT(n,e);if(u.usages.includes("deriveBits"))return new Uint8Array(await L.subtle.deriveBits(a,u,s));if(u.usages.includes("deriveKey"))return L.subtle.deriveKey(a,u,c,!1,["wrapKey","unwrapKey"]);throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"')}var Ef,wf,Wu=I(()=>{ti();ye();Ie();Bo();_f();Te();Zt();ot();st();o(vT,"getCryptoKey");o(bf,"deriveKey");Ef=o(async(t,e,r,n=2048,i=Qt(new Uint8Array(16)))=>{let s=await bf(i,t,n,e);return{encryptedKey:await ri(t.slice(-6),s,r),p2c:n,p2s:Z(i)}},"encrypt"),wf=o(async(t,e,r,n,i)=>{let s=await bf(i,t,n,e);return ni(t.slice(-6),s,r)},"decrypt")});function Qr(t){switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new U(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}var vf=I(()=>{V();o(Qr,"subtleRsaEs")});var Or,zo=I(()=>{Or=o((t,e)=>{if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}},"default")});var Tf,Sf,Qu=I(()=>{vf();Ku();Te();Zt();zo();ot();st();Tf=o(async(t,e,r)=>{if(!se(e))throw new TypeError(ie(e,...W));if(He(e,t,"encrypt","wrapKey"),Or(t,e),e.usages.includes("encrypt"))return new Uint8Array(await L.subtle.encrypt(Qr(t),e,r));if(e.usages.includes("wrapKey")){let n=await L.subtle.importKey("raw",r,...Wr);return new Uint8Array(await L.subtle.wrapKey("raw",n,e,Qr(t)))}throw new TypeError('RSA-OAEP key "usages" must include "encrypt" or "wrapKey" for this operation')},"encrypt"),Sf=o(async(t,e,r)=>{if(!se(e))throw new TypeError(ie(e,...W));if(He(e,t,"decrypt","unwrapKey"),Or(t,e),e.usages.includes("decrypt"))return new Uint8Array(await L.subtle.decrypt(Qr(t),e,r));if(e.usages.includes("unwrapKey")){let n=await L.subtle.unwrapKey("raw",r,e,Qr(t),...Wr);return new Uint8Array(await L.subtle.exportKey("raw",n))}throw new TypeError('RSA-OAEP key "usages" must include "decrypt" or "unwrapKey" for this operation')},"decrypt")});function ii(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new U(`Unsupported JWE Algorithm: ${t}`)}}var gt,oi=I(()=>{V();ti();o(ii,"bitLength");gt=o(t=>Qt(new Uint8Array(ii(t)>>3)),"default")});var Yu,If=I(()=>{Yu=o((t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
 `);return`-----BEGIN ${e}-----
 ${r}
------END ${e}-----`},"default")});function Pf(t){let e=[],r=0;for(;r<t.length;){let n=Lf(t.subarray(r));e.push(n),r+=n.byteLength}return e}function Lf(t){let e=0,r=t[0]&31;if(e++,r===31){for(r=0;t[e]>=128;)r=r*128+t[e]-128,e++;r=r*128+t[e]-128,e++}let n=0;if(t[e]<128)n=t[e],e++;else if(n===128){for(n=0;t[e+n]!==0||t[e+n+1]!==0;){if(n>t.byteLength)throw new TypeError("invalid indefinite form length");n++}let s=e+n+2;return{byteLength:s,contents:t.subarray(e,e+n),raw:t.subarray(0,s)}}else{let s=t[e]&127;e++,n=0;for(let a=0;a<s;a++)n=n*256+t[e],e++}let i=e+n;return{byteLength:i,contents:t.subarray(e,i),raw:t.subarray(0,i)}}function TT(t){let e=Pf(Pf(Lf(t).contents)[0].contents);return Ho(e[e[0].raw[0]===160?6:5].raw)}function ST(t){let e=t.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g,""),r=ku(e);return Yu(TT(r),"PUBLIC KEY")}var Rf,Of,xf,Xt,Af,Nf,Cf,Zu,Df,Wo=I(()=>{Te();ot();Ie();If();V();st();Rf=o(async(t,e,r)=>{if(!se(r))throw new TypeError(ie(r,...W));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return Yu(Ho(new Uint8Array(await L.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},"genericExport"),Of=o(t=>Rf("public","spki",t),"toSPKI"),xf=o(t=>Rf("private","pkcs8",t),"toPKCS8"),Xt=o((t,e,r=0)=>{r===0&&(e.unshift(e.length),e.unshift(6));let n=t.indexOf(e[0],r);if(n===-1)return!1;let i=t.subarray(n,n+e.length);return i.length!==e.length?!1:i.every((s,a)=>s===e[a])||Xt(t,e,n+1)},"findOid"),Af=o(t=>{switch(!0){case Xt(t,[42,134,72,206,61,3,1,7]):return"P-256";case Xt(t,[43,129,4,0,34]):return"P-384";case Xt(t,[43,129,4,0,35]):return"P-521";case Xt(t,[43,101,110]):return"X25519";case Xt(t,[43,101,111]):return"X448";case Xt(t,[43,101,112]):return"Ed25519";case Xt(t,[43,101,113]):return"Ed448";default:throw new U("Invalid or unsupported EC Key Curve or OKP Key Sub Type")}},"getNamedCurve"),Nf=o(async(t,e,r,n,i)=>{var s;let a,c,u=new Uint8Array(atob(r.replace(t,"")).split("").map(d=>d.charCodeAt(0))),l=e==="spki";switch(n){case"PS256":case"PS384":case"PS512":a={name:"RSA-PSS",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RS256":case"RS384":case"RS512":a={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":a={name:"RSA-OAEP",hash:`SHA-${parseInt(n.slice(-3),10)||1}`},c=l?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":a={name:"ECDSA",namedCurve:"P-256"},c=l?["verify"]:["sign"];break;case"ES384":a={name:"ECDSA",namedCurve:"P-384"},c=l?["verify"]:["sign"];break;case"ES512":a={name:"ECDSA",namedCurve:"P-521"},c=l?["verify"]:["sign"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let d=Af(u);a=d.startsWith("P-")?{name:"ECDH",namedCurve:d}:{name:d},c=l?[]:["deriveBits"];break}case"EdDSA":a={name:Af(u)},c=l?["verify"]:["sign"];break;default:throw new U('Invalid or unsupported "alg" (Algorithm) value')}return L.subtle.importKey(e,u,a,(s=i?.extractable)!==null&&s!==void 0?s:!1,c)},"genericImport"),Cf=o((t,e,r)=>Nf(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"pkcs8",t,e,r),"fromPKCS8"),Zu=o((t,e,r)=>Nf(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,"spki",t,e,r),"fromSPKI");o(Pf,"getElement");o(Lf,"parseElement");o(TT,"spkiFromX509");o(ST,"getSPKI");Df=o((t,e,r)=>{let n;try{n=ST(t)}catch(i){throw new TypeError("failed to parse the X.509 certificate",{cause:i})}return Zu(n,e,r)},"fromX509")});function IT(t){let e,r;switch(t.kty){case"oct":{switch(t.alg){case"HS256":case"HS384":case"HS512":e={name:"HMAC",hash:`SHA-${t.alg.slice(-3)}`},r=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":throw new U(`${t.alg} keys cannot be imported as CryptoKey instances`);case"A128GCM":case"A192GCM":case"A256GCM":case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":e={name:"AES-GCM"},r=["encrypt","decrypt"];break;case"A128KW":case"A192KW":case"A256KW":e={name:"AES-KW"},r=["wrapKey","unwrapKey"];break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":e={name:"PBKDF2"},r=["deriveBits"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"EC":{switch(t.alg){case"ES256":e={name:"ECDSA",namedCurve:"P-256"},r=t.d?["sign"]:["verify"];break;case"ES384":e={name:"ECDSA",namedCurve:"P-384"},r=t.d?["sign"]:["verify"];break;case"ES512":e={name:"ECDSA",namedCurve:"P-521"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"OKP":{switch(t.alg){case"EdDSA":e={name:t.crv},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new U('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}var AT,Xu,Uf=I(()=>{Te();V();Ie();o(IT,"subtleMapping");AT=o(async t=>{var e,r;if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:n,keyUsages:i}=IT(t),s=[n,(e=t.ext)!==null&&e!==void 0?e:!1,(r=t.key_ops)!==null&&r!==void 0?r:i];if(n.name==="PBKDF2")return L.subtle.importKey("raw",te(t.k),...s);let a={...t};return delete a.alg,delete a.use,L.subtle.importKey("jwk",a,...s)},"parse"),Xu=AT});async function Mf(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return Zu(t,e,r)}async function kf(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return Df(t,e,r)}async function Ff(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Cf(t,e,r)}async function er(t,e,r){var n;if(!Q(t))throw new TypeError("JWK must be an object");switch(e||(e=t.alg),t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return r??(r=t.ext!==!0),r?Xu({...t,alg:e,ext:(n=t.ext)!==null&&n!==void 0?n:!1}):te(t.k);case"RSA":if(t.oth!==void 0)throw new U('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return Xu({...t,alg:e});default:throw new U('Unsupported "kty" (Key Type) Parameter value')}}var si=I(()=>{Ie();Wo();Uf();V();qe();o(Mf,"importSPKI");o(kf,"importX509");o(Ff,"importPKCS8");o(er,"importJWK")});var PT,RT,OT,tr,ai=I(()=>{ot();st();PT=o((t,e)=>{if(!(e instanceof Uint8Array)){if(!Vu(e))throw new TypeError(ju(t,e,...W,"Uint8Array"));if(e.type!=="secret")throw new TypeError(`${W.join(" or ")} instances for symmetric algorithms must be of type "secret"`)}},"symmetricTypeCheck"),RT=o((t,e,r)=>{if(!Vu(e))throw new TypeError(ju(t,e,...W));if(e.type==="secret")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);if(r==="sign"&&e.type==="public")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm signing must be of type "private"`);if(r==="decrypt"&&e.type==="public")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm decryption must be of type "private"`);if(e.algorithm&&r==="verify"&&e.type==="private")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);if(e.algorithm&&r==="encrypt"&&e.type==="private")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`)},"asymmetricTypeCheck"),OT=o((t,e,r)=>{t.startsWith("HS")||t==="dir"||t.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(t)?PT(t,e):RT(t,e,r)},"checkKeyType"),tr=OT});async function xT(t,e,r,n,i){if(!(r instanceof Uint8Array))throw new TypeError(ie(r,"Uint8Array"));let s=parseInt(t.slice(1,4),10),a=await L.subtle.importKey("raw",r.subarray(s>>3),"AES-CBC",!1,["encrypt"]),c=await L.subtle.importKey("raw",r.subarray(0,s>>3),{hash:`SHA-${s<<1}`,name:"HMAC"},!1,["sign"]),u=new Uint8Array(await L.subtle.encrypt({iv:n,name:"AES-CBC"},a,e)),l=Se(i,n,u,Mo(i.length<<3)),d=new Uint8Array((await L.subtle.sign("HMAC",c,l)).slice(0,s>>3));return{ciphertext:u,tag:d}}async function NT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await L.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(He(r,t,"encrypt"),s=r);let a=new Uint8Array(await L.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),c=a.slice(-16);return{ciphertext:a.slice(0,-16),tag:c}}var CT,ci,el=I(()=>{ye();qu();$u();Te();Zt();ot();V();st();o(xT,"cbcEncrypt");o(NT,"gcmEncrypt");CT=o(async(t,e,r,n,i)=>{if(!se(r)&&!(r instanceof Uint8Array))throw new TypeError(ie(r,...W,"Uint8Array"));switch(jo(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Jr(r,parseInt(t.slice(-3),10)),xT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Jr(r,parseInt(t.slice(1,4),10)),NT(t,e,r,n,i);default:throw new U("Unsupported JWE Content Encryption Algorithm")}},"encrypt"),ci=CT});async function Hf(t,e,r,n){let i=t.slice(0,7);n||(n=qo(i));let{ciphertext:s,tag:a}=await ci(i,r,e,n,new Uint8Array(0));return{encryptedKey:s,iv:Z(n),tag:Z(a)}}async function qf(t,e,r,n,i){let s=t.slice(0,7);return Go(s,e,r,n,i,new Uint8Array(0))}var tl=I(()=>{el();Gu();$o();Ie();o(Hf,"wrap");o(qf,"unwrap")});async function LT(t,e,r,n,i){switch(tr(t,e,"decrypt"),t){case"dir":{if(r!==void 0)throw new P("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new P("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!Q(n.epk))throw new P('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(!Jo(e))throw new U("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await er(n.epk,t),a,c;if(n.apu!==void 0){if(typeof n.apu!="string")throw new P('JOSE Header "apu" (Agreement PartyUInfo) invalid');a=te(n.apu)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new P('JOSE Header "apv" (Agreement PartyVInfo) invalid');c=te(n.apv)}let u=await Ko(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?ii(n.enc):parseInt(t.slice(-5,-2),10),a,c);if(t==="ECDH-ES")return u;if(r===void 0)throw new P("JWE Encrypted Key missing");return ni(t.slice(-6),u,r)}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(r===void 0)throw new P("JWE Encrypted Key missing");return Sf(t,e,r)}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(r===void 0)throw new P("JWE Encrypted Key missing");if(typeof n.p2c!="number")throw new P('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new P('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new P('JOSE Header "p2s" (PBES2 Salt) missing or invalid');return wf(t,e,r,n.p2c,te(n.p2s))}case"A128KW":case"A192KW":case"A256KW":{if(r===void 0)throw new P("JWE Encrypted Key missing");return ni(t,e,r)}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(r===void 0)throw new P("JWE Encrypted Key missing");if(typeof n.iv!="string")throw new P('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new P('JOSE Header "tag" (Authentication Tag) missing or invalid');let s=te(n.iv),a=te(n.tag);return qf(t,e,r,s,a)}default:throw new U('Invalid or unsupported "alg" (JWE Algorithm) header value')}}var $f,jf=I(()=>{Bo();Ju();Wu();Qu();Ie();V();oi();si();ai();qe();tl();o(LT,"decryptKeyManagement");$f=LT});function DT(t,e,r,n,i){if(i.crit!==void 0&&n.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(a=>typeof a!="string"||a.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let a of n.crit){if(!s.has(a))throw new U(`Extension Header Parameter "${a}" is not recognized`);if(i[a]===void 0)throw new t(`Extension Header Parameter "${a}" is missing`);if(s.get(a)&&n[a]===void 0)throw new t(`Extension Header Parameter "${a}" MUST be integrity protected`)}return new Set(n.crit)}var _t,Yr=I(()=>{V();o(DT,"validateCrit");_t=DT});var UT,ui,rl=I(()=>{UT=o((t,e)=>{if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)},"validateAlgorithms"),ui=UT});async function Zr(t,e,r){var n;if(!Q(t))throw new P("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new P("JOSE Header missing");if(typeof t.iv!="string")throw new P("JWE Initialization Vector missing or incorrect type");if(typeof t.ciphertext!="string")throw new P("JWE Ciphertext missing or incorrect type");if(typeof t.tag!="string")throw new P("JWE Authentication Tag missing or incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new P("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new P("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new P("JWE AAD incorrect type");if(t.header!==void 0&&!Q(t.header))throw new P("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!Q(t.unprotected))throw new P("JWE Per-Recipient Unprotected Header incorrect type");let i;if(t.protected)try{let j=te(t.protected);i=JSON.parse(ce.decode(j))}catch{throw new P("JWE Protected Header is invalid")}if(!yt(i,t.header,t.unprotected))throw new P("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let s={...i,...t.header,...t.unprotected};if(_t(P,new Map,r?.crit,i,s),s.zip!==void 0){if(!i||!i.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if(s.zip!=="DEF")throw new U('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:a,enc:c}=s;if(typeof a!="string"||!a)throw new P("missing JWE Algorithm (alg) in JWE Header");if(typeof c!="string"||!c)throw new P("missing JWE Encryption Algorithm (enc) in JWE Header");let u=r&&ui("keyManagementAlgorithms",r.keyManagementAlgorithms),l=r&&ui("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(u&&!u.has(a))throw new zt('"alg" (Algorithm) Header Parameter not allowed');if(l&&!l.has(c))throw new zt('"enc" (Encryption Algorithm) Header Parameter not allowed');let d;t.encrypted_key!==void 0&&(d=te(t.encrypted_key));let p=!1;typeof e=="function"&&(e=await e(i,t),p=!0);let y;try{y=await $f(a,e,d,s,r)}catch(j){if(j instanceof TypeError||j instanceof P||j instanceof U)throw j;y=gt(c)}let h=te(t.iv),m=te(t.tag),v=Y.encode((n=t.protected)!==null&&n!==void 0?n:""),T;t.aad!==void 0?T=Se(v,Y.encode("."),Y.encode(t.aad)):T=v;let S=await Go(c,y,te(t.ciphertext),h,m,T);s.zip==="DEF"&&(S=await(r?.inflateRaw||pf)(S));let k={plaintext:S};return t.protected!==void 0&&(k.protectedHeader=i),t.aad!==void 0&&(k.additionalAuthenticatedData=te(t.aad)),t.unprotected!==void 0&&(k.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(k.unprotectedHeader=t.header),p?{...k,key:e}:k}var Qo=I(()=>{Ie();Gu();Bu();V();zr();qe();jf();ye();oi();Yr();rl();o(Zr,"flattenedDecrypt")});async function Yo(t,e,r){if(t instanceof Uint8Array&&(t=ce.decode(t)),typeof t!="string")throw new P("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:a,4:c,length:u}=t.split(".");if(u!==5)throw new P("Invalid Compact JWE");let l=await Zr({ciphertext:a,iv:s||void 0,protected:n||void 0,tag:c||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var nl=I(()=>{Qo();V();ye();o(Yo,"compactDecrypt")});async function Vf(t,e,r){if(!Q(t))throw new P("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(Q))throw new P("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new P("JWE Recipients has no members");for(let n of t.recipients)try{return await Zr({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Ct}var Gf=I(()=>{Qo();V();qe();o(Vf,"generalDecrypt")});var MT,Bf,Kf=I(()=>{Te();ot();Ie();st();MT=o(async t=>{if(t instanceof Uint8Array)return{kty:"oct",k:Z(t)};if(!se(t))throw new TypeError(ie(t,...W,"Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await L.subtle.exportKey("jwk",t);return s},"keyToJWK"),Bf=MT});async function Jf(t){return Of(t)}async function zf(t){return xf(t)}async function Zo(t){return Bf(t)}var il=I(()=>{Wo();Wo();Kf();o(Jf,"exportSPKI");o(zf,"exportPKCS8");o(Zo,"exportJWK")});async function kT(t,e,r,n,i={}){let s,a,c;switch(tr(t,r,"encrypt"),t){case"dir":{c=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!Jo(r))throw new U("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:u,apv:l}=i,{epk:d}=i;d||(d=(await yf(r)).privateKey);let{x:p,y,crv:h,kty:m}=await Zo(d),v=await Ko(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?ii(e):parseInt(t.slice(-5,-2),10),u,l);if(a={epk:{x:p,crv:h,kty:m}},m==="EC"&&(a.epk.y=y),u&&(a.apu=Z(u)),l&&(a.apv=Z(l)),t==="ECDH-ES"){c=v;break}c=n||gt(e);let T=t.slice(-6);s=await ri(T,v,c);break}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{c=n||gt(e),s=await Tf(t,r,c);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{c=n||gt(e);let{p2c:u,p2s:l}=i;({encryptedKey:s,...a}=await Ef(t,r,c,u,l));break}case"A128KW":case"A192KW":case"A256KW":{c=n||gt(e),s=await ri(t,r,c);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{c=n||gt(e);let{iv:u}=i;({encryptedKey:s,...a}=await Hf(t,r,c,u));break}default:throw new U('Invalid or unsupported "alg" (JWE Algorithm) header value')}return{cek:c,encryptedKey:s,parameters:a}}var Xo,ol=I(()=>{Bo();Ju();Wu();Qu();Ie();oi();V();il();ai();tl();o(kT,"encryptKeyManagement");Xo=kT});var sl,Lt,es=I(()=>{Ie();el();Bu();$o();ol();V();zr();ye();Yr();sl=Symbol(),Lt=class{static{o(this,"FlattenedEncrypt")}constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this._plaintext=e}setKeyManagementParameters(e){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._sharedUnprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._sharedUnprotectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}setContentEncryptionKey(e){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=e,this}async encrypt(e,r){if(!this._protectedHeader&&!this._unprotectedHeader&&!this._sharedUnprotectedHeader)throw new P("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!yt(this._protectedHeader,this._unprotectedHeader,this._sharedUnprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this._protectedHeader,...this._unprotectedHeader,...this._sharedUnprotectedHeader};if(_t(P,new Map,r?.crit,this._protectedHeader,n),n.zip!==void 0){if(!this._protectedHeader||!this._protectedHeader.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if(n.zip!=="DEF")throw new U('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let a;if(i==="dir"){if(this._cek)throw new TypeError("setContentEncryptionKey cannot be called when using Direct Encryption")}else if(i==="ECDH-ES"&&this._cek)throw new TypeError("setContentEncryptionKey cannot be called when using Direct Key Agreement");let c;{let m;({cek:c,encryptedKey:a,parameters:m}=await Xo(i,s,e,this._cek,this._keyManagementParameters)),m&&(r&&sl in r?this._unprotectedHeader?this._unprotectedHeader={...this._unprotectedHeader,...m}:this.setUnprotectedHeader(m):this._protectedHeader?this._protectedHeader={...this._protectedHeader,...m}:this.setProtectedHeader(m))}this._iv||(this._iv=qo(s));let u,l,d;this._protectedHeader?l=Y.encode(Z(JSON.stringify(this._protectedHeader))):l=Y.encode(""),this._aad?(d=Z(this._aad),u=Se(l,Y.encode("."),Y.encode(d))):u=l;let p,y;if(n.zip==="DEF"){let m=await(r?.deflateRaw||hf)(this._plaintext);({ciphertext:p,tag:y}=await ci(s,m,c,this._iv,u))}else({ciphertext:p,tag:y}=await ci(s,this._plaintext,c,this._iv,u));let h={ciphertext:Z(p),iv:Z(this._iv),tag:Z(y)};return a&&(h.encrypted_key=Z(a)),d&&(h.aad=d),this._protectedHeader&&(h.protected=ce.decode(l)),this._sharedUnprotectedHeader&&(h.unprotected=this._sharedUnprotectedHeader),this._unprotectedHeader&&(h.header=this._unprotectedHeader),h}}});var al,ts,Wf=I(()=>{es();V();oi();zr();ol();Ie();Yr();al=class{static{o(this,"IndividualRecipient")}constructor(e,r,n){this.parent=e,this.key=r,this.options=n}setUnprotectedHeader(e){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addRecipient(...e){return this.parent.addRecipient(...e)}encrypt(...e){return this.parent.encrypt(...e)}done(){return this.parent}},ts=class{static{o(this,"GeneralEncrypt")}constructor(e){this._recipients=[],this._plaintext=e}addRecipient(e,r){let n=new al(this,e,{crit:r?.crit});return this._recipients.push(n),n}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}async encrypt(e){var r,n,i;if(!this._recipients.length)throw new P("at least one recipient must be added");if(e={deflateRaw:e?.deflateRaw},this._recipients.length===1){let[u]=this._recipients,l=await new Lt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(u.unprotectedHeader).encrypt(u.key,{...u.options,...e}),d={ciphertext:l.ciphertext,iv:l.iv,recipients:[{}],tag:l.tag};return l.aad&&(d.aad=l.aad),l.protected&&(d.protected=l.protected),l.unprotected&&(d.unprotected=l.unprotected),l.encrypted_key&&(d.recipients[0].encrypted_key=l.encrypted_key),l.header&&(d.recipients[0].header=l.header),d}let s;for(let u=0;u<this._recipients.length;u++){let l=this._recipients[u];if(!yt(this._protectedHeader,this._unprotectedHeader,l.unprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let d={...this._protectedHeader,...this._unprotectedHeader,...l.unprotectedHeader},{alg:p}=d;if(typeof p!="string"||!p)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(p==="dir"||p==="ECDH-ES")throw new P('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof d.enc!="string"||!d.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!s)s=d.enc;else if(s!==d.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(_t(P,new Map,l.options.crit,this._protectedHeader,d),d.zip!==void 0&&(!this._protectedHeader||!this._protectedHeader.zip))throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected')}let a=gt(s),c={ciphertext:"",iv:"",recipients:[],tag:""};for(let u=0;u<this._recipients.length;u++){let l=this._recipients[u],d={};c.recipients.push(d);let y={...this._protectedHeader,...this._unprotectedHeader,...l.unprotectedHeader}.alg.startsWith("PBES2")?2048+u:void 0;if(u===0){let v=await new Lt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setContentEncryptionKey(a).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(l.unprotectedHeader).setKeyManagementParameters({p2c:y}).encrypt(l.key,{...l.options,...e,[sl]:!0});c.ciphertext=v.ciphertext,c.iv=v.iv,c.tag=v.tag,v.aad&&(c.aad=v.aad),v.protected&&(c.protected=v.protected),v.unprotected&&(c.unprotected=v.unprotected),d.encrypted_key=v.encrypted_key,v.header&&(d.header=v.header);continue}let{encryptedKey:h,parameters:m}=await Xo(((r=l.unprotectedHeader)===null||r===void 0?void 0:r.alg)||((n=this._protectedHeader)===null||n===void 0?void 0:n.alg)||((i=this._unprotectedHeader)===null||i===void 0?void 0:i.alg),s,l.key,a,{p2c:y});d.encrypted_key=Z(h),(l.unprotectedHeader||m)&&(d.header={...l.unprotectedHeader,...m})}return c}}});function li(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:t.slice(-3)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"EdDSA":return{name:e.name};default:throw new U(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}var cl=I(()=>{V();o(li,"subtleDsa")});function di(t,e,r){if(se(e))return lf(e,t,r),e;if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(ie(e,...W));return L.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}throw new TypeError(ie(e,...W,"Uint8Array"))}var ul=I(()=>{Te();Zt();ot();st();o(di,"getCryptoKey")});var FT,Qf,Yf=I(()=>{cl();Te();zo();ul();FT=o(async(t,e,r,n)=>{let i=await di(t,e,"verify");Or(t,i);let s=li(t,i.algorithm);try{return await L.subtle.verify(s,i,r,n)}catch{return!1}},"verify"),Qf=FT});async function Xr(t,e,r){var n;if(!Q(t))throw new z("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new z('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new z("JWS Protected Header incorrect type");if(t.payload===void 0)throw new z("JWS Payload missing");if(typeof t.signature!="string")throw new z("JWS Signature missing or incorrect type");if(t.header!==void 0&&!Q(t.header))throw new z("JWS Unprotected Header incorrect type");let i={};if(t.protected)try{let T=te(t.protected);i=JSON.parse(ce.decode(T))}catch{throw new z("JWS Protected Header is invalid")}if(!yt(i,t.header))throw new z("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let s={...i,...t.header},a=_t(z,new Map([["b64",!0]]),r?.crit,i,s),c=!0;if(a.has("b64")&&(c=i.b64,typeof c!="boolean"))throw new z('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:u}=s;if(typeof u!="string"||!u)throw new z('JWS "alg" (Algorithm) Header Parameter missing or invalid');let l=r&&ui("algorithms",r.algorithms);if(l&&!l.has(u))throw new zt('"alg" (Algorithm) Header Parameter not allowed');if(c){if(typeof t.payload!="string")throw new z("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new z("JWS Payload must be a string or an Uint8Array instance");let d=!1;typeof e=="function"&&(e=await e(i,t),d=!0),tr(u,e,"verify");let p=Se(Y.encode((n=t.protected)!==null&&n!==void 0?n:""),Y.encode("."),typeof t.payload=="string"?Y.encode(t.payload):t.payload),y=te(t.signature);if(!await Qf(u,e,y,p))throw new Rr;let m;c?m=te(t.payload):typeof t.payload=="string"?m=Y.encode(t.payload):m=t.payload;let v={payload:m};return t.protected!==void 0&&(v.protectedHeader=i),t.header!==void 0&&(v.unprotectedHeader=t.header),d?{...v,key:e}:v}var rs=I(()=>{Ie();Yf();V();ye();zr();qe();ai();Yr();rl();o(Xr,"flattenedVerify")});async function ns(t,e,r){if(t instanceof Uint8Array&&(t=ce.decode(t)),typeof t!="string")throw new z("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:a}=t.split(".");if(a!==3)throw new z("Invalid Compact JWS");let c=await Xr({payload:i,protected:n,signature:s},e,r),u={payload:c.payload,protectedHeader:c.protectedHeader};return typeof e=="function"?{...u,key:c.key}:u}var ll=I(()=>{rs();V();ye();o(ns,"compactVerify")});async function Zf(t,e,r){if(!Q(t))throw new z("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(Q))throw new z("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await Xr({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new Rr}var Xf=I(()=>{rs();V();qe();o(Zf,"generalVerify")});var en,dl=I(()=>{en=o(t=>Math.floor(t.getTime()/1e3),"default")});var HT,tn,pl=I(()=>{HT=/^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i,tn=o(t=>{let e=HT.exec(t);if(!e)throw new TypeError("Invalid time period format");let r=parseFloat(e[1]);switch(e[2].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":return Math.round(r);case"minute":case"minutes":case"min":case"mins":case"m":return Math.round(r*60);case"hour":case"hours":case"hr":case"hrs":case"h":return Math.round(r*3600);case"day":case"days":case"d":return Math.round(r*86400);case"week":case"weeks":case"w":return Math.round(r*604800);default:return Math.round(r*31557600)}},"default")});var em,qT,rn,is=I(()=>{V();ye();dl();pl();qe();em=o(t=>t.toLowerCase().replace(/^application\//,""),"normalizeTyp"),qT=o((t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1,"checkAudiencePresence"),rn=o((t,e,r={})=>{let{typ:n}=r;if(n&&(typeof t.typ!="string"||em(t.typ)!==em(n)))throw new ge('unexpected "typ" JWT header value',"typ","check_failed");let i;try{i=JSON.parse(ce.decode(e))}catch{}if(!Q(i))throw new ue("JWT Claims Set must be a top-level JSON object");let{requiredClaims:s=[],issuer:a,subject:c,audience:u,maxTokenAge:l}=r;l!==void 0&&s.push("iat"),u!==void 0&&s.push("aud"),c!==void 0&&s.push("sub"),a!==void 0&&s.push("iss");for(let h of new Set(s.reverse()))if(!(h in i))throw new ge(`missing required "${h}" claim`,h,"missing");if(a&&!(Array.isArray(a)?a:[a]).includes(i.iss))throw new ge('unexpected "iss" claim value',"iss","check_failed");if(c&&i.sub!==c)throw new ge('unexpected "sub" claim value',"sub","check_failed");if(u&&!qT(i.aud,typeof u=="string"?[u]:u))throw new ge('unexpected "aud" claim value',"aud","check_failed");let d;switch(typeof r.clockTolerance){case"string":d=tn(r.clockTolerance);break;case"number":d=r.clockTolerance;break;case"undefined":d=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:p}=r,y=en(p||new Date);if((i.iat!==void 0||l)&&typeof i.iat!="number")throw new ge('"iat" claim must be a number',"iat","invalid");if(i.nbf!==void 0){if(typeof i.nbf!="number")throw new ge('"nbf" claim must be a number',"nbf","invalid");if(i.nbf>y+d)throw new ge('"nbf" claim timestamp check failed',"nbf","check_failed")}if(i.exp!==void 0){if(typeof i.exp!="number")throw new ge('"exp" claim must be a number',"exp","invalid");if(i.exp<=y-d)throw new Kr('"exp" claim timestamp check failed',"exp","check_failed")}if(l){let h=y-i.iat,m=typeof l=="number"?l:tn(l);if(h-d>m)throw new Kr('"iat" claim timestamp check failed (too far in the past)',"iat","check_failed");if(h<0-d)throw new ge('"iat" claim timestamp check failed (it should be in the past)',"iat","check_failed")}return i},"default")});async function tm(t,e,r){var n;let i=await ns(t,e,r);if(!((n=i.protectedHeader.crit)===null||n===void 0)&&n.includes("b64")&&i.protectedHeader.b64===!1)throw new ue("JWTs MUST NOT use unencoded payload");let a={payload:rn(i.protectedHeader,i.payload,r),protectedHeader:i.protectedHeader};return typeof e=="function"?{...a,key:i.key}:a}var rm=I(()=>{ll();is();V();o(tm,"jwtVerify")});async function nm(t,e,r){let n=await Yo(t,e,r),i=rn(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ge('replicated "iss" claim header parameter mismatch',"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ge('replicated "sub" claim header parameter mismatch',"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ge('replicated "aud" claim header parameter mismatch',"aud","mismatch");let a={payload:i,protectedHeader:s};return typeof e=="function"?{...a,key:n.key}:a}var im=I(()=>{nl();is();V();o(nm,"jwtDecrypt")});var nn,hl=I(()=>{es();nn=class{static{o(this,"CompactEncrypt")}constructor(e){this._flattened=new Lt(e)}setContentEncryptionKey(e){return this._flattened.setContentEncryptionKey(e),this}setInitializationVector(e){return this._flattened.setInitializationVector(e),this}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}setKeyManagementParameters(e){return this._flattened.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this._flattened.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var $T,om,sm=I(()=>{cl();Te();zo();ul();$T=o(async(t,e,r)=>{let n=await di(t,e,"sign");Or(t,n);let i=await L.subtle.sign(li(t,n.algorithm),n,r);return new Uint8Array(i)},"sign"),om=$T});var rr,os=I(()=>{Ie();sm();zr();V();ye();ai();Yr();rr=class{static{o(this,"FlattenedSign")}constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this._payload=e}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}async sign(e,r){if(!this._protectedHeader&&!this._unprotectedHeader)throw new z("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!yt(this._protectedHeader,this._unprotectedHeader))throw new z("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this._protectedHeader,...this._unprotectedHeader},i=_t(z,new Map([["b64",!0]]),r?.crit,this._protectedHeader,n),s=!0;if(i.has("b64")&&(s=this._protectedHeader.b64,typeof s!="boolean"))throw new z('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=n;if(typeof a!="string"||!a)throw new z('JWS "alg" (Algorithm) Header Parameter missing or invalid');tr(a,e,"sign");let c=this._payload;s&&(c=Y.encode(Z(c)));let u;this._protectedHeader?u=Y.encode(Z(JSON.stringify(this._protectedHeader))):u=Y.encode("");let l=Se(u,Y.encode("."),c),d=await om(a,e,l),p={signature:Z(d),payload:""};return s&&(p.payload=ce.decode(c)),this._unprotectedHeader&&(p.header=this._unprotectedHeader),this._protectedHeader&&(p.protected=ce.decode(u)),p}}});var on,fl=I(()=>{os();on=class{static{o(this,"CompactSign")}constructor(e){this._flattened=new rr(e)}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}async sign(e,r){let n=await this._flattened.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var ml,ss,am=I(()=>{os();V();ml=class{static{o(this,"IndividualSignature")}constructor(e,r,n){this.parent=e,this.key=r,this.options=n}setProtectedHeader(e){if(this.protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this.protectedHeader=e,this}setUnprotectedHeader(e){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addSignature(...e){return this.parent.addSignature(...e)}sign(...e){return this.parent.sign(...e)}done(){return this.parent}},ss=class{static{o(this,"GeneralSign")}constructor(e){this._signatures=[],this._payload=e}addSignature(e,r){let n=new ml(this,e,r);return this._signatures.push(n),n}async sign(){if(!this._signatures.length)throw new z("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this._signatures.length;r++){let n=this._signatures[r],i=new rr(this._payload);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...a}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new z("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(a)}return e}}});var nr,as=I(()=>{dl();qe();pl();nr=class{static{o(this,"ProduceJWT")}constructor(e){if(!Q(e))throw new TypeError("JWT Claims Set MUST be an object");this._payload=e}setIssuer(e){return this._payload={...this._payload,iss:e},this}setSubject(e){return this._payload={...this._payload,sub:e},this}setAudience(e){return this._payload={...this._payload,aud:e},this}setJti(e){return this._payload={...this._payload,jti:e},this}setNotBefore(e){return typeof e=="number"?this._payload={...this._payload,nbf:e}:this._payload={...this._payload,nbf:en(new Date)+tn(e)},this}setExpirationTime(e){return typeof e=="number"?this._payload={...this._payload,exp:e}:this._payload={...this._payload,exp:en(new Date)+tn(e)},this}setIssuedAt(e){return typeof e>"u"?this._payload={...this._payload,iat:en(new Date)}:this._payload={...this._payload,iat:e},this}}});var cs,cm=I(()=>{fl();V();ye();as();cs=class extends nr{static{o(this,"SignJWT")}setProtectedHeader(e){return this._protectedHeader=e,this}async sign(e,r){var n;let i=new on(Y.encode(JSON.stringify(this._payload)));if(i.setProtectedHeader(this._protectedHeader),Array.isArray((n=this._protectedHeader)===null||n===void 0?void 0:n.crit)&&this._protectedHeader.crit.includes("b64")&&this._protectedHeader.b64===!1)throw new ue("JWTs MUST NOT use unencoded payload");return i.sign(e,r)}}});var us,um=I(()=>{hl();ye();as();us=class extends nr{static{o(this,"EncryptJWT")}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setKeyManagementParameters(e){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setContentEncryptionKey(e){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=e,this}replicateIssuerAsHeader(){return this._replicateIssuerAsHeader=!0,this}replicateSubjectAsHeader(){return this._replicateSubjectAsHeader=!0,this}replicateAudienceAsHeader(){return this._replicateAudienceAsHeader=!0,this}async encrypt(e,r){let n=new nn(Y.encode(JSON.stringify(this._payload)));return this._replicateIssuerAsHeader&&(this._protectedHeader={...this._protectedHeader,iss:this._payload.iss}),this._replicateSubjectAsHeader&&(this._protectedHeader={...this._protectedHeader,sub:this._payload.sub}),this._replicateAudienceAsHeader&&(this._protectedHeader={...this._protectedHeader,aud:this._payload.aud}),n.setProtectedHeader(this._protectedHeader),this._iv&&n.setInitializationVector(this._iv),this._cek&&n.setContentEncryptionKey(this._cek),this._keyManagementParameters&&n.setKeyManagementParameters(this._keyManagementParameters),n.encrypt(e,r)}}});async function yl(t,e){if(!Q(t))throw new TypeError("JWK must be an object");if(e??(e="sha256"),e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let r;switch(t.kty){case"EC":ir(t.crv,'"crv" (Curve) Parameter'),ir(t.x,'"x" (X Coordinate) Parameter'),ir(t.y,'"y" (Y Coordinate) Parameter'),r={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":ir(t.crv,'"crv" (Subtype of Key Pair) Parameter'),ir(t.x,'"x" (Public Key) Parameter'),r={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":ir(t.e,'"e" (Exponent) Parameter'),ir(t.n,'"n" (Modulus) Parameter'),r={e:t.e,kty:t.kty,n:t.n};break;case"oct":ir(t.k,'"k" (Key Value) Parameter'),r={k:t.k,kty:t.kty};break;default:throw new U('"kty" (Key Type) Parameter missing or unsupported')}let n=Y.encode(JSON.stringify(r));return Z(await Do(e,n))}async function lm(t,e){e??(e="sha256");let r=await yl(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var ir,dm=I(()=>{Uu();Ie();V();ye();qe();ir=o((t,e)=>{if(typeof t!="string"||!t)throw new Zn(`${e} missing or invalid`)},"check");o(yl,"calculateJwkThumbprint");o(lm,"calculateJwkThumbprintUri")});async function pm(t,e){let r={...t,...e?.header};if(!Q(r.jwk))throw new z('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await er({...r.jwk,ext:!0},r.alg,!0);if(n instanceof Uint8Array||n.type!=="public")throw new z('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var hm=I(()=>{si();qe();V();o(pm,"EmbeddedJWK")});function jT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new U('Unsupported "alg" value for a JSON Web Key Set')}}function gl(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(VT)}function VT(t){return Q(t)}function GT(t){return typeof structuredClone=="function"?structuredClone(t):JSON.parse(JSON.stringify(t))}async function fm(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await er({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Wt("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function mm(t){let e=new pi(t);return async function(r,n){return e.getKey(r,n)}}var pi,_l=I(()=>{si();V();qe();o(jT,"getKtyFromAlg");o(gl,"isJWKSLike");o(VT,"isJWKLike");o(GT,"clone");pi=class{static{o(this,"LocalJWKSet")}constructor(e){if(this._cached=new WeakMap,!gl(e))throw new Wt("JSON Web Key Set malformed");this._jwks=GT(e)}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=jT(n),a=this._jwks.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&typeof l.alg=="string"&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d&&n==="EdDSA"&&(d=l.crv==="Ed25519"||l.crv==="Ed448"),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES256K":d=l.crv==="secp256k1";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break}return d}),{0:c,length:u}=a;if(u===0)throw new Pr;if(u!==1){let l=new Xn,{_cached:d}=this;throw l[Symbol.asyncIterator]=async function*(){for(let p of a)try{yield await fm(d,p,n)}catch{continue}},l}return fm(this._cached,c,n)}};o(fm,"importWithAlgCache");o(mm,"createLocalJWKSet")});var BT,ym,gm=I(()=>{V();BT=o(async(t,e,r)=>{let n,i,s=!1;typeof AbortController=="function"&&(n=new AbortController,i=setTimeout(()=>{s=!0,n.abort()},e));let a=await fetch(t.href,{signal:n?n.signal:void 0,redirect:"manual",headers:r.headers}).catch(c=>{throw s?new ei:c});if(i!==void 0&&clearTimeout(i),a.status!==200)throw new pe("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await a.json()}catch{throw new pe("Failed to parse the JSON Web Key Set HTTP response as JSON")}},"fetchJwks"),ym=BT});function KT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}function _m(t,e){let r=new bl(t,e);return async function(n,i){return r.getKey(n,i)}}var bl,bm=I(()=>{gm();V();_l();o(KT,"isCloudflareWorkers");bl=class extends pi{static{o(this,"RemoteJWKSet")}constructor(e,r){if(super({keys:[]}),this._jwks=void 0,!(e instanceof URL))throw new TypeError("url must be an instance of URL");this._url=new URL(e.href),this._options={agent:r?.agent,headers:r?.headers},this._timeoutDuration=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this._cooldownDuration=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this._cacheMaxAge=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5}coolingDown(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cooldownDuration:!1}fresh(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cacheMaxAge:!1}async getKey(e,r){(!this._jwks||!this.fresh())&&await this.reload();try{return await super.getKey(e,r)}catch(n){if(n instanceof Pr&&this.coolingDown()===!1)return await this.reload(),super.getKey(e,r);throw n}}async reload(){this._pendingFetch&&KT()&&(this._pendingFetch=void 0),this._pendingFetch||(this._pendingFetch=ym(this._url,this._timeoutDuration,this._options).then(e=>{if(!gl(e))throw new Wt("JSON Web Key Set malformed");this._jwks={keys:e.keys},this._jwksTimestamp=Date.now(),this._pendingFetch=void 0}).catch(e=>{throw this._pendingFetch=void 0,e})),await this._pendingFetch}};o(_m,"createRemoteJWKSet")});var ls,Em=I(()=>{Ie();ye();V();is();as();ls=class extends nr{static{o(this,"UnsecuredJWT")}encode(){let e=Z(JSON.stringify({alg:"none"})),r=Z(JSON.stringify(this._payload));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new ue("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:a}=e.split(".");if(a!==3||s!=="")throw new ue("Invalid Unsecured JWT");let c;try{if(c=JSON.parse(ce.decode(te(n))),c.alg!=="none")throw new Error}catch{throw new ue("Invalid Unsecured JWT")}return{payload:rn(c,te(i),r),header:c}}}});var El={};Vi(El,{decode:()=>hi,encode:()=>JT});var JT,hi,ds=I(()=>{Ie();JT=Z,hi=te});function wm(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ce.decode(hi(e)));if(!Q(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var vm=I(()=>{ds();ye();qe();o(wm,"decodeProtectedHeader")});function Tm(t){if(typeof t!="string")throw new ue("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new ue("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new ue("Invalid JWT");if(!e)throw new ue("JWTs must contain a payload");let n;try{n=hi(e)}catch{throw new ue("Failed to parse the base64url encoded payload")}let i;try{i=JSON.parse(ce.decode(n))}catch{throw new ue("Failed to parse the decoded payload as JSON")}if(!Q(i))throw new ue("Invalid JWT Claims Set");return i}var Sm=I(()=>{ds();ye();qe();V();o(Tm,"decodeJwt")});async function Im(t,e){var r;let n,i,s;switch(t){case"HS256":case"HS384":case"HS512":n=parseInt(t.slice(-3),10),i={name:"HMAC",hash:`SHA-${n}`,length:n},s=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return n=parseInt(t.slice(-3),10),Qt(new Uint8Array(n>>3));case"A128KW":case"A192KW":case"A256KW":n=parseInt(t.slice(1,4),10),i={name:"AES-KW",length:n},s=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=parseInt(t.slice(1,4),10),i={name:"AES-GCM",length:n},s=["encrypt","decrypt"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return L.subtle.generateKey(i,(r=e?.extractable)!==null&&r!==void 0?r:!1,s)}function wl(t){var e;let r=(e=t?.modulusLength)!==null&&e!==void 0?e:2048;if(typeof r!="number"||r<2048)throw new U("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return r}async function Am(t,e){var r,n,i;let s,a;switch(t){case"PS256":case"PS384":case"PS512":s={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["sign","verify"];break;case"RS256":case"RS384":case"RS512":s={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":s={name:"ECDSA",namedCurve:"P-256"},a=["sign","verify"];break;case"ES384":s={name:"ECDSA",namedCurve:"P-384"},a=["sign","verify"];break;case"ES512":s={name:"ECDSA",namedCurve:"P-521"},a=["sign","verify"];break;case"EdDSA":a=["sign","verify"];let c=(r=e?.crv)!==null&&r!==void 0?r:"Ed25519";switch(c){case"Ed25519":case"Ed448":s={name:c};break;default:throw new U("Invalid or unsupported crv option provided")}break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{a=["deriveKey","deriveBits"];let u=(n=e?.crv)!==null&&n!==void 0?n:"P-256";switch(u){case"P-256":case"P-384":case"P-521":{s={name:"ECDH",namedCurve:u};break}case"X25519":case"X448":s={name:u};break;default:throw new U("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448")}break}default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return L.subtle.generateKey(s,(i=e?.extractable)!==null&&i!==void 0?i:!1,a)}var vl=I(()=>{Te();V();ti();o(Im,"generateSecret");o(wl,"getModulusLengthOption");o(Am,"generateKeyPair")});async function Pm(t,e){return Am(t,e)}var Rm=I(()=>{vl();o(Pm,"generateKeyPair")});async function Om(t,e){return Im(t,e)}var xm=I(()=>{vl();o(Om,"generateSecret")});var ps={};Vi(ps,{CompactEncrypt:()=>nn,CompactSign:()=>on,EmbeddedJWK:()=>pm,EncryptJWT:()=>us,FlattenedEncrypt:()=>Lt,FlattenedSign:()=>rr,GeneralEncrypt:()=>ts,GeneralSign:()=>ss,SignJWT:()=>cs,UnsecuredJWT:()=>ls,base64url:()=>El,calculateJwkThumbprint:()=>yl,calculateJwkThumbprintUri:()=>lm,compactDecrypt:()=>Yo,compactVerify:()=>ns,createLocalJWKSet:()=>mm,createRemoteJWKSet:()=>_m,decodeJwt:()=>Tm,decodeProtectedHeader:()=>wm,errors:()=>Fu,exportJWK:()=>Zo,exportPKCS8:()=>zf,exportSPKI:()=>Jf,flattenedDecrypt:()=>Zr,flattenedVerify:()=>Xr,generalDecrypt:()=>Vf,generalVerify:()=>Zf,generateKeyPair:()=>Pm,generateSecret:()=>Om,importJWK:()=>er,importPKCS8:()=>Ff,importSPKI:()=>Mf,importX509:()=>kf,jwtDecrypt:()=>nm,jwtVerify:()=>tm});var hs=I(()=>{nl();Qo();Gf();Wf();ll();rs();Xf();rm();im();hl();es();fl();os();am();cm();um();dm();hm();_l();bm();Em();il();si();vm();Sm();V();Rm();xm();ds()});var ms=g(fs=>{"use strict";Object.defineProperty(fs,"__esModule",{value:!0});fs.fetchRetry=void 0;var zT=D();async function WT(t,e,r){for(let n=0;n<=t.retries;n++){let i=fetch(e,r);if(n===t.retries)return i;let s=await i;if(s.status<500&&s.status!==429)return s;t?.logger?.error("Request failed, retrying",{method:typeof e=="string"?"GET":e.method,url:typeof e=="string"?e:e.url,status:s.status}),await new Promise(a=>setTimeout(a,t.retryDelayMs*Math.pow(2,n)))}throw new zT.ConfigurationError("An unknown error occurred, ensure retries is not negative")}o(WT,"fetchRetry");fs.fetchRetry=WT});var sn=g(Ze=>{"use strict";Object.defineProperty(Ze,"__esModule",{value:!0});Ze.GcpServiceAccount=Ze.fetchToken=Ze.exchangeGgpJwtForIdToken=Ze.exchangeFirebaseJwtForIdToken=Ze.getTokenFromGcpServiceAccount=void 0;var Nm=(hs(),Gi(ps)),QT=D(),YT=ms();async function ZT({serviceAccount:t,audience:e,expirationTime:r="1h",payload:n={}}){let{clientEmail:i,privateKeyId:s,privateKey:a}=t;return await new Nm.SignJWT(n).setProtectedHeader({alg:"RS256",kid:s}).setIssuer(i).setSubject(i).setAudience(e).setIssuedAt().setExpirationTime(r).sign(a)}o(ZT,"getTokenFromGcpServiceAccount");Ze.getTokenFromGcpServiceAccount=ZT;async function XT(t,e,r){return Sl(t,{token:e,returnSecureToken:!0},r)}o(XT,"exchangeFirebaseJwtForIdToken");Ze.exchangeFirebaseJwtForIdToken=XT;async function eS(t,e,r){return Sl(t,{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e},r)}o(eS,"exchangeGgpJwtForIdToken");Ze.exchangeGgpJwtForIdToken=eS;async function Sl(t,e,r){let n=await(0,YT.fetchRetry)(r,t,{method:"POST",headers:{"Content-Type":"application/json"},redirect:"follow",body:JSON.stringify(e)});if(n.status!==200){let s;try{let a=await n.text(),c=JSON.parse(a);s={cause:c.error??c}}catch{}throw new QT.RuntimeError({message:"Could not get token from Google Identity",extensionMembers:s})}return await n.json()}o(Sl,"fetchToken");Ze.fetchToken=Sl;var Tl=class t{static{o(this,"GcpServiceAccount")}#e;#t;constructor({serviceAccount:e,privateKey:r}){this.#t=e,this.#e=r}static async init(e){let r=JSON.parse(e),n=await(0,Nm.importPKCS8)(r.private_key.trim(),"RS256");return new t({serviceAccount:r,privateKey:n})}get type(){return this.#t.type}get projectId(){return this.#t.project_id}get privateKeyId(){return this.#t.private_key_id}get privateKey(){return this.#e}get clientEmail(){return this.#t.client_email}get clientId(){return this.#t.client_id}get authUri(){return this.#t.auth_uri}get tokenUrl(){return this.#t.token_url}get authProviderX509CertUrl(){return this.#t.auth_provider_x509_cert_url}get clientX509CertUrl(){return this.#t.client_x509_cert_url}get universalDomain(){return this.#t.universe_domain}};Ze.GcpServiceAccount=Tl});var gs=g(Dt=>{"use strict";Object.defineProperty(Dt,"__esModule",{value:!0});Dt.GoogleLogTransport=Dt.ZuploToGCPMap=Dt.GoogleCloudLoggingPlugin=void 0;var tS=we(),Il=ee(),Al=sn(),rS=Nt(),Cm=mt(),Pl=class extends rS.LogPlugin{static{o(this,"GoogleCloudLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new ys(this.options)}};Dt.GoogleCloudLoggingPlugin=Pl;var nS="https://logging.googleapis.com/v2/entries:write?alt=json";Dt.ZuploToGCPMap={error:"ERROR",warn:"WARNING",info:"INFO",debug:"DEBUG"};var ys=class{static{o(this,"GoogleLogTransport")}constructor(e){this.#r=e.logName,this.#e=e.serviceAccountJson,this.#i=Il.Environment.instance.loggingEnvironmentType,this.#o=Il.Environment.instance.loggingEnvironmentStage,this.#n=Il.Environment.instance.deploymentName}#e;#t;#r;#n;#i;#o;async log(e,r){if(e.messages.length===0)return;let n={allMessages:(0,Cm.makeErrorsSerializable)(e.messages)};this.#t||(this.#t=await Al.GcpServiceAccount.init(this.#e));let i=this.#t.projectId??"zuplo-production",s={logName:this.#r,resource:{type:"global"},severity:Dt.ZuploToGCPMap[e.level],timestamp:e.timestamp,trace:`projects/${i}/traces/${e.requestId}`,labels:{requestId:e.requestId,buildId:e.buildId,source:e.logSource,loggingId:e.loggingId,logOwner:e.logOwner,environment:this.#n,environmentType:this.#i,environmentStage:this.#o}};e.rayId&&(s.labels.rayId=e.rayId);let a=(0,Cm.extractBestMessage)(n.allMessages);s.jsonPayload={...n,message:a},this.batcher.enqueue(s),r.waitUntil(this.batcher.waitUntilFlushed())}dispatchFunction=async e=>{if(e.length===0)return;this.#t||(this.#t=await Al.GcpServiceAccount.init(this.#e));let r=await(0,Al.getTokenFromGcpServiceAccount)({serviceAccount:this.#t,audience:"https://logging.googleapis.com/google.logging.v2.LoggingServiceV2"}),n=await fetch(nS,{method:"POST",body:JSON.stringify({entries:e}),headers:{Authorization:`Bearer ${r}`,"content-type":"application/json;charset=UTF-8"}});n.ok||console.error(n.status,n.statusText,await n.text())};batcher=new tS.BatchDispatch("google-log-transport",1,this.dispatchFunction)};Dt.GoogleLogTransport=ys});var Rl=g(an=>{"use strict";Object.defineProperty(an,"__esModule",{value:!0});an.gcpLogFormat=an.GCP_LOG_FORMAT=void 0;var Lm=mt(),iS=gs();an.GCP_LOG_FORMAT="gcp";function oS(t){let e={allMessages:(0,Lm.makeErrorsSerializable)(t.messages)},r="zuplo-production",n=(0,Lm.extractBestMessage)(e.allMessages),i={logName:`projects/${r}/logs/runtime-user`,message:n,severity:iS.ZuploToGCPMap[t.level],timestamp:t.timestamp,"logging.googleapis.com/labels":{buildId:t.buildId,source:t.logSource,loggingId:t.loggingId,logOwner:t.logOwner},"logging.googleapis.com/trace":`projects/${r}/traces/${t.requestId}`,allMessages:e.allMessages};return t.rayId&&(i["logging.googleapis.com/labels"].rayId=t.rayId),i}o(oS,"gcpLogFormat");an.gcpLogFormat=oS});var Um=g(_s=>{"use strict";Object.defineProperty(_s,"__esModule",{value:!0});_s.ConsoleTransport=void 0;var Dm=Rl(),Ol=class{static{o(this,"ConsoleTransport")}constructor(e,r){this.#e=e??console,this.#t=r}#e;#t;async log(e){if(this.#t===Dm.GCP_LOG_FORMAT){if(e.messages.length===0)return;this.#e[e.level].apply(null,[(0,Dm.gcpLogFormat)(e)])}else this.#e[e.level].apply(null,[...e.messages,{logOwner:e.logOwner,logSource:e.logSource,level:e.level,timestamp:e.timestamp,loggingId:e.loggingId,rayId:e.rayId,requestId:e.requestId,buildId:e.buildId}])}};_s.ConsoleTransport=Ol});var Ul=g(cn=>{"use strict";Object.defineProperty(cn,"__esModule",{value:!0});cn.DataDogTransport=cn.DataDogLoggingPlugin=void 0;var sS=we(),xl=ee(),aS=Nt(),Mm=mt(),Dl=class extends aS.LogPlugin{static{o(this,"DataDogLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new bs(this.options)}};cn.DataDogLoggingPlugin=Dl;var Nl="__ddtags",Cl="__ddattr",Ll=o(t=>t.replaceAll(",","_").replaceAll(":","_"),"cleanTagText"),cS=o(t=>{let e=Object.keys(t),r=[];return e.forEach(n=>{let i=t[n];i==null?r.push(Ll(n)):r.push(`${Ll(n)}:${Ll(i.toString())}`)}),r.join(",")},"formatTags"),bs=class{static{o(this,"DataDogTransport")}constructor(e){this.#e=e.apiKey,this.#t=e.url??"https://http-intake.logs.datadoghq.com/api/v2/logs",this.#n=xl.Environment.instance.loggingEnvironmentType,this.#i=xl.Environment.instance.loggingEnvironmentStage,this.#r=xl.Environment.instance.deploymentName}#e;#t;#r;#n;#i;async log(e,r){let n={},i=r.custom[Nl];i&&typeof i=="object"&&Object.assign(n,i);let s=[...e.messages],a=e.messages.findIndex(h=>h[Nl]!==void 0);a>-1&&(Object.assign(n,s[a][Nl]),s.splice(a,1));let c={},u=r.custom[Cl];u&&typeof u=="object"&&Object.assign(c,u);let l=e.messages.findIndex(h=>h[Cl]!==void 0);l>-1&&(Object.assign(c,s[l][Cl]),s.splice(l,1));let d=(0,Mm.makeErrorsSerializable)(s),y={message:{...{...e,activityId:e.requestId,trace:e.requestId},messages:d},ddsource:"Zuplo",hostname:new URL(r.originalRequest.url).hostname,msg:(0,Mm.extractBestMessage)(d),service:e.loggingId,ddtags:cS(n),environment:this.#r,environment_type:this.#n,environment_stage:this.#i};Object.assign(y,c),this.batcher.enqueue(y),r.waitUntil(this.batcher.waitUntilFlushed())}dispatchFunction=async e=>{e.length!==0&&await fetch(this.#t,{method:"POST",body:JSON.stringify([...e]),headers:{"content-type":"application/json","DD-API-KEY":this.#e}})};batcher=new sS.BatchDispatch("data-dog-transport",10,this.dispatchFunction)};cn.DataDogTransport=bs});var Fm=g(Es=>{"use strict";Object.defineProperty(Es,"__esModule",{value:!0});Es.ProcessTransport=void 0;var km=Rl(),Ml=class{static{o(this,"ProcessTransport")}constructor(e,r){this.#e=e,this.#t=r}#e;#t;async log(e){if(this.#t===km.GCP_LOG_FORMAT){if(e.messages.length===0)return;this.#e[e.level].apply(null,[(0,km.gcpLogFormat)(e)])}else this.#e[e.level].apply(null,[...e.messages,{logOwner:e.logOwner,logSource:e.logSource,timestamp:e.timestamp,loggingId:e.loggingId,rayId:e.rayId,requestId:e.requestId,buildId:e.buildId,vectorClock:e.vectorClock}])}};Es.ProcessTransport=Ml});var qm=g(vs=>{"use strict";Object.defineProperty(vs,"__esModule",{value:!0});vs.RemoteLogTransport=void 0;var uS=we(),Hm=ee(),lS=mt(),dS=o(({url:t,remoteLogToken:e,loggingId:r,sendOnlyErrors:n})=>async i=>{let s;n===!0?s=i.filter(a=>a.level==="error"):s=i,s.length!==0&&fetch(`${t}/publish/${r}`,{method:"POST",body:JSON.stringify({timestamp:Date.now(),type:"log",message:s.map(a=>({...a,messages:(0,lS.makeErrorsSerializable)(a.messages)}))}),headers:{"content-type":"application/json",authentication:`Bearer ${e}`,"user-agent":Hm.Environment.instance.systemUserAgent,"zp-dn":Hm.Environment.instance.deploymentName??"unknown"}}).catch(a=>{console.error(a)})},"dispatchFunction"),ws,kl=class{static{o(this,"RemoteLogTransport")}constructor(e){ws||(ws=new uS.BatchDispatch("remote-log-transport",1,dS(e)))}async log(e,r){ws.enqueue(e),r.waitUntil(ws.waitUntilFlushed())}};vs.RemoteLogTransport=kl});var $m=g(xr=>{"use strict";Object.defineProperty(xr,"__esModule",{value:!0});xr.unifiedFormatter=xr.SeverityNumberOpenTelemetryMap=void 0;xr.SeverityNumberOpenTelemetryMap={internal:1,trace:2,debug:5,info:9,warn:13,error:17,fatal:21};var pS=o((t,e)=>r=>{let n={};return n.deploymentName=t,n.labels={requestId:r.requestId,source:r.logSource,loggingId:r.loggingId,logOwner:r.logOwner},n.rayId=r.rayId??"",n.runtime={buildId:e.BUILD_ID,buildTimestamp:e.TIMESTAMP,gitSHA:e.GIT_SHA,version:e.ZUPLO_VERSION},n.atomicCounter=r.vectorClock,{timestamp:r.timestamp,observerdTimestamp:r.timestamp,traceId:r.requestId,severityText:r.level,severityNumber:xr.SeverityNumberOpenTelemetryMap[r.level],body:r.messages,attributes:n}},"unifiedFormatter");xr.unifiedFormatter=pS});var Vm=g(Ss=>{"use strict";Object.defineProperty(Ss,"__esModule",{value:!0});Ss.UnifiedLogTransport=void 0;var hS=we(),jm=ee(),fS=$m(),mS=o(({url:t,remoteLogToken:e,deploymentName:r,build:n})=>async i=>{if(i.length===0)return;let s=(0,fS.unifiedFormatter)(r,n);fetch(`${t}/v1/runtime-logs`,{method:"POST",body:JSON.stringify({entries:i.map(s)}),headers:{"content-type":"application/json",authentication:`Bearer ${e}`,"user-agent":jm.Environment.instance.systemUserAgent,"zp-dn":jm.Environment.instance.deploymentName??"unknown"}}).catch(a=>{console.error(a)})},"dispatchFunction"),Ts,Fl=class{static{o(this,"UnifiedLogTransport")}constructor(e){Ts||(Ts=new hS.BatchDispatch("unified-log-transport",1,mS(e)))}async log(e,r){Ts.enqueue(e),r.waitUntil(Ts.waitUntilFlushed())}};Ss.UnifiedLogTransport=Fl});var Qm=g(Is=>{"use strict";Object.defineProperty(Is,"__esModule",{value:!0});Is.LogInitializer=void 0;var yS=Er(),gS=Rt(),Gm=Tu(),Bm=ee(),Km=Vh(),_S=Nt(),bS=Gh(),Jm=Bh(),zm=Um(),ES=Ul(),wS=gs(),Wm=Fm(),vS=qm(),TS=Vm(),Hl=(0,yS.debug)("zuplo:logging"),ql=class{static{o(this,"LogInitializer")}serviceProvider;systemCoreLogger;userCoreLogger;constructor(e){this.serviceProvider=e,this.systemCoreLogger=this.setupSystemCoreLogger(Bm.Environment.instance),this.userCoreLogger=this.setupUserCoreLogger(Bm.Environment.instance)}setupSystemCoreLogger(e){let{runtime:r,build:n}=e;Hl("Gateway.setupSystemCoreLogger");let i=[],s=this.serviceProvider.getService(Gm.SYSTEM_LOGGER);return s?i.push(new Wm.ProcessTransport(s.logger,e.logFormat)):e.isDeno&&i.push(new zm.ConsoleTransport(console,e.logFormat)),e.isCloudflare&&e.deploymentName&&e.remoteLogToken&&i.push(new TS.UnifiedLogTransport({url:e.remoteLogURL,deploymentName:e.deploymentName,remoteLogToken:e.remoteLogToken,build:e.build})),new Km.CoreLogger(e.systemLogLevel,"system",e.loggingId,n.BUILD_ID,i)}setupUserCoreLogger(e){Hl("Gateway.setupUserCoreLogger");let r=[],{runtime:n,build:i}=e,s=this.serviceProvider.getService(Gm.SYSTEM_LOGGER);if(s&&s.captureUserLogs===!0?r.push(new Wm.ProcessTransport(s.logger,e.logFormat)):e.isDeno&&r.push(new zm.ConsoleTransport(console,e.logFormat)),e.remoteLogToken&&e.loggingId&&r.push(new vS.RemoteLogTransport({loggingId:e.loggingId,url:e.remoteLogURL,remoteLogToken:e.remoteLogToken,sendOnlyErrors:e.isCloudflare})),n.GCP_USER_LOG_NAME&&n.GCP_USER_LOG_SVC_ACCT_JSON&&r.push(new wS.GoogleLogTransport({serviceAccountJson:n.GCP_USER_LOG_SVC_ACCT_JSON,logName:n.GCP_USER_LOG_NAME})),n.ZUPLO_USER_LOGGER_DATA_DOG_API_KEY){let a=n.ZUPLO_USER_LOGGER_DATA_DOG_URL;r.push(new ES.DataDogTransport({apiKey:n.ZUPLO_USER_LOGGER_DATA_DOG_API_KEY,url:a}))}return gS.plugins.forEach(a=>{a instanceof _S.LogPlugin&&r.push(a.getTransport())}),new Km.CoreLogger(e.userLogLevel,"user",e.loggingId,i.BUILD_ID,r)}createRequestLoggers(e,r,n,i,s){Hl("Gateway.createRequestLoggers");let a=new bS.LoggingContext(n,i,s),c=new Jm.RequestLogger(e,r,this.systemCoreLogger,a);return{userRequestLogger:new Jm.RequestLogger(e,r,this.userCoreLogger,a),systemRequestLogger:c}}};Is.LogInitializer=ql});var jl=g(As=>{"use strict";Object.defineProperty(As,"__esModule",{value:!0});As.UserRouteConfiguration=void 0;var $l=class{static{o(this,"UserRouteConfiguration")}constructor(e){this.path=e.path,this.methods=e.methods,this.label=e.label,this.key=e.key,this.handler=e.handler,this.corsPolicy=e.corsPolicy,this.custom=e.custom,this.version=e.version,this.policies=e.policies,this.excludeFromOpenApi=e.excludeFromOpenApi,this.pathPattern=e.pathPattern,e.raw?(this.#e=e.raw(),this.operationId=this.raw()?.operationId,this.summary=this.raw()?.summary,this.tags=this.raw()?.tags,this.parameters=this.raw()?.parameters,this.responses=this.raw()?.responses):(this.operationId=e.operationId,this.summary=e.summary,this.tags=e.tags,this.parameters=e.parameters,this.responses=e.responses)}raw(){return this.#e}#e;label;key;path;summary;operationId;tags;parameters;responses;excludeFromOpenApi;pathPattern;custom;methods;handler;corsPolicy;version;policies};As.UserRouteConfiguration=$l});var Gl=g(bt=>{"use strict";Object.defineProperty(bt,"__esModule",{value:!0});bt.Router=bt.RouterError=bt.LookupResult=bt.RouterEntry=void 0;var Ym=D(),SS=ft(),IS=jl(),Ps=class{static{o(this,"RouterEntry")}constructor(e,r,n,i){this.fullPath=e,this.urlPattern=r,this.config=n,this.executableHandler=i}fullPath;urlPattern;config;executableHandler};bt.RouterEntry=Ps;var fi=class{static{o(this,"LookupResult")}constructor(e,r,n){this.routeConfiguration=e,this.params=n??{},this.executableHandler=r}executableHandler;routeConfiguration;params};bt.LookupResult=fi;var Rs=class extends Error{static{o(this,"RouterError")}constructor(e,r){super(e,r)}};bt.RouterError=Rs;var Vl=class{static{o(this,"Router")}constructor(e){this.routeEntries=[],this.versions=e}versions;routeEntries;addRoute(e,r){if(!(e instanceof IS.UserRouteConfiguration||e instanceof SS.SystemRouteConfiguration))throw new Ym.SystemError("Config must be a UserRouteConfiguration or SystemRouteConfiguration");let n=this.versions.find(s=>s.name===e.version)?.pathPrefix,i;"pathPattern"in e&&e.pathPattern?i=`${n??""}${e.pathPattern}`:i=`${n??""}${e.path}`;try{let s=new URLPattern({pathname:i}),a=new Ps(i,s,e,r);Object.freeze(a.config),this.routeEntries.push(a)}catch(s){throw new Rs(`addRoute-error: Invalid path '${i}'. '${s.message}'`,{cause:s})}}lookup(e,r){if(typeof e>"u")throw new Ym.ConfigurationError(`Invalid request - Method was undefined. Path: '${r}'`);let n=this.routeEntries.filter(i=>i.config.methods.includes(e));if(n.length!==0)for(let i=0;i<n.length;i++){let s=n[i],c=s.urlPattern.exec({pathname:r});if(c!==null)return new fi(s.config,s.executableHandler,c.pathname.groups)}}lookupByPathOnly(e){let r=[];for(let n=0;n<this.routeEntries.length;n++){let i=this.routeEntries[n],a=i.urlPattern.exec({pathname:e});if(a!==null){let c=new fi(i.config,i.executableHandler,a.pathname.groups);r.push(c)}}return r}};bt.Router=Vl});var un=g(xs=>{"use strict";Object.defineProperty(xs,"__esModule",{value:!0});xs.Gateway=void 0;var AS=Er(),Zm=wh(),Xm=Sh(),PS=Ih(),ey=Ah(),ty=xh(),Ut=Jn(),Os=wr(),ry=jh(),wt=D(),Bl=Rt(),RS=Qm(),OS=Gt(),xS=ve(),NS=Eu(),CS=Tr(),LS=Qn(),DS=Wn(),US=Gl(),Kl=ft(),ny=jl(),MS=Be(),iy=ee(),oy=Ar(),kS=["/__zuplo/ping","/__zuplo/open-api","/__zuplo/docs","/__zuplo/consumers","/__zuplo/external-users","/__zuplo/assets","/__zuplo/config","/__zuplo/build","/favicon.ico"],Et=(0,AS.debug)("zuplo:runtime"),FS=o(t=>{let e=t.findIndex(r=>r.name===Kl.systemNoVersion.name);return e>-1?[...t.splice(e),Kl.systemNoVersion]:[...t,Kl.systemNoVersion]},"setupSystemNoVersion"),Jl=class t{static{o(this,"Gateway")}routeData;runtimeSettings;schemaValidator;static#e;constructor(e,r,n,i){this.routeData=e,this.runtimeSettings=r,this.schemaValidator=i,Et("Gateway.constructor"),this.#r=this.setupRoutes(),this.#i=this.setupErrorHandler(),this.#t=new RS.LogInitializer(n)}static async initialize(e,r,n,i,s){if(Et("Gateway.initialize"),!t.#e){await(0,Bl.initializeRuntime)(s);let a=new t(e,r,n,i);t.#e=a}return t.#e}static purgeGatewayCache(){Et("Gateway.purgeGatewayCache"),t.#e=void 0}static get instance(){if(!t.#e)throw new wt.SystemError("Gateway cannot be used before it is initialized");return t.#e}instanceId=crypto.randomUUID();#t;#r;#n=[LS.policyProcessor,NS.corsProcessor,CS.metricsProcessor];#i;setupRoutes=()=>{Et("Gateway.setupRoutes");let e=this.routeData,r=FS(e.versions),n=new US.Router(r);if(e.routes.length===0)return(0,Zm.registerBuildRoute)(n,this),(0,ty.registerPingRoute)(n,this),(0,Xm.registerCorsRoute)(n,this),(0,PS.registerNoRoutes)(n,this),n;let{enabled:i}=this.runtimeSettings.developerPortal;return i&&((0,ry.registerDevPortalLegacyRedirectRoute)(n,this),(0,ry.registerDevPortalV3Route)(n,this)),(0,Zm.registerBuildRoute)(n,this),(0,ty.registerPingRoute)(n,this),(0,Xm.registerCorsRoute)(n,this),e.routes.forEach(s=>{let a;if(typeof s.handler?.module=="object"&&(a=s.handler?.module[s.handler.export]),typeof a!="function")throw new wt.ConfigurationError(`Invalid state - No handler on route for path '${s.path}'`);let c=a,u=new OS.Pipeline(this.#n,c,this),l=new ny.UserRouteConfiguration(s);n.addRoute(l,u.execute)}),(0,ey.registerNotMatchedHandler)(n,this),n};setupErrorHandler=()=>{let e;if(typeof this.routeData.requestErrorHandler?.module=="object"){if(e=this.routeData.requestErrorHandler.module[this.routeData.requestErrorHandler.export],typeof e!="function")throw new wt.ConfigurationError("Invalid state - Module and export set for 'errorHandler' is not a function")}else e=o((r,n,i)=>this.#o(r,n,i),"errorHandler");return e};errorHandler(e,r,n){try{return this.#i(e,r,n)}catch(i){return Et("An error occurred in the user's errorHandler",i),this.#o(e,r,i)}}#o(e,r,n){Et("Gateway.internalErrorResponse");let i={};if(iy.Environment.instance.isDeno){if(n instanceof wt.RuntimeError&&n.extensionMembers)i=n.extensionMembers;else if(n.cause){let s=(0,oy.serializeError)(n.cause);"stack"in s&&(s.stack=(0,oy.cleanStack)(s.stack)),i={cause:s}}}return xS.HttpProblems.internalServerError(e,r,{detail:n.message,...i})}#s(e){let r=new Headers(e.headers);return Ut.DISPATCH_HEADERS_TO_REMOVE.forEach(n=>{r.delete(n)}),iy.Environment.instance.isDeno&&Ut.INTERNAL_HEADERS_TO_REMOVE.forEach(n=>{r.delete(n)}),new Request(e,{headers:r})}async handleRequest(e,r){let n=e.headers.get(Ut.REQUEST_ID_HEADER)??e.headers.get(Ut.LEGACY_REQUEST_ID_HEADER),i=e.headers.get(Ut.RAY_ID_HEADER);if(!n){n=crypto.randomUUID();let T=new Headers(e.headers);T.set(Ut.REQUEST_ID_HEADER,n),e=new Request(e,{headers:T})}if(["GET","HEAD"].includes(e.method)&&e.body){let T=new Headers(e.headers);T.set(Ut.BODY_REMOVED_HEADER,"true"),e=new Request(e,{headers:T,body:null})}let s={},{userRequestLogger:a,systemRequestLogger:c}=this.#t.createRequestLoggers(n,i,r,s,e),u=new URL(e.url),l=u.pathname,d=this.#r.lookup(e.method,l);if(!d)throw new wt.SystemError(`Invalid state - no route match - should have been picked up by the not found handler, path: '${l}'`);let p=new Os.HeaderIncomingRequestProperties(e.headers),y=this.#s(e),h=new DS.ZuploRequest(y,{params:d.params}),m=new Os.SystemZuploContext({logger:a,route:d.routeConfiguration,requestId:n,fetchEvent:r,custom:s,incomingRequestProperties:p}),v=Os.ZuploContextExtensions.initialize(m,h);if(d.routeConfiguration===ey.notFoundRouteConfiguration&&Bl.runtimeExtensions.value?.notFoundHandler!==void 0){let T=this.#r.lookupByPathOnly(l);v.pathOnlyMatches=T.map(S=>S.routeConfiguration).filter(S=>S instanceof ny.UserRouteConfiguration)}try{if(MS.SystemLogMap.addLogger(m,c),!u.pathname.startsWith("/__zuplo")){let j=await(0,Bl.invokeOnRequestExtensions)(h,m);if(j instanceof Response)return j;{let C=Os.ZuploContextExtensions.getContextExtensions(m);h=j,C.latestRequest=h}}[...kS,...this.runtimeSettings.developerPortal.enabled?[this.runtimeSettings.developerPortal.sitePathname]:[]].filter(j=>new RegExp(j).test(u.pathname)).length===0&&a.debug(`Request received '${u.pathname}'`,{method:e.method,url:u.pathname,hostname:u.hostname,route:d.routeConfiguration.path});let S=d.executableHandler;HS(S,d,e),Et("Gateway.handleRequest - call user handler");let k=await S(h,m);if(Et("Gateway.handleRequest - user handler"),!(k instanceof Response))throw new wt.RuntimeError(`Invalid Response type from the request handler: ${typeof k}`);if(k.bodyUsed)throw new wt.RuntimeError("The response object has already been used. Return a new response instead.");if(k.headers.get(Ut.REQUEST_ID_HEADER)===null&&!k.webSocket){let j=new Headers(k.headers);return j.set(Ut.REQUEST_ID_HEADER,n),new Response(k.body,{status:k.status,statusText:k.statusText,headers:j,cf:k.cf})}else return k}catch(T){return Et("Gateway - error executing handler",T),T instanceof wt.RuntimeError?(a.error(T),c.warn(T)):c.error(T),await this.#o(h,m,T)}}};xs.Gateway=Jl;function HS(t,e,r){if(Et("Gateway.checkHandler"),!t)throw typeof e.routeConfiguration>"u"?new wt.ConfigurationError(`Invalid state - no routeConfiguration for '${r.method}:${r.url}`):new wt.ConfigurationError(`Invalid state. No handler for request '${r.method}':'${e.routeConfiguration.path}'`)}o(HS,"checkHandler")});var sy=g(Ns=>{"use strict";Object.defineProperty(Ns,"__esModule",{value:!0});Ns.invokeInboundPolicy=void 0;var qS=D(),$S=un(),jS=Qn(),VS=o(async(t,e,r)=>{let n=$S.Gateway.instance.routeData.policies,i=(0,jS.getInboundPolicyHandlerAndOptions)([t],n);if(i.length===0)throw new qS.RuntimeError(`Invalid 'invokeInboundPolicy call' - no policy '${t}' found.`);let s=i[0];return s.handler(e,r,s.options,t)},"invokeInboundPolicy");Ns.invokeInboundPolicy=VS});var wr=g(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.SystemZuploContext=Xe.ZuploContextExtensions=Xe.ResponseSentEvent=Xe.ResponseSendingEvent=Xe.HeaderIncomingRequestProperties=void 0;var _e=Jn(),GS=D(),BS=sy(),zl=class{static{o(this,"HeaderIncomingRequestProperties")}#e;constructor(e){this.#e=e}get asn(){try{let e=this.#e.get(_e.ZP_ASN_HEADER);if(typeof e=="string")return parseInt(e)}catch{}}get asOrganization(){return this.#e.get(_e.ZP_AS_ORG_HEADER)??void 0}get city(){return this.#e.get(_e.CF_IP_CITY_HEADER)??this.#e.get(_e.ZP_IP_CITY_HEADER)??void 0}get continent(){return this.#e.get(_e.CF_IP_CONTINENT_HEADER)??this.#e.get(_e.ZP_IP_CONTINENT_HEADER)??void 0}get country(){return this.#e.get(_e.CF_IP_COUNTRY_HEADER)??this.#e.get(_e.ZP_IP_COUNTRY_HEADER)??void 0}get latitude(){return this.#e.get(_e.CF_IP_LATITUDE_HEADER)??this.#e.get(_e.ZP_IP_LATITUDE_HEADER)??void 0}get longitude(){return this.#e.get(_e.CF_IP_LONGITUDE_HEADER)??this.#e.get(_e.ZP_IP_LONGITUDE_HEADER)??void 0}get colo(){return this.#e.get(_e.ZP_COLO_HEADER)??void 0}get postalCode(){return this.#e.get(_e.ZP_POSTAL_CODE_HEADER)??void 0}get metroCode(){return this.#e.get(_e.ZP_METRO_CODE_HEADER)??void 0}get region(){return this.#e.get(_e.ZP_REGION_HEADER)??void 0}get regionCode(){return this.#e.get(_e.ZP_REGION_CODE_HEADER)??void 0}get timezone(){return this.#e.get(_e.ZP_TIMEZONE_HEADER)??void 0}toJSON(){return{asn:this.asn,asOrganization:this.asOrganization,city:this.city,continent:this.continent,country:this.country,latitude:this.latitude,longitude:this.longitude,colo:this.colo,postalCode:this.postalCode,metroCode:this.metroCode,region:this.region,regionCode:this.regionCode,timezone:this.timezone}}};Xe.HeaderIncomingRequestProperties=zl;var Wl=class extends Event{static{o(this,"ResponseSendingEvent")}constructor(e,r){super("responseSending"),this.request=e,this.mutableResponse=r}request;mutableResponse};Xe.ResponseSendingEvent=Wl;var Ql=class extends Event{static{o(this,"ResponseSentEvent")}constructor(e,r){super("responseSent"),this.request=e,this.response=r}request;response};Xe.ResponseSentEvent=Ql;var Cs=class t{static{o(this,"ZuploContextExtensions")}static#e=new WeakMap;static initialize(e,r){if(!t.#e.has(e)){let n=new t(r);return t.#e.set(e,n),n}throw new Error(`ZuploContextExtensions already initialized for context with requestId '${e.requestId}'`)}static getContextExtensions(e){let r=t.#e.get(e);if(!r)throw new GS.RuntimeError(`Invalid state, could not get ZuploContext extensions for context with requestId '${e.requestId}'`);return r}latestRequest;pathOnlyMatches;#t;#r;constructor(e){this.latestRequest=e,this.#t=[],this.#r=[]}addResponseSendingHook(e){this.#r.push(e)}addResponseSendingFinalHook(e){this.#t.push(e)}onResponseSendingFinal=async(e,r,n)=>{for(let i of this.#t)await i(e,r,n)};onResponseSending=async(e,r,n)=>{let i=e;for(let s of this.#r)i=await s(e,r,n);return i}};Xe.ZuploContextExtensions=Cs;var Yl=class extends EventTarget{static{o(this,"SystemZuploContext")}constructor({logger:e,route:r,requestId:n,fetchEvent:i,custom:s,incomingRequestProperties:a}){super(),this.log=Object.freeze(e),this.route=r,this.requestId=n,this.custom=s,this.incomingRequestProperties=a,this.#e=i,this.invokeInboundPolicy=(c,u)=>(0,BS.invokeInboundPolicy)(c,u,this),this.waitUntil=c=>{this.#e.waitUntil(c)},this.addResponseSendingFinalHook=c=>{Cs.getContextExtensions(this).addResponseSendingFinalHook(c)},Object.freeze(this)}#e;requestId;log;route;custom;incomingRequestProperties;invokeInboundPolicy;waitUntil;addResponseSendingFinalHook;addEventListener(e,r,n){let i=o(s=>{try{typeof r=="function"?r(s):r.handleEvent(s)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,i,n)}};Xe.SystemZuploContext=Yl});var ay=g(Ls=>{"use strict";Object.defineProperty(Ls,"__esModule",{value:!0});Ls.ContextData=void 0;var Zl=class t{static{o(this,"ContextData")}static#e;#t;constructor(e){this.#t=e}set(e,r){t.set(e,this.#t,r)}get(e){return t.get(e,this.#t)}static set(e,r,n){t.#e||(t.#e=new WeakMap);let i=t.#e.get(e);i||(i=new Map),i.set(r,n)}static get(e,r){return t.#e||(t.#e=new WeakMap),t.#e.get(e)?.get(r)}};Ls.ContextData=Zl});var Xl=g(or=>{"use strict";Object.defineProperty(or,"__esModule",{value:!0});or.environment=or.isZuploReadableEnvVariableName=or.isRestrictedEnvVariableName=void 0;var KS=["ZUPLO_USER_LOGGER_DATA_DOG_API_KEY","ZUPLO_USER_LOGGER_DATA_DOG_URL","ZUPLO_LOG_LEVEL","ZUPLO_HANDLER_WRITE_LOG_LEVEL"];function cy(t){return t.startsWith("__ZUPLO")||t.startsWith("ZUPLO_")?!KS.includes(t)&&!t.startsWith("ZUPLO_PUBLIC_"):!1}o(cy,"isRestrictedEnvVariableName");or.isRestrictedEnvVariableName=cy;function uy(t){return!!t.startsWith("ZUPLO_")}o(uy,"isZuploReadableEnvVariableName");or.isZuploReadableEnvVariableName=uy;var JS=new Proxy({},{get(t,e,r){if(cy(String(e))&&!uy(String(e)))return;let n=globalThis,i;return n.process?i=n.process.env[e]:i=n[e],i}});or.environment=JS});var ed=g(ln=>{"use strict";Object.defineProperty(ln,"__esModule",{value:!0});ln.externalServiceHandler=ln.externalServiceTunnelConfig=void 0;var zS=Er(),Nr=D(),WS=td(),mi=ee(),at=(0,zS.debug)("zuplo:runtime:external-service");function dy(){let t,{__ZUPLO_EXTERNAL_SERVICE_TOKEN:e}=mi.Environment.instance.runtime;if(e&&e!=="undefined")try{let r=atob(e);t=JSON.parse(r)}catch{}return t}o(dy,"getServiceAuth");async function QS(t){let e=dy();if(!e)throw at("There is no external service auth configured for this zup."),new Nr.RuntimeError("There are no external services configured for this zup.");if(typeof t!="string")throw at("Cannot call external service with Request object"),new Nr.RuntimeError("Currently, we only support fetch(<some_string>, ...).");let n=new URL(t).hostname,i={};i["CF-Access-Client-Id"]=e.clientId,i["CF-Access-Client-Secret"]=e.clientSecret;let s;if(e.customServiceMapping&&e.customServiceMapping[n])s=`https://${e.customServiceMapping[n]}`;else if(mi.Environment.instance.useSha256ServiceRouting){at("Using sha256 service routing");let a=mi.Environment.instance.build;if(a.ACCOUNT_NAME&&a.PROJECT_NAME&&a.ENVIRONMENT_TYPE)s=`https://${await py(n,a.ACCOUNT_NAME,a.PROJECT_NAME,a.ENVIRONMENT_TYPE)}.zuptunnel.com`;else throw at("Cannot use sha256 service routing, missing build variables"),new Nr.RuntimeError("Failed to generate fully qualified tunnel url.")}else s=`https://${n}.zuptunnel.com`;return{serviceBaseUrl:s,tunnelHeaders:i}}o(QS,"externalServiceTunnelConfig");ln.externalServiceTunnelConfig=QS;async function YS(t,e){let r=dy();if(r)if(at(`Using external service auth. ClientId: ${r.clientId})`),typeof t=="string"){let n=new URL(t),i=n.hostname,s=e??{},a=new Headers(s.headers||{});a.set("CF-Access-Client-Id",r.clientId),a.set("CF-Access-Client-Secret",r.clientSecret),s.headers=a;let c;if(r.customServiceMapping&&r.customServiceMapping[i])c=`https://${r.customServiceMapping[i]}`;else if(mi.Environment.instance.useSha256ServiceRouting){at("Using sha256 service routing");let d=mi.Environment.instance.build;if(d.ACCOUNT_NAME&&d.PROJECT_NAME&&d.ENVIRONMENT_TYPE)c=`https://${await py(i,d.ACCOUNT_NAME,d.PROJECT_NAME,d.ENVIRONMENT_TYPE)}.zuptunnel.com`;else throw at("Cannot use sha256 service routing, missing build variables"),new Nr.RuntimeError("Failed to generate fully qualified tunnel url.")}else c=`https://${i}.zuptunnel.com`;let u=new URL(`${c}${n.pathname}${n.search}`);at(`Calling external service: ${u.toString()}`);let l=await(0,WS.originalFetch)(u.toString(),s);if(l.status===403&&l.headers.get("cf-access-domain")!==null)throw console.error("403 Forbidden when calling external service.",{clientId:r.clientId,tunnelHost:c}),new Nr.RuntimeError("Could not connect to secure tunnel.");return l}else throw at("Cannot call external service with Request object"),new Nr.RuntimeError("Currently, we only support fetch(<some_string>, ...).");else throw at("There is no external service auth configured for this zup."),new Nr.RuntimeError("There are no external services configured for this zup.")}o(YS,"externalServiceHandler");ln.externalServiceHandler=YS;async function py(t,e,r,n){let i=t.toLowerCase(),s=e.toLowerCase(),a=r.toLowerCase(),c=ZS(n);at(`Hashing service name: ${s}-${i}.${s}-${a}-${c}`);let u=await ly(`${s}-${i}`),l=await ly(`${s}-${a}-${c}`);return`${u}.${l}`}o(py,"hashServiceName");async function ly(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("").slice(0,-1)}o(ly,"hashSegment");function ZS(t){let e=t.toLowerCase();switch(e){case"production":case"preview":return e;default:return"working-copy"}}o(ZS,"sanitizeEnvironmentType")});var td=g(dn=>{"use strict";Object.defineProperty(dn,"__esModule",{value:!0});dn.originalFetch=void 0;var XS=ed(),hy=new Map;hy.set("service:",XS.externalServiceHandler);dn.originalFetch=globalThis.fetch;globalThis.fetch=function(t,e){let r=eI(e);if(typeof t=="string"){let n=new URL(t),i=hy.get(n.protocol);return i?i(t,r):(0,dn.originalFetch)(t,r)}else return(0,dn.originalFetch)(t,r)};var eI=o(t=>{if(!t||t instanceof Request)return t;let e=t;if(!e.zuplo)return t;let r=t;return r.cf={cacheEverything:e.zuplo?.cacheEverything,cacheTtl:e.zuplo?.cacheTtlSeconds},delete t.zuplo,t},"transformInit")});var yy=g(pn=>{"use strict";Object.defineProperty(pn,"__esModule",{value:!0});pn.Handler=pn.purgeGatewayCache=void 0;var my=un(),fy=ee(),tI=o(()=>{my.Gateway.purgeGatewayCache()},"purgeGatewayCache");pn.purgeGatewayCache=tI;var rd=class{static{o(this,"Handler")}routeData;buildEnvironment;runtimeEnvironment;runtimeSettings;serviceProvider;schemaValidations;runtimeInit;constructor(e,r,n,i,s,a,c){this.routeData=e,this.buildEnvironment=r,this.runtimeEnvironment=n,this.runtimeSettings=i,this.serviceProvider=s,this.schemaValidations=a,this.runtimeInit=c}requestHandler=async(e,r)=>{fy.Environment.initialize(this.buildEnvironment,this.runtimeEnvironment);let n;try{n=await my.Gateway.initialize(this.routeData,this.runtimeSettings,this.serviceProvider,this.schemaValidations,this.runtimeInit)}catch(i){console.error("Error initializing gateway.",i);let s={status:500,title:"Gateway Initialization Error",type:"https://httpproblems.com/http-status/500",detail:"Error initializing gateway. Check your 'zuplo.runtime.ts' for errors or contact support.",instance:e.url,trace:{timestamp:Date.now(),rayId:e.headers.get("cf-ray")??void 0,buildId:this.buildEnvironment.BUILD_ID},message:fy.Environment.instance.isDeno?i.message:void 0};return new Response(JSON.stringify(s,null,2),{status:500,headers:{"content-type":"application/json"}})}return n.handleRequest(e,r)}};pn.Handler=rd});var Ey=g(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.pathToRegexp=Re.tokensToRegexp=Re.regexpToFunction=Re.match=Re.tokensToFunction=Re.compile=Re.parse=void 0;function rI(t){for(var e=[],r=0;r<t.length;){var n=t[r];if(n==="*"||n==="+"||n==="?"){e.push({type:"MODIFIER",index:r,value:t[r++]});continue}if(n==="\\"){e.push({type:"ESCAPED_CHAR",index:r++,value:t[r++]});continue}if(n==="{"){e.push({type:"OPEN",index:r,value:t[r++]});continue}if(n==="}"){e.push({type:"CLOSE",index:r,value:t[r++]});continue}if(n===":"){for(var i="",s=r+1;s<t.length;){var a=t.charCodeAt(s);if(a>=48&&a<=57||a>=65&&a<=90||a>=97&&a<=122||a===95){i+=t[s++];continue}break}if(!i)throw new TypeError("Missing parameter name at ".concat(r));e.push({type:"NAME",index:r,value:i}),r=s;continue}if(n==="("){var c=1,u="",s=r+1;if(t[s]==="?")throw new TypeError('Pattern cannot start with "?" at '.concat(s));for(;s<t.length;){if(t[s]==="\\"){u+=t[s++]+t[s++];continue}if(t[s]===")"){if(c--,c===0){s++;break}}else if(t[s]==="("&&(c++,t[s+1]!=="?"))throw new TypeError("Capturing groups are not allowed at ".concat(s));u+=t[s++]}if(c)throw new TypeError("Unbalanced pattern at ".concat(r));if(!u)throw new TypeError("Missing pattern at ".concat(r));e.push({type:"PATTERN",index:r,value:u}),r=s;continue}e.push({type:"CHAR",index:r,value:t[r++]})}return e.push({type:"END",index:r,value:""}),e}o(rI,"lexer");function nd(t,e){e===void 0&&(e={});for(var r=rI(t),n=e.prefixes,i=n===void 0?"./":n,s="[^".concat(hn(e.delimiter||"/#?"),"]+?"),a=[],c=0,u=0,l="",d=o(function(ne){if(u<r.length&&r[u].type===ne)return r[u++].value},"tryConsume"),p=o(function(ne){var fe=d(ne);if(fe!==void 0)return fe;var Ge=r[u],E=Ge.type,F=Ge.index;throw new TypeError("Unexpected ".concat(E," at ").concat(F,", expected ").concat(ne))},"mustConsume"),y=o(function(){for(var ne="",fe;fe=d("CHAR")||d("ESCAPED_CHAR");)ne+=fe;return ne},"consumeText");u<r.length;){var h=d("CHAR"),m=d("NAME"),v=d("PATTERN");if(m||v){var T=h||"";i.indexOf(T)===-1&&(l+=T,T=""),l&&(a.push(l),l=""),a.push({name:m||c++,prefix:T,suffix:"",pattern:v||s,modifier:d("MODIFIER")||""});continue}var S=h||d("ESCAPED_CHAR");if(S){l+=S;continue}l&&(a.push(l),l="");var k=d("OPEN");if(k){var T=y(),j=d("NAME")||"",C=d("PATTERN")||"",re=y();p("CLOSE"),a.push({name:j||(C?c++:""),pattern:j&&!C?s:C,prefix:T,suffix:re,modifier:d("MODIFIER")||""});continue}p("END")}return a}o(nd,"parse");Re.parse=nd;function nI(t,e){return gy(nd(t,e),e)}o(nI,"compile");Re.compile=nI;function gy(t,e){e===void 0&&(e={});var r=id(e),n=e.encode,i=n===void 0?function(u){return u}:n,s=e.validate,a=s===void 0?!0:s,c=t.map(function(u){if(typeof u=="object")return new RegExp("^(?:".concat(u.pattern,")$"),r)});return function(u){for(var l="",d=0;d<t.length;d++){var p=t[d];if(typeof p=="string"){l+=p;continue}var y=u?u[p.name]:void 0,h=p.modifier==="?"||p.modifier==="*",m=p.modifier==="*"||p.modifier==="+";if(Array.isArray(y)){if(!m)throw new TypeError('Expected "'.concat(p.name,'" to not repeat, but got an array'));if(y.length===0){if(h)continue;throw new TypeError('Expected "'.concat(p.name,'" to not be empty'))}for(var v=0;v<y.length;v++){var T=i(y[v],p);if(a&&!c[d].test(T))throw new TypeError('Expected all "'.concat(p.name,'" to match "').concat(p.pattern,'", but got "').concat(T,'"'));l+=p.prefix+T+p.suffix}continue}if(typeof y=="string"||typeof y=="number"){var T=i(String(y),p);if(a&&!c[d].test(T))throw new TypeError('Expected "'.concat(p.name,'" to match "').concat(p.pattern,'", but got "').concat(T,'"'));l+=p.prefix+T+p.suffix;continue}if(!h){var S=m?"an array":"a string";throw new TypeError('Expected "'.concat(p.name,'" to be ').concat(S))}}return l}}o(gy,"tokensToFunction");Re.tokensToFunction=gy;function iI(t,e){var r=[],n=od(t,r,e);return _y(n,r,e)}o(iI,"match");Re.match=iI;function _y(t,e,r){r===void 0&&(r={});var n=r.decode,i=n===void 0?function(s){return s}:n;return function(s){var a=t.exec(s);if(!a)return!1;for(var c=a[0],u=a.index,l=Object.create(null),d=o(function(y){if(a[y]===void 0)return"continue";var h=e[y-1];h.modifier==="*"||h.modifier==="+"?l[h.name]=a[y].split(h.prefix+h.suffix).map(function(m){return i(m,h)}):l[h.name]=i(a[y],h)},"_loop_1"),p=1;p<a.length;p++)d(p);return{path:c,index:u,params:l}}}o(_y,"regexpToFunction");Re.regexpToFunction=_y;function hn(t){return t.replace(/([.+*?=^!:${}()[\]|/\\])/g,"\\$1")}o(hn,"escapeString");function id(t){return t&&t.sensitive?"":"i"}o(id,"flags");function oI(t,e){if(!e)return t;for(var r=/\((?:\?<(.*?)>)?(?!\?)/g,n=0,i=r.exec(t.source);i;)e.push({name:i[1]||n++,prefix:"",suffix:"",modifier:"",pattern:""}),i=r.exec(t.source);return t}o(oI,"regexpToRegexp");function sI(t,e,r){var n=t.map(function(i){return od(i,e,r).source});return new RegExp("(?:".concat(n.join("|"),")"),id(r))}o(sI,"arrayToRegexp");function aI(t,e,r){return by(nd(t,r),e,r)}o(aI,"stringToRegexp");function by(t,e,r){r===void 0&&(r={});for(var n=r.strict,i=n===void 0?!1:n,s=r.start,a=s===void 0?!0:s,c=r.end,u=c===void 0?!0:c,l=r.encode,d=l===void 0?function(F){return F}:l,p=r.delimiter,y=p===void 0?"/#?":p,h=r.endsWith,m=h===void 0?"":h,v="[".concat(hn(m),"]|$"),T="[".concat(hn(y),"]"),S=a?"^":"",k=0,j=t;k<j.length;k++){var C=j[k];if(typeof C=="string")S+=hn(d(C));else{var re=hn(d(C.prefix)),ne=hn(d(C.suffix));if(C.pattern)if(e&&e.push(C),re||ne)if(C.modifier==="+"||C.modifier==="*"){var fe=C.modifier==="*"?"?":"";S+="(?:".concat(re,"((?:").concat(C.pattern,")(?:").concat(ne).concat(re,"(?:").concat(C.pattern,"))*)").concat(ne,")").concat(fe)}else S+="(?:".concat(re,"(").concat(C.pattern,")").concat(ne,")").concat(C.modifier);else C.modifier==="+"||C.modifier==="*"?S+="((?:".concat(C.pattern,")").concat(C.modifier,")"):S+="(".concat(C.pattern,")").concat(C.modifier);else S+="(?:".concat(re).concat(ne,")").concat(C.modifier)}}if(u)i||(S+="".concat(T,"?")),S+=r.endsWith?"(?=".concat(v,")"):"$";else{var Ge=t[t.length-1],E=typeof Ge=="string"?T.indexOf(Ge[Ge.length-1])>-1:Ge===void 0;i||(S+="(?:".concat(T,"(?=").concat(v,"))?")),E||(S+="(?=".concat(T,"|").concat(v,")"))}return new RegExp(S,id(r))}o(by,"tokensToRegexp");Re.tokensToRegexp=by;function od(t,e,r){return t instanceof RegExp?oI(t,e):Array.isArray(t)?sI(t,e,r):aI(t,e,r)}o(od,"pathToRegexp");Re.pathToRegexp=od});var ud=g(fn=>{"use strict";Object.defineProperty(fn,"__esModule",{value:!0});fn.AwsV4Signer=fn.AwsClient=void 0;var cI=Er(),Sy=D(),uI=(0,cI.debug)("zuplo:runtime"),ad=new TextEncoder,wy={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"},lI=["authorization","content-type","content-length","user-agent","presigned-expires","expect","x-amzn-trace-id","range","connection"],cd=class{static{o(this,"AwsClient")}accessKeyId;secretAccessKey;sessionToken;service;region;cache;retries;initRetryMs;constructor({accessKeyId:e,secretAccessKey:r,sessionToken:n,service:i,region:s,cache:a,retries:c,initRetryMs:u}){if(e==null)throw new TypeError("accessKeyId is a required option");if(r==null)throw new TypeError("secretAccessKey is a required option");this.accessKeyId=e,this.secretAccessKey=r,this.sessionToken=n,this.service=i,this.region=s,this.cache=a||new Map,this.retries=c??0,this.initRetryMs=u||50}async sign(e,r){let n=new Ds(Object.assign({url:e},r,this,r&&r.aws)),i=Object.assign({},r,await n.sign());return delete i.aws,{url:i.url.toString(),request:i}}async fetch(e,r){uI("AWS fetch",e);for(let n=0;n<=this.retries;n++){let{url:i,request:s}=await this.sign(e,r),a=fetch(i,s);if(n===this.retries)return a;let c=await a;if(c.status<500&&c.status!==429)return c;await new Promise(u=>setTimeout(u,Math.random()*this.initRetryMs*Math.pow(2,n)))}throw new Sy.ConfigurationError("An unknown error occurred, ensure retries is not negative")}};fn.AwsClient=cd;var Ds=class{static{o(this,"AwsV4Signer")}method;url;headers;body;accessKeyId;secretAccessKey;sessionToken;service;region;cache;datetime;signQuery;appendSessionToken;signableHeaders;signedHeaders;canonicalHeaders;credentialString;encodedPath;encodedSearch;constructor({method:e,url:r,headers:n,body:i,accessKeyId:s,secretAccessKey:a,sessionToken:c,service:u,region:l,cache:d,datetime:p,signQuery:y,appendSessionToken:h,allHeaders:m,singleEncode:v}){if(r==null)throw new TypeError("url is a required option");if(s==null)throw new TypeError("accessKeyId is a required option");if(a==null)throw new TypeError("secretAccessKey is a required option");this.method=e||(i?"POST":"GET"),this.url=new URL(r),this.headers=new Headers(n||{}),this.body=i,this.accessKeyId=s,this.secretAccessKey=a,this.sessionToken=c;let T,S;(!u||!l)&&([T,S]=dI(this.url,this.headers)),this.service=u||T||"",this.region=l||S||"us-east-1",this.cache=d||new Map,this.datetime=p||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),this.signQuery=y,this.appendSessionToken=h||this.service==="iotdevicegateway",this.headers.delete("Host");let k=this.signQuery?this.url.searchParams:this.headers;if(this.service==="s3"&&!this.headers.has("X-Amz-Content-Sha256")&&this.headers.set("X-Amz-Content-Sha256","UNSIGNED-PAYLOAD"),k.set("X-Amz-Date",this.datetime),this.sessionToken&&!this.appendSessionToken&&k.set("X-Amz-Security-Token",this.sessionToken),this.signableHeaders=["host",...this.headers.keys()].filter(C=>m||!lI.includes(C)).sort(),this.signedHeaders=this.signableHeaders.join(";"),this.canonicalHeaders=this.signableHeaders.map(C=>C+":"+(C==="host"?this.url.host:(this.headers.get(C)||"").replace(/\s+/g," "))).join(`
+-----END ${e}-----`},"default")});function Pf(t){let e=[],r=0;for(;r<t.length;){let n=Lf(t.subarray(r));e.push(n),r+=n.byteLength}return e}function Lf(t){let e=0,r=t[0]&31;if(e++,r===31){for(r=0;t[e]>=128;)r=r*128+t[e]-128,e++;r=r*128+t[e]-128,e++}let n=0;if(t[e]<128)n=t[e],e++;else if(n===128){for(n=0;t[e+n]!==0||t[e+n+1]!==0;){if(n>t.byteLength)throw new TypeError("invalid indefinite form length");n++}let s=e+n+2;return{byteLength:s,contents:t.subarray(e,e+n),raw:t.subarray(0,s)}}else{let s=t[e]&127;e++,n=0;for(let a=0;a<s;a++)n=n*256+t[e],e++}let i=e+n;return{byteLength:i,contents:t.subarray(e,i),raw:t.subarray(0,i)}}function TT(t){let e=Pf(Pf(Lf(t).contents)[0].contents);return Ho(e[e[0].raw[0]===160?6:5].raw)}function ST(t){let e=t.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g,""),r=ku(e);return Yu(TT(r),"PUBLIC KEY")}var Rf,Of,xf,Xt,Af,Nf,Cf,Zu,Df,Wo=I(()=>{Te();ot();Ie();If();V();st();Rf=o(async(t,e,r)=>{if(!se(r))throw new TypeError(ie(r,...W));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return Yu(Ho(new Uint8Array(await L.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},"genericExport"),Of=o(t=>Rf("public","spki",t),"toSPKI"),xf=o(t=>Rf("private","pkcs8",t),"toPKCS8"),Xt=o((t,e,r=0)=>{r===0&&(e.unshift(e.length),e.unshift(6));let n=t.indexOf(e[0],r);if(n===-1)return!1;let i=t.subarray(n,n+e.length);return i.length!==e.length?!1:i.every((s,a)=>s===e[a])||Xt(t,e,n+1)},"findOid"),Af=o(t=>{switch(!0){case Xt(t,[42,134,72,206,61,3,1,7]):return"P-256";case Xt(t,[43,129,4,0,34]):return"P-384";case Xt(t,[43,129,4,0,35]):return"P-521";case Xt(t,[43,101,110]):return"X25519";case Xt(t,[43,101,111]):return"X448";case Xt(t,[43,101,112]):return"Ed25519";case Xt(t,[43,101,113]):return"Ed448";default:throw new U("Invalid or unsupported EC Key Curve or OKP Key Sub Type")}},"getNamedCurve"),Nf=o(async(t,e,r,n,i)=>{var s;let a,c,u=new Uint8Array(atob(r.replace(t,"")).split("").map(d=>d.charCodeAt(0))),l=e==="spki";switch(n){case"PS256":case"PS384":case"PS512":a={name:"RSA-PSS",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RS256":case"RS384":case"RS512":a={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${n.slice(-3)}`},c=l?["verify"]:["sign"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":a={name:"RSA-OAEP",hash:`SHA-${parseInt(n.slice(-3),10)||1}`},c=l?["encrypt","wrapKey"]:["decrypt","unwrapKey"];break;case"ES256":a={name:"ECDSA",namedCurve:"P-256"},c=l?["verify"]:["sign"];break;case"ES384":a={name:"ECDSA",namedCurve:"P-384"},c=l?["verify"]:["sign"];break;case"ES512":a={name:"ECDSA",namedCurve:"P-521"},c=l?["verify"]:["sign"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{let d=Af(u);a=d.startsWith("P-")?{name:"ECDH",namedCurve:d}:{name:d},c=l?[]:["deriveBits"];break}case"EdDSA":a={name:Af(u)},c=l?["verify"]:["sign"];break;default:throw new U('Invalid or unsupported "alg" (Algorithm) value')}return L.subtle.importKey(e,u,a,(s=i?.extractable)!==null&&s!==void 0?s:!1,c)},"genericImport"),Cf=o((t,e,r)=>Nf(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,"pkcs8",t,e,r),"fromPKCS8"),Zu=o((t,e,r)=>Nf(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,"spki",t,e,r),"fromSPKI");o(Pf,"getElement");o(Lf,"parseElement");o(TT,"spkiFromX509");o(ST,"getSPKI");Df=o((t,e,r)=>{let n;try{n=ST(t)}catch(i){throw new TypeError("failed to parse the X.509 certificate",{cause:i})}return Zu(n,e,r)},"fromX509")});function IT(t){let e,r;switch(t.kty){case"oct":{switch(t.alg){case"HS256":case"HS384":case"HS512":e={name:"HMAC",hash:`SHA-${t.alg.slice(-3)}`},r=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":throw new U(`${t.alg} keys cannot be imported as CryptoKey instances`);case"A128GCM":case"A192GCM":case"A256GCM":case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":e={name:"AES-GCM"},r=["encrypt","decrypt"];break;case"A128KW":case"A192KW":case"A256KW":e={name:"AES-KW"},r=["wrapKey","unwrapKey"];break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":e={name:"PBKDF2"},r=["deriveBits"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"EC":{switch(t.alg){case"ES256":e={name:"ECDSA",namedCurve:"P-256"},r=t.d?["sign"]:["verify"];break;case"ES384":e={name:"ECDSA",namedCurve:"P-384"},r=t.d?["sign"]:["verify"];break;case"ES512":e={name:"ECDSA",namedCurve:"P-521"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}case"OKP":{switch(t.alg){case"EdDSA":e={name:t.crv},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break}default:throw new U('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}var AT,Xu,Uf=I(()=>{Te();V();Ie();o(IT,"subtleMapping");AT=o(async t=>{var e,r;if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:n,keyUsages:i}=IT(t),s=[n,(e=t.ext)!==null&&e!==void 0?e:!1,(r=t.key_ops)!==null&&r!==void 0?r:i];if(n.name==="PBKDF2")return L.subtle.importKey("raw",te(t.k),...s);let a={...t};return delete a.alg,delete a.use,L.subtle.importKey("jwk",a,...s)},"parse"),Xu=AT});async function Mf(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return Zu(t,e,r)}async function kf(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return Df(t,e,r)}async function Ff(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return Cf(t,e,r)}async function er(t,e,r){var n;if(!Q(t))throw new TypeError("JWK must be an object");switch(e||(e=t.alg),t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return r??(r=t.ext!==!0),r?Xu({...t,alg:e,ext:(n=t.ext)!==null&&n!==void 0?n:!1}):te(t.k);case"RSA":if(t.oth!==void 0)throw new U('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return Xu({...t,alg:e});default:throw new U('Unsupported "kty" (Key Type) Parameter value')}}var si=I(()=>{Ie();Wo();Uf();V();qe();o(Mf,"importSPKI");o(kf,"importX509");o(Ff,"importPKCS8");o(er,"importJWK")});var PT,RT,OT,tr,ai=I(()=>{ot();st();PT=o((t,e)=>{if(!(e instanceof Uint8Array)){if(!Vu(e))throw new TypeError(ju(t,e,...W,"Uint8Array"));if(e.type!=="secret")throw new TypeError(`${W.join(" or ")} instances for symmetric algorithms must be of type "secret"`)}},"symmetricTypeCheck"),RT=o((t,e,r)=>{if(!Vu(e))throw new TypeError(ju(t,e,...W));if(e.type==="secret")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);if(r==="sign"&&e.type==="public")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm signing must be of type "private"`);if(r==="decrypt"&&e.type==="public")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm decryption must be of type "private"`);if(e.algorithm&&r==="verify"&&e.type==="private")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);if(e.algorithm&&r==="encrypt"&&e.type==="private")throw new TypeError(`${W.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`)},"asymmetricTypeCheck"),OT=o((t,e,r)=>{t.startsWith("HS")||t==="dir"||t.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(t)?PT(t,e):RT(t,e,r)},"checkKeyType"),tr=OT});async function xT(t,e,r,n,i){if(!(r instanceof Uint8Array))throw new TypeError(ie(r,"Uint8Array"));let s=parseInt(t.slice(1,4),10),a=await L.subtle.importKey("raw",r.subarray(s>>3),"AES-CBC",!1,["encrypt"]),c=await L.subtle.importKey("raw",r.subarray(0,s>>3),{hash:`SHA-${s<<1}`,name:"HMAC"},!1,["sign"]),u=new Uint8Array(await L.subtle.encrypt({iv:n,name:"AES-CBC"},a,e)),l=Se(i,n,u,Mo(i.length<<3)),d=new Uint8Array((await L.subtle.sign("HMAC",c,l)).slice(0,s>>3));return{ciphertext:u,tag:d}}async function NT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await L.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(He(r,t,"encrypt"),s=r);let a=new Uint8Array(await L.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),c=a.slice(-16);return{ciphertext:a.slice(0,-16),tag:c}}var CT,ci,el=I(()=>{ye();qu();$u();Te();Zt();ot();V();st();o(xT,"cbcEncrypt");o(NT,"gcmEncrypt");CT=o(async(t,e,r,n,i)=>{if(!se(r)&&!(r instanceof Uint8Array))throw new TypeError(ie(r,...W,"Uint8Array"));switch(jo(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Jr(r,parseInt(t.slice(-3),10)),xT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Jr(r,parseInt(t.slice(1,4),10)),NT(t,e,r,n,i);default:throw new U("Unsupported JWE Content Encryption Algorithm")}},"encrypt"),ci=CT});async function Hf(t,e,r,n){let i=t.slice(0,7);n||(n=qo(i));let{ciphertext:s,tag:a}=await ci(i,r,e,n,new Uint8Array(0));return{encryptedKey:s,iv:Z(n),tag:Z(a)}}async function qf(t,e,r,n,i){let s=t.slice(0,7);return Go(s,e,r,n,i,new Uint8Array(0))}var tl=I(()=>{el();Gu();$o();Ie();o(Hf,"wrap");o(qf,"unwrap")});async function LT(t,e,r,n,i){switch(tr(t,e,"decrypt"),t){case"dir":{if(r!==void 0)throw new P("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new P("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!Q(n.epk))throw new P('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(!Jo(e))throw new U("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await er(n.epk,t),a,c;if(n.apu!==void 0){if(typeof n.apu!="string")throw new P('JOSE Header "apu" (Agreement PartyUInfo) invalid');a=te(n.apu)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new P('JOSE Header "apv" (Agreement PartyVInfo) invalid');c=te(n.apv)}let u=await Ko(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?ii(n.enc):parseInt(t.slice(-5,-2),10),a,c);if(t==="ECDH-ES")return u;if(r===void 0)throw new P("JWE Encrypted Key missing");return ni(t.slice(-6),u,r)}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(r===void 0)throw new P("JWE Encrypted Key missing");return Sf(t,e,r)}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(r===void 0)throw new P("JWE Encrypted Key missing");if(typeof n.p2c!="number")throw new P('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new P('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new P('JOSE Header "p2s" (PBES2 Salt) missing or invalid');return wf(t,e,r,n.p2c,te(n.p2s))}case"A128KW":case"A192KW":case"A256KW":{if(r===void 0)throw new P("JWE Encrypted Key missing");return ni(t,e,r)}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(r===void 0)throw new P("JWE Encrypted Key missing");if(typeof n.iv!="string")throw new P('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new P('JOSE Header "tag" (Authentication Tag) missing or invalid');let s=te(n.iv),a=te(n.tag);return qf(t,e,r,s,a)}default:throw new U('Invalid or unsupported "alg" (JWE Algorithm) header value')}}var $f,jf=I(()=>{Bo();Ju();Wu();Qu();Ie();V();oi();si();ai();qe();tl();o(LT,"decryptKeyManagement");$f=LT});function DT(t,e,r,n,i){if(i.crit!==void 0&&n.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(a=>typeof a!="string"||a.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let a of n.crit){if(!s.has(a))throw new U(`Extension Header Parameter "${a}" is not recognized`);if(i[a]===void 0)throw new t(`Extension Header Parameter "${a}" is missing`);if(s.get(a)&&n[a]===void 0)throw new t(`Extension Header Parameter "${a}" MUST be integrity protected`)}return new Set(n.crit)}var _t,Yr=I(()=>{V();o(DT,"validateCrit");_t=DT});var UT,ui,rl=I(()=>{UT=o((t,e)=>{if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)},"validateAlgorithms"),ui=UT});async function Zr(t,e,r){var n;if(!Q(t))throw new P("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new P("JOSE Header missing");if(typeof t.iv!="string")throw new P("JWE Initialization Vector missing or incorrect type");if(typeof t.ciphertext!="string")throw new P("JWE Ciphertext missing or incorrect type");if(typeof t.tag!="string")throw new P("JWE Authentication Tag missing or incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new P("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new P("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new P("JWE AAD incorrect type");if(t.header!==void 0&&!Q(t.header))throw new P("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!Q(t.unprotected))throw new P("JWE Per-Recipient Unprotected Header incorrect type");let i;if(t.protected)try{let j=te(t.protected);i=JSON.parse(ce.decode(j))}catch{throw new P("JWE Protected Header is invalid")}if(!yt(i,t.header,t.unprotected))throw new P("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let s={...i,...t.header,...t.unprotected};if(_t(P,new Map,r?.crit,i,s),s.zip!==void 0){if(!i||!i.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if(s.zip!=="DEF")throw new U('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:a,enc:c}=s;if(typeof a!="string"||!a)throw new P("missing JWE Algorithm (alg) in JWE Header");if(typeof c!="string"||!c)throw new P("missing JWE Encryption Algorithm (enc) in JWE Header");let u=r&&ui("keyManagementAlgorithms",r.keyManagementAlgorithms),l=r&&ui("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(u&&!u.has(a))throw new zt('"alg" (Algorithm) Header Parameter not allowed');if(l&&!l.has(c))throw new zt('"enc" (Encryption Algorithm) Header Parameter not allowed');let d;t.encrypted_key!==void 0&&(d=te(t.encrypted_key));let p=!1;typeof e=="function"&&(e=await e(i,t),p=!0);let y;try{y=await $f(a,e,d,s,r)}catch(j){if(j instanceof TypeError||j instanceof P||j instanceof U)throw j;y=gt(c)}let h=te(t.iv),m=te(t.tag),v=Y.encode((n=t.protected)!==null&&n!==void 0?n:""),T;t.aad!==void 0?T=Se(v,Y.encode("."),Y.encode(t.aad)):T=v;let S=await Go(c,y,te(t.ciphertext),h,m,T);s.zip==="DEF"&&(S=await(r?.inflateRaw||pf)(S));let k={plaintext:S};return t.protected!==void 0&&(k.protectedHeader=i),t.aad!==void 0&&(k.additionalAuthenticatedData=te(t.aad)),t.unprotected!==void 0&&(k.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(k.unprotectedHeader=t.header),p?{...k,key:e}:k}var Qo=I(()=>{Ie();Gu();Bu();V();zr();qe();jf();ye();oi();Yr();rl();o(Zr,"flattenedDecrypt")});async function Yo(t,e,r){if(t instanceof Uint8Array&&(t=ce.decode(t)),typeof t!="string")throw new P("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:a,4:c,length:u}=t.split(".");if(u!==5)throw new P("Invalid Compact JWE");let l=await Zr({ciphertext:a,iv:s||void 0,protected:n||void 0,tag:c||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var nl=I(()=>{Qo();V();ye();o(Yo,"compactDecrypt")});async function Vf(t,e,r){if(!Q(t))throw new P("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(Q))throw new P("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new P("JWE Recipients has no members");for(let n of t.recipients)try{return await Zr({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Ct}var Gf=I(()=>{Qo();V();qe();o(Vf,"generalDecrypt")});var MT,Bf,Kf=I(()=>{Te();ot();Ie();st();MT=o(async t=>{if(t instanceof Uint8Array)return{kty:"oct",k:Z(t)};if(!se(t))throw new TypeError(ie(t,...W,"Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await L.subtle.exportKey("jwk",t);return s},"keyToJWK"),Bf=MT});async function Jf(t){return Of(t)}async function zf(t){return xf(t)}async function Zo(t){return Bf(t)}var il=I(()=>{Wo();Wo();Kf();o(Jf,"exportSPKI");o(zf,"exportPKCS8");o(Zo,"exportJWK")});async function kT(t,e,r,n,i={}){let s,a,c;switch(tr(t,r,"encrypt"),t){case"dir":{c=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!Jo(r))throw new U("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:u,apv:l}=i,{epk:d}=i;d||(d=(await yf(r)).privateKey);let{x:p,y,crv:h,kty:m}=await Zo(d),v=await Ko(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?ii(e):parseInt(t.slice(-5,-2),10),u,l);if(a={epk:{x:p,crv:h,kty:m}},m==="EC"&&(a.epk.y=y),u&&(a.apu=Z(u)),l&&(a.apv=Z(l)),t==="ECDH-ES"){c=v;break}c=n||gt(e);let T=t.slice(-6);s=await ri(T,v,c);break}case"RSA1_5":case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{c=n||gt(e),s=await Tf(t,r,c);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{c=n||gt(e);let{p2c:u,p2s:l}=i;({encryptedKey:s,...a}=await Ef(t,r,c,u,l));break}case"A128KW":case"A192KW":case"A256KW":{c=n||gt(e),s=await ri(t,r,c);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{c=n||gt(e);let{iv:u}=i;({encryptedKey:s,...a}=await Hf(t,r,c,u));break}default:throw new U('Invalid or unsupported "alg" (JWE Algorithm) header value')}return{cek:c,encryptedKey:s,parameters:a}}var Xo,ol=I(()=>{Bo();Ju();Wu();Qu();Ie();oi();V();il();ai();tl();o(kT,"encryptKeyManagement");Xo=kT});var sl,Lt,es=I(()=>{Ie();el();Bu();$o();ol();V();zr();ye();Yr();sl=Symbol(),Lt=class{static{o(this,"FlattenedEncrypt")}constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this._plaintext=e}setKeyManagementParameters(e){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._sharedUnprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._sharedUnprotectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}setContentEncryptionKey(e){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=e,this}async encrypt(e,r){if(!this._protectedHeader&&!this._unprotectedHeader&&!this._sharedUnprotectedHeader)throw new P("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!yt(this._protectedHeader,this._unprotectedHeader,this._sharedUnprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this._protectedHeader,...this._unprotectedHeader,...this._sharedUnprotectedHeader};if(_t(P,new Map,r?.crit,this._protectedHeader,n),n.zip!==void 0){if(!this._protectedHeader||!this._protectedHeader.zip)throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');if(n.zip!=="DEF")throw new U('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value')}let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let a;if(i==="dir"){if(this._cek)throw new TypeError("setContentEncryptionKey cannot be called when using Direct Encryption")}else if(i==="ECDH-ES"&&this._cek)throw new TypeError("setContentEncryptionKey cannot be called when using Direct Key Agreement");let c;{let m;({cek:c,encryptedKey:a,parameters:m}=await Xo(i,s,e,this._cek,this._keyManagementParameters)),m&&(r&&sl in r?this._unprotectedHeader?this._unprotectedHeader={...this._unprotectedHeader,...m}:this.setUnprotectedHeader(m):this._protectedHeader?this._protectedHeader={...this._protectedHeader,...m}:this.setProtectedHeader(m))}this._iv||(this._iv=qo(s));let u,l,d;this._protectedHeader?l=Y.encode(Z(JSON.stringify(this._protectedHeader))):l=Y.encode(""),this._aad?(d=Z(this._aad),u=Se(l,Y.encode("."),Y.encode(d))):u=l;let p,y;if(n.zip==="DEF"){let m=await(r?.deflateRaw||hf)(this._plaintext);({ciphertext:p,tag:y}=await ci(s,m,c,this._iv,u))}else({ciphertext:p,tag:y}=await ci(s,this._plaintext,c,this._iv,u));let h={ciphertext:Z(p),iv:Z(this._iv),tag:Z(y)};return a&&(h.encrypted_key=Z(a)),d&&(h.aad=d),this._protectedHeader&&(h.protected=ce.decode(l)),this._sharedUnprotectedHeader&&(h.unprotected=this._sharedUnprotectedHeader),this._unprotectedHeader&&(h.header=this._unprotectedHeader),h}}});var al,ts,Wf=I(()=>{es();V();oi();zr();ol();Ie();Yr();al=class{static{o(this,"IndividualRecipient")}constructor(e,r,n){this.parent=e,this.key=r,this.options=n}setUnprotectedHeader(e){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addRecipient(...e){return this.parent.addRecipient(...e)}encrypt(...e){return this.parent.encrypt(...e)}done(){return this.parent}},ts=class{static{o(this,"GeneralEncrypt")}constructor(e){this._recipients=[],this._plaintext=e}addRecipient(e,r){let n=new al(this,e,{crit:r?.crit});return this._recipients.push(n),n}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setSharedUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setSharedUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}setAdditionalAuthenticatedData(e){return this._aad=e,this}async encrypt(e){var r,n,i;if(!this._recipients.length)throw new P("at least one recipient must be added");if(e={deflateRaw:e?.deflateRaw},this._recipients.length===1){let[u]=this._recipients,l=await new Lt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(u.unprotectedHeader).encrypt(u.key,{...u.options,...e}),d={ciphertext:l.ciphertext,iv:l.iv,recipients:[{}],tag:l.tag};return l.aad&&(d.aad=l.aad),l.protected&&(d.protected=l.protected),l.unprotected&&(d.unprotected=l.unprotected),l.encrypted_key&&(d.recipients[0].encrypted_key=l.encrypted_key),l.header&&(d.recipients[0].header=l.header),d}let s;for(let u=0;u<this._recipients.length;u++){let l=this._recipients[u];if(!yt(this._protectedHeader,this._unprotectedHeader,l.unprotectedHeader))throw new P("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let d={...this._protectedHeader,...this._unprotectedHeader,...l.unprotectedHeader},{alg:p}=d;if(typeof p!="string"||!p)throw new P('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(p==="dir"||p==="ECDH-ES")throw new P('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof d.enc!="string"||!d.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!s)s=d.enc;else if(s!==d.enc)throw new P('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(_t(P,new Map,l.options.crit,this._protectedHeader,d),d.zip!==void 0&&(!this._protectedHeader||!this._protectedHeader.zip))throw new P('JWE "zip" (Compression Algorithm) Header MUST be integrity protected')}let a=gt(s),c={ciphertext:"",iv:"",recipients:[],tag:""};for(let u=0;u<this._recipients.length;u++){let l=this._recipients[u],d={};c.recipients.push(d);let y={...this._protectedHeader,...this._unprotectedHeader,...l.unprotectedHeader}.alg.startsWith("PBES2")?2048+u:void 0;if(u===0){let v=await new Lt(this._plaintext).setAdditionalAuthenticatedData(this._aad).setContentEncryptionKey(a).setProtectedHeader(this._protectedHeader).setSharedUnprotectedHeader(this._unprotectedHeader).setUnprotectedHeader(l.unprotectedHeader).setKeyManagementParameters({p2c:y}).encrypt(l.key,{...l.options,...e,[sl]:!0});c.ciphertext=v.ciphertext,c.iv=v.iv,c.tag=v.tag,v.aad&&(c.aad=v.aad),v.protected&&(c.protected=v.protected),v.unprotected&&(c.unprotected=v.unprotected),d.encrypted_key=v.encrypted_key,v.header&&(d.header=v.header);continue}let{encryptedKey:h,parameters:m}=await Xo(((r=l.unprotectedHeader)===null||r===void 0?void 0:r.alg)||((n=this._protectedHeader)===null||n===void 0?void 0:n.alg)||((i=this._unprotectedHeader)===null||i===void 0?void 0:i.alg),s,l.key,a,{p2c:y});d.encrypted_key=Z(h),(l.unprotectedHeader||m)&&(d.header={...l.unprotectedHeader,...m})}return c}}});function li(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:t.slice(-3)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"EdDSA":return{name:e.name};default:throw new U(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}var cl=I(()=>{V();o(li,"subtleDsa")});function di(t,e,r){if(se(e))return lf(e,t,r),e;if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(ie(e,...W));return L.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}throw new TypeError(ie(e,...W,"Uint8Array"))}var ul=I(()=>{Te();Zt();ot();st();o(di,"getCryptoKey")});var FT,Qf,Yf=I(()=>{cl();Te();zo();ul();FT=o(async(t,e,r,n)=>{let i=await di(t,e,"verify");Or(t,i);let s=li(t,i.algorithm);try{return await L.subtle.verify(s,i,r,n)}catch{return!1}},"verify"),Qf=FT});async function Xr(t,e,r){var n;if(!Q(t))throw new z("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new z('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new z("JWS Protected Header incorrect type");if(t.payload===void 0)throw new z("JWS Payload missing");if(typeof t.signature!="string")throw new z("JWS Signature missing or incorrect type");if(t.header!==void 0&&!Q(t.header))throw new z("JWS Unprotected Header incorrect type");let i={};if(t.protected)try{let T=te(t.protected);i=JSON.parse(ce.decode(T))}catch{throw new z("JWS Protected Header is invalid")}if(!yt(i,t.header))throw new z("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let s={...i,...t.header},a=_t(z,new Map([["b64",!0]]),r?.crit,i,s),c=!0;if(a.has("b64")&&(c=i.b64,typeof c!="boolean"))throw new z('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:u}=s;if(typeof u!="string"||!u)throw new z('JWS "alg" (Algorithm) Header Parameter missing or invalid');let l=r&&ui("algorithms",r.algorithms);if(l&&!l.has(u))throw new zt('"alg" (Algorithm) Header Parameter not allowed');if(c){if(typeof t.payload!="string")throw new z("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new z("JWS Payload must be a string or an Uint8Array instance");let d=!1;typeof e=="function"&&(e=await e(i,t),d=!0),tr(u,e,"verify");let p=Se(Y.encode((n=t.protected)!==null&&n!==void 0?n:""),Y.encode("."),typeof t.payload=="string"?Y.encode(t.payload):t.payload),y=te(t.signature);if(!await Qf(u,e,y,p))throw new Rr;let m;c?m=te(t.payload):typeof t.payload=="string"?m=Y.encode(t.payload):m=t.payload;let v={payload:m};return t.protected!==void 0&&(v.protectedHeader=i),t.header!==void 0&&(v.unprotectedHeader=t.header),d?{...v,key:e}:v}var rs=I(()=>{Ie();Yf();V();ye();zr();qe();ai();Yr();rl();o(Xr,"flattenedVerify")});async function ns(t,e,r){if(t instanceof Uint8Array&&(t=ce.decode(t)),typeof t!="string")throw new z("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:a}=t.split(".");if(a!==3)throw new z("Invalid Compact JWS");let c=await Xr({payload:i,protected:n,signature:s},e,r),u={payload:c.payload,protectedHeader:c.protectedHeader};return typeof e=="function"?{...u,key:c.key}:u}var ll=I(()=>{rs();V();ye();o(ns,"compactVerify")});async function Zf(t,e,r){if(!Q(t))throw new z("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(Q))throw new z("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await Xr({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new Rr}var Xf=I(()=>{rs();V();qe();o(Zf,"generalVerify")});var en,dl=I(()=>{en=o(t=>Math.floor(t.getTime()/1e3),"default")});var HT,tn,pl=I(()=>{HT=/^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i,tn=o(t=>{let e=HT.exec(t);if(!e)throw new TypeError("Invalid time period format");let r=parseFloat(e[1]);switch(e[2].toLowerCase()){case"sec":case"secs":case"second":case"seconds":case"s":return Math.round(r);case"minute":case"minutes":case"min":case"mins":case"m":return Math.round(r*60);case"hour":case"hours":case"hr":case"hrs":case"h":return Math.round(r*3600);case"day":case"days":case"d":return Math.round(r*86400);case"week":case"weeks":case"w":return Math.round(r*604800);default:return Math.round(r*31557600)}},"default")});var em,qT,rn,is=I(()=>{V();ye();dl();pl();qe();em=o(t=>t.toLowerCase().replace(/^application\//,""),"normalizeTyp"),qT=o((t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1,"checkAudiencePresence"),rn=o((t,e,r={})=>{let{typ:n}=r;if(n&&(typeof t.typ!="string"||em(t.typ)!==em(n)))throw new ge('unexpected "typ" JWT header value',"typ","check_failed");let i;try{i=JSON.parse(ce.decode(e))}catch{}if(!Q(i))throw new ue("JWT Claims Set must be a top-level JSON object");let{requiredClaims:s=[],issuer:a,subject:c,audience:u,maxTokenAge:l}=r;l!==void 0&&s.push("iat"),u!==void 0&&s.push("aud"),c!==void 0&&s.push("sub"),a!==void 0&&s.push("iss");for(let h of new Set(s.reverse()))if(!(h in i))throw new ge(`missing required "${h}" claim`,h,"missing");if(a&&!(Array.isArray(a)?a:[a]).includes(i.iss))throw new ge('unexpected "iss" claim value',"iss","check_failed");if(c&&i.sub!==c)throw new ge('unexpected "sub" claim value',"sub","check_failed");if(u&&!qT(i.aud,typeof u=="string"?[u]:u))throw new ge('unexpected "aud" claim value',"aud","check_failed");let d;switch(typeof r.clockTolerance){case"string":d=tn(r.clockTolerance);break;case"number":d=r.clockTolerance;break;case"undefined":d=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:p}=r,y=en(p||new Date);if((i.iat!==void 0||l)&&typeof i.iat!="number")throw new ge('"iat" claim must be a number',"iat","invalid");if(i.nbf!==void 0){if(typeof i.nbf!="number")throw new ge('"nbf" claim must be a number',"nbf","invalid");if(i.nbf>y+d)throw new ge('"nbf" claim timestamp check failed',"nbf","check_failed")}if(i.exp!==void 0){if(typeof i.exp!="number")throw new ge('"exp" claim must be a number',"exp","invalid");if(i.exp<=y-d)throw new Kr('"exp" claim timestamp check failed',"exp","check_failed")}if(l){let h=y-i.iat,m=typeof l=="number"?l:tn(l);if(h-d>m)throw new Kr('"iat" claim timestamp check failed (too far in the past)',"iat","check_failed");if(h<0-d)throw new ge('"iat" claim timestamp check failed (it should be in the past)',"iat","check_failed")}return i},"default")});async function tm(t,e,r){var n;let i=await ns(t,e,r);if(!((n=i.protectedHeader.crit)===null||n===void 0)&&n.includes("b64")&&i.protectedHeader.b64===!1)throw new ue("JWTs MUST NOT use unencoded payload");let a={payload:rn(i.protectedHeader,i.payload,r),protectedHeader:i.protectedHeader};return typeof e=="function"?{...a,key:i.key}:a}var rm=I(()=>{ll();is();V();o(tm,"jwtVerify")});async function nm(t,e,r){let n=await Yo(t,e,r),i=rn(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ge('replicated "iss" claim header parameter mismatch',"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ge('replicated "sub" claim header parameter mismatch',"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ge('replicated "aud" claim header parameter mismatch',"aud","mismatch");let a={payload:i,protectedHeader:s};return typeof e=="function"?{...a,key:n.key}:a}var im=I(()=>{nl();is();V();o(nm,"jwtDecrypt")});var nn,hl=I(()=>{es();nn=class{static{o(this,"CompactEncrypt")}constructor(e){this._flattened=new Lt(e)}setContentEncryptionKey(e){return this._flattened.setContentEncryptionKey(e),this}setInitializationVector(e){return this._flattened.setInitializationVector(e),this}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}setKeyManagementParameters(e){return this._flattened.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this._flattened.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var $T,om,sm=I(()=>{cl();Te();zo();ul();$T=o(async(t,e,r)=>{let n=await di(t,e,"sign");Or(t,n);let i=await L.subtle.sign(li(t,n.algorithm),n,r);return new Uint8Array(i)},"sign"),om=$T});var rr,os=I(()=>{Ie();sm();zr();V();ye();ai();Yr();rr=class{static{o(this,"FlattenedSign")}constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this._payload=e}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setUnprotectedHeader(e){if(this._unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this._unprotectedHeader=e,this}async sign(e,r){if(!this._protectedHeader&&!this._unprotectedHeader)throw new z("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!yt(this._protectedHeader,this._unprotectedHeader))throw new z("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this._protectedHeader,...this._unprotectedHeader},i=_t(z,new Map([["b64",!0]]),r?.crit,this._protectedHeader,n),s=!0;if(i.has("b64")&&(s=this._protectedHeader.b64,typeof s!="boolean"))throw new z('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=n;if(typeof a!="string"||!a)throw new z('JWS "alg" (Algorithm) Header Parameter missing or invalid');tr(a,e,"sign");let c=this._payload;s&&(c=Y.encode(Z(c)));let u;this._protectedHeader?u=Y.encode(Z(JSON.stringify(this._protectedHeader))):u=Y.encode("");let l=Se(u,Y.encode("."),c),d=await om(a,e,l),p={signature:Z(d),payload:""};return s&&(p.payload=ce.decode(c)),this._unprotectedHeader&&(p.header=this._unprotectedHeader),this._protectedHeader&&(p.protected=ce.decode(u)),p}}});var on,fl=I(()=>{os();on=class{static{o(this,"CompactSign")}constructor(e){this._flattened=new rr(e)}setProtectedHeader(e){return this._flattened.setProtectedHeader(e),this}async sign(e,r){let n=await this._flattened.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var ml,ss,am=I(()=>{os();V();ml=class{static{o(this,"IndividualSignature")}constructor(e,r,n){this.parent=e,this.key=r,this.options=n}setProtectedHeader(e){if(this.protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this.protectedHeader=e,this}setUnprotectedHeader(e){if(this.unprotectedHeader)throw new TypeError("setUnprotectedHeader can only be called once");return this.unprotectedHeader=e,this}addSignature(...e){return this.parent.addSignature(...e)}sign(...e){return this.parent.sign(...e)}done(){return this.parent}},ss=class{static{o(this,"GeneralSign")}constructor(e){this._signatures=[],this._payload=e}addSignature(e,r){let n=new ml(this,e,r);return this._signatures.push(n),n}async sign(){if(!this._signatures.length)throw new z("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this._signatures.length;r++){let n=this._signatures[r],i=new rr(this._payload);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...a}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new z("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(a)}return e}}});var nr,as=I(()=>{dl();qe();pl();nr=class{static{o(this,"ProduceJWT")}constructor(e){if(!Q(e))throw new TypeError("JWT Claims Set MUST be an object");this._payload=e}setIssuer(e){return this._payload={...this._payload,iss:e},this}setSubject(e){return this._payload={...this._payload,sub:e},this}setAudience(e){return this._payload={...this._payload,aud:e},this}setJti(e){return this._payload={...this._payload,jti:e},this}setNotBefore(e){return typeof e=="number"?this._payload={...this._payload,nbf:e}:this._payload={...this._payload,nbf:en(new Date)+tn(e)},this}setExpirationTime(e){return typeof e=="number"?this._payload={...this._payload,exp:e}:this._payload={...this._payload,exp:en(new Date)+tn(e)},this}setIssuedAt(e){return typeof e>"u"?this._payload={...this._payload,iat:en(new Date)}:this._payload={...this._payload,iat:e},this}}});var cs,cm=I(()=>{fl();V();ye();as();cs=class extends nr{static{o(this,"SignJWT")}setProtectedHeader(e){return this._protectedHeader=e,this}async sign(e,r){var n;let i=new on(Y.encode(JSON.stringify(this._payload)));if(i.setProtectedHeader(this._protectedHeader),Array.isArray((n=this._protectedHeader)===null||n===void 0?void 0:n.crit)&&this._protectedHeader.crit.includes("b64")&&this._protectedHeader.b64===!1)throw new ue("JWTs MUST NOT use unencoded payload");return i.sign(e,r)}}});var us,um=I(()=>{hl();ye();as();us=class extends nr{static{o(this,"EncryptJWT")}setProtectedHeader(e){if(this._protectedHeader)throw new TypeError("setProtectedHeader can only be called once");return this._protectedHeader=e,this}setKeyManagementParameters(e){if(this._keyManagementParameters)throw new TypeError("setKeyManagementParameters can only be called once");return this._keyManagementParameters=e,this}setContentEncryptionKey(e){if(this._cek)throw new TypeError("setContentEncryptionKey can only be called once");return this._cek=e,this}setInitializationVector(e){if(this._iv)throw new TypeError("setInitializationVector can only be called once");return this._iv=e,this}replicateIssuerAsHeader(){return this._replicateIssuerAsHeader=!0,this}replicateSubjectAsHeader(){return this._replicateSubjectAsHeader=!0,this}replicateAudienceAsHeader(){return this._replicateAudienceAsHeader=!0,this}async encrypt(e,r){let n=new nn(Y.encode(JSON.stringify(this._payload)));return this._replicateIssuerAsHeader&&(this._protectedHeader={...this._protectedHeader,iss:this._payload.iss}),this._replicateSubjectAsHeader&&(this._protectedHeader={...this._protectedHeader,sub:this._payload.sub}),this._replicateAudienceAsHeader&&(this._protectedHeader={...this._protectedHeader,aud:this._payload.aud}),n.setProtectedHeader(this._protectedHeader),this._iv&&n.setInitializationVector(this._iv),this._cek&&n.setContentEncryptionKey(this._cek),this._keyManagementParameters&&n.setKeyManagementParameters(this._keyManagementParameters),n.encrypt(e,r)}}});async function yl(t,e){if(!Q(t))throw new TypeError("JWK must be an object");if(e??(e="sha256"),e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let r;switch(t.kty){case"EC":ir(t.crv,'"crv" (Curve) Parameter'),ir(t.x,'"x" (X Coordinate) Parameter'),ir(t.y,'"y" (Y Coordinate) Parameter'),r={crv:t.crv,kty:t.kty,x:t.x,y:t.y};break;case"OKP":ir(t.crv,'"crv" (Subtype of Key Pair) Parameter'),ir(t.x,'"x" (Public Key) Parameter'),r={crv:t.crv,kty:t.kty,x:t.x};break;case"RSA":ir(t.e,'"e" (Exponent) Parameter'),ir(t.n,'"n" (Modulus) Parameter'),r={e:t.e,kty:t.kty,n:t.n};break;case"oct":ir(t.k,'"k" (Key Value) Parameter'),r={k:t.k,kty:t.kty};break;default:throw new U('"kty" (Key Type) Parameter missing or unsupported')}let n=Y.encode(JSON.stringify(r));return Z(await Do(e,n))}async function lm(t,e){e??(e="sha256");let r=await yl(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var ir,dm=I(()=>{Uu();Ie();V();ye();qe();ir=o((t,e)=>{if(typeof t!="string"||!t)throw new Zn(`${e} missing or invalid`)},"check");o(yl,"calculateJwkThumbprint");o(lm,"calculateJwkThumbprintUri")});async function pm(t,e){let r={...t,...e?.header};if(!Q(r.jwk))throw new z('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await er({...r.jwk,ext:!0},r.alg,!0);if(n instanceof Uint8Array||n.type!=="public")throw new z('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var hm=I(()=>{si();qe();V();o(pm,"EmbeddedJWK")});function jT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new U('Unsupported "alg" value for a JSON Web Key Set')}}function gl(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(VT)}function VT(t){return Q(t)}function GT(t){return typeof structuredClone=="function"?structuredClone(t):JSON.parse(JSON.stringify(t))}async function fm(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await er({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Wt("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function mm(t){let e=new pi(t);return async function(r,n){return e.getKey(r,n)}}var pi,_l=I(()=>{si();V();qe();o(jT,"getKtyFromAlg");o(gl,"isJWKSLike");o(VT,"isJWKLike");o(GT,"clone");pi=class{static{o(this,"LocalJWKSet")}constructor(e){if(this._cached=new WeakMap,!gl(e))throw new Wt("JSON Web Key Set malformed");this._jwks=GT(e)}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=jT(n),a=this._jwks.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&typeof l.alg=="string"&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d&&n==="EdDSA"&&(d=l.crv==="Ed25519"||l.crv==="Ed448"),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES256K":d=l.crv==="secp256k1";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break}return d}),{0:c,length:u}=a;if(u===0)throw new Pr;if(u!==1){let l=new Xn,{_cached:d}=this;throw l[Symbol.asyncIterator]=async function*(){for(let p of a)try{yield await fm(d,p,n)}catch{continue}},l}return fm(this._cached,c,n)}};o(fm,"importWithAlgCache");o(mm,"createLocalJWKSet")});var BT,ym,gm=I(()=>{V();BT=o(async(t,e,r)=>{let n,i,s=!1;typeof AbortController=="function"&&(n=new AbortController,i=setTimeout(()=>{s=!0,n.abort()},e));let a=await fetch(t.href,{signal:n?n.signal:void 0,redirect:"manual",headers:r.headers}).catch(c=>{throw s?new ei:c});if(i!==void 0&&clearTimeout(i),a.status!==200)throw new pe("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await a.json()}catch{throw new pe("Failed to parse the JSON Web Key Set HTTP response as JSON")}},"fetchJwks"),ym=BT});function KT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}function _m(t,e){let r=new bl(t,e);return async function(n,i){return r.getKey(n,i)}}var bl,bm=I(()=>{gm();V();_l();o(KT,"isCloudflareWorkers");bl=class extends pi{static{o(this,"RemoteJWKSet")}constructor(e,r){if(super({keys:[]}),this._jwks=void 0,!(e instanceof URL))throw new TypeError("url must be an instance of URL");this._url=new URL(e.href),this._options={agent:r?.agent,headers:r?.headers},this._timeoutDuration=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this._cooldownDuration=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this._cacheMaxAge=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5}coolingDown(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cooldownDuration:!1}fresh(){return typeof this._jwksTimestamp=="number"?Date.now()<this._jwksTimestamp+this._cacheMaxAge:!1}async getKey(e,r){(!this._jwks||!this.fresh())&&await this.reload();try{return await super.getKey(e,r)}catch(n){if(n instanceof Pr&&this.coolingDown()===!1)return await this.reload(),super.getKey(e,r);throw n}}async reload(){this._pendingFetch&&KT()&&(this._pendingFetch=void 0),this._pendingFetch||(this._pendingFetch=ym(this._url,this._timeoutDuration,this._options).then(e=>{if(!gl(e))throw new Wt("JSON Web Key Set malformed");this._jwks={keys:e.keys},this._jwksTimestamp=Date.now(),this._pendingFetch=void 0}).catch(e=>{throw this._pendingFetch=void 0,e})),await this._pendingFetch}};o(_m,"createRemoteJWKSet")});var ls,Em=I(()=>{Ie();ye();V();is();as();ls=class extends nr{static{o(this,"UnsecuredJWT")}encode(){let e=Z(JSON.stringify({alg:"none"})),r=Z(JSON.stringify(this._payload));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new ue("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:a}=e.split(".");if(a!==3||s!=="")throw new ue("Invalid Unsecured JWT");let c;try{if(c=JSON.parse(ce.decode(te(n))),c.alg!=="none")throw new Error}catch{throw new ue("Invalid Unsecured JWT")}return{payload:rn(c,te(i),r),header:c}}}});var El={};Vi(El,{decode:()=>hi,encode:()=>JT});var JT,hi,ds=I(()=>{Ie();JT=Z,hi=te});function wm(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ce.decode(hi(e)));if(!Q(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var vm=I(()=>{ds();ye();qe();o(wm,"decodeProtectedHeader")});function Tm(t){if(typeof t!="string")throw new ue("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new ue("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new ue("Invalid JWT");if(!e)throw new ue("JWTs must contain a payload");let n;try{n=hi(e)}catch{throw new ue("Failed to parse the base64url encoded payload")}let i;try{i=JSON.parse(ce.decode(n))}catch{throw new ue("Failed to parse the decoded payload as JSON")}if(!Q(i))throw new ue("Invalid JWT Claims Set");return i}var Sm=I(()=>{ds();ye();qe();V();o(Tm,"decodeJwt")});async function Im(t,e){var r;let n,i,s;switch(t){case"HS256":case"HS384":case"HS512":n=parseInt(t.slice(-3),10),i={name:"HMAC",hash:`SHA-${n}`,length:n},s=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return n=parseInt(t.slice(-3),10),Qt(new Uint8Array(n>>3));case"A128KW":case"A192KW":case"A256KW":n=parseInt(t.slice(1,4),10),i={name:"AES-KW",length:n},s=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=parseInt(t.slice(1,4),10),i={name:"AES-GCM",length:n},s=["encrypt","decrypt"];break;default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return L.subtle.generateKey(i,(r=e?.extractable)!==null&&r!==void 0?r:!1,s)}function wl(t){var e;let r=(e=t?.modulusLength)!==null&&e!==void 0?e:2048;if(typeof r!="number"||r<2048)throw new U("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return r}async function Am(t,e){var r,n,i;let s,a;switch(t){case"PS256":case"PS384":case"PS512":s={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["sign","verify"];break;case"RS256":case"RS384":case"RS512":s={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":s={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:new Uint8Array([1,0,1]),modulusLength:wl(e)},a=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":s={name:"ECDSA",namedCurve:"P-256"},a=["sign","verify"];break;case"ES384":s={name:"ECDSA",namedCurve:"P-384"},a=["sign","verify"];break;case"ES512":s={name:"ECDSA",namedCurve:"P-521"},a=["sign","verify"];break;case"EdDSA":a=["sign","verify"];let c=(r=e?.crv)!==null&&r!==void 0?r:"Ed25519";switch(c){case"Ed25519":case"Ed448":s={name:c};break;default:throw new U("Invalid or unsupported crv option provided")}break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{a=["deriveKey","deriveBits"];let u=(n=e?.crv)!==null&&n!==void 0?n:"P-256";switch(u){case"P-256":case"P-384":case"P-521":{s={name:"ECDH",namedCurve:u};break}case"X25519":case"X448":s={name:u};break;default:throw new U("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448")}break}default:throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return L.subtle.generateKey(s,(i=e?.extractable)!==null&&i!==void 0?i:!1,a)}var vl=I(()=>{Te();V();ti();o(Im,"generateSecret");o(wl,"getModulusLengthOption");o(Am,"generateKeyPair")});async function Pm(t,e){return Am(t,e)}var Rm=I(()=>{vl();o(Pm,"generateKeyPair")});async function Om(t,e){return Im(t,e)}var xm=I(()=>{vl();o(Om,"generateSecret")});var ps={};Vi(ps,{CompactEncrypt:()=>nn,CompactSign:()=>on,EmbeddedJWK:()=>pm,EncryptJWT:()=>us,FlattenedEncrypt:()=>Lt,FlattenedSign:()=>rr,GeneralEncrypt:()=>ts,GeneralSign:()=>ss,SignJWT:()=>cs,UnsecuredJWT:()=>ls,base64url:()=>El,calculateJwkThumbprint:()=>yl,calculateJwkThumbprintUri:()=>lm,compactDecrypt:()=>Yo,compactVerify:()=>ns,createLocalJWKSet:()=>mm,createRemoteJWKSet:()=>_m,decodeJwt:()=>Tm,decodeProtectedHeader:()=>wm,errors:()=>Fu,exportJWK:()=>Zo,exportPKCS8:()=>zf,exportSPKI:()=>Jf,flattenedDecrypt:()=>Zr,flattenedVerify:()=>Xr,generalDecrypt:()=>Vf,generalVerify:()=>Zf,generateKeyPair:()=>Pm,generateSecret:()=>Om,importJWK:()=>er,importPKCS8:()=>Ff,importSPKI:()=>Mf,importX509:()=>kf,jwtDecrypt:()=>nm,jwtVerify:()=>tm});var hs=I(()=>{nl();Qo();Gf();Wf();ll();rs();Xf();rm();im();hl();es();fl();os();am();cm();um();dm();hm();_l();bm();Em();il();si();vm();Sm();V();Rm();xm();ds()});var ms=g(fs=>{"use strict";Object.defineProperty(fs,"__esModule",{value:!0});fs.fetchRetry=void 0;var zT=D();async function WT(t,e,r){for(let n=0;n<=t.retries;n++){let i=fetch(e,r);if(n===t.retries)return i;let s=await i;if(s.status<500&&s.status!==429)return s;t?.logger?.error("Request failed, retrying",{method:typeof e=="string"?"GET":e.method,url:typeof e=="string"?e:e.url,status:s.status}),await new Promise(a=>setTimeout(a,t.retryDelayMs*Math.pow(2,n)))}throw new zT.ConfigurationError("An unknown error occurred, ensure retries is not negative")}o(WT,"fetchRetry");fs.fetchRetry=WT});var sn=g(Ze=>{"use strict";Object.defineProperty(Ze,"__esModule",{value:!0});Ze.GcpServiceAccount=Ze.fetchToken=Ze.exchangeGgpJwtForIdToken=Ze.exchangeFirebaseJwtForIdToken=Ze.getTokenFromGcpServiceAccount=void 0;var Nm=(hs(),Gi(ps)),QT=D(),YT=ms();async function ZT({serviceAccount:t,audience:e,expirationTime:r="1h",payload:n={}}){let{clientEmail:i,privateKeyId:s,privateKey:a}=t;return await new Nm.SignJWT(n).setProtectedHeader({alg:"RS256",kid:s}).setIssuer(i).setSubject(i).setAudience(e).setIssuedAt().setExpirationTime(r).sign(a)}o(ZT,"getTokenFromGcpServiceAccount");Ze.getTokenFromGcpServiceAccount=ZT;async function XT(t,e,r){return Sl(t,{token:e,returnSecureToken:!0},r)}o(XT,"exchangeFirebaseJwtForIdToken");Ze.exchangeFirebaseJwtForIdToken=XT;async function eS(t,e,r){return Sl(t,{grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:e},r)}o(eS,"exchangeGgpJwtForIdToken");Ze.exchangeGgpJwtForIdToken=eS;async function Sl(t,e,r){let n=await(0,YT.fetchRetry)(r,t,{method:"POST",headers:{"Content-Type":"application/json"},redirect:"follow",body:JSON.stringify(e)});if(n.status!==200){let s;try{let a=await n.text(),c=JSON.parse(a);s={cause:c.error??c}}catch{}throw new QT.RuntimeError({message:"Could not get token from Google Identity",extensionMembers:s})}return await n.json()}o(Sl,"fetchToken");Ze.fetchToken=Sl;var Tl=class t{static{o(this,"GcpServiceAccount")}#e;#t;constructor({serviceAccount:e,privateKey:r}){this.#t=e,this.#e=r}static async init(e){let r=JSON.parse(e),n=await(0,Nm.importPKCS8)(r.private_key.trim(),"RS256");return new t({serviceAccount:r,privateKey:n})}get type(){return this.#t.type}get projectId(){return this.#t.project_id}get privateKeyId(){return this.#t.private_key_id}get privateKey(){return this.#e}get clientEmail(){return this.#t.client_email}get clientId(){return this.#t.client_id}get authUri(){return this.#t.auth_uri}get tokenUrl(){return this.#t.token_url}get authProviderX509CertUrl(){return this.#t.auth_provider_x509_cert_url}get clientX509CertUrl(){return this.#t.client_x509_cert_url}get universalDomain(){return this.#t.universe_domain}};Ze.GcpServiceAccount=Tl});var gs=g(Dt=>{"use strict";Object.defineProperty(Dt,"__esModule",{value:!0});Dt.GoogleLogTransport=Dt.ZuploToGCPMap=Dt.GoogleCloudLoggingPlugin=void 0;var tS=we(),Il=ee(),Al=sn(),rS=Nt(),Cm=mt(),Pl=class extends rS.LogPlugin{static{o(this,"GoogleCloudLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new ys(this.options)}};Dt.GoogleCloudLoggingPlugin=Pl;var nS="https://logging.googleapis.com/v2/entries:write?alt=json";Dt.ZuploToGCPMap={error:"ERROR",warn:"WARNING",info:"INFO",debug:"DEBUG"};var ys=class{static{o(this,"GoogleLogTransport")}constructor(e){this.#r=e.logName,this.#e=e.serviceAccountJson,this.#i=Il.Environment.instance.loggingEnvironmentType,this.#o=Il.Environment.instance.loggingEnvironmentStage,this.#n=Il.Environment.instance.deploymentName}#e;#t;#r;#n;#i;#o;async log(e,r){if(e.messages.length===0)return;let n={allMessages:(0,Cm.makeErrorsSerializable)(e.messages)};this.#t||(this.#t=await Al.GcpServiceAccount.init(this.#e));let i=this.#t.projectId??"zuplo-production",s={logName:this.#r,resource:{type:"global"},severity:Dt.ZuploToGCPMap[e.level],timestamp:e.timestamp,trace:`projects/${i}/traces/${e.requestId}`,labels:{requestId:e.requestId,buildId:e.buildId,source:e.logSource,loggingId:e.loggingId,logOwner:e.logOwner,environment:this.#n,environmentType:this.#i,environmentStage:this.#o}};e.rayId&&(s.labels.rayId=e.rayId);let a=(0,Cm.extractBestMessage)(n.allMessages);s.jsonPayload={...n,message:a},this.batcher.enqueue(s),r.waitUntil(this.batcher.waitUntilFlushed())}dispatchFunction=async e=>{if(e.length===0)return;this.#t||(this.#t=await Al.GcpServiceAccount.init(this.#e));let r=await(0,Al.getTokenFromGcpServiceAccount)({serviceAccount:this.#t,audience:"https://logging.googleapis.com/google.logging.v2.LoggingServiceV2"}),n=await fetch(nS,{method:"POST",body:JSON.stringify({entries:e}),headers:{Authorization:`Bearer ${r}`,"content-type":"application/json;charset=UTF-8"}});n.ok||console.error(n.status,n.statusText,await n.text())};batcher=new tS.BatchDispatch("google-log-transport",1,this.dispatchFunction)};Dt.GoogleLogTransport=ys});var Rl=g(an=>{"use strict";Object.defineProperty(an,"__esModule",{value:!0});an.gcpLogFormat=an.GCP_LOG_FORMAT=void 0;var Lm=mt(),iS=gs();an.GCP_LOG_FORMAT="gcp";function oS(t){let e={allMessages:(0,Lm.makeErrorsSerializable)(t.messages)},r="zuplo-production",n=(0,Lm.extractBestMessage)(e.allMessages),i={logName:`projects/${r}/logs/runtime-user`,message:n,severity:iS.ZuploToGCPMap[t.level],timestamp:t.timestamp,"logging.googleapis.com/labels":{buildId:t.buildId,source:t.logSource,loggingId:t.loggingId,logOwner:t.logOwner},"logging.googleapis.com/trace":`projects/${r}/traces/${t.requestId}`,allMessages:e.allMessages};return t.rayId&&(i["logging.googleapis.com/labels"].rayId=t.rayId),i}o(oS,"gcpLogFormat");an.gcpLogFormat=oS});var Um=g(_s=>{"use strict";Object.defineProperty(_s,"__esModule",{value:!0});_s.ConsoleTransport=void 0;var Dm=Rl(),Ol=class{static{o(this,"ConsoleTransport")}constructor(e,r){this.#e=e??console,this.#t=r}#e;#t;async log(e){if(this.#t===Dm.GCP_LOG_FORMAT){if(e.messages.length===0)return;this.#e[e.level].apply(null,[(0,Dm.gcpLogFormat)(e)])}else this.#e[e.level].apply(null,[...e.messages,{logOwner:e.logOwner,logSource:e.logSource,level:e.level,timestamp:e.timestamp,loggingId:e.loggingId,rayId:e.rayId,requestId:e.requestId,buildId:e.buildId}])}};_s.ConsoleTransport=Ol});var Ul=g(cn=>{"use strict";Object.defineProperty(cn,"__esModule",{value:!0});cn.DataDogTransport=cn.DataDogLoggingPlugin=void 0;var sS=we(),xl=ee(),aS=Nt(),Mm=mt(),Dl=class extends aS.LogPlugin{static{o(this,"DataDogLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new bs(this.options)}};cn.DataDogLoggingPlugin=Dl;var Nl="__ddtags",Cl="__ddattr",Ll=o(t=>t.replaceAll(",","_").replaceAll(":","_"),"cleanTagText"),cS=o(t=>{let e=Object.keys(t),r=[];return e.forEach(n=>{let i=t[n];i==null?r.push(Ll(n)):r.push(`${Ll(n)}:${Ll(i.toString())}`)}),r.join(",")},"formatTags"),bs=class{static{o(this,"DataDogTransport")}constructor(e){this.#e=e.apiKey,this.#t=e.url??"https://http-intake.logs.datadoghq.com/api/v2/logs",this.#n=xl.Environment.instance.loggingEnvironmentType,this.#i=xl.Environment.instance.loggingEnvironmentStage,this.#r=xl.Environment.instance.deploymentName}#e;#t;#r;#n;#i;async log(e,r){let n={},i=r.custom[Nl];i&&typeof i=="object"&&Object.assign(n,i);let s=[...e.messages],a=e.messages.findIndex(h=>h[Nl]!==void 0);a>-1&&(Object.assign(n,s[a][Nl]),s.splice(a,1));let c={},u=r.custom[Cl];u&&typeof u=="object"&&Object.assign(c,u);let l=e.messages.findIndex(h=>h[Cl]!==void 0);l>-1&&(Object.assign(c,s[l][Cl]),s.splice(l,1));let d=(0,Mm.makeErrorsSerializable)(s),y={message:{...{...e,activityId:e.requestId,trace:e.requestId},messages:d},ddsource:"Zuplo",hostname:new URL(r.originalRequest.url).hostname,msg:(0,Mm.extractBestMessage)(d),service:e.loggingId,ddtags:cS(n),environment:this.#r,environment_type:this.#n,environment_stage:this.#i};Object.assign(y,c),this.batcher.enqueue(y),r.waitUntil(this.batcher.waitUntilFlushed())}dispatchFunction=async e=>{e.length!==0&&await fetch(this.#t,{method:"POST",body:JSON.stringify([...e]),headers:{"content-type":"application/json","DD-API-KEY":this.#e}})};batcher=new sS.BatchDispatch("data-dog-transport",10,this.dispatchFunction)};cn.DataDogTransport=bs});var Fm=g(Es=>{"use strict";Object.defineProperty(Es,"__esModule",{value:!0});Es.ProcessTransport=void 0;var km=Rl(),Ml=class{static{o(this,"ProcessTransport")}constructor(e,r){this.#e=e,this.#t=r}#e;#t;async log(e){if(this.#t===km.GCP_LOG_FORMAT){if(e.messages.length===0)return;this.#e[e.level].apply(null,[(0,km.gcpLogFormat)(e)])}else this.#e[e.level].apply(null,[...e.messages,{logOwner:e.logOwner,logSource:e.logSource,timestamp:e.timestamp,loggingId:e.loggingId,rayId:e.rayId,requestId:e.requestId,buildId:e.buildId,vectorClock:e.vectorClock}])}};Es.ProcessTransport=Ml});var qm=g(vs=>{"use strict";Object.defineProperty(vs,"__esModule",{value:!0});vs.RemoteLogTransport=void 0;var uS=we(),Hm=ee(),lS=mt(),dS=o(({url:t,remoteLogToken:e,loggingId:r,sendOnlyErrors:n})=>async i=>{let s;n===!0?s=i.filter(a=>a.level==="error"):s=i,s.length!==0&&fetch(`${t}/publish/${r}`,{method:"POST",body:JSON.stringify({timestamp:Date.now(),type:"log",message:s.map(a=>({...a,messages:(0,lS.makeErrorsSerializable)(a.messages)}))}),headers:{"content-type":"application/json",authentication:`Bearer ${e}`,"user-agent":Hm.Environment.instance.systemUserAgent,"zp-dn":Hm.Environment.instance.deploymentName??"unknown"}}).catch(a=>{console.error(a)})},"dispatchFunction"),ws,kl=class{static{o(this,"RemoteLogTransport")}constructor(e){ws||(ws=new uS.BatchDispatch("remote-log-transport",1,dS(e)))}async log(e,r){ws.enqueue(e),r.waitUntil(ws.waitUntilFlushed())}};vs.RemoteLogTransport=kl});var $m=g(xr=>{"use strict";Object.defineProperty(xr,"__esModule",{value:!0});xr.unifiedFormatter=xr.SeverityNumberOpenTelemetryMap=void 0;xr.SeverityNumberOpenTelemetryMap={internal:1,trace:2,debug:5,info:9,warn:13,error:17,fatal:21};var pS=o((t,e)=>r=>{let n={};return n.deploymentName=t,n.labels={requestId:r.requestId,source:r.logSource,loggingId:r.loggingId,logOwner:r.logOwner},n.rayId=r.rayId??"",n.runtime={buildId:e.BUILD_ID,buildTimestamp:e.TIMESTAMP,gitSHA:e.GIT_SHA,version:e.ZUPLO_VERSION},n.atomicCounter=r.vectorClock,{timestamp:r.timestamp,observerdTimestamp:r.timestamp,traceId:r.requestId,severityText:r.level,severityNumber:xr.SeverityNumberOpenTelemetryMap[r.level],body:r.messages,attributes:n}},"unifiedFormatter");xr.unifiedFormatter=pS});var Vm=g(Ss=>{"use strict";Object.defineProperty(Ss,"__esModule",{value:!0});Ss.UnifiedLogTransport=void 0;var hS=we(),jm=ee(),fS=$m(),mS=o(({url:t,remoteLogToken:e,deploymentName:r,build:n})=>async i=>{if(i.length===0)return;let s=(0,fS.unifiedFormatter)(r,n);fetch(`${t}/v1/runtime-logs`,{method:"POST",body:JSON.stringify({entries:i.map(s)}),headers:{"content-type":"application/json",authentication:`Bearer ${e}`,"user-agent":jm.Environment.instance.systemUserAgent,"zp-dn":jm.Environment.instance.deploymentName??"unknown"}}).catch(a=>{console.error(a)})},"dispatchFunction"),Ts,Fl=class{static{o(this,"UnifiedLogTransport")}constructor(e){Ts||(Ts=new hS.BatchDispatch("unified-log-transport",1,mS(e)))}async log(e,r){Ts.enqueue(e),r.waitUntil(Ts.waitUntilFlushed())}};Ss.UnifiedLogTransport=Fl});var Qm=g(Is=>{"use strict";Object.defineProperty(Is,"__esModule",{value:!0});Is.LogInitializer=void 0;var yS=Er(),gS=Rt(),Gm=Tu(),Bm=ee(),Km=Vh(),_S=Nt(),bS=Gh(),Jm=Bh(),zm=Um(),ES=Ul(),wS=gs(),Wm=Fm(),vS=qm(),TS=Vm(),Hl=(0,yS.debug)("zuplo:logging"),ql=class{static{o(this,"LogInitializer")}serviceProvider;systemCoreLogger;userCoreLogger;constructor(e){this.serviceProvider=e,this.systemCoreLogger=this.setupSystemCoreLogger(Bm.Environment.instance),this.userCoreLogger=this.setupUserCoreLogger(Bm.Environment.instance)}setupSystemCoreLogger(e){let{build:r}=e;Hl("Gateway.setupSystemCoreLogger");let n=[],i=this.serviceProvider.getService(Gm.SYSTEM_LOGGER);return i?n.push(new Wm.ProcessTransport(i.logger,e.logFormat)):e.isDeno&&n.push(new zm.ConsoleTransport(console,e.logFormat)),e.isCloudflare&&e.deploymentName&&e.remoteLogToken&&n.push(new TS.UnifiedLogTransport({url:e.remoteLogURL,deploymentName:e.deploymentName,remoteLogToken:e.remoteLogToken,build:e.build})),new Km.CoreLogger(e.systemLogLevel,"system",e.loggingId,r.BUILD_ID,n)}setupUserCoreLogger(e){Hl("Gateway.setupUserCoreLogger");let r=[],{runtime:n,build:i}=e,s=this.serviceProvider.getService(Gm.SYSTEM_LOGGER);if(s&&s.captureUserLogs===!0?r.push(new Wm.ProcessTransport(s.logger,e.logFormat)):e.isDeno&&r.push(new zm.ConsoleTransport(console,e.logFormat)),e.remoteLogToken&&e.loggingId&&r.push(new vS.RemoteLogTransport({loggingId:e.loggingId,url:e.remoteLogURL,remoteLogToken:e.remoteLogToken,sendOnlyErrors:e.isCloudflare})),n.GCP_USER_LOG_NAME&&n.GCP_USER_LOG_SVC_ACCT_JSON&&r.push(new wS.GoogleLogTransport({serviceAccountJson:n.GCP_USER_LOG_SVC_ACCT_JSON,logName:n.GCP_USER_LOG_NAME})),n.ZUPLO_USER_LOGGER_DATA_DOG_API_KEY){let a=n.ZUPLO_USER_LOGGER_DATA_DOG_URL;r.push(new ES.DataDogTransport({apiKey:n.ZUPLO_USER_LOGGER_DATA_DOG_API_KEY,url:a}))}return gS.plugins.forEach(a=>{a instanceof _S.LogPlugin&&r.push(a.getTransport())}),new Km.CoreLogger(e.userLogLevel,"user",e.loggingId,i.BUILD_ID,r)}createRequestLoggers(e,r,n,i,s){Hl("Gateway.createRequestLoggers");let a=new bS.LoggingContext(n,i,s),c=new Jm.RequestLogger(e,r,this.systemCoreLogger,a);return{userRequestLogger:new Jm.RequestLogger(e,r,this.userCoreLogger,a),systemRequestLogger:c}}};Is.LogInitializer=ql});var jl=g(As=>{"use strict";Object.defineProperty(As,"__esModule",{value:!0});As.UserRouteConfiguration=void 0;var $l=class{static{o(this,"UserRouteConfiguration")}constructor(e){this.path=e.path,this.methods=e.methods,this.label=e.label,this.key=e.key,this.handler=e.handler,this.corsPolicy=e.corsPolicy,this.custom=e.custom,this.version=e.version,this.policies=e.policies,this.excludeFromOpenApi=e.excludeFromOpenApi,this.pathPattern=e.pathPattern,e.raw?(this.#e=e.raw(),this.operationId=this.raw()?.operationId,this.summary=this.raw()?.summary,this.tags=this.raw()?.tags,this.parameters=this.raw()?.parameters,this.responses=this.raw()?.responses):(this.operationId=e.operationId,this.summary=e.summary,this.tags=e.tags,this.parameters=e.parameters,this.responses=e.responses)}raw(){return this.#e}#e;label;key;path;summary;operationId;tags;parameters;responses;excludeFromOpenApi;pathPattern;custom;methods;handler;corsPolicy;version;policies};As.UserRouteConfiguration=$l});var Gl=g(bt=>{"use strict";Object.defineProperty(bt,"__esModule",{value:!0});bt.Router=bt.RouterError=bt.LookupResult=bt.RouterEntry=void 0;var Ym=D(),SS=ft(),IS=jl(),Ps=class{static{o(this,"RouterEntry")}constructor(e,r,n,i){this.fullPath=e,this.urlPattern=r,this.config=n,this.executableHandler=i}fullPath;urlPattern;config;executableHandler};bt.RouterEntry=Ps;var fi=class{static{o(this,"LookupResult")}constructor(e,r,n){this.routeConfiguration=e,this.params=n??{},this.executableHandler=r}executableHandler;routeConfiguration;params};bt.LookupResult=fi;var Rs=class extends Error{static{o(this,"RouterError")}constructor(e,r){super(e,r)}};bt.RouterError=Rs;var Vl=class{static{o(this,"Router")}constructor(e){this.routeEntries=[],this.versions=e}versions;routeEntries;addRoute(e,r){if(!(e instanceof IS.UserRouteConfiguration||e instanceof SS.SystemRouteConfiguration))throw new Ym.SystemError("Config must be a UserRouteConfiguration or SystemRouteConfiguration");let n=this.versions.find(s=>s.name===e.version)?.pathPrefix,i;"pathPattern"in e&&e.pathPattern?i=`${n??""}${e.pathPattern}`:i=`${n??""}${e.path}`;try{let s=new URLPattern({pathname:i}),a=new Ps(i,s,e,r);Object.freeze(a.config),this.routeEntries.push(a)}catch(s){throw new Rs(`addRoute-error: Invalid path '${i}'. '${s.message}'`,{cause:s})}}lookup(e,r){if(typeof e>"u")throw new Ym.ConfigurationError(`Invalid request - Method was undefined. Path: '${r}'`);let n=this.routeEntries.filter(i=>i.config.methods.includes(e));if(n.length!==0)for(let i=0;i<n.length;i++){let s=n[i],c=s.urlPattern.exec({pathname:r});if(c!==null)return new fi(s.config,s.executableHandler,c.pathname.groups)}}lookupByPathOnly(e){let r=[];for(let n=0;n<this.routeEntries.length;n++){let i=this.routeEntries[n],a=i.urlPattern.exec({pathname:e});if(a!==null){let c=new fi(i.config,i.executableHandler,a.pathname.groups);r.push(c)}}return r}};bt.Router=Vl});var un=g(xs=>{"use strict";Object.defineProperty(xs,"__esModule",{value:!0});xs.Gateway=void 0;var AS=Er(),Zm=wh(),Xm=Sh(),PS=Ih(),ey=Ah(),ty=xh(),Ut=Jn(),Os=wr(),ry=jh(),wt=D(),Bl=Rt(),RS=Qm(),OS=Gt(),xS=ve(),NS=Eu(),CS=Tr(),LS=Qn(),DS=Wn(),US=Gl(),Kl=ft(),ny=jl(),MS=Be(),iy=ee(),oy=Ar(),kS=["/__zuplo/ping","/__zuplo/open-api","/__zuplo/docs","/__zuplo/consumers","/__zuplo/external-users","/__zuplo/assets","/__zuplo/config","/__zuplo/build","/favicon.ico"],Et=(0,AS.debug)("zuplo:runtime"),FS=o(t=>{let e=t.findIndex(r=>r.name===Kl.systemNoVersion.name);return e>-1?[...t.splice(e),Kl.systemNoVersion]:[...t,Kl.systemNoVersion]},"setupSystemNoVersion"),Jl=class t{static{o(this,"Gateway")}routeData;runtimeSettings;schemaValidator;static#e;constructor(e,r,n,i){this.routeData=e,this.runtimeSettings=r,this.schemaValidator=i,Et("Gateway.constructor"),this.#r=this.setupRoutes(),this.#i=this.setupErrorHandler(),this.#t=new RS.LogInitializer(n)}static async initialize(e,r,n,i,s){if(Et("Gateway.initialize"),!t.#e){await(0,Bl.initializeRuntime)(s);let a=new t(e,r,n,i);t.#e=a}return t.#e}static purgeGatewayCache(){Et("Gateway.purgeGatewayCache"),t.#e=void 0}static get instance(){if(!t.#e)throw new wt.SystemError("Gateway cannot be used before it is initialized");return t.#e}instanceId=crypto.randomUUID();#t;#r;#n=[LS.policyProcessor,NS.corsProcessor,CS.metricsProcessor];#i;setupRoutes=()=>{Et("Gateway.setupRoutes");let e=this.routeData,r=FS(e.versions),n=new US.Router(r);if(e.routes.length===0)return(0,Zm.registerBuildRoute)(n,this),(0,ty.registerPingRoute)(n,this),(0,Xm.registerCorsRoute)(n,this),(0,PS.registerNoRoutes)(n,this),n;let{enabled:i}=this.runtimeSettings.developerPortal;return i&&((0,ry.registerDevPortalLegacyRedirectRoute)(n,this),(0,ry.registerDevPortalV3Route)(n,this)),(0,Zm.registerBuildRoute)(n,this),(0,ty.registerPingRoute)(n,this),(0,Xm.registerCorsRoute)(n,this),e.routes.forEach(s=>{let a;if(typeof s.handler?.module=="object"&&(a=s.handler?.module[s.handler.export]),typeof a!="function")throw new wt.ConfigurationError(`Invalid state - No handler on route for path '${s.path}'`);let c=a,u=new OS.Pipeline(this.#n,c,this),l=new ny.UserRouteConfiguration(s);n.addRoute(l,u.execute)}),(0,ey.registerNotMatchedHandler)(n,this),n};setupErrorHandler=()=>{let e;if(typeof this.routeData.requestErrorHandler?.module=="object"){if(e=this.routeData.requestErrorHandler.module[this.routeData.requestErrorHandler.export],typeof e!="function")throw new wt.ConfigurationError("Invalid state - Module and export set for 'errorHandler' is not a function")}else e=o((r,n,i)=>this.#o(r,n,i),"errorHandler");return e};errorHandler(e,r,n){try{return this.#i(e,r,n)}catch(i){return Et("An error occurred in the user's errorHandler",i),this.#o(e,r,i)}}#o(e,r,n){Et("Gateway.internalErrorResponse");let i={};if(iy.Environment.instance.isDeno){if(n instanceof wt.RuntimeError&&n.extensionMembers)i=n.extensionMembers;else if(n.cause){let s=(0,oy.serializeError)(n.cause);"stack"in s&&(s.stack=(0,oy.cleanStack)(s.stack)),i={cause:s}}}return xS.HttpProblems.internalServerError(e,r,{detail:n.message,...i})}#s(e){let r=new Headers(e.headers);return Ut.DISPATCH_HEADERS_TO_REMOVE.forEach(n=>{r.delete(n)}),iy.Environment.instance.isDeno&&Ut.INTERNAL_HEADERS_TO_REMOVE.forEach(n=>{r.delete(n)}),new Request(e,{headers:r})}async handleRequest(e,r){let n=e.headers.get(Ut.REQUEST_ID_HEADER)??e.headers.get(Ut.LEGACY_REQUEST_ID_HEADER),i=e.headers.get(Ut.RAY_ID_HEADER);if(!n){n=crypto.randomUUID();let T=new Headers(e.headers);T.set(Ut.REQUEST_ID_HEADER,n),e=new Request(e,{headers:T})}if(["GET","HEAD"].includes(e.method)&&e.body){let T=new Headers(e.headers);T.set(Ut.BODY_REMOVED_HEADER,"true"),e=new Request(e,{headers:T,body:null})}let s={},{userRequestLogger:a,systemRequestLogger:c}=this.#t.createRequestLoggers(n,i,r,s,e),u=new URL(e.url),l=u.pathname,d=this.#r.lookup(e.method,l);if(!d)throw new wt.SystemError(`Invalid state - no route match - should have been picked up by the not found handler, path: '${l}'`);let p=new Os.HeaderIncomingRequestProperties(e.headers),y=this.#s(e),h=new DS.ZuploRequest(y,{params:d.params}),m=new Os.SystemZuploContext({logger:a,route:d.routeConfiguration,requestId:n,fetchEvent:r,custom:s,incomingRequestProperties:p}),v=Os.ZuploContextExtensions.initialize(m,h);if(d.routeConfiguration===ey.notFoundRouteConfiguration&&Bl.runtimeExtensions.value?.notFoundHandler!==void 0){let T=this.#r.lookupByPathOnly(l);v.pathOnlyMatches=T.map(S=>S.routeConfiguration).filter(S=>S instanceof ny.UserRouteConfiguration)}try{if(MS.SystemLogMap.addLogger(m,c),!u.pathname.startsWith("/__zuplo")){let j=await(0,Bl.invokeOnRequestExtensions)(h,m);if(j instanceof Response)return j;{let C=Os.ZuploContextExtensions.getContextExtensions(m);h=j,C.latestRequest=h}}[...kS,...this.runtimeSettings.developerPortal.enabled?[this.runtimeSettings.developerPortal.sitePathname]:[]].filter(j=>new RegExp(j).test(u.pathname)).length===0&&a.debug(`Request received '${u.pathname}'`,{method:e.method,url:u.pathname,hostname:u.hostname,route:d.routeConfiguration.path});let S=d.executableHandler;HS(S,d,e),Et("Gateway.handleRequest - call user handler");let k=await S(h,m);if(Et("Gateway.handleRequest - user handler"),!(k instanceof Response))throw new wt.RuntimeError(`Invalid Response type from the request handler: ${typeof k}`);if(k.bodyUsed)throw new wt.RuntimeError("The response object has already been used. Return a new response instead.");if(k.headers.get(Ut.REQUEST_ID_HEADER)===null&&!k.webSocket){let j=new Headers(k.headers);return j.set(Ut.REQUEST_ID_HEADER,n),new Response(k.body,{status:k.status,statusText:k.statusText,headers:j,cf:k.cf})}else return k}catch(T){return Et("Gateway - error executing handler",T),T instanceof wt.RuntimeError?(a.error(T),c.warn(T)):c.error(T),await this.#o(h,m,T)}}};xs.Gateway=Jl;function HS(t,e,r){if(Et("Gateway.checkHandler"),!t)throw typeof e.routeConfiguration>"u"?new wt.ConfigurationError(`Invalid state - no routeConfiguration for '${r.method}:${r.url}`):new wt.ConfigurationError(`Invalid state. No handler for request '${r.method}':'${e.routeConfiguration.path}'`)}o(HS,"checkHandler")});var sy=g(Ns=>{"use strict";Object.defineProperty(Ns,"__esModule",{value:!0});Ns.invokeInboundPolicy=void 0;var qS=D(),$S=un(),jS=Qn(),VS=o(async(t,e,r)=>{let n=$S.Gateway.instance.routeData.policies,i=(0,jS.getInboundPolicyHandlerAndOptions)([t],n);if(i.length===0)throw new qS.RuntimeError(`Invalid 'invokeInboundPolicy call' - no policy '${t}' found.`);let s=i[0];return s.handler(e,r,s.options,t)},"invokeInboundPolicy");Ns.invokeInboundPolicy=VS});var wr=g(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.SystemZuploContext=Xe.ZuploContextExtensions=Xe.ResponseSentEvent=Xe.ResponseSendingEvent=Xe.HeaderIncomingRequestProperties=void 0;var _e=Jn(),GS=D(),BS=sy(),zl=class{static{o(this,"HeaderIncomingRequestProperties")}#e;constructor(e){this.#e=e}get asn(){try{let e=this.#e.get(_e.ZP_ASN_HEADER);if(typeof e=="string")return parseInt(e)}catch{}}get asOrganization(){return this.#e.get(_e.ZP_AS_ORG_HEADER)??void 0}get city(){return this.#e.get(_e.CF_IP_CITY_HEADER)??this.#e.get(_e.ZP_IP_CITY_HEADER)??void 0}get continent(){return this.#e.get(_e.CF_IP_CONTINENT_HEADER)??this.#e.get(_e.ZP_IP_CONTINENT_HEADER)??void 0}get country(){return this.#e.get(_e.CF_IP_COUNTRY_HEADER)??this.#e.get(_e.ZP_IP_COUNTRY_HEADER)??void 0}get latitude(){return this.#e.get(_e.CF_IP_LATITUDE_HEADER)??this.#e.get(_e.ZP_IP_LATITUDE_HEADER)??void 0}get longitude(){return this.#e.get(_e.CF_IP_LONGITUDE_HEADER)??this.#e.get(_e.ZP_IP_LONGITUDE_HEADER)??void 0}get colo(){return this.#e.get(_e.ZP_COLO_HEADER)??void 0}get postalCode(){return this.#e.get(_e.ZP_POSTAL_CODE_HEADER)??void 0}get metroCode(){return this.#e.get(_e.ZP_METRO_CODE_HEADER)??void 0}get region(){return this.#e.get(_e.ZP_REGION_HEADER)??void 0}get regionCode(){return this.#e.get(_e.ZP_REGION_CODE_HEADER)??void 0}get timezone(){return this.#e.get(_e.ZP_TIMEZONE_HEADER)??void 0}toJSON(){return{asn:this.asn,asOrganization:this.asOrganization,city:this.city,continent:this.continent,country:this.country,latitude:this.latitude,longitude:this.longitude,colo:this.colo,postalCode:this.postalCode,metroCode:this.metroCode,region:this.region,regionCode:this.regionCode,timezone:this.timezone}}};Xe.HeaderIncomingRequestProperties=zl;var Wl=class extends Event{static{o(this,"ResponseSendingEvent")}constructor(e,r){super("responseSending"),this.request=e,this.mutableResponse=r}request;mutableResponse};Xe.ResponseSendingEvent=Wl;var Ql=class extends Event{static{o(this,"ResponseSentEvent")}constructor(e,r){super("responseSent"),this.request=e,this.response=r}request;response};Xe.ResponseSentEvent=Ql;var Cs=class t{static{o(this,"ZuploContextExtensions")}static#e=new WeakMap;static initialize(e,r){if(!t.#e.has(e)){let n=new t(r);return t.#e.set(e,n),n}throw new Error(`ZuploContextExtensions already initialized for context with requestId '${e.requestId}'`)}static getContextExtensions(e){let r=t.#e.get(e);if(!r)throw new GS.RuntimeError(`Invalid state, could not get ZuploContext extensions for context with requestId '${e.requestId}'`);return r}latestRequest;pathOnlyMatches;#t;#r;constructor(e){this.latestRequest=e,this.#t=[],this.#r=[]}addResponseSendingHook(e){this.#r.push(e)}addResponseSendingFinalHook(e){this.#t.push(e)}onResponseSendingFinal=async(e,r,n)=>{for(let i of this.#t)await i(e,r,n)};onResponseSending=async(e,r,n)=>{let i=e;for(let s of this.#r)i=await s(e,r,n);return i}};Xe.ZuploContextExtensions=Cs;var Yl=class extends EventTarget{static{o(this,"SystemZuploContext")}constructor({logger:e,route:r,requestId:n,fetchEvent:i,custom:s,incomingRequestProperties:a}){super(),this.log=Object.freeze(e),this.route=r,this.requestId=n,this.custom=s,this.incomingRequestProperties=a,this.#e=i,this.invokeInboundPolicy=(c,u)=>(0,BS.invokeInboundPolicy)(c,u,this),this.waitUntil=c=>{this.#e.waitUntil(c)},this.addResponseSendingFinalHook=c=>{Cs.getContextExtensions(this).addResponseSendingFinalHook(c)},Object.freeze(this)}#e;requestId;log;route;custom;incomingRequestProperties;invokeInboundPolicy;waitUntil;addResponseSendingFinalHook;addEventListener(e,r,n){let i=o(s=>{try{typeof r=="function"?r(s):r.handleEvent(s)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,i,n)}};Xe.SystemZuploContext=Yl});var ay=g(Ls=>{"use strict";Object.defineProperty(Ls,"__esModule",{value:!0});Ls.ContextData=void 0;var Zl=class t{static{o(this,"ContextData")}static#e;#t;constructor(e){this.#t=e}set(e,r){t.set(e,this.#t,r)}get(e){return t.get(e,this.#t)}static set(e,r,n){t.#e||(t.#e=new WeakMap);let i=t.#e.get(e);i||(i=new Map),i.set(r,n)}static get(e,r){return t.#e||(t.#e=new WeakMap),t.#e.get(e)?.get(r)}};Ls.ContextData=Zl});var Xl=g(or=>{"use strict";Object.defineProperty(or,"__esModule",{value:!0});or.environment=or.isZuploReadableEnvVariableName=or.isRestrictedEnvVariableName=void 0;var KS=["ZUPLO_USER_LOGGER_DATA_DOG_API_KEY","ZUPLO_USER_LOGGER_DATA_DOG_URL","ZUPLO_LOG_LEVEL","ZUPLO_HANDLER_WRITE_LOG_LEVEL"];function cy(t){return t.startsWith("__ZUPLO")||t.startsWith("ZUPLO_")?!KS.includes(t)&&!t.startsWith("ZUPLO_PUBLIC_"):!1}o(cy,"isRestrictedEnvVariableName");or.isRestrictedEnvVariableName=cy;function uy(t){return!!t.startsWith("ZUPLO_")}o(uy,"isZuploReadableEnvVariableName");or.isZuploReadableEnvVariableName=uy;var JS=new Proxy({},{get(t,e){if(cy(String(e))&&!uy(String(e)))return;let r=globalThis,n;return r.process?n=r.process.env[e]:n=r[e],n}});or.environment=JS});var ed=g(ln=>{"use strict";Object.defineProperty(ln,"__esModule",{value:!0});ln.externalServiceHandler=ln.externalServiceTunnelConfig=void 0;var zS=Er(),Nr=D(),WS=td(),mi=ee(),at=(0,zS.debug)("zuplo:runtime:external-service");function dy(){let t,{__ZUPLO_EXTERNAL_SERVICE_TOKEN:e}=mi.Environment.instance.runtime;if(e&&e!=="undefined")try{let r=atob(e);t=JSON.parse(r)}catch{}return t}o(dy,"getServiceAuth");async function QS(t){let e=dy();if(!e)throw at("There is no external service auth configured for this zup."),new Nr.RuntimeError("There are no external services configured for this zup.");if(typeof t!="string")throw at("Cannot call external service with Request object"),new Nr.RuntimeError("Currently, we only support fetch(<some_string>, ...).");let n=new URL(t).hostname,i={};i["CF-Access-Client-Id"]=e.clientId,i["CF-Access-Client-Secret"]=e.clientSecret;let s;if(e.customServiceMapping&&e.customServiceMapping[n])s=`https://${e.customServiceMapping[n]}`;else if(mi.Environment.instance.useSha256ServiceRouting){at("Using sha256 service routing");let a=mi.Environment.instance.build;if(a.ACCOUNT_NAME&&a.PROJECT_NAME&&a.ENVIRONMENT_TYPE)s=`https://${await py(n,a.ACCOUNT_NAME,a.PROJECT_NAME,a.ENVIRONMENT_TYPE)}.zuptunnel.com`;else throw at("Cannot use sha256 service routing, missing build variables"),new Nr.RuntimeError("Failed to generate fully qualified tunnel url.")}else s=`https://${n}.zuptunnel.com`;return{serviceBaseUrl:s,tunnelHeaders:i}}o(QS,"externalServiceTunnelConfig");ln.externalServiceTunnelConfig=QS;async function YS(t,e){let r=dy();if(r)if(at(`Using external service auth. ClientId: ${r.clientId})`),typeof t=="string"){let n=new URL(t),i=n.hostname,s=e??{},a=new Headers(s.headers||{});a.set("CF-Access-Client-Id",r.clientId),a.set("CF-Access-Client-Secret",r.clientSecret),s.headers=a;let c;if(r.customServiceMapping&&r.customServiceMapping[i])c=`https://${r.customServiceMapping[i]}`;else if(mi.Environment.instance.useSha256ServiceRouting){at("Using sha256 service routing");let d=mi.Environment.instance.build;if(d.ACCOUNT_NAME&&d.PROJECT_NAME&&d.ENVIRONMENT_TYPE)c=`https://${await py(i,d.ACCOUNT_NAME,d.PROJECT_NAME,d.ENVIRONMENT_TYPE)}.zuptunnel.com`;else throw at("Cannot use sha256 service routing, missing build variables"),new Nr.RuntimeError("Failed to generate fully qualified tunnel url.")}else c=`https://${i}.zuptunnel.com`;let u=new URL(`${c}${n.pathname}${n.search}`);at(`Calling external service: ${u.toString()}`);let l=await(0,WS.originalFetch)(u.toString(),s);if(l.status===403&&l.headers.get("cf-access-domain")!==null)throw console.error("403 Forbidden when calling external service.",{clientId:r.clientId,tunnelHost:c}),new Nr.RuntimeError("Could not connect to secure tunnel.");return l}else throw at("Cannot call external service with Request object"),new Nr.RuntimeError("Currently, we only support fetch(<some_string>, ...).");else throw at("There is no external service auth configured for this zup."),new Nr.RuntimeError("There are no external services configured for this zup.")}o(YS,"externalServiceHandler");ln.externalServiceHandler=YS;async function py(t,e,r,n){let i=t.toLowerCase(),s=e.toLowerCase(),a=r.toLowerCase(),c=ZS(n);at(`Hashing service name: ${s}-${i}.${s}-${a}-${c}`);let u=await ly(`${s}-${i}`),l=await ly(`${s}-${a}-${c}`);return`${u}.${l}`}o(py,"hashServiceName");async function ly(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("").slice(0,-1)}o(ly,"hashSegment");function ZS(t){let e=t.toLowerCase();switch(e){case"production":case"preview":return e;default:return"working-copy"}}o(ZS,"sanitizeEnvironmentType")});var td=g(dn=>{"use strict";Object.defineProperty(dn,"__esModule",{value:!0});dn.originalFetch=void 0;var XS=ed(),hy=new Map;hy.set("service:",XS.externalServiceHandler);dn.originalFetch=globalThis.fetch;globalThis.fetch=function(t,e){let r=eI(e);if(typeof t=="string"){let n=new URL(t),i=hy.get(n.protocol);return i?i(t,r):(0,dn.originalFetch)(t,r)}else return(0,dn.originalFetch)(t,r)};var eI=o(t=>{if(!t||t instanceof Request)return t;let e=t;if(!e.zuplo)return t;let r=t;return r.cf={cacheEverything:e.zuplo?.cacheEverything,cacheTtl:e.zuplo?.cacheTtlSeconds},delete t.zuplo,t},"transformInit")});var yy=g(pn=>{"use strict";Object.defineProperty(pn,"__esModule",{value:!0});pn.Handler=pn.purgeGatewayCache=void 0;var my=un(),fy=ee(),tI=o(()=>{my.Gateway.purgeGatewayCache()},"purgeGatewayCache");pn.purgeGatewayCache=tI;var rd=class{static{o(this,"Handler")}routeData;buildEnvironment;runtimeEnvironment;runtimeSettings;serviceProvider;schemaValidations;runtimeInit;constructor(e,r,n,i,s,a,c){this.routeData=e,this.buildEnvironment=r,this.runtimeEnvironment=n,this.runtimeSettings=i,this.serviceProvider=s,this.schemaValidations=a,this.runtimeInit=c}requestHandler=async(e,r)=>{fy.Environment.initialize(this.buildEnvironment,this.runtimeEnvironment);let n;try{n=await my.Gateway.initialize(this.routeData,this.runtimeSettings,this.serviceProvider,this.schemaValidations,this.runtimeInit)}catch(i){console.error("Error initializing gateway.",i);let s={status:500,title:"Gateway Initialization Error",type:"https://httpproblems.com/http-status/500",detail:"Error initializing gateway. Check your 'zuplo.runtime.ts' for errors or contact support.",instance:e.url,trace:{timestamp:Date.now(),rayId:e.headers.get("cf-ray")??void 0,buildId:this.buildEnvironment.BUILD_ID},message:fy.Environment.instance.isDeno?i.message:void 0};return new Response(JSON.stringify(s,null,2),{status:500,headers:{"content-type":"application/json"}})}return n.handleRequest(e,r)}};pn.Handler=rd});var Ey=g(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.pathToRegexp=Re.tokensToRegexp=Re.regexpToFunction=Re.match=Re.tokensToFunction=Re.compile=Re.parse=void 0;function rI(t){for(var e=[],r=0;r<t.length;){var n=t[r];if(n==="*"||n==="+"||n==="?"){e.push({type:"MODIFIER",index:r,value:t[r++]});continue}if(n==="\\"){e.push({type:"ESCAPED_CHAR",index:r++,value:t[r++]});continue}if(n==="{"){e.push({type:"OPEN",index:r,value:t[r++]});continue}if(n==="}"){e.push({type:"CLOSE",index:r,value:t[r++]});continue}if(n===":"){for(var i="",s=r+1;s<t.length;){var a=t.charCodeAt(s);if(a>=48&&a<=57||a>=65&&a<=90||a>=97&&a<=122||a===95){i+=t[s++];continue}break}if(!i)throw new TypeError("Missing parameter name at ".concat(r));e.push({type:"NAME",index:r,value:i}),r=s;continue}if(n==="("){var c=1,u="",s=r+1;if(t[s]==="?")throw new TypeError('Pattern cannot start with "?" at '.concat(s));for(;s<t.length;){if(t[s]==="\\"){u+=t[s++]+t[s++];continue}if(t[s]===")"){if(c--,c===0){s++;break}}else if(t[s]==="("&&(c++,t[s+1]!=="?"))throw new TypeError("Capturing groups are not allowed at ".concat(s));u+=t[s++]}if(c)throw new TypeError("Unbalanced pattern at ".concat(r));if(!u)throw new TypeError("Missing pattern at ".concat(r));e.push({type:"PATTERN",index:r,value:u}),r=s;continue}e.push({type:"CHAR",index:r,value:t[r++]})}return e.push({type:"END",index:r,value:""}),e}o(rI,"lexer");function nd(t,e){e===void 0&&(e={});for(var r=rI(t),n=e.prefixes,i=n===void 0?"./":n,s="[^".concat(hn(e.delimiter||"/#?"),"]+?"),a=[],c=0,u=0,l="",d=o(function(ne){if(u<r.length&&r[u].type===ne)return r[u++].value},"tryConsume"),p=o(function(ne){var fe=d(ne);if(fe!==void 0)return fe;var Ge=r[u],E=Ge.type,F=Ge.index;throw new TypeError("Unexpected ".concat(E," at ").concat(F,", expected ").concat(ne))},"mustConsume"),y=o(function(){for(var ne="",fe;fe=d("CHAR")||d("ESCAPED_CHAR");)ne+=fe;return ne},"consumeText");u<r.length;){var h=d("CHAR"),m=d("NAME"),v=d("PATTERN");if(m||v){var T=h||"";i.indexOf(T)===-1&&(l+=T,T=""),l&&(a.push(l),l=""),a.push({name:m||c++,prefix:T,suffix:"",pattern:v||s,modifier:d("MODIFIER")||""});continue}var S=h||d("ESCAPED_CHAR");if(S){l+=S;continue}l&&(a.push(l),l="");var k=d("OPEN");if(k){var T=y(),j=d("NAME")||"",C=d("PATTERN")||"",re=y();p("CLOSE"),a.push({name:j||(C?c++:""),pattern:j&&!C?s:C,prefix:T,suffix:re,modifier:d("MODIFIER")||""});continue}p("END")}return a}o(nd,"parse");Re.parse=nd;function nI(t,e){return gy(nd(t,e),e)}o(nI,"compile");Re.compile=nI;function gy(t,e){e===void 0&&(e={});var r=id(e),n=e.encode,i=n===void 0?function(u){return u}:n,s=e.validate,a=s===void 0?!0:s,c=t.map(function(u){if(typeof u=="object")return new RegExp("^(?:".concat(u.pattern,")$"),r)});return function(u){for(var l="",d=0;d<t.length;d++){var p=t[d];if(typeof p=="string"){l+=p;continue}var y=u?u[p.name]:void 0,h=p.modifier==="?"||p.modifier==="*",m=p.modifier==="*"||p.modifier==="+";if(Array.isArray(y)){if(!m)throw new TypeError('Expected "'.concat(p.name,'" to not repeat, but got an array'));if(y.length===0){if(h)continue;throw new TypeError('Expected "'.concat(p.name,'" to not be empty'))}for(var v=0;v<y.length;v++){var T=i(y[v],p);if(a&&!c[d].test(T))throw new TypeError('Expected all "'.concat(p.name,'" to match "').concat(p.pattern,'", but got "').concat(T,'"'));l+=p.prefix+T+p.suffix}continue}if(typeof y=="string"||typeof y=="number"){var T=i(String(y),p);if(a&&!c[d].test(T))throw new TypeError('Expected "'.concat(p.name,'" to match "').concat(p.pattern,'", but got "').concat(T,'"'));l+=p.prefix+T+p.suffix;continue}if(!h){var S=m?"an array":"a string";throw new TypeError('Expected "'.concat(p.name,'" to be ').concat(S))}}return l}}o(gy,"tokensToFunction");Re.tokensToFunction=gy;function iI(t,e){var r=[],n=od(t,r,e);return _y(n,r,e)}o(iI,"match");Re.match=iI;function _y(t,e,r){r===void 0&&(r={});var n=r.decode,i=n===void 0?function(s){return s}:n;return function(s){var a=t.exec(s);if(!a)return!1;for(var c=a[0],u=a.index,l=Object.create(null),d=o(function(y){if(a[y]===void 0)return"continue";var h=e[y-1];h.modifier==="*"||h.modifier==="+"?l[h.name]=a[y].split(h.prefix+h.suffix).map(function(m){return i(m,h)}):l[h.name]=i(a[y],h)},"_loop_1"),p=1;p<a.length;p++)d(p);return{path:c,index:u,params:l}}}o(_y,"regexpToFunction");Re.regexpToFunction=_y;function hn(t){return t.replace(/([.+*?=^!:${}()[\]|/\\])/g,"\\$1")}o(hn,"escapeString");function id(t){return t&&t.sensitive?"":"i"}o(id,"flags");function oI(t,e){if(!e)return t;for(var r=/\((?:\?<(.*?)>)?(?!\?)/g,n=0,i=r.exec(t.source);i;)e.push({name:i[1]||n++,prefix:"",suffix:"",modifier:"",pattern:""}),i=r.exec(t.source);return t}o(oI,"regexpToRegexp");function sI(t,e,r){var n=t.map(function(i){return od(i,e,r).source});return new RegExp("(?:".concat(n.join("|"),")"),id(r))}o(sI,"arrayToRegexp");function aI(t,e,r){return by(nd(t,r),e,r)}o(aI,"stringToRegexp");function by(t,e,r){r===void 0&&(r={});for(var n=r.strict,i=n===void 0?!1:n,s=r.start,a=s===void 0?!0:s,c=r.end,u=c===void 0?!0:c,l=r.encode,d=l===void 0?function(F){return F}:l,p=r.delimiter,y=p===void 0?"/#?":p,h=r.endsWith,m=h===void 0?"":h,v="[".concat(hn(m),"]|$"),T="[".concat(hn(y),"]"),S=a?"^":"",k=0,j=t;k<j.length;k++){var C=j[k];if(typeof C=="string")S+=hn(d(C));else{var re=hn(d(C.prefix)),ne=hn(d(C.suffix));if(C.pattern)if(e&&e.push(C),re||ne)if(C.modifier==="+"||C.modifier==="*"){var fe=C.modifier==="*"?"?":"";S+="(?:".concat(re,"((?:").concat(C.pattern,")(?:").concat(ne).concat(re,"(?:").concat(C.pattern,"))*)").concat(ne,")").concat(fe)}else S+="(?:".concat(re,"(").concat(C.pattern,")").concat(ne,")").concat(C.modifier);else C.modifier==="+"||C.modifier==="*"?S+="((?:".concat(C.pattern,")").concat(C.modifier,")"):S+="(".concat(C.pattern,")").concat(C.modifier);else S+="(?:".concat(re).concat(ne,")").concat(C.modifier)}}if(u)i||(S+="".concat(T,"?")),S+=r.endsWith?"(?=".concat(v,")"):"$";else{var Ge=t[t.length-1],E=typeof Ge=="string"?T.indexOf(Ge[Ge.length-1])>-1:Ge===void 0;i||(S+="(?:".concat(T,"(?=").concat(v,"))?")),E||(S+="(?=".concat(T,"|").concat(v,")"))}return new RegExp(S,id(r))}o(by,"tokensToRegexp");Re.tokensToRegexp=by;function od(t,e,r){return t instanceof RegExp?oI(t,e):Array.isArray(t)?sI(t,e,r):aI(t,e,r)}o(od,"pathToRegexp");Re.pathToRegexp=od});var ud=g(fn=>{"use strict";Object.defineProperty(fn,"__esModule",{value:!0});fn.AwsV4Signer=fn.AwsClient=void 0;var cI=Er(),Sy=D(),uI=(0,cI.debug)("zuplo:runtime"),ad=new TextEncoder,wy={appstream2:"appstream",cloudhsmv2:"cloudhsm",email:"ses",marketplace:"aws-marketplace",mobile:"AWSMobileHubService",pinpoint:"mobiletargeting",queue:"sqs","git-codecommit":"codecommit","mturk-requester-sandbox":"mturk-requester","personalize-runtime":"personalize"},lI=["authorization","content-type","content-length","user-agent","presigned-expires","expect","x-amzn-trace-id","range","connection"],cd=class{static{o(this,"AwsClient")}accessKeyId;secretAccessKey;sessionToken;service;region;cache;retries;initRetryMs;constructor({accessKeyId:e,secretAccessKey:r,sessionToken:n,service:i,region:s,cache:a,retries:c,initRetryMs:u}){if(e==null)throw new TypeError("accessKeyId is a required option");if(r==null)throw new TypeError("secretAccessKey is a required option");this.accessKeyId=e,this.secretAccessKey=r,this.sessionToken=n,this.service=i,this.region=s,this.cache=a||new Map,this.retries=c??0,this.initRetryMs=u||50}async sign(e,r){let n=new Ds(Object.assign({url:e},r,this,r&&r.aws)),i=Object.assign({},r,await n.sign());return delete i.aws,{url:i.url.toString(),request:i}}async fetch(e,r){uI("AWS fetch",e);for(let n=0;n<=this.retries;n++){let{url:i,request:s}=await this.sign(e,r),a=fetch(i,s);if(n===this.retries)return a;let c=await a;if(c.status<500&&c.status!==429)return c;await new Promise(u=>setTimeout(u,Math.random()*this.initRetryMs*Math.pow(2,n)))}throw new Sy.ConfigurationError("An unknown error occurred, ensure retries is not negative")}};fn.AwsClient=cd;var Ds=class{static{o(this,"AwsV4Signer")}method;url;headers;body;accessKeyId;secretAccessKey;sessionToken;service;region;cache;datetime;signQuery;appendSessionToken;signableHeaders;signedHeaders;canonicalHeaders;credentialString;encodedPath;encodedSearch;constructor({method:e,url:r,headers:n,body:i,accessKeyId:s,secretAccessKey:a,sessionToken:c,service:u,region:l,cache:d,datetime:p,signQuery:y,appendSessionToken:h,allHeaders:m,singleEncode:v}){if(r==null)throw new TypeError("url is a required option");if(s==null)throw new TypeError("accessKeyId is a required option");if(a==null)throw new TypeError("secretAccessKey is a required option");this.method=e||(i?"POST":"GET"),this.url=new URL(r),this.headers=new Headers(n||{}),this.body=i,this.accessKeyId=s,this.secretAccessKey=a,this.sessionToken=c;let T,S;(!u||!l)&&([T,S]=dI(this.url,this.headers)),this.service=u||T||"",this.region=l||S||"us-east-1",this.cache=d||new Map,this.datetime=p||new Date().toISOString().replace(/[:-]|\.\d{3}/g,""),this.signQuery=y,this.appendSessionToken=h||this.service==="iotdevicegateway",this.headers.delete("Host");let k=this.signQuery?this.url.searchParams:this.headers;if(this.service==="s3"&&!this.headers.has("X-Amz-Content-Sha256")&&this.headers.set("X-Amz-Content-Sha256","UNSIGNED-PAYLOAD"),k.set("X-Amz-Date",this.datetime),this.sessionToken&&!this.appendSessionToken&&k.set("X-Amz-Security-Token",this.sessionToken),this.signableHeaders=["host",...this.headers.keys()].filter(C=>m||!lI.includes(C)).sort(),this.signedHeaders=this.signableHeaders.join(";"),this.canonicalHeaders=this.signableHeaders.map(C=>C+":"+(C==="host"?this.url.host:(this.headers.get(C)||"").replace(/\s+/g," "))).join(`
 `),this.credentialString=[this.datetime.slice(0,8),this.region,this.service,"aws4_request"].join("/"),this.signQuery&&(this.service==="s3"&&!k.has("X-Amz-Expires")&&k.set("X-Amz-Expires","86400"),k.set("X-Amz-Algorithm","AWS4-HMAC-SHA256"),k.set("X-Amz-Credential",this.accessKeyId+"/"+this.credentialString),k.set("X-Amz-SignedHeaders",this.signedHeaders)),this.service==="s3")try{this.encodedPath=decodeURIComponent(this.url.pathname.replace(/\+/g," "))}catch{this.encodedPath=this.url.pathname}else this.encodedPath=this.url.pathname.replace(/\/+/g,"/");v||(this.encodedPath=encodeURIComponent(this.encodedPath).replace(/%2F/g,"/")),this.encodedPath=Ty(this.encodedPath);let j=new Set;this.encodedSearch=[...this.url.searchParams].filter(([C])=>{if(!C)return!1;if(this.service==="s3"){if(j.has(C))return!1;j.add(C)}return!0}).map(C=>C.map(re=>Ty(encodeURIComponent(re)))).sort(([C,re],[ne,fe])=>C<ne?-1:C>ne?1:re<fe?-1:re>fe?1:0).map(C=>C.join("=")).join("&")}async sign(){return this.signQuery?(this.url.searchParams.set("X-Amz-Signature",await this.signature()),this.sessionToken&&this.appendSessionToken&&this.url.searchParams.set("X-Amz-Security-Token",this.sessionToken)):this.headers.set("Authorization",await this.authHeader()),{method:this.method,url:this.url,headers:this.headers,body:this.body}}async authHeader(){return["AWS4-HMAC-SHA256 Credential="+this.accessKeyId+"/"+this.credentialString,"SignedHeaders="+this.signedHeaders,"Signature="+await this.signature()].join(", ")}async signature(){let e=this.datetime.slice(0,8),r=[this.secretAccessKey,e,this.region,this.service].join(),n=this.cache.get(r);if(!n){let i=await yi("AWS4"+this.secretAccessKey,e),s=await yi(i,this.region),a=await yi(s,this.service);n=await yi(a,"aws4_request"),this.cache.set(r,n)}return sd(await yi(n,await this.stringToSign()))}async stringToSign(){return["AWS4-HMAC-SHA256",this.datetime,this.credentialString,sd(await vy(await this.canonicalString()))].join(`
 `)}async canonicalString(){return[this.method.toUpperCase(),this.encodedPath,this.encodedSearch,this.canonicalHeaders+`
 `,this.signedHeaders,await this.hexBodyHash()].join(`
 `)}async hexBodyHash(){let e=this.headers.get("X-Amz-Content-Sha256");if(e==null){if(this.body&&typeof this.body!="string"&&!("byteLength"in this.body))throw new Sy.RuntimeError("body must be a string, ArrayBuffer or ArrayBufferView, unless you include the X-Amz-Content-Sha256 header");e=sd(await vy(this.body||""))}return e}};fn.AwsV4Signer=Ds;async function yi(t,e){let r=await crypto.subtle.importKey("raw",typeof t=="string"?ad.encode(t):t,{name:"HMAC",hash:{name:"SHA-256"}},!1,["sign"]);return crypto.subtle.sign("HMAC",r,ad.encode(e))}o(yi,"hmac");async function vy(t){return crypto.subtle.digest("SHA-256",typeof t=="string"?ad.encode(t):t)}o(vy,"hash");function sd(t){return Array.prototype.map.call(new Uint8Array(t),e=>("0"+e.toString(16)).slice(-2)).join("")}o(sd,"buf2hex");function Ty(t){return t.replace(/[!'()*]/g,e=>"%"+e.charCodeAt(0).toString(16).toUpperCase())}o(Ty,"encodeRfc3986");function dI(t,e){let{hostname:r,pathname:n}=t,i=r.replace("dualstack.","").match(/([^.]+)\.(?:([^.]*)\.)?amazonaws\.com(?:\.cn)?$/),[s,a]=(i||["",""]).slice(1,3);if(a==="us-gov")a="us-gov-west-1";else if(a==="s3"||a==="s3-accelerate")a="us-east-1",s="s3";else if(s==="iot")r.startsWith("iot.")?s="execute-api":r.startsWith("data.jobs.iot.")?s="iot-jobs-data":s=n==="/mqtt"?"iotdevicegateway":"iotdata";else if(s==="autoscaling"){let c=(e.get("X-Amz-Target")||"").split(".")[0];c==="AnyScaleFrontendService"?s="application-autoscaling":c==="AnyScaleScalingPlannerFrontendService"&&(s="autoscaling-plans")}else a==null&&s.startsWith("s3-")?(a=s.slice(3).replace(/^fips-|^external-1/,""),s="s3"):s.endsWith("-fips")?s=s.slice(0,-5):a&&/-\d$/.test(s)&&!/-\d$/.test(a)&&([s,a]=[a,s]);return s in wy?[wy[s],a]:[s,a]}o(dI,"guessServiceRegion")});var Iy=g(vt=>{"use strict";Object.defineProperty(vt,"__esModule",{value:!0});vt.convertStringToUtf8Array=vt.convertUtf8ArrayToString=vt.base64Encode=vt.base64Decode=void 0;function pI(t){return t>64&&t<91?t-65:t>96&&t<123?t-71:t>47&&t<58?t+4:t===43?62:t===47?63:0}o(pI,"b64ToUint6");function hI(t,e){let r=t.replace(/[^A-Za-z0-9+/]/g,""),n=r.length,i=e?Math.ceil((n*3+1>>2)/e)*e:n*3+1>>2,s=new Uint8Array(i),a,c,u=0,l=0;for(let d=0;d<n;d++)if(c=d&3,u|=pI(r.charCodeAt(d))<<6*(3-c),c===3||n-d===1){for(a=0;a<3&&l<i;)s[l]=u>>>(16>>>a&24)&255,a++,l++;u=0}return s}o(hI,"base64Decode");vt.base64Decode=hI;function Us(t){return t<26?t+65:t<52?t+71:t<62?t-4:t===62?43:t===63?47:65}o(Us,"uint6ToB64");function fI(t){let e=2,r="",n=t.length,i=0;for(let s=0;s<n;s++)e=s%3,i|=t[s]<<(16>>>e&24),(e===2||t.length-s===1)&&(r+=String.fromCodePoint(Us(i>>>18&63),Us(i>>>12&63),Us(i>>>6&63),Us(i&63)),i=0);return r.substring(0,r.length-2+e)+(e===2?"":e===1?"=":"==")}o(fI,"base64Encode");vt.base64Encode=fI;function mI(t){let e="",r,n=t.length;for(let i=0;i<n;i++)r=t[i],e+=String.fromCodePoint(r>251&&r<254&&i+5<n?(r-252)*1073741824+(t[++i]-128<<24)+(t[++i]-128<<18)+(t[++i]-128<<12)+(t[++i]-128<<6)+t[++i]-128:r>247&&r<252&&i+4<n?(r-248<<24)+(t[++i]-128<<18)+(t[++i]-128<<12)+(t[++i]-128<<6)+t[++i]-128:r>239&&r<248&&i+3<n?(r-240<<18)+(t[++i]-128<<12)+(t[++i]-128<<6)+t[++i]-128:r>223&&r<240&&i+2<n?(r-224<<12)+(t[++i]-128<<6)+t[++i]-128:r>191&&r<224&&i+1<n?(r-192<<6)+t[++i]-128:r);return e}o(mI,"convertUtf8ArrayToString");vt.convertUtf8ArrayToString=mI;function yI(t){let e,r=t.length,n=0;for(let c=0;c<r;c++)e=t.codePointAt(c),e>=65536&&c++,n+=e<128?1:e<2048?2:e<65536?3:e<2097152?4:e<67108864?5:6;let i=new Uint8Array(n),s=0,a=0;for(;s<n;)e=t.codePointAt(a),e<128?i[s++]=e:e<2048?(i[s++]=192+(e>>>6),i[s++]=128+(e&63)):e<65536?(i[s++]=224+(e>>>12),i[s++]=128+(e>>>6&63),i[s++]=128+(e&63)):e<2097152?(i[s++]=240+(e>>>18),i[s++]=128+(e>>>12&63),i[s++]=128+(e>>>6&63),i[s++]=128+(e&63),a++):e<67108864?(i[s++]=248+(e>>>24),i[s++]=128+(e>>>18&63),i[s++]=128+(e>>>12&63),i[s++]=128+(e>>>6&63),i[s++]=128+(e&63),a++):(i[s++]=252+(e>>>30),i[s++]=128+(e>>>24&63),i[s++]=128+(e>>>18&63),i[s++]=128+(e>>>12&63),i[s++]=128+(e>>>6&63),i[s++]=128+(e&63),a++),a++;return i}o(yI,"convertStringToUtf8Array");vt.convertStringToUtf8Array=yI});var Ay=g(Ms=>{"use strict";Object.defineProperty(Ms,"__esModule",{value:!0});Ms.toCLFDate=void 0;function mn(t){let e=t.toString();return`${e.length===1?"0":""}${e}`}o(mn,"numberToString");function gI(t){let e=t.getTimezoneOffset(),r=Math.abs(e),n=e>0?"-":"+",i=mn(Math.floor(r/60)),s=mn(r%60);return`${n}${i}${s}`}o(gI,"getCLFOffset");function _I(t=new Date){if(!(t instanceof Date))throw new Error("clf-date: invalid parameter");let e=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],r=mn(t.getDate()),n=e[t.getMonth()],i=t.getFullYear(),s=mn(t.getHours()),a=mn(t.getMinutes()),c=mn(t.getSeconds()),u=gI(t);return`${r}/${n}/${i}:${s}:${a}:${c} ${u}`}o(_I,"toCLFDate");Ms.toCLFDate=_I});var Ly=g(sr=>{"use strict";Object.defineProperty(sr,"__esModule",{value:!0});sr.getResponse=sr.awsLambdaHandler=sr.AwsLambdaHandlerExtensions=void 0;var bI=Er(),Py=Ey(),gi=D(),EI=Ot(),wI=ud(),Oy=Iy(),xy=Ay(),Ry=(0,bI.debug)("zuplo:runtime"),vI="X-Amzn-Trace-Id",TI="x-amzn-errortype",Ny=[],SI=o(async(t,e,r)=>{let n=r;for await(let i of Ny)n=await i(t,e,r);return n},"onSendingAwsLambdaEvent"),Ke=class extends gi.RuntimeError{static{o(this,"AwsLambdaError")}traceId;errorType;constructor(e,r){super(`Failed to invoke AWS Lambda function. ${e}`),this.traceId=r.get(vI)??void 0,this.errorType=r.get(TI)??void 0}};sr.AwsLambdaHandlerExtensions={addSendingAwsLambdaEventHook:t=>{Ny.push(t)}};async function II(t,e){let{accessKeyId:r,secretAccessKey:n,region:i,functionName:s,useLambdaProxyIntegration:a=!0,useAwsResourcePathStyle:c=!1,binaryMediaTypes:u}=e.route.handler.options;if(!r)throw new gi.ConfigurationError("awsAccessKeyId is not set in the handler options");if(!n)throw new gi.ConfigurationError("secretAccessKey is not set in the handler options");if(!i)throw new gi.ConfigurationError("region is not set in the handler options");if(!s)throw new gi.ConfigurationError("functionName is not set in the handler options");let l=new wI.AwsClient({accessKeyId:r,secretAccessKey:n}),d=`https://lambda.${i}.amazonaws.com/2015-03-31/functions/${s}/invocations`;if(Ry(`AWS Lambda URL: ${d}`),!a)return l.fetch(d,{body:await t.arrayBuffer()});let[p,y]=await RI(t,{binaryMediaTypes:u}),{options:h}=e.route.handler,m;h&&typeof h=="object"&&"payloadFormatVersion"in h&&h.payloadFormatVersion==="2.0"?m=PI(t,e):m=await AI(t,e,{useAwsResourcePathStyle:c}),Ry("Calling onSendingAwsLambdaEvent hook");let v=await SI(t,e,m);v.body=p,v.isBase64Encoded=y;let T=await l.fetch(d,{body:JSON.stringify(v)});try{return Cy(T)}catch(S){if(S instanceof Ke){let k=h&&typeof h=="object"&&"returnAmazonTraceIdHeader"in h&&h.returnAmazonTraceIdHeader&&S.traceId?{AMZN_TRACE_ID_HEADER:S.traceId}:void 0;return EI.HttpProblems.internalServerError(t,e,void 0,k)}throw S}}o(II,"awsLambdaHandler");sr.awsLambdaHandler=II;async function Cy(t){let e;try{e=await t.json()}catch{throw new Ke("Lambda response did not contain valid JSON",t.headers)}if(t.status!==200)throw e&&typeof e=="object"&&"message"in e&&typeof e.message=="string"?new Ke(e.message,t.headers):new Ke(`Status: ${t.statusText}`,t.headers);if(e&&typeof e=="object"&&"errorMessage"in e&&typeof e.errorMessage=="string")throw new Ke(e.errorMessage,t.headers);if(!e||typeof e!="object"||!("statusCode"in e)||typeof e.statusCode!="number")return new Response(JSON.stringify(e),{status:t.status,headers:{"content-type":"application/json"}});let r=new Headers;if("headers"in e&&e.headers){if(typeof e.headers!="object")throw new Ke(`Response headers must be an object. Received ${typeof e.headers}`,t.headers);for(let[i,s]of Object.entries(e.headers))r.set(i,s)}if("cookies"in e&&e.cookies){if(!Array.isArray(e.cookies))throw new Ke(`Response cookies must be an array. Received ${typeof e.cookies}`,t.headers);r.set("cookie",e.cookies.join(";"))}let n;if("isBase64Encoded"in e&&typeof e.isBase64Encoded!="boolean")throw new Ke(`Response property isBase64Encoded must be a boolean. Received ${typeof e.isBase64Encoded}`,t.headers);if("isBase64Encoded"in e&&e.isBase64Encoded===!0){if(!("body"in e))throw new Ke("Response was set to base64 encoded but no body was set",t.headers);if(typeof e.body!="string")throw new Ke("Response was set to base64 encoded but body was not a string",t.headers);n=(0,Oy.base64Decode)(e.body)}else"body"in e&&typeof e.body=="string"?n=e.statusCode===204&&e.body===""?null:e.body:"body"in e&&e.body!==null&&e.body!==void 0?n=JSON.stringify(e.body):n=null;if(n!==null&&"bodyEncoding"in e){if(typeof e.bodyEncoding!="string"||!(e.bodyEncoding==="gzip"||e.bodyEncoding==="deflate"))throw new Ke(`Response property bodyEncoding can only be set to 'gzip' or 'deflate'. Received ${e.bodyEncoding}`,t.headers);let i=new Blob([n]).stream().pipeThrough(new DecompressionStream(e.bodyEncoding));n=await new Response(i).arrayBuffer()}return new Response(n,{headers:r,status:e.statusCode})}o(Cy,"getResponse");sr.getResponse=Cy;async function AI(t,e,{useAwsResourcePathStyle:r}){let n={},i={};t.headers.forEach((l,d)=>{n[d]=l,i[d]=[l]});let s=t.query,a={};for(let[l,d]of Object.entries(s))a[l]=[d];let c=new URL(t.url);return{version:"1.0",resource:c.pathname,path:c.pathname,httpMethod:t.method,headers:n,multiValueHeaders:i,queryStringParameters:s,multiValueQueryStringParameters:a,requestContext:{accountId:null,apiId:null,authorizer:{claims:{},scopes:[]},domainName:c.hostname,domainPrefix:null,extendedRequestId:e.requestId,httpMethod:t.method,identity:{accessKey:null,accountId:null,caller:null,cognitoAuthenticationProvider:null,cognitoAuthenticationType:null,cognitoIdentityId:null,cognitoIdentityPoolId:null,principalOrgId:null,sourceIp:t.headers.get("CF-Connecting-IP"),user:null,userAgent:t.headers.get("user-agent"),userArn:null,clientCert:{clientCertPem:null,subjectDN:null,issuerDN:null,serialNumber:null,validity:{notBefore:null,notAfter:null}}},path:c.pathname,protocol:"HTTP/1.1",requestId:e.requestId,requestTime:(0,xy.toCLFDate)(),requestTimeEpoch:new Date().valueOf(),resourceId:e.route.operationId??null,resourcePath:xI(e.route.path,r),stage:null},pathParameters:t.params,stageVariables:null}}o(AI,"buildEventVersion1");function PI(t,e){let r={};t.headers.forEach((s,a)=>{r[a]=s});let n=new URL(t.url);return{version:"2.0",routeKey:null,rawPath:n.pathname,rawQueryString:n.search,cookies:[],headers:r,queryStringParameters:t.query,requestContext:{accountId:null,apiId:null,authentication:{clientCert:{clientCertPem:null,subjectDN:null,issuerDN:null,serialNumber:null,validity:{notBefore:null,notAfter:null}}},authorizer:{jwt:{claims:{},scopes:[]}},domainName:n.hostname,domainPrefix:null,http:{method:t.method,path:n.pathname,protocol:"HTTP/1.1",sourceIp:t.headers.get("CF-Connecting-IP"),userAgent:t.headers.get("user-agent")},requestId:e.requestId,routeKey:null,stage:null,time:(0,xy.toCLFDate)(),timeEpoch:new Date().valueOf()},pathParameters:t.params,stageVariables:null}}o(PI,"buildEventVersion2");async function RI(t,{binaryMediaTypes:e}){let r,n=!1,i=t.headers.get("content-type");if(t.method==="GET"||t.method==="HEAD")r=null;else if(e&&i&&OI(e,i)){let s=await t.arrayBuffer();r=(0,Oy.base64Encode)(new Uint8Array(s)),n=!0}else r=await t.clone().text();return[r,n]}o(RI,"getBodyResult");function OI(t,e){let r=e.split(";")[0].trim().toLowerCase();return t.findIndex(n=>n==="*/*"?!0:n.toLowerCase()===r)>-1}o(OI,"matchesContentType");function xI(t,e=!1){if(!e)return t;let r=(0,Py.parse)(t),n=(0,Py.compile)(t),i={};return r.forEach(s=>{typeof s=="string"?i[s]=`{${s}}`:i[s.name]=`{${s.name}}`}),n(i)}o(xI,"getResourcePath")});var gn=g(yn=>{"use strict";Object.defineProperty(yn,"__esModule",{value:!0});yn.getHandlerUserLogFunction=yn.logBadGatewayResponses=void 0;var NI=Be(),CI=ee(),LI=[502,503,504];async function DI(t,e){if(LI.includes(t.status)){let r=NI.SystemLogMap.getLogger(e),i=await t.clone().text(),s={};for(let[a,c]of t.headers)s[a]=c;r.warn(`BadGatewayResponse ${t.status}`,{status:t.status,statusText:t.statusText,body:i,headers:s})}}o(DI,"logBadGatewayResponses");yn.logBadGatewayResponses=DI;var ld;function UI(t){if(ld===void 0){let r=CI.Environment.instance.runtime.ZUPLO_HANDLER_WRITE_LOG_LEVEL;["debug","info","warn","error"].includes(r??"")||(r="debug"),ld=r}return t.log[ld]}o(UI,"getHandlerUserLogFunction");yn.getHandlerUserLogFunction=UI});var Uy=g(ks=>{"use strict";Object.defineProperty(ks,"__esModule",{value:!0});ks.openApiSpecHandler=void 0;var Dy=D(),MI=ve(),dd=ee(),kI=gn();async function FI(t,e){let r=dd.Environment.instance.build.BUILD_ID,{buildAssetsUrl:n}=dd.Environment.instance,i=e.route.handler.options,{openApiFilePath:s}=i;if(!s)throw new Dy.ConfigurationError("Open API Spec Handler must have 'openApiFilePath' specified");let a=HI(s);if(!a.isValid)throw new Dy.ConfigurationError(a.error);let c;dd.Environment.instance.isLocalDevelopment?c=`${n}/${s.substring(1)}`:c=`${n}/${r}${s.substring(1)}`;let u=await fetch(c,{method:t.method,body:t.body,headers:t.headers});if(u.status!==200)return MI.HttpProblems.notFound(t,e,{detail:"OpenAPI file could not be found."});let l=new Response(u.body,{headers:{"content-type":"application/json"},status:u.status,statusText:u.statusText});return(0,kI.logBadGatewayResponses)(l,e),l}o(FI,"openApiSpecHandler");ks.openApiSpecHandler=FI;var HI=o(t=>t.startsWith("./")?t.startsWith("./config")?t.endsWith(".oas.json")?{isValid:!0}:{isValid:!1,error:"'openApiFilePath' must point to a file ending in '.oas.json'"}:{isValid:!1,error:"'openApiFilePath' must point to a file in your /config directory"}:{isValid:!1,error:"'openApiFilePath' must start with './'"},"validateOpenApiPath")});var My=g(Fs=>{"use strict";Object.defineProperty(Fs,"__esModule",{value:!0});Fs.redirectHandler=void 0;var qI=D();async function $I(t,e){let r=e.route.handler.options;if(!r.location)throw new qI.ConfigurationError("Redirect Handler must have 'location' specified");let n=r.status??302;return new Response(null,{status:n,headers:{location:r.location}})}o($I,"redirectHandler");Fs.redirectHandler=$I});var Fy=g(Hs=>{"use strict";Object.defineProperty(Hs,"__esModule",{value:!0});Hs.urlForwardHandler=void 0;var jI=D(),ky=gn();function VI(t,e){let r=t.endsWith("/"),n=e.startsWith("/");return r&&n?`${t.substring(0,t.length-1)}${e}`:!r&&!n?`${t}/${e}`:`${t}${e}`}o(VI,"join");async function GI(t,e){let r=(0,ky.getHandlerUserLogFunction)(e),n=e.route.handler.options,i=n.forwardSearch!==!1;if(!n.baseUrl)throw new Error("URL Forward Handler must have 'baseUrl' specified");if(!n||typeof n.__rewriteFunction!="function")throw new jI.ConfigurationError("Invalid options for this route");let s={incomingRequestProperties:e.incomingRequestProperties,requestId:e.requestId,route:e.route,custom:e.custom},a=new URL(t.url),c=n.__rewriteFunction(t,s),u=VI(c,a.pathname),l=i?`${u}${a.search}`:u.toString(),d=Date.now();r(`URL Forwarding to '${l}'`);let p=await fetch(l,{method:t.method,body:t.body,headers:t.headers}),y=Date.now()-d;return r(`URL Forward received response ${p.status} - ${p.statusText} in ${y}ms`),(0,ky.logBadGatewayResponses)(p,e),p}o(GI,"urlForwardHandler");Hs.urlForwardHandler=GI});var qy=g(qs=>{"use strict";Object.defineProperty(qs,"__esModule",{value:!0});qs.urlRewriteHandler=void 0;var BI=D(),Hy=gn(),KI=o((t,e)=>{let r=new URL(t),n=new URL(e);for(let[i,s]of n.searchParams.entries())r.searchParams.append(i,s);return r.toString()},"addQuery");async function JI(t,e){let r=(0,Hy.getHandlerUserLogFunction)(e),n=e.route.handler.options,i=n.forwardSearch!==!1,s=n.followRedirects??!1;if(!n||typeof n.__rewriteFunction!="function")throw new BI.ConfigurationError("Invalid options for this route");let a={incomingRequestProperties:e.incomingRequestProperties,requestId:e.requestId,route:e.route,custom:e.custom},c=n.__rewriteFunction(t,a),u=i?KI(c,t.url):c,l=Date.now();r(`URL Rewriting to '${u}'`);let d=await fetch(u.toString(),{method:t.method,body:t.body,headers:t.headers,redirect:s?"follow":"manual"}),p=Date.now()-l;return r(`URL Rewrite received response ${d.status} - ${d.statusText} in ${p}ms`),(0,Hy.logBadGatewayResponses)(d,e),d}o(JI,"urlRewriteHandler");qs.urlRewriteHandler=JI});var jy=g($s=>{"use strict";Object.defineProperty($s,"__esModule",{value:!0});$s.webSocketHandler=void 0;var $y=D(),zI=ed(),WI=Ot(),QI=ee(),YI=gn();async function ZI(t,e){let r=QI.Environment.instance,n=e.route.handler.options,i=(0,YI.getHandlerUserLogFunction)(e);if(!n||!n.rewritePattern)throw new $y.ConfigurationError("WebSocket Handler must have option 'rewritePattern' specified");let s=t.headers.get("Upgrade");if(!s||s!=="websocket")return WI.HttpProblems.badRequest(t,e,{detail:"Request must include header 'Upgrade: websocket'"});if(!n||typeof n.__rewriteFunction!="function")throw new $y.ConfigurationError("Invalid options for this route");let a={incomingRequestProperties:e.incomingRequestProperties,requestId:e.requestId,route:e.route,custom:e.custom},c=n.__rewriteFunction(t,a),u=Date.now();if(i(`Attempting WebSocket connection to '${c}'`),r.isDeno){let p=new Headers(t.headers);if(c.startsWith("service:")){let h=await(0,zI.externalServiceTunnelConfig)(c),m=new URL(c);c=new URL(`${h.serviceBaseUrl}${m.pathname}${m.search}`).toString();for(let T in h.tunnelHeaders)p.set(T,h.tunnelHeaders[T])}c=c.replace(/^(http)/,"ws");try{if(p.get("Authorization")){let h=p.get("Authorization")?.replace("Bearer ","");c+=`?apiKey=${h}`}}catch{}let y=JSON.stringify({url:c});return new Response(y,{headers:p})}c=c.replace(/^(ws)/,"http");let l=await fetch(c,{method:t.method,headers:t.headers,body:t.body});if(l.status!==101||!l.webSocket){let p=await l.text(),y=`WebSocket connection error - ${l.status}: ${l.statusText}, content: '${p}'`;throw new Error(y)}let d=Date.now()-u;return i(`WebSocket connected, received response ${l.status} - ${l.statusText} in ${d}ms`),new Response(null,{status:101,webSocket:l.webSocket})}o(ZI,"webSocketHandler");$s.webSocketHandler=ZI});var Vy=g(_n=>{"use strict";Object.defineProperty(_n,"__esModule",{value:!0});_n.webSocketPolicyProcessor=_n.getWebSocketPolicyFunctions=void 0;var XI=D(),eA=o((t,e)=>t.map((n,i)=>{let s;if(typeof n.module=="object"&&(s=n.module[n.export]),!s||typeof s!="function"){let a=e==="inbound"?"WebSocketInboundPolicy":"WebSocketOutboundPolicy",c=`policy in position: ${i+1}, export name: ${n.export}`;throw new XI.ConfigurationError(`${a} - Websocket policy must be a valid function (${c})`)}return s}),"getWebSocketPolicyFunctions");_n.getWebSocketPolicyFunctions=eA;var tA=o(async(t,e,r,n,i,s)=>{let a=t.data;if(s&&s.length>0){let c=[...s];for(;c.length>0;){let u=c.shift();if(!u)return a;if(a=await u(a,r,e,n,i),a===void 0)return}}return a},"webSocketPolicyProcessor");_n.webSocketPolicyProcessor=tA});var By=g(js=>{"use strict";Object.defineProperty(js,"__esModule",{value:!0});js.webSocketPipelineHandler=void 0;var pd=D(),rA=Ot(),nA=ee(),iA=gn(),hd=Vy();function Gy(t,e,r,n,i){t.addEventListener("close",()=>{e.close()}),t.addEventListener("error",s=>{n.log.error("WebSocket error: ",s),e.send(JSON.stringify(s))}),t.addEventListener("message",s=>{try{o(async c=>{let u=await(0,hd.webSocketPolicyProcessor)(c,t,e,r,n,i);u!==void 0&&e.send(u)},"innerPipeline")(s).catch(n.log.error)}catch(a){n.log.error(a)}})}o(Gy,"wireUpListeners");async function oA(t,e){let r=nA.Environment.instance,n=e.route.handler.options,i=(0,iA.getHandlerUserLogFunction)(e);if(!n||!n.rewritePattern)throw new pd.ConfigurationError("WebSocket Pipeline Handler must have option 'rewritePattern' specified");let s=t.headers.get("Upgrade");if(!s||s!=="websocket")return rA.HttpProblems.badRequest(t,e,{detail:"Request must include header 'Upgrade: websocket'"});if(!n||typeof n.__rewriteFunction!="function")throw new pd.ConfigurationError("Invalid options for this route");let a={incomingRequestProperties:e.incomingRequestProperties,requestId:e.requestId,route:e.route,custom:e.custom},c=n.__rewriteFunction(t,a),u=Date.now();if(i(`Attempting WebSocket connection to '${c}'`),r.isDeno)throw new pd.ConfigurationError("Websocket pipeline handler is currently not supported on working-copy environments");c=c.replace(/^(ws)/,"http");let l=await fetch(c,{method:t.method,headers:t.headers,body:t.body});if(l.status!==101||!l.webSocket){let S=await l.text(),k=`WebSocket connection error - ${l.status}: ${l.statusText}, content: '${S}'`;throw new Error(k)}let d=new WebSocketPair,[p,y]=Object.values(d),h=Date.now()-u;i(`WebSocket connected, received response ${l.status} - ${l.statusText} in ${h}ms`);let m=l.webSocket;m.accept(),y.accept();let v=n.policies&&n.policies.inbound?(0,hd.getWebSocketPolicyFunctions)(n.policies.inbound,"inbound"):[],T=n.policies&&n.policies.outbound?(0,hd.getWebSocketPolicyFunctions)(n.policies.outbound,"outbound"):[];return Gy(y,m,t,e,v),Gy(m,y,t,e,T),new Response(null,{status:101,webSocket:p})}o(oA,"webSocketPipelineHandler");js.webSocketPipelineHandler=oA});var Ky=g(Vs=>{"use strict";Object.defineProperty(Vs,"__esModule",{value:!0});Vs.DynaTraceLoggingPlugin=void 0;var sA=we(),fd=ee(),aA=Ar(),cA=Nt(),uA=mt(),md=class extends cA.LogPlugin{static{o(this,"DynaTraceLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new yd(this.options)}};Vs.DynaTraceLoggingPlugin=md;var yd=class{static{o(this,"DynaTraceTransport")}constructor(e){this.#e=e.url,this.#t=e.apiToken,this.#n=fd.Environment.instance.loggingEnvironmentType,this.#i=fd.Environment.instance.loggingEnvironmentStage,this.#r=fd.Environment.instance.deploymentName}#e;#t;#r;#n;#i;async log(e,r){e.messages.forEach(n=>{let i={timestamp:new Date().toISOString(),message:(0,uA.stringifyNonString)((0,aA.serializeError)(n)),severity:e.level,"log.source":e.logSource,requestId:e.requestId,"custom.environment":this.#r,"custom.environmentStage":this.#i,"custom.environmentType":this.#n,"custom.loggingId":e.loggingId,"custom.rayId":e.rayId===null?void 0:e.rayId};this.batcher.enqueue(i)}),r.waitUntil(this.batcher.waitUntilFlushed())}#o=async e=>{e.length!==0&&await fetch(this.#e,{method:"POST",body:JSON.stringify(e),headers:{"content-type":"application/json; charset=utf-8",authorization:`Api-Token ${this.#t}`}})};batcher=new sA.BatchDispatch("dyna-trace-log-transport",10,this.#o)}});var Jy=g(Gs=>{"use strict";Object.defineProperty(Gs,"__esModule",{value:!0});Gs.LokiLoggingPlugin=void 0;var lA=we(),gd=ee(),dA=Ar(),pA=Nt(),hA=mt(),_d=class extends pA.LogPlugin{static{o(this,"LokiLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new Ed(this.options)}};Gs.LokiLoggingPlugin=_d;var bd=class{static{o(this,"LokiStream")}constructor(e,r,n,i,s){this.level=e,this.environment=r,this.environmentType=n,this.environmentStage=i,this.requestId=s}job="zuplo";level;environment;environmentType;environmentStage;requestId;equals=e=>this.level===e.level&&this.requestId===e.requestId};function fA(t,e){return btoa(`${t}:${e}`)}o(fA,"createBasicDigest");var Ed=class{static{o(this,"LokiTransport")}constructor(e){this.#e=e.url,this.#t=fA(e.username,e.password),this.#n=gd.Environment.instance.loggingEnvironmentType,this.#i=gd.Environment.instance.loggingEnvironmentStage,this.#r=gd.Environment.instance.deploymentName}#e;#t;#r;#n;#i;async log(e,r){let n=new bd(e.level,this.#r,this.#n,this.#i,e.requestId);e.messages.forEach(i=>{let s={stream:n,message:(0,hA.stringifyNonString)((0,dA.serializeError)(i)),nanoSecondEpoch:`${e.timestamp.getTime()}000000`};this.batcher.enqueue(s)}),r.waitUntil(this.batcher.waitUntilFlushed())}#o=e=>{let r={streams:[]};return e.forEach(n=>{let i=r.streams.find(s=>s.stream.equals(n.stream));i||(i={stream:n.stream,values:[]},r.streams.push(i)),i.values.push([n.nanoSecondEpoch,n.message])}),r};#s=async e=>{if(e.length===0)return;let r=this.#o(e);await fetch(this.#e,{method:"POST",body:JSON.stringify(r),headers:{"content-type":"application/json",authorization:`Basic ${this.#t}`}})};batcher=new lA.BatchDispatch("loki-log-transport",10,this.#s)}});var zy=g(Bs=>{"use strict";Object.defineProperty(Bs,"__esModule",{value:!0});Bs.SumoLogicLoggingPlugin=void 0;var mA=we(),wd=ee(),yA=Ar(),gA=Nt(),_A=mt(),vd=class extends gA.LogPlugin{static{o(this,"SumoLogicLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new Td(this.options)}};Bs.SumoLogicLoggingPlugin=vd;var Td=class{static{o(this,"SumoLogicTransport")}constructor(e){this.#e=e.url,this.#i=e.category,this.#o=e.name,this.#r=wd.Environment.instance.loggingEnvironmentType,this.#n=wd.Environment.instance.loggingEnvironmentStage,this.#t=wd.Environment.instance.deploymentName}#e;#t;#r;#n;#i;#o;async log(e,r){e.messages.forEach(n=>{let i={timestamp:new Date().toISOString(),message:(0,_A.stringifyNonString)((0,yA.serializeError)(n)),severity:e.level,source:e.logSource,requestId:e.requestId,environment:this.#t,environmentType:this.#r,environmentStage:this.#n,rayId:e.rayId===null?void 0:e.rayId};this.batcher.enqueue(i)}),r.waitUntil(this.batcher.waitUntilFlushed())}#s=async e=>{if(e.length===0)return;let r=e.map(i=>JSON.stringify(i)).join(`
 `),n=new Headers({"content-type":"application/json; charset=utf-8"});this.#o&&n.set("X-Sumo-Name",this.#o),this.#i&&n.set("X-Sumo-Category",this.#i),await fetch(this.#e,{method:"POST",body:r,headers:n})};batcher=new mA.BatchDispatch("sumo-logic-log-transport",10,this.#s)}});var Qy=g(bn=>{"use strict";Object.defineProperty(bn,"__esModule",{value:!0});bn.VMWareLogInsightTransport=bn.VMWareLogInsightLoggingPlugin=void 0;var bA=D(),EA=we(),Sd=ee(),wA=Nt(),Wy=mt(),vA="d3a5b78f-8236-48f5-b1df-4fe269d41172",Id=class extends wA.LogPlugin{static{o(this,"VMWareLogInsightLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new Ks(this.options)}};bn.VMWareLogInsightLoggingPlugin=Id;var Ks=class{static{o(this,"VMWareLogInsightTransport")}constructor(e){let r;try{r=new URL(e.url)}catch{throw new bA.ConfigurationError(`Invalid option 'url' on 'VMWareLogInsightTransport' plugin. Must be a valid URL, received '${e.url}'`)}this.#e=r.origin,this.#r=Sd.Environment.instance.loggingEnvironmentType,this.#n=Sd.Environment.instance.loggingEnvironmentStage,this.#t=Sd.Environment.instance.deploymentName,this.#i=e.onMessageSending,e.fields&&(this.#o=Object.entries(e.fields).map(([n,i])=>({name:n,content:i})))}#e;#t;#r;#n;#i;#o;async log(e,r){let n=this.buildEntry(e,r);this.batcher.enqueue(n),r.waitUntil(this.batcher.waitUntilFlushed())}buildEntry(e,r){let n=(0,Wy.messagesToMultilineText)(e.messages),i={timestamp:Date.now(),text:n,fields:[{name:"severity",content:e.level.toUpperCase()},{name:"request_id",content:e.requestId},{name:"environment_type",content:this.#r},{name:"environment_stage",content:this.#n},{name:"log_source",content:e.logSource},{name:"atomic_counter",content:e.vectorClock}]};return e.rayId&&i.fields.push({name:"request_ray_id",content:e.rayId}),this.#t&&i.fields.push({name:"environment",content:this.#t}),this.#o&&i.fields.push(...this.#o),r.custom&&Object.entries(r.custom).forEach(([s,a])=>{let c=(0,Wy.stringifyNonStringToText)(a);c&&i.fields.push({name:s,content:c})}),this.#i&&(i=this.#i(i)),i}#s=async e=>{if(e.length===0)return;let r=await fetch(`${this.#e}/api/v1/events/ingest/${vA}`,{method:"POST",body:JSON.stringify(e),headers:{"content-type":"application/json; charset=utf-8"}});if(r.status!==200)try{let n=await r.text();console.error("Error logging to Log Insight",n)}catch(n){console.error(n)}};batcher=new EA.BatchDispatch("vmware-log-insights-log-transport",10,this.#s)};bn.VMWareLogInsightTransport=Ks});var Zy=g(En=>{"use strict";Object.defineProperty(En,"__esModule",{value:!0});En.AWSLogTransport=En.AWSLoggingPlugin=void 0;var TA=we(),Yy=ee(),SA=Ar(),IA=Nt(),AA=mt(),PA=ud(),Ad=class extends IA.LogPlugin{static{o(this,"AWSLoggingPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new Js(this.options)}};En.AWSLoggingPlugin=Ad;var Js=class{static{o(this,"AWSLogTransport")}awsClient;environment;environmentType;logGroupName;logStreamName;region;batcher=new TA.BatchDispatch("aws-log-transport",10,async e=>{if(e.length===0)return;let r=JSON.stringify({logGroupName:this.logGroupName,logStreamName:this.logStreamName,logEvents:e});await this.awsClient.fetch(`https://logs.${this.region}.amazonaws.com`,{headers:{"Content-Type":"application/x-amz-json-1.1","x-amz-Target":"Logs_20140328.PutLogEvents"},body:r,aws:{accessKeyId:this.awsClient.accessKeyId,secretAccessKey:this.awsClient.secretAccessKey,service:this.awsClient.service,region:this.awsClient.region}})});constructor({accessKeyId:e,logStreamName:r,logGroupName:n,secretAccessKey:i,region:s}){this.awsClient=new PA.AwsClient({accessKeyId:e,secretAccessKey:i,service:"logs",region:s}),this.logGroupName=n,this.logStreamName=r,this.region=s,this.environmentType=Yy.Environment.instance.loggingEnvironmentType,this.environment=Yy.Environment.instance.deploymentName}async log(e,r){e.messages.forEach(n=>{let i={timestamp:new Date().getTime(),message:JSON.stringify({data:(0,AA.stringifyNonString)((0,SA.serializeError)(n)),severity:e.level,source:e.logSource,environment:this.environment,requestId:e.requestId,environmentType:this.environmentType,rayId:e.rayId===null?void 0:e.rayId})};this.batcher.enqueue(i)}),r.waitUntil(this.batcher.waitUntilFlushed())}};En.AWSLogTransport=Js});var Xy=g(Oe=>{"use strict";Object.defineProperty(Oe,"__esModule",{value:!0});Oe.AWSLoggingPlugin=Oe.VMWareLogInsightLoggingPlugin=Oe.SumoLogicLoggingPlugin=Oe.LokiLoggingPlugin=Oe.GoogleCloudLoggingPlugin=Oe.DynaTraceLoggingPlugin=Oe.DataDogLoggingPlugin=void 0;var RA=Ul();Object.defineProperty(Oe,"DataDogLoggingPlugin",{enumerable:!0,get:function(){return RA.DataDogLoggingPlugin}});var OA=Ky();Object.defineProperty(Oe,"DynaTraceLoggingPlugin",{enumerable:!0,get:function(){return OA.DynaTraceLoggingPlugin}});var xA=gs();Object.defineProperty(Oe,"GoogleCloudLoggingPlugin",{enumerable:!0,get:function(){return xA.GoogleCloudLoggingPlugin}});var NA=Jy();Object.defineProperty(Oe,"LokiLoggingPlugin",{enumerable:!0,get:function(){return NA.LokiLoggingPlugin}});var CA=zy();Object.defineProperty(Oe,"SumoLogicLoggingPlugin",{enumerable:!0,get:function(){return CA.SumoLogicLoggingPlugin}});var LA=Qy();Object.defineProperty(Oe,"VMWareLogInsightLoggingPlugin",{enumerable:!0,get:function(){return LA.VMWareLogInsightLoggingPlugin}});var DA=Zy();Object.defineProperty(Oe,"AWSLoggingPlugin",{enumerable:!0,get:function(){return DA.AWSLoggingPlugin}})});var eg=g(ar=>{"use strict";Object.defineProperty(ar,"__esModule",{value:!0});ar.DataDogMetricsError=ar.DataDogMetricsTransport=ar.DataDogMetricsPlugin=void 0;var UA=Be(),MA=we(),kA=lo(),Pd=new WeakMap,FA={tags:[]},Rd=class extends kA.MetricsPlugin{static{o(this,"DataDogMetricsPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new zs(this.options)}static setContext(e,r){let n=Pd.get(e);n||(n=FA);let i=Object.assign({...n},r);Pd.set(e,i)}};ar.DataDogMetricsPlugin=Rd;var zs=class{static{o(this,"DataDogMetricsTransport")}#e;#t;#r;#n;#i;#o=void 0;constructor(e){this.#e=e.apiKey,this.#t=e.url??"https://api.datadoghq.com/api/v2/series",this.#r=Object.assign({latency:!0,requestContentLength:!0,responseContentLength:!0},e.metrics),this.#i=e.include??{},this.#n=e.tags??[]}pushMetrics(e,r){this.#o===void 0&&(this.#o=new MA.BatchDispatch("data-dog-metrics-transport",10,this.dispatchFunction,UA.SystemLogMap.getLogger(r)));let n=Math.floor(e.timestamp.getTime()/1e3),i=this.#n.concat(Pd.get(r)?.tags??[]);if(this.#i.country&&i.push(`country:${e.country}`),this.#i.httpMethod&&i.push(`httpMethod:${e.method}`),this.#i.statusCode&&i.push(`statusCode:${e.statusCode}`),this.#i.path){let s=e.systemRouteName||e.routePath;i.push(`path:${s}`)}this.#r.latency&&this.#o.enqueue({metric:"zuplo.request.latency",type:3,points:[{timestamp:n,value:e.durationMs}],tags:i}),this.#r.requestContentLength&&e.requestContentLength&&this.#o.enqueue({metric:"zuplo.request.content_length",type:3,points:[{timestamp:n,value:e.requestContentLength}],tags:i}),this.#r.responseContentLength&&e.responseContentLength&&this.#o.enqueue({metric:"zuplo.response.content_length",type:3,points:[{timestamp:n,value:e.responseContentLength}],tags:i}),r.waitUntil(this.#o.waitUntilFlushed())}dispatchFunction=async e=>{if(e.length===0)return;let r=JSON.stringify({series:e}),n=await fetch(this.#t,{method:"POST",body:r,headers:{"content-type":"application/json","DD-API-KEY":this.#e}});if(!n.ok)throw new Ws(await n.text())}};ar.DataDogMetricsTransport=zs;var Ws=class t extends Error{static{o(this,"DataDogMetricsError")}constructor(e){super(e),Object.setPrototypeOf(this,t.prototype)}};ar.DataDogMetricsError=Ws});var tg=g(cr=>{"use strict";Object.defineProperty(cr,"__esModule",{value:!0});cr.DynaTraceMetricsError=cr.DynaTraceMetricsTransport=cr.DynatraceMetricsPlugin=void 0;var HA=Be(),qA=we(),$A=lo(),Od=new WeakMap,jA={dimensions:[]},xd=class extends $A.MetricsPlugin{static{o(this,"DynatraceMetricsPlugin")}options;constructor(e){super(),this.options=e}getTransport(){return new Qs(this.options)}static setContext(e,r){let n=Od.get(e);n||(n=jA);let i=Object.assign({...n},r);Od.set(e,i)}};cr.DynatraceMetricsPlugin=xd;var Qs=class{static{o(this,"DynaTraceMetricsTransport")}apiToken;#e;#t;dimensions;#r;#n=void 0;constructor(e){this.apiToken=e.apiToken,this.#e=e.url,this.#t=Object.assign({latency:!0,requestContentLength:!0,responseContentLength:!0},e.metrics),this.#r=e.include??{},this.dimensions=e.dimensions??[]}pushMetrics(e,r){this.#n===void 0&&(this.#n=new qA.BatchDispatch("dynatrace-metrics-transport",10,this.dispatchFunction,HA.SystemLogMap.getLogger(r)));let n=Math.floor(e.timestamp.getTime()),i=this.dimensions.concat(Od.get(r)?.dimensions??[]);if(this.#r.country&&i.push(`country="${e.country}"`),this.#r.httpMethod&&i.push(`http_method="${e.method}"`),this.#r.statusCode&&i.push(`status_code="${e.statusCode}"`),this.#r.path){let a=e.systemRouteName||e.routePath;i.push(`path="${a}"`)}let s=i.join(",");this.#t.latency&&this.#n.enqueue(`zuplo.request.latency,${s} ${e.durationMs} ${n}`),this.#t.requestContentLength&&e.requestContentLength&&this.#n.enqueue(`zuplo.request.content_length,${s} ${e.requestContentLength} ${n}`),this.#t.responseContentLength&&e.responseContentLength&&this.#n.enqueue(`zuplo.response.content_length,${s} ${e.responseContentLength} ${n}`),r.waitUntil(this.#n.waitUntilFlushed())}dispatchFunction=async e=>{if(e.length===0)return;let r=e.join(`
-`),n=await fetch(this.#e,{method:"POST",body:r,headers:{"content-type":"text/plain",Authorization:`Api-Token ${this.apiToken}`}});if(!n.ok)throw new Ys(await n.text())}};cr.DynaTraceMetricsTransport=Qs;var Ys=class t extends Error{static{o(this,"DynaTraceMetricsError")}constructor(e){super(e),Object.setPrototypeOf(this,t.prototype)}};cr.DynaTraceMetricsError=Ys});var rg=g(wn=>{"use strict";Object.defineProperty(wn,"__esModule",{value:!0});wn.DynatraceMetricsPlugin=wn.DataDogMetricsPlugin=void 0;var VA=eg();Object.defineProperty(wn,"DataDogMetricsPlugin",{enumerable:!0,get:function(){return VA.DataDogMetricsPlugin}});var GA=tg();Object.defineProperty(wn,"DynatraceMetricsPlugin",{enumerable:!0,get:function(){return GA.DynatraceMetricsPlugin}})});var ng=g(Zs=>{"use strict";Object.defineProperty(Zs,"__esModule",{value:!0});Zs.AuditLogDataStaxProvider=void 0;var Nd=class{static{o(this,"AuditLogDataStaxProvider")}constructor(e){this.#e=e}#e;writeLogBatch=async e=>{await Promise.allSettled(e.map(async r=>{await fetch(this.#e.url,{method:"POST",headers:{"X-Cassandra-Token":this.#e.xCassandraToken,"content-type":"application/json"},body:JSON.stringify(r)})}))}};Zs.AuditLogDataStaxProvider=Nd});var og=g(Xs=>{"use strict";Object.defineProperty(Xs,"__esModule",{value:!0});Xs.AuditLogPlugin=void 0;var BA=Rt(),KA=we(),Cd=class extends BA.InitializableRuntimePlugin{static{o(this,"AuditLogPlugin")}constructor(e,r){super(),this.#e=e,this.#t=r}#e;#t;async initialize(e){new Ld(e,this.#e,this.#t)}};Xs.AuditLogPlugin=Cd;var ig=o(t=>{let e={};return t.forEach((r,n)=>{e[n]=r}),e},"serializableHeaders"),JA={requestFilter:async()=>!0,include:{request:{headers:!0,body:!0},response:{headers:!0,body:!0}}},Ld=class{static{o(this,"AuditPluginImpl")}constructor(e,r,n){this.#t=r;let i={...JA};n?.requestFilter&&(i.requestFilter=n.requestFilter),n?.include?.request&&Object.assign(i,n.include.request),n?.include?.response&&Object.assign(i,n.include.response),this.#e=i,e.addRequestHook(this.#o),this.#r=new KA.BatchDispatch("audit-log",10,this.#n)}#e;#t;#r;#n=async e=>{await this.#t.writeLogBatch(e)};#i=async(e,r,n,i,s,a)=>{try{let c={timestamp:i,durationMs:s,routePath:n.route.path,requestId:n.requestId,userSub:a,request:{url:r.url,method:r.method,headers:this.#e.include?.request?.headers?ig(r.headers):void 0,body:this.#e.include?.request?.body?await r.text():void 0},response:{status:e.status,statusText:e.statusText,headers:this.#e.include?.response?.headers?ig(e.headers):void 0,body:this.#e.include?.response?.body?await e.text():void 0}};this.#r.enqueue(c),n.waitUntil(this.#r.waitUntilFlushed())}catch(c){n.log.error(c)}};#o=async(e,r)=>{try{if(!await this.#e.requestFilter(e,r))return e;let i=new Date,s=Date.now(),a=e.clone();return r.addResponseSendingFinalHook(async(c,u)=>{let l=Date.now(),d=c.clone(),p=this.#i(d,a,r,i,l-s,u.user?.sub).catch(y=>{r.log.error(y)});r.waitUntil(p)}),e}catch(n){return r.log.error(n),e}}}});var ea=g(vn=>{"use strict";Object.defineProperty(vn,"__esModule",{value:!0});vn.getValueFromRequestUser=vn.statusCodesStringToNumberArray=void 0;var sg=D(),ag=new Map;function zA(t){if(typeof t!="string")throw new Error("Input must be a string");if(!/^\d+(?:-\d+)?(?:,\s*\d+(?:-\d+)?)*$/.test(t))throw new Error("Malformed input string");let e=ag.get(t);if(e)return e;let r=t.split(","),n=[];for(let i of r){let s=i.split("-");if(s.length===2){let a=parseInt(s[0],10),c=parseInt(s[1],10);for(let u=a;u<=c;u++)n.push(u)}else n.push(parseInt(i,10))}return ag.set(t,n),n}o(zA,"statusCodesStringToNumberArray");vn.statusCodesStringToNumberArray=zA;function WA(t,e,r){if(!e.startsWith("."))throw new sg.ConfigurationError(`Invalid ${r} - must start with '.' - '${e}' does not`);let n=e.split(".").splice(1),i=t;return n.forEach(s=>{if(i===void 0)throw new sg.RuntimeError(`Error applying ${r} '${e}', reading '${s}'`);i=i[s]}),`${i}`}o(WA,"getValueFromRequestUser");vn.getValueFromRequestUser=WA});var pg=g(Tn=>{"use strict";Object.defineProperty(Tn,"__esModule",{value:!0});Tn.AmberfloMeteringInboundPolicy=Tn.AmberfloMeteringPolicy=void 0;var cg=D(),QA=we(),ug=ea(),dg=new WeakMap,lg={},Dd=class{static{o(this,"AmberfloMeteringPolicy")}static setRequestProperties(e,r){dg.set(e,r)}};Tn.AmberfloMeteringPolicy=Dd;async function YA(t,e,r,n){if(!r.statusCodes)throw new cg.ConfigurationError(`Invalid AmberfloMeterInboundPolicy '${n}': options.statusCodes must be an array of HTTP status code numbers`);let i=Array.isArray(r.statusCodes)?r.statusCodes:(0,ug.statusCodesStringToNumberArray)(r.statusCodes);return e.addResponseSendingFinalHook(async s=>{if(i.includes(s.status)){let a=dg.get(e),c=r.customerId;if(r.customerIdPropertyPath){if(!t.user)throw new cg.RuntimeError(`Unable to apply customerIdPropertyPath '${r.customerIdPropertyPath}' as request.user is 'undefined'.`);c=(0,ug.getValueFromRequestUser)(t.user,r.customerIdPropertyPath,"customerIdPropertyPath")}let u=a?.customerId??c;if(!u){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': customerId cannot be undefined`);return}let l=a?.meterApiName??r.meterApiName;if(!l){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': meterApiName cannot be undefined`);return}let d=a?.meterValue??r.meterValue;if(!d){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': meterValue cannot be undefined`);return}let p={customerId:u,meterApiName:l,meterValue:d,meterTimeInMillis:Date.now(),dimensions:Object.apply(r.dimensions??{},a?.dimensions)},y=lg[r.apiKey];if(!y){let h=r.apiKey,m=t.headers.get("zm-test-id")??"";y=new QA.BatchDispatch("amberflo-ingest-meter",10,async v=>{try{let T=r.url??"https://app.amberflo.io/ingest",S=await fetch(T,{method:"POST",body:JSON.stringify(v),headers:{"content-type":"application/json","x-api-key":h,"zm-test-id":m}});S.ok||e.log.error(`Unexpected response in AmberfloMeteringInboundPolicy '${n}'. ${S.status}: ${await S.text()}`)}catch(T){throw e.log.error(`Error in AmberfloMeteringInboundPolicy '${n}': ${T.message}`),T}}),lg[h]=y}y.enqueue(p),e.waitUntil(y.waitUntilFlushed())}}),t}o(YA,"AmberfloMeteringInboundPolicy");Tn.AmberfloMeteringInboundPolicy=YA});var Ud=g(ta=>{"use strict";Object.defineProperty(ta,"__esModule",{value:!0});ta.sha256=void 0;async function ZA(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest({name:"SHA-256"},e);return[...new Uint8Array(r)].map(i=>i.toString(16).padStart(2,"0")).join("")}o(ZA,"sha256");ta.sha256=ZA});var ur=g(ra=>{"use strict";Object.defineProperty(ra,"__esModule",{value:!0});ra.getPolicyCacheName=void 0;var XA=Ud(),hg=new Map;async function eP(t,e){let r,n=hg.get(t);return n!==void 0?r=n:(r=`zuplo-policy-${await(0,XA.sha256)(JSON.stringify({policyName:t,options:e}))}`,hg.set(t,r)),r}o(eP,"getPolicyCacheName");ra.getPolicyCacheName=eP});var gg=g(Sn=>{"use strict";Object.defineProperty(Sn,"__esModule",{value:!0});Sn.ApiAuthKeyInboundPolicy=Sn.ApiKeyInboundPolicy=void 0;var tP=ur(),rP=_r(),fg=Xl(),Md=D(),nP=Ot(),kd=Be(),Fd=ee(),iP=ms(),mg="key-metadata-cache-type";function oP(t,e){return e.authScheme===""?t:t.replace(`${e.authScheme} `,"")}o(oP,"getKeyValue");async function yg(t,e,r,n){if(!r.bucketName)if(fg.environment.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)r.bucketName=fg.environment.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new Md.ConfigurationError(`ApiKeyInboundPolicy '${n}' - no bucketName property provided`);let i={authHeader:r.authHeader??"authorization",authScheme:r.authScheme??"Bearer",bucketName:r.bucketName,cacheTtlSeconds:r.cacheTtlSeconds??60,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests??!1,disableAutomaticallyAddingKeyHeaderToOpenApi:r.disableAutomaticallyAddingKeyHeaderToOpenApi??!1};if(i.cacheTtlSeconds<60)throw new Md.ConfigurationError(`ApiKeyInboundPolicy '${n}' - minimum cacheTtlSeconds value is 60s, '${i.cacheTtlSeconds}' is invalid`);let s=o(T=>i.allowUnauthenticatedRequests?t:nP.HttpProblems.unauthorized(t,e,{detail:T}),"unauthorizedResponse"),a=t.headers.get(i.authHeader);if(!a)return s("No Authorization Header");if(!a.toLowerCase().startsWith(i.authScheme.toLowerCase()))return s("Invalid Authorization Scheme");let c=oP(a,i);if(!c||c==="")return s("No key present");let u=await sP(c),l=await(0,tP.getPolicyCacheName)(n,i),d=new rP.MemoryZoneReadThroughCache(l,{logger:kd.SystemLogMap.getLogger(e)}),p=await d.get(u);if(p&&p.isValid===!0)return t.user=p.user,t;if(p&&!p.isValid)return p.typeId!==mg&&kd.SystemLogMap.getLogger(e).error(`ApiKeyInboundPolicy '${n}' - cached metadata has invalid typeId '${p.typeId}'`,p),s("Authorization Failed");let y={key:c},h=await(0,iP.fetchRetry)({retryDelayMs:5,retries:2,logger:kd.SystemLogMap.getLogger(e)},`${Fd.Environment.instance.apiKeyServiceUrl}/v1/$validate/${i.bucketName}`,{method:"POST",headers:{"content-type":"application/json","zp-rid":e.requestId,"zp-dn":Fd.Environment.instance.deploymentName??"unknown","User-Agent":Fd.Environment.instance.systemUserAgent},body:JSON.stringify(y)});if(h.status===401)return e.log.info(`ApiKeyInboundPolicy '${n}' - 401 response from Key Service`),s("Authorization Failed");if(h.status!==200){try{let T=await h.text(),S=JSON.parse(T);e.log.error("Unexpected response from key service",S)}catch{e.log.error("Invalid response from key service")}throw new Md.RuntimeError(`ApiKeyInboundPolicy '${n}' - unexpected response from Key Service. Status: ${h.status}`)}let m=await h.json(),v={isValid:!0,typeId:mg,user:{sub:m.name,data:m.metadata}};return t.user=v.user,d.put(u,v,i.cacheTtlSeconds),t}o(yg,"ApiKeyInboundPolicy");Sn.ApiKeyInboundPolicy=yg;async function sP(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("")}o(sP,"hashValue");Sn.ApiAuthKeyInboundPolicy=yg});var Mt=g(na=>{"use strict";Object.defineProperty(na,"__esModule",{value:!0});na.OpenIdJwtInboundPolicy=void 0;var qd=(hs(),Gi(ps)),$d=D(),aP=ve(),Hd={},cP=o(async(t,e)=>{if(!e.jwkUrl||typeof e.jwkUrl!="string")throw new $d.ConfigurationError("Invalid State - jwkUrl not set");Hd[e.jwkUrl]||(Hd[e.jwkUrl]=(0,qd.createRemoteJWKSet)(new URL(e.jwkUrl),e.headers?{headers:e.headers}:void 0));let{payload:r}=await(0,qd.jwtVerify)(t,Hd[e.jwkUrl],{issuer:e.issuer,audience:e.audience});return r},"jwkVerifier"),uP=o(async(t,e)=>{let r;if(e.secret===void 0)throw new Error("secretVerifier requires secret to be defined");if(typeof e.secret=="string"){let s=new TextEncoder().encode(e.secret);r=new Uint8Array(s)}else r=e.secret;let{payload:n}=await(0,qd.jwtVerify)(t,r,{issuer:e.issuer,audience:e.audience});return n},"secretVerifier"),lP=o(async(t,e,r,n)=>{let i=t.headers.get("Authorization"),s="bearer ",a=o(y=>aP.HttpProblems.unauthorized(t,e,{detail:y}),"unauthorizedResponse");if(!r.jwkUrl&&!r.secret)throw new $d.ConfigurationError(`OpenIdJwtInboundPolicy policy '${n}': One of 'jwkUrl' or 'secret' options are required.`);if(r.jwkUrl&&r.secret)throw new $d.ConfigurationError(`OpenIdJwtInboundPolicy policy '${n}': Only one of 'jwkUrl' and 'secret' options should be provided.`);let c=r.jwkUrl?cP:uP,l=await o(async()=>{if(!i)return a("No authorization header");if(i.toLowerCase().indexOf(s)!==0)return a("Invalid bearer token format for authorization header");let y=i.substring(s.length);if(!y||y.length===0)return a("No bearer token on authorization header");try{return await c(y,r)}catch(h){let m=new URL(t.url);return"code"in h&&h.code==="ERR_JWT_EXPIRED"?e.log.warn(`Expired token used on url: ${m.pathname} `,h):e.log.warn(`Invalid token on: ${t.method} ${m.pathname}`,h),a("Invalid token")}},"getJwtOrRejectedResponse")();if(l instanceof Response)return r.allowUnauthenticatedRequests===!0?t:l;let d=r.subPropertyName??"sub",p=l[d];return p?(t.user={sub:p,data:l},t):a(`Token is not valid, no '${d}' property found.`)},"OpenIdJwtInboundPolicy");na.OpenIdJwtInboundPolicy=lP});var _g=g(ia=>{"use strict";Object.defineProperty(ia,"__esModule",{value:!0});ia.Auth0JwtInboundPolicy=void 0;var dP=Mt(),pP=o(async(t,e,r,n)=>(0,dP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://${r.auth0Domain}/`,audience:r.audience,jwkUrl:`https://${r.auth0Domain}/.well-known/jwks.json`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n),"Auth0JwtInboundPolicy");ia.Auth0JwtInboundPolicy=pP});var bg=g(oa=>{"use strict";Object.defineProperty(oa,"__esModule",{value:!0});oa.BasicAuthInboundPolicy=void 0;var hP=ve(),fP=o(async(t,e,r)=>{let n=t.headers.get("Authorization"),i="basic ",s=o(l=>hP.HttpProblems.unauthorized(t,e,{detail:l}),"unauthorizedResponse"),c=await o(async()=>{if(!n)return await s("No Authorization header");if(n.toLowerCase().indexOf(i)!==0)return await s("Invalid Basic token format for Authorization header");let l=n.substring(i.length);if(!l||l.length===0)return await s("No username:password provided");let d=atob(l).normalize(),p=d.indexOf(":");if(p===-1||/[\0-\x1F\x7F]/.test(d))return await s("Invalid basic token value - see https://tools.ietf.org/html/rfc5234#appendix-B.1");let y=d.substring(0,p),h=d.substring(p+1),m=r.accounts.find(v=>v.username===y&&v.password===h);return m||await s("Invalid username or password")},"getAccountOrRejectedResponse")();if(c instanceof Response)return r.allowUnauthenticatedRequests?t:c;let u=c.username;return t.user={sub:u,data:c.data},t},"BasicAuthInboundPolicy");oa.BasicAuthInboundPolicy=fP});var Eg=g(sa=>{"use strict";Object.defineProperty(sa,"__esModule",{value:!0});sa.CachingInboundPolicy=void 0;var mP=ur(),yP=["cdn-cache-control","cloudflare-cdn-cache-control","surrogate-control","cache-tag","expires"];async function gP(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("")}o(gP,"digestMessage");var _P=o(async(t,e)=>{let r=[...e.dangerouslyIgnoreAuthorizationHeader===!0?[]:["authorization"],...e.headers??[]],n=[];for(let[d,p]of t.headers.entries())r.includes(d)&&n.push({key:d.toLowerCase(),value:p});n.sort((d,p)=>d.key.localeCompare(p.key));let i=await gP(JSON.stringify(n)),s=new URL(t.url),a=new URLSearchParams(s.searchParams);a.set("_z-hdr-dgst",i);let c=e.cacheHttpMethods?.includes(t.method.toUpperCase())&&t.method.toUpperCase()!=="GET";c&&a.set("_z-original-method",t.method);let u=`${s.origin}${s.pathname}?${a}`;return new Request(u,{method:c?"GET":t.method})},"createCacheKeyRequest");async function bP(t,e,r,n){let i=await(0,mP.getPolicyCacheName)(n,r),s=await caches.open(i),a=r?.cacheHttpMethods?.map(l=>l.toUpperCase())??["GET"],c=await _P(t,r),u=await s.match(c);return u||(e.addEventListener("responseSent",l=>{try{let d=r.statusCodes??[200,206,301,302,303,404,410],p=l.response.clone();if(!d.includes(p.status)||!a.includes(t.method.toUpperCase()))return;let y=r?.expirationSecondsTtl??60,h=new Response(p.body,p);yP.forEach(m=>h.headers.delete(m)),h.headers.set("cache-control",`s-maxage=${y}`),e.waitUntil(s.put(c,h))}catch(d){e.log.error(`Error in caching-inbound-policy '${n}': "${d.message}"`,d)}}),t)}o(bP,"CachingInboundPolicy");sa.CachingInboundPolicy=bP});var wg=g(aa=>{"use strict";Object.defineProperty(aa,"__esModule",{value:!0});aa.ChangeMethodInboundPolicy=void 0;var EP=D(),wP=Wn(),vP=o(async(t,e,r,n)=>{if(!r.method)throw new EP.ConfigurationError(`ChangeMethodInboundPolicy '${n}' options.method must be valid HttpMethod`);return new wP.ZuploRequest(t,{method:r.method})},"ChangeMethodInboundPolicy");aa.ChangeMethodInboundPolicy=vP});var vg=g(ca=>{"use strict";Object.defineProperty(ca,"__esModule",{value:!0});ca.ClearHeadersInboundPolicy=void 0;var TP=ke(),SP=o(async(t,e,r)=>{let n=[...r.exclude??[]],i=new Headers;return n.forEach(a=>{let c=t.headers.get(a);c&&i.set(a,c)}),new TP.ZuploRequest(t,{headers:i})},"ClearHeadersInboundPolicy");ca.ClearHeadersInboundPolicy=SP});var Tg=g(ua=>{"use strict";Object.defineProperty(ua,"__esModule",{value:!0});ua.ClearHeadersOutboundPolicy=void 0;var IP=o(async(t,e,r,n)=>{let i=[...n.exclude??[]],s=new Headers;return i.forEach(c=>{let u=t.headers.get(c);u&&s.set(c,u)}),new Response(t.body,{headers:s,status:t.status,statusText:t.statusText})},"ClearHeadersOutboundPolicy");ua.ClearHeadersOutboundPolicy=IP});var Sg=g(la=>{"use strict";Object.defineProperty(la,"__esModule",{value:!0});la.ClerkJwtInboundPolicy=void 0;var AP=Mt(),PP=o(async(t,e,r,n)=>{let i=new URL(r.frontendApiUrl.startsWith("https://")||r.frontendApiUrl.startsWith("http://")?r.frontendApiUrl:`https://${r.frontendApiUrl}`),s=new URL(i);return s.pathname="/.well-known/jwks.json",(0,AP.OpenIdJwtInboundPolicy)(t,e,{issuer:i.href.slice(0,-1),jwkUrl:s.toString(),allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)},"ClerkJwtInboundPolicy");la.ClerkJwtInboundPolicy=PP});var Ag=g(da=>{"use strict";Object.defineProperty(da,"__esModule",{value:!0});da.CognitoJwtInboundPolicy=void 0;var Ig=D(),RP=Mt(),OP=o(async(t,e,r,n)=>{if(!r.userPoolId)throw new Ig.ConfigurationError("userPoolId must be set in the options for CognitoJwtInboundPolicy");if(!r.region)throw new Ig.ConfigurationError("region must be set in the options for CognitoJwtInboundPolicy");return(0,RP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://cognito-idp.${r.region}.amazonaws.com/${r.userPoolId}`,jwkUrl:`https://cognito-idp.${r.region}.amazonaws.com/${r.userPoolId}/.well-known/jwks.json`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)},"CognitoJwtInboundPolicy");da.CognitoJwtInboundPolicy=OP});var Rg=g(pa=>{"use strict";Object.defineProperty(pa,"__esModule",{value:!0});pa.CompositeInboundPolicy=void 0;var xP=D(),NP=un(),Pg=Qn(),CP=o(async(t,e,r,n)=>{if(!r.policies||r.policies.length===0)throw new xP.ConfigurationError(`CompositeInboundPolicy '${n}' must have valid policies defined`);let i=NP.Gateway.instance,s=(0,Pg.getInboundPolicyHandlerAndOptions)(r.policies,i?.routeData.policies);return(0,Pg.toStackedInboundHandler)(s)(t,e)},"CompositeInboundPolicy");pa.CompositeInboundPolicy=CP});var lr=g(ha=>{"use strict";Object.defineProperty(ha,"__esModule",{value:!0});ha.optionValidator=void 0;var _i=D();function LP(t,e){let r=o((s,a,c)=>{let u=t[s];if(!(c&&u===void 0)){if(u===void 0)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' is required, but no value was set. If using an environment variable, check that it is set correctly.`);if(a==="array"&&Array.isArray(u))throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be an array. Received type ${typeof u}.`);if(typeof u!==a)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be of type ${a}. Received type ${typeof u}.`);if(typeof u=="string"&&u.length===0)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be a non-empty string. The value received is empty. If using an environment variable, check that it is set correctly.`);if(typeof u=="number"&&isNaN(u))throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be valid number. If using an environment variable, check that it is set correctly.`)}},"validate"),n=o((s,a)=>(r(s,a,!0),{optional:n,required:i}),"optional"),i=o((s,a)=>(r(s,a,!1),{optional:n,required:i}),"required");return{optional:n,required:i}}o(LP,"optionValidator");ha.optionValidator=LP});var Og=g(fa=>{"use strict";Object.defineProperty(fa,"__esModule",{value:!0});fa.FirebaseJwtInboundPolicy=void 0;var DP=lr(),UP=Mt(),MP=o(async(t,e,r,n)=>((0,DP.optionValidator)(r,n).required("projectId","string").optional("allowUnauthenticatedRequests","boolean"),(0,UP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://securetoken.google.com/${r.projectId}`,audience:r.projectId,jwkUrl:"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)),"FirebaseJwtInboundPolicy");fa.FirebaseJwtInboundPolicy=MP});var xg=g(ma=>{"use strict";Object.defineProperty(ma,"__esModule",{value:!0});ma.FormDataToJsonInboundPolicy=void 0;var kP=ke(),FP=o(async(t,e,r)=>{let n="application/x-www-form-urlencoded",i="multipart/form-data",s=t.headers.get("content-type")?.toLowerCase();if(!s||![i,n].includes(s))return r&&r.badRequestIfNotFormData?new Response(`Bad Request - expected content-type '${n}' or ${i}`,{status:400,statusText:"Bad Request"}):t;let a=await t.formData();if(r&&r.optionalHoneypotName&&a.get(r.optionalHoneypotName)!=="")return new Response("Bad Request",{status:400,statusText:"Bad Request"});let c={};for(let[d,p]of a)c[d]=p.toString();let u=new Headers(t.headers);return u.set("content-type","application/json"),u.delete("content-length"),new kP.ZuploRequest(t,{body:JSON.stringify(c),headers:u})},"FormDataToJsonInboundPolicy");ma.FormDataToJsonInboundPolicy=FP});var Ng=g(ya=>{"use strict";Object.defineProperty(ya,"__esModule",{value:!0});ya.GeoFilterInboundPolicy=void 0;var HP=D(),qP=ve(),In="__unknown__",$P=o(async(t,e,r,n)=>{let i={allow:{countries:Pn(r.allow?.countries,"allow.countries",n),regionCodes:Pn(r.allow?.regionCodes,"allow.regionCode",n),asns:Pn(r.allow?.asns,"allow.asOrganization",n)},block:{countries:Pn(r.block?.countries,"block.countries",n),regionCodes:Pn(r.block?.regionCodes,"block.regionCode",n),asns:Pn(r.block?.asns,"block.asOrganization",n)},ignoreUnknown:r.ignoreUnknown!==!1},s=e.incomingRequestProperties.country?.toLowerCase()??In,a=e.incomingRequestProperties.regionCode?.toLowerCase()??In,c=e.incomingRequestProperties.asn?.toString()??In,u=i.ignoreUnknown&&s===In,l=i.ignoreUnknown&&a===In,d=i.ignoreUnknown&&c===In,p=i.allow.countries,y=i.allow.regionCodes,h=i.allow.asns;if(p.length>0&&!p.includes(s)&&!u||y.length>0&&!y.includes(a)&&!l||h.length>0&&!h.includes(c)&&!d)return An(t,e,n,s,a,c);let m=i.block.countries,v=i.block.regionCodes,T=i.block.asns;return m.length>0&&m.includes(s)&&!u||v.length>0&&v.includes(a)&&!l||T.length>0&&T.includes(c)&&!d?An(t,e,n,s,a,c):t},"GeoFilterInboundPolicy");ya.GeoFilterInboundPolicy=$P;function An(t,e,r,n,i,s){return e.log.debug(`Request blocked by GeoFilterInboundPolicy '${r}' (country: '${n}', regionCode: '${i}', asn: '${s}')`),qP.HttpProblems.forbidden(t,e,{geographicContext:{country:n,regionCode:i,asn:s}})}o(An,"blockedResponse");function Pn(t,e,r){if(typeof t=="string")return t.split(",").map(n=>n.trim().toLowerCase());if(typeof t>"u")return[];if(Array.isArray(t))return t.map(n=>n.trim().toLowerCase());throw new HP.ConfigurationError(`Invalid '${e}' for GeoFilterInboundPolicy '${r}': '${t}', must be a string or string[]`)}o(Pn,"toLowerStringArray")});var Cg=g(ga=>{"use strict";Object.defineProperty(ga,"__esModule",{value:!0});ga.JWTScopeValidationInboundPolicy=void 0;var jP=o(async(t,e,r)=>{let n=t.user?.data.scope.split(" ")||[];if(!o((s,a)=>a.every(c=>s.includes(c)),"scopeChecker")(n,r.scopes)){let s={code:"UNAUTHORIZED",help_url:"https://zup.fail/UNAUTHORIZED",message:`JWT must have all the following scopes: ${r.scopes}`};return new Response(JSON.stringify(s),{status:401,statusText:"Unauthorized",headers:{"content-type":"application/json"}})}return t},"JWTScopeValidationInboundPolicy");ga.JWTScopeValidationInboundPolicy=jP});var Dg=g(_a=>{"use strict";Object.defineProperty(_a,"__esModule",{value:!0});_a.MockApiInboundPolicy=void 0;var VP=ve(),GP=o(async(t,e,r,n)=>{let i=e.route.raw().responses;if(!i)return jd(n,t,e,"No responses defined in the OpenAPI document. Add some responses with examples to use this policy.");let s=Object.keys(i),a=[];if(s.length===0)return jd(n,t,e,"No response object defined under responses in the OpenAPI document. Add some response objects with examples to use this policy.");if(s.forEach(c=>{i[c].content&&Object.keys(i[c].content).forEach(l=>{let d=i[c].content[l].examples;d&&Object.keys(d).forEach(y=>{a.push({responseName:c,contentName:l,exampleName:y,exampleValue:d[y]})})})}),a=a.filter(c=>!(r.responsePrefixFilter&&!c.responseName.startsWith(r.responsePrefixFilter)||r.contentType&&c.contentName!==r.contentType||r.exampleName&&c.exampleName!==r.exampleName)),r.random&&a.length>1){let c=Math.floor(Math.random()*a.length);return Lg(a[c])}else return a.length>0?Lg(a[0]):jd(n,t,e,"No examples matching the mocking options found in the OpenAPI document. Add examples to the OpenAPI document matching the options for this policy or change the mocking options to match the examples in the OpenAPI document.")},"MockApiInboundPolicy");_a.MockApiInboundPolicy=GP;function Lg(t){let e=JSON.stringify(t.exampleValue,null,2),r=new Headers;switch(r.set("Content-Type",t.contentName),t.responseName){case"1XX":return new Response(e,{status:100,headers:r});case"2XX":return new Response(e,{status:200,headers:r});case"3XX":return new Response(e,{status:300,headers:r});case"4XX":return new Response(e,{status:400,headers:r});case"5XX":case"default":return new Response(e,{status:500,headers:r});default:return new Response(e,{status:Number(t.responseName),headers:r})}}o(Lg,"generateResponse");var jd=o((t,e,r,n)=>{let i=`Error in policy: ${t} - On route ${e.method} ${r.route.path}. ${n}`;return VP.HttpProblems.internalServerError(e,r,{detail:i})},"getProblemDetailResponse")});var Hg=g(Rn=>{"use strict";Object.defineProperty(Rn,"__esModule",{value:!0});Rn.MoesifInboundPolicy=Rn.setMoesifContext=void 0;var BP=D(),KP=we(),JP="Incoming",zP={logRequestBody:!0,logResponseBody:!0};function Ug(t){let e={};return t.forEach((r,n)=>{e[n]=r}),e}o(Ug,"headersToObject");function Mg(){return new Date().toISOString()}o(Mg,"timestamp");var Vd=new WeakMap,WP={};function QP(t,e){let r=Vd.get(t);r||(r=WP);let n=Object.assign({...r},e);Vd.set(t,n)}o(QP,"setMoesifContext");Rn.setMoesifContext=QP;async function kg(t,e){let r=t.headers.get("content-type"),n=t.clone();if(r&&r.indexOf("json")!==0)try{return await n.json()}catch(s){e.log.error(s)}let i=await n.text();return e.log.debug({textBody:i}),i}o(kg,"readBody");var YP={},Gd;function Fg(){if(!Gd)throw new BP.RuntimeError("Invalid State - no _lastLogger");return Gd}o(Fg,"getLastLogger");function ZP(t){let e=YP[t];return e||(e=new KP.BatchDispatch("moesif-inbound",100,async r=>{let n=JSON.stringify(r);Fg().debug("posting",n);let i=await fetch("https://api.moesif.net/v1/events/batch",{method:"POST",headers:{"content-type":"application/json","X-Moesif-Application-Id":t},body:n});i.ok||Fg().error({status:i.status,body:await i.text()})})),e}o(ZP,"getDispatcher");async function XP(t,e,r,n){Gd=e.log;let i=Mg(),s=Object.assign(zP,r);if(!s.applicationId)throw new Error(`Invalid configuration for MoesifInboundPolicy '${n}' - applicationId is required`);let a=s.logRequestBody?await kg(t,e):void 0;return e.addResponseSendingFinalHook(async(c,u)=>{let l=ZP(s.applicationId),d=t.headers.get("true-client-ip"),p=Vd.get(e)??{},y={time:i,uri:t.url,verb:t.method,body:a,ip_address:d??void 0,api_version:p.apiVersion,headers:Ug(t.headers)},h=s.logResponseBody?await kg(c,e):void 0,m={time:Mg(),status:c.status,headers:Ug(c.headers),body:h},v={request:y,response:m,user_id:p.userId??u.user?.sub,session_token:p.sessionToken,company_id:p.companyId,metadata:p.metadata,direction:JP};l.enqueue(v),e.waitUntil(l.waitUntilFlushed())}),t}o(XP,"MoesifInboundPolicy");Rn.MoesifInboundPolicy=XP});var qg=g(ba=>{"use strict";Object.defineProperty(ba,"__esModule",{value:!0});ba.OktaJwtInboundPolicy=void 0;var eR=Mt(),tR=o(async(t,e,r,n)=>(0,eR.OpenIdJwtInboundPolicy)(t,e,{issuer:r.issuerUrl,audience:r.audience,jwkUrl:`${r.issuerUrl}/v1/keys`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n),"OktaJwtInboundPolicy");ba.OktaJwtInboundPolicy=tR});var $g=g(Ea=>{"use strict";Object.defineProperty(Ea,"__esModule",{value:!0});Ea.PropelAuthJwtInboundPolicy=void 0;var rR=(hs(),Gi(ps)),nR=Mt(),Bd,iR=o(async(t,e,r,n)=>{if(!Bd)try{Bd=await(0,rR.importSPKI)(r.verifierKey,"RS256")}catch(i){throw e.log.error("Could not import verifier key"),i}return(0,nR.OpenIdJwtInboundPolicy)(t,e,{issuer:r.authUrl,secret:Bd,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests,subPropertyName:"user_id"},n)},"PropelAuthJwtInboundPolicy");Ea.PropelAuthJwtInboundPolicy=iR});var jg=g(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.throwIfStateNotObject=G.throwIfStateNotNumber=G.throwIfStateNotString=G.throwIfStateUndefinedOrNull=G.throwIfStateUndefined=G.throwIfOptionNotObject=G.throwIfOptionNotNumber=G.throwIfOptionNotString=G.throwIfOptionUndefinedOrNull=G.throwIfOptionUndefined=G.OptionTypeError=G.OptionUndefinedError=G.throwIfNotNumber=G.throwIfNotString=G.throwIfUndefinedOrNull=G.throwIfUndefined=G.ArgumentTypeError=G.ArgumentUndefinedError=G.ValidationError=void 0;var $e=Br(),et=class extends Error{static{o(this,"ValidationError")}constructor(e){super(e)}};G.ValidationError=et;var bi=class extends et{static{o(this,"ArgumentUndefinedError")}constructor(e){super(`The argument '${e}' is undefined.`)}};G.ArgumentUndefinedError=bi;var Ei=class extends et{static{o(this,"ArgumentTypeError")}constructor(e,r){super(`The argument '${e}' must be of type '${r}'.`)}};G.ArgumentTypeError=Ei;function oR(t,e){if((0,$e.isUndefined)(t))throw new bi(e)}o(oR,"throwIfUndefined");G.throwIfUndefined=oR;function Kd(t,e){if((0,$e.isUndefinedOrNull)(t))throw new bi(e)}o(Kd,"throwIfUndefinedOrNull");G.throwIfUndefinedOrNull=Kd;function sR(t,e){if(Kd(t,e),!(0,$e.isString)(t))throw new Ei(e,"string")}o(sR,"throwIfNotString");G.throwIfNotString=sR;function aR(t,e){if(Kd(t,e),!(0,$e.isNumber)(t))throw new Ei(e,"number")}o(aR,"throwIfNotNumber");G.throwIfNotNumber=aR;var wi=class extends et{static{o(this,"OptionUndefinedError")}constructor(e,r,n){super(`The option '${n}' on the ${e} named '${r}' is undefined.`)}};G.OptionUndefinedError=wi;var On=class extends et{static{o(this,"OptionTypeError")}constructor(e,r,n,i){super(`The option '${n}' on the ${e} named '${r}' must be of type '${i}'.`)}};G.OptionTypeError=On;function cR(t,e,r,n){if((0,$e.isUndefined)(n))throw new wi(t,e,r)}o(cR,"throwIfOptionUndefined");G.throwIfOptionUndefined=cR;function wa(t,e,r,n){if((0,$e.isUndefinedOrNull)(n))throw new wi(t,e,r)}o(wa,"throwIfOptionUndefinedOrNull");G.throwIfOptionUndefinedOrNull=wa;function uR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isString)(n))throw new On(t,e,r,"string")}o(uR,"throwIfOptionNotString");G.throwIfOptionNotString=uR;function lR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isNumber)(n))throw new On(t,e,r,"number")}o(lR,"throwIfOptionNotNumber");G.throwIfOptionNotNumber=lR;function dR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isObject)(n))throw new On(t,e,r,"object")}o(dR,"throwIfOptionNotObject");G.throwIfOptionNotObject=dR;function pR(t,e){if((0,$e.isUndefined)(t))throw new et(e)}o(pR,"throwIfStateUndefined");G.throwIfStateUndefined=pR;function va(t,e){if((0,$e.isUndefinedOrNull)(t))throw new et(e)}o(va,"throwIfStateUndefinedOrNull");G.throwIfStateUndefinedOrNull=va;function hR(t,e){if(va(t,e),!(0,$e.isString)(t))throw new et(e);return!0}o(hR,"throwIfStateNotString");G.throwIfStateNotString=hR;function fR(t,e){if(va(t,e),!(0,$e.isNumber)(t))throw new et(e);return!0}o(fR,"throwIfStateNotNumber");G.throwIfStateNotNumber=fR;function mR(t,e){if(va(t,e),!(0,$e.isObject)(t))throw new et(e);return!0}o(mR,"throwIfStateNotObject");G.throwIfStateNotObject=mR});var Vg=g(xn=>{"use strict";Object.defineProperty(xn,"__esModule",{value:!0});xn.InMemoryRedisClient=xn.StandardRedisClient=void 0;var Jd=D(),Ta=jg(),zd=class t{static{o(this,"StandardRedisClient")}static instance;redisClientUrl;clientAuthToken;userAgent;deploymentName;constructor(e,r,n,i){this.redisClientUrl=e,this.clientAuthToken=r,this.deploymentName=n,this.userAgent=i}static initialize(e,r,n,i){return(0,Ta.throwIfNotString)(e,"redisClientUrl"),(0,Ta.throwIfNotString)(r,"clientAuthToken"),t.instance||(t.instance=new t(e,r,n,i)),t.instance}isEnabled(){return this.redisClientUrl!==void 0&&this.clientAuthToken!==void 0}async fetch({url:e,body:r,method:n,requestId:i}){(0,Ta.throwIfNotString)(e,"url");let s=await fetch(`${this.redisClientUrl}${e}`,{method:n,body:r,headers:{"content-type":"application/json",authorization:`Bearer ${this.clientAuthToken}`,"zp-rid":i,"zp-dn":this.deploymentName,"User-Agent":this.userAgent}}),a=s.headers.get("Content-Type")?.includes("application/json")?await s.json():await s.text();if(s.ok)return a;throw s.status===401?new Jd.SystemError("Redis client failed with 401: Unauthorized"):new Jd.SystemError(`Redis client failed with (${s.status}): ${typeof a=="string"?a:JSON.stringify(a,null,2)}`)}};xn.StandardRedisClient=zd;var Wd=class{static{o(this,"InMemoryRedisClient")}keyValueStore;constructor(){this.keyValueStore=new Map}isEnabled(){return!0}fetch({url:e,body:r,method:n}){if((0,Ta.throwIfNotString)(e,"url"),n==="POST"&&e==="/rate-limit"){let{incrBy:i,expire:s,key:a}=JSON.parse(r),c=Date.now()+s*1e3,u=this.keyValueStore.get(a);u?Date.now()>u.expiresAt?this.keyValueStore.set(a,{value:i,expiresAt:c}):this.keyValueStore.set(a,{value:u.value+i,expiresAt:u.expiresAt}):this.keyValueStore.set(a,{value:i,expiresAt:c});let l=this.keyValueStore.get(a);return Promise.resolve({count:l.value,ttlSeconds:Math.round((l.expiresAt-Date.now())/1e3)})}throw new Jd.SystemError("The in-memory redis client only supports /rate-limit calls")}};xn.InMemoryRedisClient=Wd});var zg=g(Aa=>{"use strict";Object.defineProperty(Aa,"__esModule",{value:!0});Aa.RateLimitInboundPolicy=void 0;var yR=Er(),gR=ke(),_R=ur(),kt=D(),bR=ve(),Gg=Be(),vi=ee(),Bg=Vg(),Kg=Br(),Sa=(0,yR.debug)("zuplo:policies:RateLimitInboundPolicy"),ER="strict",wR=o(t=>{let e=t.headers.get("cf-connecting-ip")??t.headers.get("true-client-ip");if(e)return e;let r=t.headers.get("x-forwarded-for");return r?r.split(",")[0]:"127.0.0.1"},"getRealIP"),vR=o(async t=>({key:`ip-${wR(t)}`}),"getIP"),TR=o(async t=>({key:`user-${t.user?.sub??"anonymous"}`}),"getUser"),SR=o(async()=>({key:"all-2d77ce9d-9a3c-4206-9ab2-668cfd271095"}),"getAll"),Ia;function IR(t,e){let r;if(Ia)return Ia;if(vi.Environment.instance.isLocalDevelopment)return e.info("Using in-memory redis client for local development."),r=new Bg.InMemoryRedisClient,Ia=r,r;let{authApiJWT:n,redisURL:i}=vi.Environment.instance;if(!(0,Kg.isString)(i))throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - rate limit service URL not configured`);if(!(0,Kg.isString)(n))throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - service authentication not configured`);if(i&&(r=Bg.StandardRedisClient.initialize(i,n,vi.Environment.instance.deploymentName??"unknown",vi.Environment.instance.systemUserAgent)),!r||!r.isEnabled())throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - no redis ('${r}') or redis.isEnabled ('${r?.isEnabled}) is false`);return Ia=r,r}o(IR,"getRedisClient");async function Jg(t,e,r,n,i){let s=Math.floor(e*60);return await r.fetch({url:"/rate-limit",method:"POST",body:JSON.stringify({incrBy:1,expire:s,key:t}),requestId:i})}o(Jg,"getCountAndUpdateExpiry");function AR(t,e){let r;if(t.rateLimitBy==="function"){if(!t.identifier)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier must be specified`);if(!t.identifier.module)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.module must be specified`);if(!t.identifier.export)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.export must be specified`);if(r=t.identifier.module[t.identifier.export],!r||typeof r!="function")throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - Custom rate limit function must be a valid function`)}return o(async(i,s,a)=>{let c=await r(i,s,a);if(!c.key){let u=`RateLimitInboundPolicy '${a}' - Custom rate limit function must return a valid key property '${JSON.stringify(c,null,2)}'`;throw s.log.error(u),new kt.RuntimeError(u)}return c},"outerFunction")}o(AR,"wrapUserFunction");var PR="Retry-After",RR=o(async(t,e,r,n)=>{let i=Date.now(),s=Gg.SystemLogMap.getLogger(e),a=o((u,l)=>{if(r.throwOnFailure)throw new kt.SystemError(u,{cause:l});s.error(u,l)},"throwOrLog"),c=o((u,l)=>{let d={};return(!u||u==="retry-after")&&(d[PR]=l.toString()),bR.HttpProblems.tooManyRequests(t,e,void 0,d)},"rateLimited");try{let l={function:AR(r,n),user:TR,ip:vR,all:SR}[r.rateLimitBy],d=await l(t,e,n),p=d.key,y=d.requestsAllowed??r.requestsAllowed,h=d.timeWindowMinutes??r.timeWindowMinutes,m=r.headerMode??"retry-after",v=IR(n,s),S=`bucket/${vi.Environment.instance.build.BUILD_ID}/${n}/${p}`;if((r.mode??ER)==="async"){let C=await(0,_R.getPolicyCacheName)(n,r),re=new gR.ZoneCache(C,{logger:Gg.SystemLogMap.getLogger(e)}),ne=Jg(S,h,v,s,e.requestId),fe=await re.get(S);if(fe!==void 0&&fe<=Date.now()){Sa(`RateLimitInboundPolicy '${n}' - returning 429 from cache for '${S}' (async mode)`);let Ge=Math.round((fe-Date.now())/1e3);return c(m,Ge)}return e.addEventListener("responseSending",Ge=>{try{let E=Ge,F=E.mutableResponse;E.mutableResponse=(async()=>{let Ce=await ne;if(Ce.count>y){let Hc=Date.now()+Ce.ttlSeconds*1e3;return re.put(S,Hc,Ce.ttlSeconds).catch(Mp=>{throw s.error(Mp),Mp}),Sa(`RateLimitInboundPolicy '${n}' - returning 429 from redis for '${S}' (async mode)`),c(m,Ce.ttlSeconds)}return F})()}catch(E){s.error(`RateLimitInboundPolicy '${n}' -error in responseSending`,E)}}),t}let j=await Jg(S,h,v,s,e.requestId);return j.count>y?(Sa(`RateLimitInboundPolicy '${n}' - returning 429 from redis for '${S}' (strict mode)`),c(m,j.ttlSeconds)):t}catch(u){return a(u.message,u),t}finally{let u=Date.now()-i;Sa(`RateLimitInboundPolicy '${n}' - latency ${u}ms`)}},"RateLimitInboundPolicy");Aa.RateLimitInboundPolicy=RR});var Zg=g(Pa=>{"use strict";Object.defineProperty(Pa,"__esModule",{value:!0});Pa.ReadmeMetricsInboundPolicy=void 0;var OR=we(),Qd=ee(),Wg=ea(),Yd;function Qg(t){let e=[];for(let[r,n]of t)e.push({name:r,value:n});return e}o(Qg,"headersToNameValuePairs");function xR(t){let e=[];return Object.entries(t).forEach(([r,n])=>{e.push({name:r,value:n})}),e}o(xR,"queryToNameValueParis");function NR(t){if(t===null)return;let e=parseFloat(t);if(!isNaN(e))return e}o(NR,"parseIntOrUndefined");var Yg={};async function CR(t,e,r,n){let i=new Date,s=Date.now();return Yd||(Yd={name:"zuplo",version:Qd.Environment.instance.build.ZUPLO_VERSION,comment:`zuplo/${Qd.Environment.instance.build.ZUPLO_VERSION}`}),e.addResponseSendingFinalHook(async a=>{try{let c=r.userLabelPropertyPath&&t.user?(0,Wg.getValueFromRequestUser)(t.user,r.userLabelPropertyPath,"userLabelPropertyPath"):t.user?.sub,u=r.userEmailPropertyPath&&t.user?(0,Wg.getValueFromRequestUser)(t.user,r.userEmailPropertyPath,"userEmailPropertyPath"):void 0,l={clientIPAddress:t.headers.get("true-client-ip")??"",development:r.development!==void 0?r.development:Qd.Environment.instance.isDeno,group:{label:c,email:u,id:t.user?.sub??"anonymous"},request:{log:{creator:Yd,entries:[{startedDateTime:i.toISOString(),time:Date.now()-s,request:{method:t.method,url:r.useFullRequestPath?new URL(t.url).pathname:e.route.path,httpVersion:"2",headers:Qg(t.headers),queryString:xR(t.query)},response:{status:a.status,statusText:a.statusText,headers:Qg(a.headers),content:{size:NR(t.headers.get("content-length"))}}}]}}},d=Yg[r.apiKey];if(!d){let p=r.apiKey;d=new OR.BatchDispatch("readme-metering-inbound-policy",10,async y=>{try{let h=r.url??"https://metrics.readme.io/request",m=await fetch(h,{method:"POST",body:JSON.stringify(y),headers:{"content-type":"application/json",authorization:`Basic ${btoa(p+":")}`}});m.status!==202&&e.log.error(`Unexpected response in ReadmeMeteringInboundPolicy '${n}'. ${m.status}: '${await m.text()}'`)}catch(h){throw e.log.error(`Error in ReadmeMeteringInboundPolicy '${n}': '${h.message}'`),h}}),Yg[p]=d}d.enqueue(l),e.waitUntil(d.waitUntilFlushed())}catch(c){e.log.error(c)}}),t}o(CR,"ReadmeMetricsInboundPolicy");Pa.ReadmeMetricsInboundPolicy=CR});var Xg=g(Ra=>{"use strict";Object.defineProperty(Ra,"__esModule",{value:!0});Ra.RemoveHeadersInboundPolicy=void 0;var LR=ke(),DR=D(),UR=o(async(t,e,r,n)=>{let i=r?.headers;if(!i||!Array.isArray(i)||i.length===0)throw new DR.ConfigurationError(`RemoveHeadersInboundPolicy '${n}' options.headers must be a non-empty string array of header names`);let s=new Headers(t.headers);return i.forEach(c=>{s.delete(c)}),new LR.ZuploRequest(t,{headers:s})},"RemoveHeadersInboundPolicy");Ra.RemoveHeadersInboundPolicy=UR});var e_=g(Oa=>{"use strict";Object.defineProperty(Oa,"__esModule",{value:!0});Oa.RemoveHeadersOutboundPolicy=void 0;var MR=D(),kR=o(async(t,e,r,n,i)=>{let s=n?.headers;if(!s||!Array.isArray(s)||s.length===0)throw new MR.ConfigurationError(`RemoveHeadersOutboundPolicy '${i}' options.headers must be a non-empty string array of header names`);let a=new Headers(t.headers);return s.forEach(u=>{a.delete(u)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"RemoveHeadersOutboundPolicy");Oa.RemoveHeadersOutboundPolicy=kR});var t_=g(xa=>{"use strict";Object.defineProperty(xa,"__esModule",{value:!0});xa.RemoveQueryParamsInboundPolicy=void 0;var FR=ke(),HR=D(),qR=o(async(t,e,r,n)=>{let i=r.params;if(!i||!Array.isArray(i)||i.length===0)throw new HR.ConfigurationError(`RemoveQueryParamsInboundPolicy '${n}' options.params must be a non-empty string array of header names`);let s=new URL(t.url);return i.forEach(c=>{s.searchParams.delete(c)}),new FR.ZuploRequest(s.toString(),t)},"RemoveQueryParamsInboundPolicy");xa.RemoveQueryParamsInboundPolicy=qR});var r_=g(Na=>{"use strict";Object.defineProperty(Na,"__esModule",{value:!0});Na.ReplaceStringOutboundPolicy=void 0;var $R=o(async(t,e,r,n)=>{let i=await t.text(),s=n.mode==="regexp"?new RegExp(n.match,"gm"):n.match,a=i.replaceAll(s,n.replaceWith);return new Response(a,{headers:t.headers,status:t.status,statusText:t.statusText})},"ReplaceStringOutboundPolicy");Na.ReplaceStringOutboundPolicy=$R});var i_=g(Ca=>{"use strict";Object.defineProperty(Ca,"__esModule",{value:!0});Ca.RequestSizeLimitInboundPolicy=void 0;var n_=o(()=>new Response("Maximum request size exceeded",{status:413,statusText:"Payload Too Large"}),"payloadTooLarge"),jR=o(async(t,e,r)=>{let n=r.trustContentLengthHeader??!1;if(["GET","HEAD"].includes(t.method))return t;let i=t.headers.get("content-length"),s=i!==null?parseInt(i):void 0;return s&&!isNaN(s)&&s>r.maxSizeInBytes?n_():s&&n?t:(await t.clone().text()).length>r.maxSizeInBytes?n_():t},"RequestSizeLimitInboundPolicy");Ca.RequestSizeLimitInboundPolicy=jR});var La=g(tt=>{"use strict";Object.defineProperty(tt,"__esModule",{value:!0});tt.sanitizedIdentifierName=tt.getIdForRefSchema=tt.getIdForRequestBodySchema=tt.getIdForParameterSchema=tt.getRawOperationDataIdentifierName=void 0;function VR(t,e,r){return`_${Cr(t+"_"+e+"_"+r)}`}o(VR,"getRawOperationDataIdentifierName");tt.getRawOperationDataIdentifierName=VR;function GR(t,e,r,n){return`_${Cr(t.toLowerCase())}_`+e.toLowerCase()+"_"+r.toLowerCase()+`_${n.toLowerCase()}`}o(GR,"getIdForParameterSchema");tt.getIdForParameterSchema=GR;function BR(t,e,r){return`_${Cr(t.toLowerCase())}_`+e.toLowerCase()+`_rb_${Cr(r.toLowerCase())}`}o(BR,"getIdForRequestBodySchema");tt.getIdForRequestBodySchema=BR;function KR(t,e){return`_${Cr(t)}__${Cr(e)}`}o(KR,"getIdForRefSchema");tt.getIdForRefSchema=KR;function Cr(t){let e=[];for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);n>="0".charCodeAt(0)&&n<="9".charCodeAt(0)||n>="A".charCodeAt(0)&&n<="Z".charCodeAt(0)||n>="a".charCodeAt(0)&&n<="z".charCodeAt(0)?e.push(t.charAt(r)):e.push("_")}return e.join("")}o(Cr,"sanitizedIdentifierName");tt.sanitizedIdentifierName=Cr});var Ti=g(Le=>{"use strict";Object.defineProperty(Le,"__esModule",{value:!0});Le.getErrorsFromValidator=Le.shouldReject=Le.shouldLog=Le.logErrors=Le.validateParameters=Le.getParametersForOperation=void 0;var JR=un(),Da=Lr(),zR=La(),WR=o(t=>{let e=t.route.raw();return e.parameters?e.parameters.map(n=>({name:n.name,location:n.in,required:n.required,deprecated:n.deprecated,allowEmptyValue:n.allowEmptyValue})):[]},"getParametersForOperation");Le.getParametersForOperation=WR;var QR=o((t,e,r,n,i)=>{let s=[],a=!0,c=[];return t.forEach(u=>{if(u.required&&!e[u.name])a=!1,s.push(`Required ${i} parameter '${u.name}' not found`);else{let l=(0,zR.getIdForParameterSchema)(r,n,i,u.name),d=JR.Gateway.instance.schemaValidator[l],p=d(e[u.name]),y=(0,Le.getErrorsFromValidator)(d.errors);p||(a=!1,c.push(`${i} parameter: ${u.name} : ${e[u.name]}`),s.push(`Invalid value for ${i} parameter: '${u.name}' ${y.join(", ")}`))}}),{isValid:a,invalidValues:c,errors:s}},"validateParameters");Le.validateParameters=QR;var YR=o((t,e,r,n,i)=>{n?t.log[e](r,n,i):t.log[e](r,i)},"logErrors");Le.logErrors=YR;var ZR=o(t=>t===Da.ValidationOptions.logOnly||t===Da.ValidationOptions.rejectAndLog,"shouldLog");Le.shouldLog=ZR;var XR=o(t=>t===Da.ValidationOptions.rejectOnly||t===Da.ValidationOptions.rejectAndLog,"shouldReject");Le.shouldReject=XR;var eO=o(t=>t?.map(e=>e.instancePath===void 0||e.instancePath===""?e.message??"Unknown validation error":e.instancePath.replace("/","")+" "+e.message)??["Unknown validation error"],"getErrorsFromValidator");Le.getErrorsFromValidator=eO});var o_=g(Ma=>{"use strict";Object.defineProperty(Ma,"__esModule",{value:!0});Ma.handleBodyValidation=void 0;var tO=un(),rO=Lr(),Ua=ve(),nO=La(),Je=Ti();async function iO(t,e,r){if(!r.validateBody||r.validateBody===rO.ValidationOptions.none)return;let n;try{n=await e.clone().json()}catch(h){let m=`Error in request body for method : ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,v=Ua.HttpProblems.badRequest(e,t,{detail:`${m}, see errors property for more details`,errors:`${h}`});if((0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",m,[n],h),(0,Je.shouldReject)(r.validateBody))return v}if(!e.headers.get("Content-Type")){let h=`No content-type header defined in incoming request to ${e.method} in route: ${t.route.path}`,m=Ua.HttpProblems.badRequest(e,t,{detail:h});return(0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",h,[n],[h]),(0,Je.shouldReject)(r.validateBody)?m:void 0}let i=e.headers.get("Content-Type"),s=i.indexOf(";");s>-1&&(i=i.substring(0,s));let a=(0,nO.getIdForRequestBodySchema)(t.route.path,e.method,i),c=tO.Gateway.instance.schemaValidator[a];if(!c){let h=`No schema defined for method: ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,m=Ua.HttpProblems.badRequest(e,t,{detail:h});return(0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",h,[n],[h]),(0,Je.shouldReject)(r.validateBody)?m:void 0}if(c(n))return;let l=c.errors,d="Request body did not pass validation",p=(0,Je.getErrorsFromValidator)(l),y=Ua.HttpProblems.badRequest(e,t,{detail:`${d}, see errors property for more details`,errors:p});if((0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",d,[n],p),(0,Je.shouldReject)(r.validateBody))return y}o(iO,"handleBodyValidation");Ma.handleBodyValidation=iO});var s_=g(ka=>{"use strict";Object.defineProperty(ka,"__esModule",{value:!0});ka.handleHeadersValidation=void 0;var oO=Lr(),sO=ve(),Si=Ti();function aO(t,e,r){if(!r.validateHeaders||r.validateHeaders===oO.ValidationOptions.none)return;let n={};e.headers.forEach((a,c)=>{n[c]=a});let i=(0,Si.getParametersForOperation)(t),s=(0,Si.validateParameters)(i.filter(a=>a.location==="header"),n,t.route.path,e.method.toLowerCase(),"header");if(!s.isValid){let a="Header validation failed",c=sO.HttpProblems.badRequest(e,t,{detail:`${a}, see errors property for more details`,errors:s.errors});if((0,Si.shouldLog)(r.validateHeaders)&&(0,Si.logErrors)(t,r.logLevel??"info",a,s.invalidValues,s.errors),(0,Si.shouldReject)(r.validateHeaders))return c}}o(aO,"handleHeadersValidation");ka.handleHeadersValidation=aO});var a_=g(Fa=>{"use strict";Object.defineProperty(Fa,"__esModule",{value:!0});Fa.handlePathParameterValidation=void 0;var cO=Lr(),uO=ve(),Ii=Ti();function lO(t,e,r){if(!r.validatePathParameters||r.validatePathParameters===cO.ValidationOptions.none)return;let n=(0,Ii.getParametersForOperation)(t),i=(0,Ii.validateParameters)(n.filter(s=>s.location==="path"),e.params,t.route.path,e.method.toLowerCase(),"path");if(!i.isValid){let s="Path parameters validation failed",a=uO.HttpProblems.badRequest(e,t,{detail:`${s}, see errors property for more details`,errors:i.errors});if((0,Ii.shouldLog)(r.validatePathParameters)&&(0,Ii.logErrors)(t,r.logLevel??"info",s,i.invalidValues,i.errors),(0,Ii.shouldReject)(r.validatePathParameters))return a}}o(lO,"handlePathParameterValidation");Fa.handlePathParameterValidation=lO});var c_=g(Ha=>{"use strict";Object.defineProperty(Ha,"__esModule",{value:!0});Ha.handleQueryParameterValidation=void 0;var dO=Lr(),pO=ve(),Ai=Ti();function hO(t,e,r){if(!r.validateQueryParameters||r.validateQueryParameters===dO.ValidationOptions.none)return;let n=(0,Ai.getParametersForOperation)(t),i=(0,Ai.validateParameters)(n.filter(s=>s.location==="query"),e.query,t.route.path,e.method.toLowerCase(),"query");if(!i.isValid){let s="Query parameters validation failed",a=pO.HttpProblems.badRequest(e,t,{detail:`${s}, see errors property for more details`,errors:i.errors});if((0,Ai.shouldLog)(r.validateQueryParameters)&&(0,Ai.logErrors)(t,r.logLevel??"info",s,i.invalidValues,i.errors),(0,Ai.shouldReject)(r.validateQueryParameters))return a}}o(hO,"handleQueryParameterValidation");Ha.handleQueryParameterValidation=hO});var Lr=g(Ft=>{"use strict";Object.defineProperty(Ft,"__esModule",{value:!0});Ft.SchemaBasedRequestValidation=Ft.RequestValidationInboundPolicy=Ft.ValidationOptions=void 0;var fO=o_(),mO=s_(),yO=a_(),gO=c_(),u_;(function(t){t.none="none",t.logOnly="log-only",t.rejectAndLog="reject-and-log",t.rejectOnly="reject-only"})(u_||(Ft.ValidationOptions=u_={}));var _O=o(async(t,e,r)=>{let n=(0,gO.handleQueryParameterValidation)(e,t,r);if(n!==void 0||(n=(0,yO.handlePathParameterValidation)(e,t,r),n!==void 0)||(n=(0,mO.handleHeadersValidation)(e,t,r),n!==void 0))return n;let i=await(0,fO.handleBodyValidation)(e,t,r);return i!==void 0?i:t},"RequestValidationInboundPolicy");Ft.RequestValidationInboundPolicy=_O;Ft.SchemaBasedRequestValidation=Ft.RequestValidationInboundPolicy});var l_=g(qa=>{"use strict";Object.defineProperty(qa,"__esModule",{value:!0});qa.RequireOriginInboundPolicy=void 0;var bO=ke(),EO=D(),wO=o(async(t,e,r,n)=>{if(r.origins===void 0||r.origins.length===0)throw new EO.ConfigurationError(`RequireOriginInboundPolicy '${n}' configuration error - no allowed origins specified`);let i=typeof r.origins=="string"?r.origins.split(","):r.origins;i=i.map(a=>a.trim());let s=t.headers.get("origin");if(!s||!i.includes(s)){let a=r.failureDetail??"Forbidden";return bO.HttpProblems.forbidden(t,e,{detail:a})}return t},"RequireOriginInboundPolicy");qa.RequireOriginInboundPolicy=wO});var d_=g($a=>{"use strict";Object.defineProperty($a,"__esModule",{value:!0});$a.SetBodyInboundPolicy=void 0;var vO=ke(),TO=o(async(t,e,r)=>new vO.ZuploRequest(t,{body:r.body}),"SetBodyInboundPolicy");$a.SetBodyInboundPolicy=TO});var h_=g(ja=>{"use strict";Object.defineProperty(ja,"__esModule",{value:!0});ja.SetHeadersInboundPolicy=void 0;var SO=ke(),p_=D(),IO=o(async(t,e,r,n)=>{let i=r.headers;if(!i||!Array.isArray(i)||i.length==0)throw new p_.ConfigurationError(`SetHeadersInboundPolicy '${n}' options.headers must be a valid array of { name, value }`);let s=new Headers(t.headers);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new p_.ConfigurationError(`SetHeadersInboundPolicy '${n}' each option.headers[] entry must have a name property`);let u=c.overwrite===void 0?!0:c.overwrite;(!s.has(c.name)||u)&&s.set(c.name,c.value)}),new SO.ZuploRequest(t,{headers:s})},"SetHeadersInboundPolicy");ja.SetHeadersInboundPolicy=IO});var m_=g(Va=>{"use strict";Object.defineProperty(Va,"__esModule",{value:!0});Va.SetHeadersOutboundPolicy=void 0;var f_=D(),AO=o(async(t,e,r,n,i)=>{let s=n.headers;if(!s||!Array.isArray(s)||s.length==0)throw new f_.ConfigurationError(`SetHeadersOutboundPolicy '${i}' options.headers must be a valid array of { name, value }`);let a=new Headers(t.headers);return s.forEach(u=>{if(!u.name||u.name.length===0)throw new f_.ConfigurationError(`SetHeadersOutboundPolicy '${i}' each option.headers[] entry must have a name property`);let l=u.overwrite===void 0?!0:u.overwrite;(!a.has(u.name)||l)&&a.set(u.name,u.value)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"SetHeadersOutboundPolicy");Va.SetHeadersOutboundPolicy=AO});var g_=g(Ga=>{"use strict";Object.defineProperty(Ga,"__esModule",{value:!0});Ga.SetQueryParamsInboundPolicy=void 0;var PO=ke(),y_=D(),RO=o(async(t,e,r,n)=>{let i=r.params;if(!i||!Array.isArray(i)||i.length==0)throw new y_.ConfigurationError(`SetQueryParamsInboundPolicy '${n}' options.params must be a valid array of { name, value }`);let s=new URL(t.url);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new y_.ConfigurationError(`SetQueryParamsInboundPolicy '${n}' each option.params[] entry must have a name property`);let u=c.overwrite===void 0?!0:c.overwrite;(!s.searchParams.has(c.name)||u)&&s.searchParams.set(c.name,c.value)}),new PO.ZuploRequest(s.toString(),t)},"SetQueryParamsInboundPolicy");Ga.SetQueryParamsInboundPolicy=RO});var __=g(Ba=>{"use strict";Object.defineProperty(Ba,"__esModule",{value:!0});Ba.SetStatusOutboundPolicy=void 0;var OO=o(async(t,e,r,n,i)=>{if(!n.status||isNaN(n.status)||n.status<100||n.status>599)throw new Error(`Invalid SetStatusOutboundPolicy '${i}' - status must be a valid number between 100 and 599, not '${n.status}'`);return new Response(t.body,{headers:t.headers,status:n.status,statusText:n.statusText??t.statusText})},"SetStatusOutboundPolicy");Ba.SetStatusOutboundPolicy=OO});var b_=g(Ka=>{"use strict";Object.defineProperty(Ka,"__esModule",{value:!0});Ka.SleepInboundPolicy=void 0;var xO=D(),NO=o(async t=>new Promise((r,n)=>{setTimeout(r,t)}),"sleep"),CO=o(async(t,e,r,n)=>{if(!r||r.sleepInMs===void 0||isNaN(r.sleepInMs))throw new xO.ConfigurationError(`SleepInboundPolicy '${n} must have a valid options.sleepInMs value`);return await NO(r.sleepInMs),t},"SleepInboundPolicy");Ka.SleepInboundPolicy=CO});var w_=g(Ja=>{"use strict";Object.defineProperty(Ja,"__esModule",{value:!0});Ja.SupabaseJwtInboundPolicy=void 0;var LO=ke(),E_=D(),DO=ve(),UO=lr(),MO=Mt(),kO=o(async(t,e,r,n)=>{(0,UO.optionValidator)(r,n).required("secret","string").optional("allowUnauthenticatedRequests","boolean").optional("requiredClaims","object");let i={secret:r.secret,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests??!1},s=await(0,MO.OpenIdJwtInboundPolicy)(t,e,i,n);if(s instanceof Response)return s;if(!(s instanceof LO.ZuploRequest))throw new E_.SystemError("Invalid State - SupabaseJwtInboundPolicy encountered a non-response that wasn't a ZuploRequest type')");let a=r.requiredClaims;if(!a)return s;let c=t.user?.data.app_metadata;if(!c)throw new E_.RuntimeError(`SupabaseJwtInboundPolicy policy '${n}' - has requiredClaims but the JWT token had no app_metadata property`);let u=Object.keys(a),l=[];return u.forEach(d=>{let p=a[d];Array.isArray(p)?p.includes(c[d])||l.push(d):p!==c[d]&&l.push(d)}),l.length>0?DO.HttpProblems.unauthorized(t,e,{detail:`Invalid JWT token - missing valid claims ${l.join(", ")}`}):s},"SupabaseJwtInboundPolicy");Ja.SupabaseJwtInboundPolicy=kO});var T_=g(za=>{"use strict";Object.defineProperty(za,"__esModule",{value:!0});za.UpstreamAzureAdServiceAuthInboundPolicy=void 0;var FO=ur(),HO=_r(),v_=D(),qO=Be(),$O=ms(),jO=lr(),VO=o(async(t,e,r,n)=>{(0,jO.optionValidator)(r,n).required("activeDirectoryTenantId","string").required("activeDirectoryClientId","string").required("activeDirectoryClientSecret","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number");let i=await(0,FO.getPolicyCacheName)(n,r),s=new HO.MemoryZoneReadThroughCache(i,{logger:qO.SystemLogMap.getLogger(e)}),a=await s.get(n);if(!a){let c=await GO(r,e);s.put(n,c.access_token,c.expires_in-(r.expirationOffsetSeconds??300)),a=c.access_token}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamAzureAdServiceAuthInboundPolicy");za.UpstreamAzureAdServiceAuthInboundPolicy=VO;async function GO(t,e){let r=new URLSearchParams({client_id:t.activeDirectoryClientId,scope:`${t.activeDirectoryClientId}/.default`,client_secret:t.activeDirectoryClientSecret,grant_type:"client_credentials"}),n=await(0,$O.fetchRetry)({retries:t.tokenRetries??3,retryDelayMs:10},`https://login.microsoftonline.com/${t.activeDirectoryTenantId}/oauth2/v2.0/token`,{headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST",body:r});if(n.status!==200){try{let s=await n.text();e.log.error("Could not get token from Azure AD",s)}catch{}throw new v_.RuntimeError("Could not get token from Azure AD")}let i=await n.json();if(i&&typeof i=="object"&&"access_token"in i&&typeof i.access_token=="string"&&"expires_in"in i&&typeof i.expires_in=="number")return{access_token:i.access_token,expires_in:i.expires_in};throw new v_.RuntimeError("Response returned from Azure AD is not in the expected format.")}o(GO,"getAccessToken")});var I_=g(Wa=>{"use strict";Object.defineProperty(Wa,"__esModule",{value:!0});Wa.UpstreamFirebaseAdminAuthInboundPolicy=void 0;var BO=ur(),KO=_r(),JO=D(),zO=Be(),Zd=sn(),WO=lr(),S_="https://accounts.google.com/o/oauth2/token",Xd,QO=o(async(t,e,r,n)=>{(0,WO.optionValidator)(r,n).required("serviceAccountJson","string"),Xd||(Xd=await Zd.GcpServiceAccount.init(r.serviceAccountJson));let i={scope:["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/firebase.database","https://www.googleapis.com/auth/firebase.messaging","https://www.googleapis.com/auth/identitytoolkit","https://www.googleapis.com/auth/userinfo.email"].join(" ")},s=await(0,BO.getPolicyCacheName)(n,r),a=new KO.MemoryZoneReadThroughCache(s,{logger:zO.SystemLogMap.getLogger(e)}),c=await a.get(n);if(!c){let u=await(0,Zd.getTokenFromGcpServiceAccount)({serviceAccount:Xd,audience:S_,payload:i}),l=await(0,Zd.exchangeGgpJwtForIdToken)(S_,u,{retries:r.tokenRetries??3,retryDelayMs:10});if(!l.access_token)throw new JO.RuntimeError("Invalid OAuth response from Firebase");c=l.access_token,a.put(n,c,(l.expires_in??3600)-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${c}`),t},"UpstreamFirebaseAdminAuthInboundPolicy");Wa.UpstreamFirebaseAdminAuthInboundPolicy=QO});var A_=g(Qa=>{"use strict";Object.defineProperty(Qa,"__esModule",{value:!0});Qa.UpstreamFirebaseUserAuthInboundPolicy=void 0;var YO=ur(),ZO=_r(),Nn=D(),XO=Be(),e0=Ud(),ep=sn(),t0=ea(),r0=lr(),n0="https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",i0=["acr","amr","at_hash","aud","auth_time","azp","cnf","c_hash","exp","iat","iss","jti","nbf","nonce"],tp,o0=o(async(t,e,r,n)=>{if((0,r0.optionValidator)(r,n).required("serviceAccountJson","string").required("webApiKey","string").optional("developerClaims","object").optional("userId","string").optional("userIdPropertyPath","string"),!r.userId&&!r.userIdPropertyPath)throw new Nn.ConfigurationError(`Either 'userId' or 'userIdPropertyPath' options must be set on policy '${n}'.`);let i={};if(typeof r.developerClaims<"u"){for(let p in r.developerClaims)if(Object.prototype.hasOwnProperty.call(r.developerClaims,p)){if(i0.indexOf(p)!==-1)throw new Nn.ConfigurationError(`Developer claim "${p}" is reserved and cannot be specified.`);i[p]=r.developerClaims[p]}}tp||(tp=await ep.GcpServiceAccount.init(r.serviceAccountJson));let s=r.userId;if(!s&&!r.userIdPropertyPath){if(!t.user)throw new Nn.RuntimeError("Unable to set userId for upstream auth policy as request.user is 'undefined'. Do you have an authentication policy before this policy?.");s=t.user?.sub}else if(r.userIdPropertyPath){if(!t.user)throw new Nn.RuntimeError(`Unable to apply userIdPropertyPath '${r.userIdPropertyPath}' as request.user is 'undefined'. Do you have an authentication policy before this policy?`);s=(0,t0.getValueFromRequestUser)(t.user,r.userIdPropertyPath,"userIdPropertyPath")}if(!s)throw new Nn.RuntimeError(`Unable to determine user from for the policy ${n}`);let a=await(0,YO.getPolicyCacheName)(n,r),c=new ZO.MemoryZoneReadThroughCache(a,{logger:XO.SystemLogMap.getLogger(e)}),u={uid:s,claims:i},l=await(0,e0.sha256)(JSON.stringify(u)),d=await c.get(l);if(!d){let p=await(0,ep.getTokenFromGcpServiceAccount)({serviceAccount:tp,audience:n0,payload:u}),y=`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${r.webApiKey}`,h=await(0,ep.exchangeFirebaseJwtForIdToken)(y,p,{retries:r.tokenRetries??3,retryDelayMs:10});if(!h.idToken)throw new Nn.RuntimeError("Invalid token response from Firebase");d=h.idToken,c.put(l,d,(h.expiresIn?parseInt(h.expiresIn):3600)-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${d}`),t},"UpstreamFirebaseUserAuthInboundPolicy");Qa.UpstreamFirebaseUserAuthInboundPolicy=o0});var R_=g(Ya=>{"use strict";Object.defineProperty(Ya,"__esModule",{value:!0});Ya.UpstreamGcpJwtInboundPolicy=void 0;var P_=sn(),s0=lr(),rp,a0=o(async(t,e,r,n)=>{(0,s0.optionValidator)(r,n).required("audience","string").required("serviceAccountJson","string"),rp||(rp=await P_.GcpServiceAccount.init(r.serviceAccountJson));let i=await(0,P_.getTokenFromGcpServiceAccount)({serviceAccount:rp,audience:r.audience});return t.headers.set("Authorization",`Bearer ${i}`),t},"UpstreamGcpJwtInboundPolicy");Ya.UpstreamGcpJwtInboundPolicy=a0});var x_=g(Za=>{"use strict";Object.defineProperty(Za,"__esModule",{value:!0});Za.UpstreamGcpServiceAuthInboundPolicy=void 0;var c0=ur(),u0=Kc(),l0=_r(),d0=D(),np=sn(),p0=lr(),O_="https://www.googleapis.com/oauth2/v4/token",ip,h0=o(async(t,e,r,n)=>{(0,p0.optionValidator)(r,n).required("audience","string").required("serviceAccountJson","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number"),ip||(ip=await np.GcpServiceAccount.init(r.serviceAccountJson));let i=await(0,c0.getPolicyCacheName)(n,r),s;r.useMemoryCacheOnly?s=new u0.MemoryCache(i):s=new l0.MemoryZoneReadThroughCache(i,e);let a=await s.get(n);if(!a){let c=await(0,np.getTokenFromGcpServiceAccount)({serviceAccount:ip,audience:O_,payload:{target_audience:`${r.audience}`}}),{id_token:u}=await(0,np.exchangeGgpJwtForIdToken)(O_,c,{retries:r.tokenRetries??3,retryDelayMs:10});if(!u)throw new d0.RuntimeError("Invalid token response from GCP");a=u,s.put(n,a,3600-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamGcpServiceAuthInboundPolicy");Za.UpstreamGcpServiceAuthInboundPolicy=h0});var C_=g(Xa=>{"use strict";Object.defineProperty(Xa,"__esModule",{value:!0});Xa.ValidateJsonSchemaInbound=void 0;var f0=D(),N_=ve(),m0=o(async(t,e,r)=>{let n=t.clone(),i;try{i=await n.json()}catch{return N_.HttpProblems.badRequest(t,e,{detail:"Invalid JSON body - expected well-formed JSON document"})}if(r.validator(i))return t;let{errors:a}=r.validator;if(!a)throw new f0.SystemError("Invalid state - validator error object is undefined even though validation failed.");let c=a.map(u=>u.instancePath===void 0||u.instancePath===""?"Body "+u.message:u.instancePath.replace("/","")+" "+u.message);return N_.HttpProblems.badRequest(t,e,{detail:"Incoming body did not pass schema validation",errors:c})},"ValidateJsonSchemaInbound");Xa.ValidateJsonSchemaInbound=m0});var L_=g(dr=>{"use strict";Object.defineProperty(dr,"__esModule",{value:!0});dr.serialize=dr.ContentTypes=void 0;dr.ContentTypes={Json:"application/json",Form:"application/x-www-form-urlencoded"};function y0(t,e){if(t!==null)return e&&typeof t=="string"?t:typeof t=="object"&&e?.startsWith(dr.ContentTypes.Form)?new URLSearchParams(t).toString():typeof t=="object"&&e?.startsWith(dr.ContentTypes.Json)||!e?JSON.stringify(t):t}o(y0,"serialize");dr.serialize=y0});var D_=g(ec=>{"use strict";Object.defineProperty(ec,"__esModule",{value:!0});ec.ServiceProviderImpl=void 0;var g0=D(),op=class t{static{o(this,"ServiceProviderImpl")}static#e;services=new Map;constructor(){}static getInstance(){return t.#e||(t.#e=new t),t.#e}setInstance(e){t.#e=e}addService(e,r){if(this.services.get(e))throw new g0.SystemError(`A service with the name ${e} already exists -- you cannot have duplicate services`);this.services.set(e,r)}getService(e){return this.services.get(e)}};ec.ServiceProviderImpl=op});var U_=g(sp=>{"use strict";Object.defineProperty(sp,"__esModule",{value:!0});var _0={100:"Continue",101:"Switching Protocols",102:"Processing",103:"Early Hints",200:"OK",201:"Created",202:"Accepted",203:"Non-Authoritative Information",204:"No Content",205:"Reset Content",206:"Partial Content",207:"Multi-Status",208:"Already Reported",226:"IM Used",300:"Multiple Choices",301:"Moved Permanently",302:"Found",303:"See Other",304:"Not Modified",305:"Use Proxy",307:"Temporary Redirect",308:"Permanent Redirect",400:"Bad Request",401:"Unauthorized",402:"Payment Required",403:"Forbidden",404:"Not Found",405:"Method Not Allowed",406:"Not Acceptable",407:"Proxy Authentication Required",408:"Request Timeout",409:"Conflict",410:"Gone",411:"Length Required",412:"Precondition Failed",413:"Payload Too Large",414:"URI Too Long",415:"Unsupported Media Type",416:"Range Not Satisfiable",417:"Expectation Failed",418:"I'm a Teapot",421:"Misdirected Request",422:"Unprocessable Entity",423:"Locked",424:"Failed Dependency",425:"Too Early",426:"Upgrade Required",428:"Precondition Required",429:"Too Many Requests",431:"Request Header Fields Too Large",451:"Unavailable For Legal Reasons",500:"Internal Server Error",501:"Not Implemented",502:"Bad Gateway",503:"Service Unavailable",504:"Gateway Timeout",505:"HTTP Version Not Supported",506:"Variant Also Negotiates",507:"Insufficient Storage",508:"Loop Detected",509:"Bandwidth Limit Exceeded",510:"Not Extended",511:"Network Authentication Required"};sp.default=_0});var ke=g(f=>{"use strict";var b0=f&&f.__createBinding||(Object.create?function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,n,i)}:function(t,e,r,n){n===void 0&&(n=r),t[n]=e[r]}),M_=f&&f.__exportStar||function(t,e){for(var r in t)r!=="default"&&!Object.prototype.hasOwnProperty.call(e,r)&&b0(e,t,r)},E0=f&&f.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(f,"__esModule",{value:!0});f.ReadmeMetricsInboundPolicy=f.RateLimitInboundPolicy=f.BasicRateLimitInboundPolicy=f.PropelAuthJwtInboundPolicy=f.OpenIdJwtInboundPolicy=f.OktaJwtInboundPolicy=f.setMoesifContext=f.MoesifInboundPolicy=f.MockApiInboundPolicy=f.JWTScopeValidationInboundPolicy=f.GeoFilterInboundPolicy=f.FormDataToJsonInboundPolicy=f.FirebaseJwtInboundPolicy=f.CompositeInboundPolicy=f.CognitoJwtInboundPolicy=f.ClerkJwtInboundPolicy=f.ClearHeadersOutboundPolicy=f.ClearHeadersInboundPolicy=f.ChangeMethodInboundPolicy=f.CachingInboundPolicy=f.BasicAuthInboundPolicy=f.Auth0JwtInboundPolicy=f.ApiKeyInboundPolicy=f.ApiAuthKeyInboundPolicy=f.AmberfloMeteringPolicy=f.AmberfloMeteringInboundPolicy=f.AuditLogPlugin=f.AuditLogDataStaxProvider=f.HttpStatusCode=f.webSocketPipelineHandler=f.webSocketHandler=f.urlRewriteHandler=f.urlForwardHandler=f.redirectHandler=f.openApiSpecHandler=f.awsLambdaHandler=f.AwsLambdaHandlerExtensions=f.purgeGatewayCache=f.Handler=f.originalFetch=f.ConfigurationError=f.isZuploReadableEnvVariableName=f.isRestrictedEnvVariableName=f.environment=f.ContextData=f.ResponseSentEvent=f.ResponseSendingEvent=f.VALID_COMPATIBILITY_DATES=f.ZoneCache=f.MemoryZoneReadThroughCache=void 0;f.sanitizedIdentifierName=f.getRawOperationDataIdentifierName=f.getIdForRequestBodySchema=f.getIdForRefSchema=f.getIdForParameterSchema=f.SystemLogMap=f.httpStatuses=f.SYSTEM_LOGGER=f.API_KEY=f.ServiceProviderImpl=f.serialize=f.ContentTypes=f.Router=f.LookupResult=f.SystemRouteName=f.ZuploRequest=f.ProblemResponseFormatter=f.HttpProblems=f.ValidateJsonSchemaInbound=f.UpstreamGcpServiceAuthInboundPolicy=f.UpstreamGcpJwtInboundPolicy=f.UpstreamFirebaseUserAuthInboundPolicy=f.UpstreamFirebaseAdminAuthInboundPolicy=f.UpstreamAzureAdServiceAuthInboundPolicy=f.SupabaseJwtInboundPolicy=f.SleepInboundPolicy=f.SetStatusOutboundPolicy=f.SetQueryParamsInboundPolicy=f.SetHeadersOutboundPolicy=f.SetHeadersInboundPolicy=f.SetBodyInboundPolicy=f.RequireOriginInboundPolicy=f.SchemaBasedRequestValidation=f.RequestValidationInboundPolicy=f.RequestSizeLimitInboundPolicy=f.ReplaceStringOutboundPolicy=f.RemoveQueryParamsInboundPolicy=f.RemoveHeadersOutboundPolicy=f.RemoveHeadersInboundPolicy=void 0;jp();var w0=_r();Object.defineProperty(f,"MemoryZoneReadThroughCache",{enumerable:!0,get:function(){return w0.MemoryZoneReadThroughCache}});var v0=Wc();Object.defineProperty(f,"ZoneCache",{enumerable:!0,get:function(){return v0.ZoneCache}});var T0=Gp();Object.defineProperty(f,"VALID_COMPATIBILITY_DATES",{enumerable:!0,get:function(){return T0.VALID_COMPATIBILITY_DATES}});var k_=wr();Object.defineProperty(f,"ResponseSendingEvent",{enumerable:!0,get:function(){return k_.ResponseSendingEvent}});Object.defineProperty(f,"ResponseSentEvent",{enumerable:!0,get:function(){return k_.ResponseSentEvent}});var S0=ay();Object.defineProperty(f,"ContextData",{enumerable:!0,get:function(){return S0.ContextData}});var ap=Xl();Object.defineProperty(f,"environment",{enumerable:!0,get:function(){return ap.environment}});Object.defineProperty(f,"isRestrictedEnvVariableName",{enumerable:!0,get:function(){return ap.isRestrictedEnvVariableName}});Object.defineProperty(f,"isZuploReadableEnvVariableName",{enumerable:!0,get:function(){return ap.isZuploReadableEnvVariableName}});var I0=D();Object.defineProperty(f,"ConfigurationError",{enumerable:!0,get:function(){return I0.ConfigurationError}});var A0=td();Object.defineProperty(f,"originalFetch",{enumerable:!0,get:function(){return A0.originalFetch}});var F_=yy();Object.defineProperty(f,"Handler",{enumerable:!0,get:function(){return F_.Handler}});Object.defineProperty(f,"purgeGatewayCache",{enumerable:!0,get:function(){return F_.purgeGatewayCache}});var H_=Ly();Object.defineProperty(f,"AwsLambdaHandlerExtensions",{enumerable:!0,get:function(){return H_.AwsLambdaHandlerExtensions}});Object.defineProperty(f,"awsLambdaHandler",{enumerable:!0,get:function(){return H_.awsLambdaHandler}});var P0=Uy();Object.defineProperty(f,"openApiSpecHandler",{enumerable:!0,get:function(){return P0.openApiSpecHandler}});var R0=My();Object.defineProperty(f,"redirectHandler",{enumerable:!0,get:function(){return R0.redirectHandler}});var O0=Fy();Object.defineProperty(f,"urlForwardHandler",{enumerable:!0,get:function(){return O0.urlForwardHandler}});var x0=qy();Object.defineProperty(f,"urlRewriteHandler",{enumerable:!0,get:function(){return x0.urlRewriteHandler}});var N0=jy();Object.defineProperty(f,"webSocketHandler",{enumerable:!0,get:function(){return N0.webSocketHandler}});var C0=By();Object.defineProperty(f,"webSocketPipelineHandler",{enumerable:!0,get:function(){return C0.webSocketPipelineHandler}});var L0=fu();Object.defineProperty(f,"HttpStatusCode",{enumerable:!0,get:function(){return L0.HttpStatusCode}});M_(Xy(),f);M_(rg(),f);var D0=ng();Object.defineProperty(f,"AuditLogDataStaxProvider",{enumerable:!0,get:function(){return D0.AuditLogDataStaxProvider}});var U0=og();Object.defineProperty(f,"AuditLogPlugin",{enumerable:!0,get:function(){return U0.AuditLogPlugin}});var q_=pg();Object.defineProperty(f,"AmberfloMeteringInboundPolicy",{enumerable:!0,get:function(){return q_.AmberfloMeteringInboundPolicy}});Object.defineProperty(f,"AmberfloMeteringPolicy",{enumerable:!0,get:function(){return q_.AmberfloMeteringPolicy}});var $_=gg();Object.defineProperty(f,"ApiAuthKeyInboundPolicy",{enumerable:!0,get:function(){return $_.ApiAuthKeyInboundPolicy}});Object.defineProperty(f,"ApiKeyInboundPolicy",{enumerable:!0,get:function(){return $_.ApiKeyInboundPolicy}});var M0=_g();Object.defineProperty(f,"Auth0JwtInboundPolicy",{enumerable:!0,get:function(){return M0.Auth0JwtInboundPolicy}});var k0=bg();Object.defineProperty(f,"BasicAuthInboundPolicy",{enumerable:!0,get:function(){return k0.BasicAuthInboundPolicy}});var F0=Eg();Object.defineProperty(f,"CachingInboundPolicy",{enumerable:!0,get:function(){return F0.CachingInboundPolicy}});var H0=wg();Object.defineProperty(f,"ChangeMethodInboundPolicy",{enumerable:!0,get:function(){return H0.ChangeMethodInboundPolicy}});var q0=vg();Object.defineProperty(f,"ClearHeadersInboundPolicy",{enumerable:!0,get:function(){return q0.ClearHeadersInboundPolicy}});var $0=Tg();Object.defineProperty(f,"ClearHeadersOutboundPolicy",{enumerable:!0,get:function(){return $0.ClearHeadersOutboundPolicy}});var j0=Sg();Object.defineProperty(f,"ClerkJwtInboundPolicy",{enumerable:!0,get:function(){return j0.ClerkJwtInboundPolicy}});var V0=Ag();Object.defineProperty(f,"CognitoJwtInboundPolicy",{enumerable:!0,get:function(){return V0.CognitoJwtInboundPolicy}});var G0=Rg();Object.defineProperty(f,"CompositeInboundPolicy",{enumerable:!0,get:function(){return G0.CompositeInboundPolicy}});var B0=Og();Object.defineProperty(f,"FirebaseJwtInboundPolicy",{enumerable:!0,get:function(){return B0.FirebaseJwtInboundPolicy}});var K0=xg();Object.defineProperty(f,"FormDataToJsonInboundPolicy",{enumerable:!0,get:function(){return K0.FormDataToJsonInboundPolicy}});var J0=Ng();Object.defineProperty(f,"GeoFilterInboundPolicy",{enumerable:!0,get:function(){return J0.GeoFilterInboundPolicy}});var z0=Cg();Object.defineProperty(f,"JWTScopeValidationInboundPolicy",{enumerable:!0,get:function(){return z0.JWTScopeValidationInboundPolicy}});var W0=Dg();Object.defineProperty(f,"MockApiInboundPolicy",{enumerable:!0,get:function(){return W0.MockApiInboundPolicy}});var j_=Hg();Object.defineProperty(f,"MoesifInboundPolicy",{enumerable:!0,get:function(){return j_.MoesifInboundPolicy}});Object.defineProperty(f,"setMoesifContext",{enumerable:!0,get:function(){return j_.setMoesifContext}});var Q0=qg();Object.defineProperty(f,"OktaJwtInboundPolicy",{enumerable:!0,get:function(){return Q0.OktaJwtInboundPolicy}});var Y0=Mt();Object.defineProperty(f,"OpenIdJwtInboundPolicy",{enumerable:!0,get:function(){return Y0.OpenIdJwtInboundPolicy}});var Z0=$g();Object.defineProperty(f,"PropelAuthJwtInboundPolicy",{enumerable:!0,get:function(){return Z0.PropelAuthJwtInboundPolicy}});var V_=zg();Object.defineProperty(f,"BasicRateLimitInboundPolicy",{enumerable:!0,get:function(){return V_.RateLimitInboundPolicy}});Object.defineProperty(f,"RateLimitInboundPolicy",{enumerable:!0,get:function(){return V_.RateLimitInboundPolicy}});var X0=Zg();Object.defineProperty(f,"ReadmeMetricsInboundPolicy",{enumerable:!0,get:function(){return X0.ReadmeMetricsInboundPolicy}});var ex=Xg();Object.defineProperty(f,"RemoveHeadersInboundPolicy",{enumerable:!0,get:function(){return ex.RemoveHeadersInboundPolicy}});var tx=e_();Object.defineProperty(f,"RemoveHeadersOutboundPolicy",{enumerable:!0,get:function(){return tx.RemoveHeadersOutboundPolicy}});var rx=t_();Object.defineProperty(f,"RemoveQueryParamsInboundPolicy",{enumerable:!0,get:function(){return rx.RemoveQueryParamsInboundPolicy}});var nx=r_();Object.defineProperty(f,"ReplaceStringOutboundPolicy",{enumerable:!0,get:function(){return nx.ReplaceStringOutboundPolicy}});var ix=i_();Object.defineProperty(f,"RequestSizeLimitInboundPolicy",{enumerable:!0,get:function(){return ix.RequestSizeLimitInboundPolicy}});var G_=Lr();Object.defineProperty(f,"RequestValidationInboundPolicy",{enumerable:!0,get:function(){return G_.RequestValidationInboundPolicy}});Object.defineProperty(f,"SchemaBasedRequestValidation",{enumerable:!0,get:function(){return G_.SchemaBasedRequestValidation}});var ox=l_();Object.defineProperty(f,"RequireOriginInboundPolicy",{enumerable:!0,get:function(){return ox.RequireOriginInboundPolicy}});var sx=d_();Object.defineProperty(f,"SetBodyInboundPolicy",{enumerable:!0,get:function(){return sx.SetBodyInboundPolicy}});var ax=h_();Object.defineProperty(f,"SetHeadersInboundPolicy",{enumerable:!0,get:function(){return ax.SetHeadersInboundPolicy}});var cx=m_();Object.defineProperty(f,"SetHeadersOutboundPolicy",{enumerable:!0,get:function(){return cx.SetHeadersOutboundPolicy}});var ux=g_();Object.defineProperty(f,"SetQueryParamsInboundPolicy",{enumerable:!0,get:function(){return ux.SetQueryParamsInboundPolicy}});var lx=__();Object.defineProperty(f,"SetStatusOutboundPolicy",{enumerable:!0,get:function(){return lx.SetStatusOutboundPolicy}});var dx=b_();Object.defineProperty(f,"SleepInboundPolicy",{enumerable:!0,get:function(){return dx.SleepInboundPolicy}});var px=w_();Object.defineProperty(f,"SupabaseJwtInboundPolicy",{enumerable:!0,get:function(){return px.SupabaseJwtInboundPolicy}});var hx=T_();Object.defineProperty(f,"UpstreamAzureAdServiceAuthInboundPolicy",{enumerable:!0,get:function(){return hx.UpstreamAzureAdServiceAuthInboundPolicy}});var fx=I_();Object.defineProperty(f,"UpstreamFirebaseAdminAuthInboundPolicy",{enumerable:!0,get:function(){return fx.UpstreamFirebaseAdminAuthInboundPolicy}});var mx=A_();Object.defineProperty(f,"UpstreamFirebaseUserAuthInboundPolicy",{enumerable:!0,get:function(){return mx.UpstreamFirebaseUserAuthInboundPolicy}});var yx=R_();Object.defineProperty(f,"UpstreamGcpJwtInboundPolicy",{enumerable:!0,get:function(){return yx.UpstreamGcpJwtInboundPolicy}});var gx=x_();Object.defineProperty(f,"UpstreamGcpServiceAuthInboundPolicy",{enumerable:!0,get:function(){return gx.UpstreamGcpServiceAuthInboundPolicy}});var _x=C_();Object.defineProperty(f,"ValidateJsonSchemaInbound",{enumerable:!0,get:function(){return _x.ValidateJsonSchemaInbound}});var bx=ve();Object.defineProperty(f,"HttpProblems",{enumerable:!0,get:function(){return bx.HttpProblems}});var Ex=io();Object.defineProperty(f,"ProblemResponseFormatter",{enumerable:!0,get:function(){return Ex.ProblemResponseFormatter}});var wx=Wn();Object.defineProperty(f,"ZuploRequest",{enumerable:!0,get:function(){return wx.ZuploRequest}});var vx=Sr();Object.defineProperty(f,"SystemRouteName",{enumerable:!0,get:function(){return vx.SystemRouteName}});var B_=Gl();Object.defineProperty(f,"LookupResult",{enumerable:!0,get:function(){return B_.LookupResult}});Object.defineProperty(f,"Router",{enumerable:!0,get:function(){return B_.Router}});var K_=L_();Object.defineProperty(f,"ContentTypes",{enumerable:!0,get:function(){return K_.ContentTypes}});Object.defineProperty(f,"serialize",{enumerable:!0,get:function(){return K_.serialize}});var Tx=D_();Object.defineProperty(f,"ServiceProviderImpl",{enumerable:!0,get:function(){return Tx.ServiceProviderImpl}});var J_=Tu();Object.defineProperty(f,"API_KEY",{enumerable:!0,get:function(){return J_.API_KEY}});Object.defineProperty(f,"SYSTEM_LOGGER",{enumerable:!0,get:function(){return J_.SYSTEM_LOGGER}});var Sx=U_();Object.defineProperty(f,"httpStatuses",{enumerable:!0,get:function(){return E0(Sx).default}});var Ix=Be();Object.defineProperty(f,"SystemLogMap",{enumerable:!0,get:function(){return Ix.SystemLogMap}});var Pi=La();Object.defineProperty(f,"getIdForParameterSchema",{enumerable:!0,get:function(){return Pi.getIdForParameterSchema}});Object.defineProperty(f,"getIdForRefSchema",{enumerable:!0,get:function(){return Pi.getIdForRefSchema}});Object.defineProperty(f,"getIdForRequestBodySchema",{enumerable:!0,get:function(){return Pi.getIdForRequestBodySchema}});Object.defineProperty(f,"getRawOperationDataIdentifierName",{enumerable:!0,get:function(){return Pi.getRawOperationDataIdentifierName}});Object.defineProperty(f,"sanitizedIdentifierName",{enumerable:!0,get:function(){return Pi.sanitizedIdentifierName}})});var z_=g(Cn=>{"use strict";Object.defineProperty(Cn,"__esModule",{value:!0});Cn.BaseCryptoBeta=Cn.supportedDigests=void 0;Cn.supportedDigests=["sha-1","sha-256","sha-384","sha-512"];var cp=class{static{o(this,"BaseCryptoBeta")}};Cn.BaseCryptoBeta=cp});var W_=g(tc=>{"use strict";Object.defineProperty(tc,"__esModule",{value:!0});tc.WorkerCryptoBeta=void 0;var up=z_(),Ax=D(),lp=class extends up.BaseCryptoBeta{static{o(this,"WorkerCryptoBeta")}async digest(e,r){if(!up.supportedDigests.includes(e.toLowerCase()))throw new Ax.RuntimeError(`Algorithm ${e} is not supported. Try using ${up.supportedDigests.join(", ")}`);let n=new TextEncoder().encode(r),i=await crypto.subtle.digest(e,n);return Array.from(new Uint8Array(i)).map(c=>c.toString(16).padStart(2,"0")).join("")}};tc.WorkerCryptoBeta=lp});var Q_=g(rc=>{"use strict";Object.defineProperty(rc,"__esModule",{value:!0});rc.BaseKeyValueStore=void 0;var dp=class{static{o(this,"BaseKeyValueStore")}context;constructor(e){this.context=e}};rc.BaseKeyValueStore=dp});var Z_=g(nc=>{"use strict";Object.defineProperty(nc,"__esModule",{value:!0});nc.WorkerKeyValueStore=void 0;var Y_=D(),Px=Q_(),pp=class extends Px.BaseKeyValueStore{static{o(this,"WorkerKeyValueStore")}#e;constructor(e){super(e);let n=globalThis.ZUPLO_KV;if(!n)throw new Y_.FeatureNotEnabledError("The Key Value Store feature is not enabled for this project.");this.#e=n}put(e,r,n){if(typeof e!="string")throw new Y_.ConfigurationError("value must be of type string");return this.#e.put(e,r,n?{expirationTtl:n.expirationSecondsTtl}:void 0)}get(e,r){return this.#e.get(e,{type:"text",cacheTtl:r?.cacheSecondsTtl})}delete(e){return this.#e.delete(e)}};nc.WorkerKeyValueStore=pp});var Ot=g(ct=>{"use strict";var Rx=ct&&ct.__createBinding||(Object.create?function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,n,i)}:function(t,e,r,n){n===void 0&&(n=r),t[n]=e[r]}),Ox=ct&&ct.__exportStar||function(t,e){for(var r in t)r!=="default"&&!Object.prototype.hasOwnProperty.call(e,r)&&Rx(e,t,r)};Object.defineProperty(ct,"__esModule",{value:!0});ct.KeyValueStore=ct.CryptoBeta=void 0;Ox(ke(),ct);var xx=W_();Object.defineProperty(ct,"CryptoBeta",{enumerable:!0,get:function(){return xx.WorkerCryptoBeta}});var Nx=Z_();Object.defineProperty(ct,"KeyValueStore",{enumerable:!0,get:function(){return Nx.WorkerKeyValueStore}})});var FN={};Vi(FN,{GraphQLComplexityLimitInboundPolicy:()=>xb,GraphQLDisableIntrospectionInboundPolicy:()=>Cb});module.exports=Gi(FN);var Gn=Fp(Ot());function B(t,e){if(!!!t)throw new Error(e)}o(B,"devAssert");function be(t){return typeof t=="object"&&t!==null}o(be,"isObjectLike");function Tt(t,e){if(!!!t)throw new Error(e??"Unexpected invariant triggered.")}o(Tt,"invariant");var Cx=/\r\n|[\n\r]/g;function Ln(t,e){let r=0,n=1;for(let i of t.body.matchAll(Cx)){if(typeof i.index=="number"||Tt(!1),i.index>=e)break;r=i.index+i[0].length,n+=1}return{line:n,column:e+1-r}}o(Ln,"getLocation");function hp(t){return ic(t.source,Ln(t.source,t.start))}o(hp,"printLocation");function ic(t,e){let r=t.locationOffset.column-1,n="".padStart(r)+t.body,i=e.line-1,s=t.locationOffset.line-1,a=e.line+s,c=e.line===1?r:0,u=e.column+c,l=`${t.name}:${a}:${u}
+`),n=await fetch(this.#e,{method:"POST",body:r,headers:{"content-type":"text/plain",Authorization:`Api-Token ${this.apiToken}`}});if(!n.ok)throw new Ys(await n.text())}};cr.DynaTraceMetricsTransport=Qs;var Ys=class t extends Error{static{o(this,"DynaTraceMetricsError")}constructor(e){super(e),Object.setPrototypeOf(this,t.prototype)}};cr.DynaTraceMetricsError=Ys});var rg=g(wn=>{"use strict";Object.defineProperty(wn,"__esModule",{value:!0});wn.DynatraceMetricsPlugin=wn.DataDogMetricsPlugin=void 0;var VA=eg();Object.defineProperty(wn,"DataDogMetricsPlugin",{enumerable:!0,get:function(){return VA.DataDogMetricsPlugin}});var GA=tg();Object.defineProperty(wn,"DynatraceMetricsPlugin",{enumerable:!0,get:function(){return GA.DynatraceMetricsPlugin}})});var ng=g(Zs=>{"use strict";Object.defineProperty(Zs,"__esModule",{value:!0});Zs.AuditLogDataStaxProvider=void 0;var Nd=class{static{o(this,"AuditLogDataStaxProvider")}constructor(e){this.#e=e}#e;writeLogBatch=async e=>{await Promise.allSettled(e.map(async r=>{await fetch(this.#e.url,{method:"POST",headers:{"X-Cassandra-Token":this.#e.xCassandraToken,"content-type":"application/json"},body:JSON.stringify(r)})}))}};Zs.AuditLogDataStaxProvider=Nd});var og=g(Xs=>{"use strict";Object.defineProperty(Xs,"__esModule",{value:!0});Xs.AuditLogPlugin=void 0;var BA=Rt(),KA=we(),Cd=class extends BA.InitializableRuntimePlugin{static{o(this,"AuditLogPlugin")}constructor(e,r){super(),this.#e=e,this.#t=r}#e;#t;async initialize(e){new Ld(e,this.#e,this.#t)}};Xs.AuditLogPlugin=Cd;var ig=o(t=>{let e={};return t.forEach((r,n)=>{e[n]=r}),e},"serializableHeaders"),JA={requestFilter:async()=>!0,include:{request:{headers:!0,body:!0},response:{headers:!0,body:!0}}},Ld=class{static{o(this,"AuditPluginImpl")}constructor(e,r,n){this.#t=r;let i={...JA};n?.requestFilter&&(i.requestFilter=n.requestFilter),n?.include?.request&&Object.assign(i,n.include.request),n?.include?.response&&Object.assign(i,n.include.response),this.#e=i,e.addRequestHook(this.#o),this.#r=new KA.BatchDispatch("audit-log",10,this.#n)}#e;#t;#r;#n=async e=>{await this.#t.writeLogBatch(e)};#i=async(e,r,n,i,s,a)=>{try{let c={timestamp:i,durationMs:s,routePath:n.route.path,requestId:n.requestId,userSub:a,request:{url:r.url,method:r.method,headers:this.#e.include?.request?.headers?ig(r.headers):void 0,body:this.#e.include?.request?.body?await r.text():void 0},response:{status:e.status,statusText:e.statusText,headers:this.#e.include?.response?.headers?ig(e.headers):void 0,body:this.#e.include?.response?.body?await e.text():void 0}};this.#r.enqueue(c),n.waitUntil(this.#r.waitUntilFlushed())}catch(c){n.log.error(c)}};#o=async(e,r)=>{try{if(!await this.#e.requestFilter(e,r))return e;let i=new Date,s=Date.now(),a=e.clone();return r.addResponseSendingFinalHook(async(c,u)=>{let l=Date.now(),d=c.clone(),p=this.#i(d,a,r,i,l-s,u.user?.sub).catch(y=>{r.log.error(y)});r.waitUntil(p)}),e}catch(n){return r.log.error(n),e}}}});var ea=g(vn=>{"use strict";Object.defineProperty(vn,"__esModule",{value:!0});vn.getValueFromRequestUser=vn.statusCodesStringToNumberArray=void 0;var sg=D(),ag=new Map;function zA(t){if(typeof t!="string")throw new Error("Input must be a string");if(!/^\d+(?:-\d+)?(?:,\s*\d+(?:-\d+)?)*$/.test(t))throw new Error("Malformed input string");let e=ag.get(t);if(e)return e;let r=t.split(","),n=[];for(let i of r){let s=i.split("-");if(s.length===2){let a=parseInt(s[0],10),c=parseInt(s[1],10);for(let u=a;u<=c;u++)n.push(u)}else n.push(parseInt(i,10))}return ag.set(t,n),n}o(zA,"statusCodesStringToNumberArray");vn.statusCodesStringToNumberArray=zA;function WA(t,e,r){if(!e.startsWith("."))throw new sg.ConfigurationError(`Invalid ${r} - must start with '.' - '${e}' does not`);let n=e.split(".").splice(1),i=t;return n.forEach(s=>{if(i===void 0)throw new sg.RuntimeError(`Error applying ${r} '${e}', reading '${s}'`);i=i[s]}),`${i}`}o(WA,"getValueFromRequestUser");vn.getValueFromRequestUser=WA});var pg=g(Tn=>{"use strict";Object.defineProperty(Tn,"__esModule",{value:!0});Tn.AmberfloMeteringInboundPolicy=Tn.AmberfloMeteringPolicy=void 0;var cg=D(),QA=we(),ug=ea(),dg=new WeakMap,lg={},Dd=class{static{o(this,"AmberfloMeteringPolicy")}static setRequestProperties(e,r){dg.set(e,r)}};Tn.AmberfloMeteringPolicy=Dd;async function YA(t,e,r,n){if(!r.statusCodes)throw new cg.ConfigurationError(`Invalid AmberfloMeterInboundPolicy '${n}': options.statusCodes must be an array of HTTP status code numbers`);let i=Array.isArray(r.statusCodes)?r.statusCodes:(0,ug.statusCodesStringToNumberArray)(r.statusCodes);return e.addResponseSendingFinalHook(async s=>{if(i.includes(s.status)){let a=dg.get(e),c=r.customerId;if(r.customerIdPropertyPath){if(!t.user)throw new cg.RuntimeError(`Unable to apply customerIdPropertyPath '${r.customerIdPropertyPath}' as request.user is 'undefined'.`);c=(0,ug.getValueFromRequestUser)(t.user,r.customerIdPropertyPath,"customerIdPropertyPath")}let u=a?.customerId??c;if(!u){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': customerId cannot be undefined`);return}let l=a?.meterApiName??r.meterApiName;if(!l){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': meterApiName cannot be undefined`);return}let d=a?.meterValue??r.meterValue;if(!d){e.log.error(`Error in AmberfloMeterInboundPolicy '${n}': meterValue cannot be undefined`);return}let p={customerId:u,meterApiName:l,meterValue:d,meterTimeInMillis:Date.now(),dimensions:Object.apply(r.dimensions??{},a?.dimensions)},y=lg[r.apiKey];if(!y){let h=r.apiKey,m=t.headers.get("zm-test-id")??"";y=new QA.BatchDispatch("amberflo-ingest-meter",10,async v=>{try{let T=r.url??"https://app.amberflo.io/ingest",S=await fetch(T,{method:"POST",body:JSON.stringify(v),headers:{"content-type":"application/json","x-api-key":h,"zm-test-id":m}});S.ok||e.log.error(`Unexpected response in AmberfloMeteringInboundPolicy '${n}'. ${S.status}: ${await S.text()}`)}catch(T){throw e.log.error(`Error in AmberfloMeteringInboundPolicy '${n}': ${T.message}`),T}}),lg[h]=y}y.enqueue(p),e.waitUntil(y.waitUntilFlushed())}}),t}o(YA,"AmberfloMeteringInboundPolicy");Tn.AmberfloMeteringInboundPolicy=YA});var Ud=g(ta=>{"use strict";Object.defineProperty(ta,"__esModule",{value:!0});ta.sha256=void 0;async function ZA(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest({name:"SHA-256"},e);return[...new Uint8Array(r)].map(i=>i.toString(16).padStart(2,"0")).join("")}o(ZA,"sha256");ta.sha256=ZA});var ur=g(ra=>{"use strict";Object.defineProperty(ra,"__esModule",{value:!0});ra.getPolicyCacheName=void 0;var XA=Ud(),hg=new Map;async function eP(t,e){let r,n=hg.get(t);return n!==void 0?r=n:(r=`zuplo-policy-${await(0,XA.sha256)(JSON.stringify({policyName:t,options:e}))}`,hg.set(t,r)),r}o(eP,"getPolicyCacheName");ra.getPolicyCacheName=eP});var gg=g(Sn=>{"use strict";Object.defineProperty(Sn,"__esModule",{value:!0});Sn.ApiAuthKeyInboundPolicy=Sn.ApiKeyInboundPolicy=void 0;var tP=ur(),rP=_r(),fg=Xl(),Md=D(),nP=Ot(),kd=Be(),Fd=ee(),iP=ms(),mg="key-metadata-cache-type";function oP(t,e){return e.authScheme===""?t:t.replace(`${e.authScheme} `,"")}o(oP,"getKeyValue");async function yg(t,e,r,n){if(!r.bucketName)if(fg.environment.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)r.bucketName=fg.environment.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new Md.ConfigurationError(`ApiKeyInboundPolicy '${n}' - no bucketName property provided`);let i={authHeader:r.authHeader??"authorization",authScheme:r.authScheme??"Bearer",bucketName:r.bucketName,cacheTtlSeconds:r.cacheTtlSeconds??60,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests??!1,disableAutomaticallyAddingKeyHeaderToOpenApi:r.disableAutomaticallyAddingKeyHeaderToOpenApi??!1};if(i.cacheTtlSeconds<60)throw new Md.ConfigurationError(`ApiKeyInboundPolicy '${n}' - minimum cacheTtlSeconds value is 60s, '${i.cacheTtlSeconds}' is invalid`);let s=o(T=>i.allowUnauthenticatedRequests?t:nP.HttpProblems.unauthorized(t,e,{detail:T}),"unauthorizedResponse"),a=t.headers.get(i.authHeader);if(!a)return s("No Authorization Header");if(!a.toLowerCase().startsWith(i.authScheme.toLowerCase()))return s("Invalid Authorization Scheme");let c=oP(a,i);if(!c||c==="")return s("No key present");let u=await sP(c),l=await(0,tP.getPolicyCacheName)(n,i),d=new rP.MemoryZoneReadThroughCache(l,{logger:kd.SystemLogMap.getLogger(e)}),p=await d.get(u);if(p&&p.isValid===!0)return t.user=p.user,t;if(p&&!p.isValid)return p.typeId!==mg&&kd.SystemLogMap.getLogger(e).error(`ApiKeyInboundPolicy '${n}' - cached metadata has invalid typeId '${p.typeId}'`,p),s("Authorization Failed");let y={key:c},h=await(0,iP.fetchRetry)({retryDelayMs:5,retries:2,logger:kd.SystemLogMap.getLogger(e)},`${Fd.Environment.instance.apiKeyServiceUrl}/v1/$validate/${i.bucketName}`,{method:"POST",headers:{"content-type":"application/json","zp-rid":e.requestId,"zp-dn":Fd.Environment.instance.deploymentName??"unknown","User-Agent":Fd.Environment.instance.systemUserAgent},body:JSON.stringify(y)});if(h.status===401)return e.log.info(`ApiKeyInboundPolicy '${n}' - 401 response from Key Service`),s("Authorization Failed");if(h.status!==200){try{let T=await h.text(),S=JSON.parse(T);e.log.error("Unexpected response from key service",S)}catch{e.log.error("Invalid response from key service")}throw new Md.RuntimeError(`ApiKeyInboundPolicy '${n}' - unexpected response from Key Service. Status: ${h.status}`)}let m=await h.json(),v={isValid:!0,typeId:mg,user:{sub:m.name,data:m.metadata}};return t.user=v.user,d.put(u,v,i.cacheTtlSeconds),t}o(yg,"ApiKeyInboundPolicy");Sn.ApiKeyInboundPolicy=yg;async function sP(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("")}o(sP,"hashValue");Sn.ApiAuthKeyInboundPolicy=yg});var Mt=g(na=>{"use strict";Object.defineProperty(na,"__esModule",{value:!0});na.OpenIdJwtInboundPolicy=void 0;var qd=(hs(),Gi(ps)),$d=D(),aP=ve(),Hd={},cP=o(async(t,e)=>{if(!e.jwkUrl||typeof e.jwkUrl!="string")throw new $d.ConfigurationError("Invalid State - jwkUrl not set");Hd[e.jwkUrl]||(Hd[e.jwkUrl]=(0,qd.createRemoteJWKSet)(new URL(e.jwkUrl),e.headers?{headers:e.headers}:void 0));let{payload:r}=await(0,qd.jwtVerify)(t,Hd[e.jwkUrl],{issuer:e.issuer,audience:e.audience});return r},"jwkVerifier"),uP=o(async(t,e)=>{let r;if(e.secret===void 0)throw new Error("secretVerifier requires secret to be defined");if(typeof e.secret=="string"){let s=new TextEncoder().encode(e.secret);r=new Uint8Array(s)}else r=e.secret;let{payload:n}=await(0,qd.jwtVerify)(t,r,{issuer:e.issuer,audience:e.audience});return n},"secretVerifier"),lP=o(async(t,e,r,n)=>{let i=t.headers.get("Authorization"),s="bearer ",a=o(y=>aP.HttpProblems.unauthorized(t,e,{detail:y}),"unauthorizedResponse");if(!r.jwkUrl&&!r.secret)throw new $d.ConfigurationError(`OpenIdJwtInboundPolicy policy '${n}': One of 'jwkUrl' or 'secret' options are required.`);if(r.jwkUrl&&r.secret)throw new $d.ConfigurationError(`OpenIdJwtInboundPolicy policy '${n}': Only one of 'jwkUrl' and 'secret' options should be provided.`);let c=r.jwkUrl?cP:uP,l=await o(async()=>{if(!i)return a("No authorization header");if(i.toLowerCase().indexOf(s)!==0)return a("Invalid bearer token format for authorization header");let y=i.substring(s.length);if(!y||y.length===0)return a("No bearer token on authorization header");try{return await c(y,r)}catch(h){let m=new URL(t.url);return"code"in h&&h.code==="ERR_JWT_EXPIRED"?e.log.warn(`Expired token used on url: ${m.pathname} `,h):e.log.warn(`Invalid token on: ${t.method} ${m.pathname}`,h),a("Invalid token")}},"getJwtOrRejectedResponse")();if(l instanceof Response)return r.allowUnauthenticatedRequests===!0?t:l;let d=r.subPropertyName??"sub",p=l[d];return p?(t.user={sub:p,data:l},t):a(`Token is not valid, no '${d}' property found.`)},"OpenIdJwtInboundPolicy");na.OpenIdJwtInboundPolicy=lP});var _g=g(ia=>{"use strict";Object.defineProperty(ia,"__esModule",{value:!0});ia.Auth0JwtInboundPolicy=void 0;var dP=Mt(),pP=o(async(t,e,r,n)=>(0,dP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://${r.auth0Domain}/`,audience:r.audience,jwkUrl:`https://${r.auth0Domain}/.well-known/jwks.json`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n),"Auth0JwtInboundPolicy");ia.Auth0JwtInboundPolicy=pP});var bg=g(oa=>{"use strict";Object.defineProperty(oa,"__esModule",{value:!0});oa.BasicAuthInboundPolicy=void 0;var hP=ve(),fP=o(async(t,e,r)=>{let n=t.headers.get("Authorization"),i="basic ",s=o(l=>hP.HttpProblems.unauthorized(t,e,{detail:l}),"unauthorizedResponse"),c=await o(async()=>{if(!n)return await s("No Authorization header");if(n.toLowerCase().indexOf(i)!==0)return await s("Invalid Basic token format for Authorization header");let l=n.substring(i.length);if(!l||l.length===0)return await s("No username:password provided");let d=atob(l).normalize(),p=d.indexOf(":");if(p===-1||/[\0-\x1F\x7F]/.test(d))return await s("Invalid basic token value - see https://tools.ietf.org/html/rfc5234#appendix-B.1");let y=d.substring(0,p),h=d.substring(p+1),m=r.accounts.find(v=>v.username===y&&v.password===h);return m||await s("Invalid username or password")},"getAccountOrRejectedResponse")();if(c instanceof Response)return r.allowUnauthenticatedRequests?t:c;let u=c.username;return t.user={sub:u,data:c.data},t},"BasicAuthInboundPolicy");oa.BasicAuthInboundPolicy=fP});var Eg=g(sa=>{"use strict";Object.defineProperty(sa,"__esModule",{value:!0});sa.CachingInboundPolicy=void 0;var mP=ur(),yP=["cdn-cache-control","cloudflare-cdn-cache-control","surrogate-control","cache-tag","expires"];async function gP(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(r)).map(s=>s.toString(16).padStart(2,"0")).join("")}o(gP,"digestMessage");var _P=o(async(t,e)=>{let r=[...e.dangerouslyIgnoreAuthorizationHeader===!0?[]:["authorization"],...e.headers??[]],n=[];for(let[d,p]of t.headers.entries())r.includes(d)&&n.push({key:d.toLowerCase(),value:p});n.sort((d,p)=>d.key.localeCompare(p.key));let i=await gP(JSON.stringify(n)),s=new URL(t.url),a=new URLSearchParams(s.searchParams);a.set("_z-hdr-dgst",i);let c=e.cacheHttpMethods?.includes(t.method.toUpperCase())&&t.method.toUpperCase()!=="GET";c&&a.set("_z-original-method",t.method);let u=`${s.origin}${s.pathname}?${a}`;return new Request(u,{method:c?"GET":t.method})},"createCacheKeyRequest");async function bP(t,e,r,n){let i=await(0,mP.getPolicyCacheName)(n,r),s=await caches.open(i),a=r?.cacheHttpMethods?.map(l=>l.toUpperCase())??["GET"],c=await _P(t,r),u=await s.match(c);return u||(e.addEventListener("responseSent",l=>{try{let d=r.statusCodes??[200,206,301,302,303,404,410],p=l.response.clone();if(!d.includes(p.status)||!a.includes(t.method.toUpperCase()))return;let y=r?.expirationSecondsTtl??60,h=new Response(p.body,p);yP.forEach(m=>h.headers.delete(m)),h.headers.set("cache-control",`s-maxage=${y}`),e.waitUntil(s.put(c,h))}catch(d){e.log.error(`Error in caching-inbound-policy '${n}': "${d.message}"`,d)}}),t)}o(bP,"CachingInboundPolicy");sa.CachingInboundPolicy=bP});var wg=g(aa=>{"use strict";Object.defineProperty(aa,"__esModule",{value:!0});aa.ChangeMethodInboundPolicy=void 0;var EP=D(),wP=Wn(),vP=o(async(t,e,r,n)=>{if(!r.method)throw new EP.ConfigurationError(`ChangeMethodInboundPolicy '${n}' options.method must be valid HttpMethod`);return new wP.ZuploRequest(t,{method:r.method})},"ChangeMethodInboundPolicy");aa.ChangeMethodInboundPolicy=vP});var vg=g(ca=>{"use strict";Object.defineProperty(ca,"__esModule",{value:!0});ca.ClearHeadersInboundPolicy=void 0;var TP=ke(),SP=o(async(t,e,r)=>{let n=[...r.exclude??[]],i=new Headers;return n.forEach(a=>{let c=t.headers.get(a);c&&i.set(a,c)}),new TP.ZuploRequest(t,{headers:i})},"ClearHeadersInboundPolicy");ca.ClearHeadersInboundPolicy=SP});var Tg=g(ua=>{"use strict";Object.defineProperty(ua,"__esModule",{value:!0});ua.ClearHeadersOutboundPolicy=void 0;var IP=o(async(t,e,r,n)=>{let i=[...n.exclude??[]],s=new Headers;return i.forEach(c=>{let u=t.headers.get(c);u&&s.set(c,u)}),new Response(t.body,{headers:s,status:t.status,statusText:t.statusText})},"ClearHeadersOutboundPolicy");ua.ClearHeadersOutboundPolicy=IP});var Sg=g(la=>{"use strict";Object.defineProperty(la,"__esModule",{value:!0});la.ClerkJwtInboundPolicy=void 0;var AP=Mt(),PP=o(async(t,e,r,n)=>{let i=new URL(r.frontendApiUrl.startsWith("https://")||r.frontendApiUrl.startsWith("http://")?r.frontendApiUrl:`https://${r.frontendApiUrl}`),s=new URL(i);return s.pathname="/.well-known/jwks.json",(0,AP.OpenIdJwtInboundPolicy)(t,e,{issuer:i.href.slice(0,-1),jwkUrl:s.toString(),allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)},"ClerkJwtInboundPolicy");la.ClerkJwtInboundPolicy=PP});var Ag=g(da=>{"use strict";Object.defineProperty(da,"__esModule",{value:!0});da.CognitoJwtInboundPolicy=void 0;var Ig=D(),RP=Mt(),OP=o(async(t,e,r,n)=>{if(!r.userPoolId)throw new Ig.ConfigurationError("userPoolId must be set in the options for CognitoJwtInboundPolicy");if(!r.region)throw new Ig.ConfigurationError("region must be set in the options for CognitoJwtInboundPolicy");return(0,RP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://cognito-idp.${r.region}.amazonaws.com/${r.userPoolId}`,jwkUrl:`https://cognito-idp.${r.region}.amazonaws.com/${r.userPoolId}/.well-known/jwks.json`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)},"CognitoJwtInboundPolicy");da.CognitoJwtInboundPolicy=OP});var Rg=g(pa=>{"use strict";Object.defineProperty(pa,"__esModule",{value:!0});pa.CompositeInboundPolicy=void 0;var xP=D(),NP=un(),Pg=Qn(),CP=o(async(t,e,r,n)=>{if(!r.policies||r.policies.length===0)throw new xP.ConfigurationError(`CompositeInboundPolicy '${n}' must have valid policies defined`);let i=NP.Gateway.instance,s=(0,Pg.getInboundPolicyHandlerAndOptions)(r.policies,i?.routeData.policies);return(0,Pg.toStackedInboundHandler)(s)(t,e)},"CompositeInboundPolicy");pa.CompositeInboundPolicy=CP});var lr=g(ha=>{"use strict";Object.defineProperty(ha,"__esModule",{value:!0});ha.optionValidator=void 0;var _i=D();function LP(t,e){let r=o((s,a,c)=>{let u=t[s];if(!(c&&u===void 0)){if(u===void 0)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' is required, but no value was set. If using an environment variable, check that it is set correctly.`);if(a==="array"&&Array.isArray(u))throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be an array. Received type ${typeof u}.`);if(typeof u!==a)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be of type ${a}. Received type ${typeof u}.`);if(typeof u=="string"&&u.length===0)throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be a non-empty string. The value received is empty. If using an environment variable, check that it is set correctly.`);if(typeof u=="number"&&isNaN(u))throw new _i.ConfigurationError(`Value of '${String(s)}' on policy '${e}' must be valid number. If using an environment variable, check that it is set correctly.`)}},"validate"),n=o((s,a)=>(r(s,a,!0),{optional:n,required:i}),"optional"),i=o((s,a)=>(r(s,a,!1),{optional:n,required:i}),"required");return{optional:n,required:i}}o(LP,"optionValidator");ha.optionValidator=LP});var Og=g(fa=>{"use strict";Object.defineProperty(fa,"__esModule",{value:!0});fa.FirebaseJwtInboundPolicy=void 0;var DP=lr(),UP=Mt(),MP=o(async(t,e,r,n)=>((0,DP.optionValidator)(r,n).required("projectId","string").optional("allowUnauthenticatedRequests","boolean"),(0,UP.OpenIdJwtInboundPolicy)(t,e,{issuer:`https://securetoken.google.com/${r.projectId}`,audience:r.projectId,jwkUrl:"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n)),"FirebaseJwtInboundPolicy");fa.FirebaseJwtInboundPolicy=MP});var xg=g(ma=>{"use strict";Object.defineProperty(ma,"__esModule",{value:!0});ma.FormDataToJsonInboundPolicy=void 0;var kP=ke(),FP=o(async(t,e,r)=>{let n="application/x-www-form-urlencoded",i="multipart/form-data",s=t.headers.get("content-type")?.toLowerCase();if(!s||![i,n].includes(s))return r&&r.badRequestIfNotFormData?new Response(`Bad Request - expected content-type '${n}' or ${i}`,{status:400,statusText:"Bad Request"}):t;let a=await t.formData();if(r&&r.optionalHoneypotName&&a.get(r.optionalHoneypotName)!=="")return new Response("Bad Request",{status:400,statusText:"Bad Request"});let c={};for(let[d,p]of a)c[d]=p.toString();let u=new Headers(t.headers);return u.set("content-type","application/json"),u.delete("content-length"),new kP.ZuploRequest(t,{body:JSON.stringify(c),headers:u})},"FormDataToJsonInboundPolicy");ma.FormDataToJsonInboundPolicy=FP});var Ng=g(ya=>{"use strict";Object.defineProperty(ya,"__esModule",{value:!0});ya.GeoFilterInboundPolicy=void 0;var HP=D(),qP=ve(),In="__unknown__",$P=o(async(t,e,r,n)=>{let i={allow:{countries:Pn(r.allow?.countries,"allow.countries",n),regionCodes:Pn(r.allow?.regionCodes,"allow.regionCode",n),asns:Pn(r.allow?.asns,"allow.asOrganization",n)},block:{countries:Pn(r.block?.countries,"block.countries",n),regionCodes:Pn(r.block?.regionCodes,"block.regionCode",n),asns:Pn(r.block?.asns,"block.asOrganization",n)},ignoreUnknown:r.ignoreUnknown!==!1},s=e.incomingRequestProperties.country?.toLowerCase()??In,a=e.incomingRequestProperties.regionCode?.toLowerCase()??In,c=e.incomingRequestProperties.asn?.toString()??In,u=i.ignoreUnknown&&s===In,l=i.ignoreUnknown&&a===In,d=i.ignoreUnknown&&c===In,p=i.allow.countries,y=i.allow.regionCodes,h=i.allow.asns;if(p.length>0&&!p.includes(s)&&!u||y.length>0&&!y.includes(a)&&!l||h.length>0&&!h.includes(c)&&!d)return An(t,e,n,s,a,c);let m=i.block.countries,v=i.block.regionCodes,T=i.block.asns;return m.length>0&&m.includes(s)&&!u||v.length>0&&v.includes(a)&&!l||T.length>0&&T.includes(c)&&!d?An(t,e,n,s,a,c):t},"GeoFilterInboundPolicy");ya.GeoFilterInboundPolicy=$P;function An(t,e,r,n,i,s){return e.log.debug(`Request blocked by GeoFilterInboundPolicy '${r}' (country: '${n}', regionCode: '${i}', asn: '${s}')`),qP.HttpProblems.forbidden(t,e,{geographicContext:{country:n,regionCode:i,asn:s}})}o(An,"blockedResponse");function Pn(t,e,r){if(typeof t=="string")return t.split(",").map(n=>n.trim().toLowerCase());if(typeof t>"u")return[];if(Array.isArray(t))return t.map(n=>n.trim().toLowerCase());throw new HP.ConfigurationError(`Invalid '${e}' for GeoFilterInboundPolicy '${r}': '${t}', must be a string or string[]`)}o(Pn,"toLowerStringArray")});var Cg=g(ga=>{"use strict";Object.defineProperty(ga,"__esModule",{value:!0});ga.JWTScopeValidationInboundPolicy=void 0;var jP=o(async(t,e,r)=>{let n=t.user?.data.scope.split(" ")||[];if(!o((s,a)=>a.every(c=>s.includes(c)),"scopeChecker")(n,r.scopes)){let s={code:"UNAUTHORIZED",help_url:"https://zup.fail/UNAUTHORIZED",message:`JWT must have all the following scopes: ${r.scopes}`};return new Response(JSON.stringify(s),{status:401,statusText:"Unauthorized",headers:{"content-type":"application/json"}})}return t},"JWTScopeValidationInboundPolicy");ga.JWTScopeValidationInboundPolicy=jP});var Dg=g(_a=>{"use strict";Object.defineProperty(_a,"__esModule",{value:!0});_a.MockApiInboundPolicy=void 0;var VP=ve(),GP=o(async(t,e,r,n)=>{let i=e.route.raw().responses;if(!i)return jd(n,t,e,"No responses defined in the OpenAPI document. Add some responses with examples to use this policy.");let s=Object.keys(i),a=[];if(s.length===0)return jd(n,t,e,"No response object defined under responses in the OpenAPI document. Add some response objects with examples to use this policy.");if(s.forEach(c=>{i[c].content&&Object.keys(i[c].content).forEach(l=>{let d=i[c].content[l].examples;d&&Object.keys(d).forEach(y=>{a.push({responseName:c,contentName:l,exampleName:y,exampleValue:d[y]})})})}),a=a.filter(c=>!(r.responsePrefixFilter&&!c.responseName.startsWith(r.responsePrefixFilter)||r.contentType&&c.contentName!==r.contentType||r.exampleName&&c.exampleName!==r.exampleName)),r.random&&a.length>1){let c=Math.floor(Math.random()*a.length);return Lg(a[c])}else return a.length>0?Lg(a[0]):jd(n,t,e,"No examples matching the mocking options found in the OpenAPI document. Add examples to the OpenAPI document matching the options for this policy or change the mocking options to match the examples in the OpenAPI document.")},"MockApiInboundPolicy");_a.MockApiInboundPolicy=GP;function Lg(t){let e=JSON.stringify(t.exampleValue,null,2),r=new Headers;switch(r.set("Content-Type",t.contentName),t.responseName){case"1XX":return new Response(e,{status:100,headers:r});case"2XX":return new Response(e,{status:200,headers:r});case"3XX":return new Response(e,{status:300,headers:r});case"4XX":return new Response(e,{status:400,headers:r});case"5XX":case"default":return new Response(e,{status:500,headers:r});default:return new Response(e,{status:Number(t.responseName),headers:r})}}o(Lg,"generateResponse");var jd=o((t,e,r,n)=>{let i=`Error in policy: ${t} - On route ${e.method} ${r.route.path}. ${n}`;return VP.HttpProblems.internalServerError(e,r,{detail:i})},"getProblemDetailResponse")});var Hg=g(Rn=>{"use strict";Object.defineProperty(Rn,"__esModule",{value:!0});Rn.MoesifInboundPolicy=Rn.setMoesifContext=void 0;var BP=D(),KP=we(),JP="Incoming",zP={logRequestBody:!0,logResponseBody:!0};function Ug(t){let e={};return t.forEach((r,n)=>{e[n]=r}),e}o(Ug,"headersToObject");function Mg(){return new Date().toISOString()}o(Mg,"timestamp");var Vd=new WeakMap,WP={};function QP(t,e){let r=Vd.get(t);r||(r=WP);let n=Object.assign({...r},e);Vd.set(t,n)}o(QP,"setMoesifContext");Rn.setMoesifContext=QP;async function kg(t,e){let r=t.headers.get("content-type"),n=t.clone();if(r&&r.indexOf("json")!==0)try{return await n.json()}catch(s){e.log.error(s)}let i=await n.text();return e.log.debug({textBody:i}),i}o(kg,"readBody");var YP={},Gd;function Fg(){if(!Gd)throw new BP.RuntimeError("Invalid State - no _lastLogger");return Gd}o(Fg,"getLastLogger");function ZP(t){let e=YP[t];return e||(e=new KP.BatchDispatch("moesif-inbound",100,async r=>{let n=JSON.stringify(r);Fg().debug("posting",n);let i=await fetch("https://api.moesif.net/v1/events/batch",{method:"POST",headers:{"content-type":"application/json","X-Moesif-Application-Id":t},body:n});i.ok||Fg().error({status:i.status,body:await i.text()})})),e}o(ZP,"getDispatcher");async function XP(t,e,r,n){Gd=e.log;let i=Mg(),s=Object.assign(zP,r);if(!s.applicationId)throw new Error(`Invalid configuration for MoesifInboundPolicy '${n}' - applicationId is required`);let a=s.logRequestBody?await kg(t,e):void 0;return e.addResponseSendingFinalHook(async(c,u)=>{let l=ZP(s.applicationId),d=t.headers.get("true-client-ip"),p=Vd.get(e)??{},y={time:i,uri:t.url,verb:t.method,body:a,ip_address:d??void 0,api_version:p.apiVersion,headers:Ug(t.headers)},h=s.logResponseBody?await kg(c,e):void 0,m={time:Mg(),status:c.status,headers:Ug(c.headers),body:h},v={request:y,response:m,user_id:p.userId??u.user?.sub,session_token:p.sessionToken,company_id:p.companyId,metadata:p.metadata,direction:JP};l.enqueue(v),e.waitUntil(l.waitUntilFlushed())}),t}o(XP,"MoesifInboundPolicy");Rn.MoesifInboundPolicy=XP});var qg=g(ba=>{"use strict";Object.defineProperty(ba,"__esModule",{value:!0});ba.OktaJwtInboundPolicy=void 0;var eR=Mt(),tR=o(async(t,e,r,n)=>(0,eR.OpenIdJwtInboundPolicy)(t,e,{issuer:r.issuerUrl,audience:r.audience,jwkUrl:`${r.issuerUrl}/v1/keys`,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests},n),"OktaJwtInboundPolicy");ba.OktaJwtInboundPolicy=tR});var $g=g(Ea=>{"use strict";Object.defineProperty(Ea,"__esModule",{value:!0});Ea.PropelAuthJwtInboundPolicy=void 0;var rR=(hs(),Gi(ps)),nR=Mt(),Bd,iR=o(async(t,e,r,n)=>{if(!Bd)try{Bd=await(0,rR.importSPKI)(r.verifierKey,"RS256")}catch(i){throw e.log.error("Could not import verifier key"),i}return(0,nR.OpenIdJwtInboundPolicy)(t,e,{issuer:r.authUrl,secret:Bd,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests,subPropertyName:"user_id"},n)},"PropelAuthJwtInboundPolicy");Ea.PropelAuthJwtInboundPolicy=iR});var jg=g(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.throwIfStateNotObject=G.throwIfStateNotNumber=G.throwIfStateNotString=G.throwIfStateUndefinedOrNull=G.throwIfStateUndefined=G.throwIfOptionNotObject=G.throwIfOptionNotNumber=G.throwIfOptionNotString=G.throwIfOptionUndefinedOrNull=G.throwIfOptionUndefined=G.OptionTypeError=G.OptionUndefinedError=G.throwIfNotNumber=G.throwIfNotString=G.throwIfUndefinedOrNull=G.throwIfUndefined=G.ArgumentTypeError=G.ArgumentUndefinedError=G.ValidationError=void 0;var $e=Br(),et=class extends Error{static{o(this,"ValidationError")}constructor(e){super(e)}};G.ValidationError=et;var bi=class extends et{static{o(this,"ArgumentUndefinedError")}constructor(e){super(`The argument '${e}' is undefined.`)}};G.ArgumentUndefinedError=bi;var Ei=class extends et{static{o(this,"ArgumentTypeError")}constructor(e,r){super(`The argument '${e}' must be of type '${r}'.`)}};G.ArgumentTypeError=Ei;function oR(t,e){if((0,$e.isUndefined)(t))throw new bi(e)}o(oR,"throwIfUndefined");G.throwIfUndefined=oR;function Kd(t,e){if((0,$e.isUndefinedOrNull)(t))throw new bi(e)}o(Kd,"throwIfUndefinedOrNull");G.throwIfUndefinedOrNull=Kd;function sR(t,e){if(Kd(t,e),!(0,$e.isString)(t))throw new Ei(e,"string")}o(sR,"throwIfNotString");G.throwIfNotString=sR;function aR(t,e){if(Kd(t,e),!(0,$e.isNumber)(t))throw new Ei(e,"number")}o(aR,"throwIfNotNumber");G.throwIfNotNumber=aR;var wi=class extends et{static{o(this,"OptionUndefinedError")}constructor(e,r,n){super(`The option '${n}' on the ${e} named '${r}' is undefined.`)}};G.OptionUndefinedError=wi;var On=class extends et{static{o(this,"OptionTypeError")}constructor(e,r,n,i){super(`The option '${n}' on the ${e} named '${r}' must be of type '${i}'.`)}};G.OptionTypeError=On;function cR(t,e,r,n){if((0,$e.isUndefined)(n))throw new wi(t,e,r)}o(cR,"throwIfOptionUndefined");G.throwIfOptionUndefined=cR;function wa(t,e,r,n){if((0,$e.isUndefinedOrNull)(n))throw new wi(t,e,r)}o(wa,"throwIfOptionUndefinedOrNull");G.throwIfOptionUndefinedOrNull=wa;function uR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isString)(n))throw new On(t,e,r,"string")}o(uR,"throwIfOptionNotString");G.throwIfOptionNotString=uR;function lR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isNumber)(n))throw new On(t,e,r,"number")}o(lR,"throwIfOptionNotNumber");G.throwIfOptionNotNumber=lR;function dR(t,e,r,n){if(wa(t,e,r,n),!(0,$e.isObject)(n))throw new On(t,e,r,"object")}o(dR,"throwIfOptionNotObject");G.throwIfOptionNotObject=dR;function pR(t,e){if((0,$e.isUndefined)(t))throw new et(e)}o(pR,"throwIfStateUndefined");G.throwIfStateUndefined=pR;function va(t,e){if((0,$e.isUndefinedOrNull)(t))throw new et(e)}o(va,"throwIfStateUndefinedOrNull");G.throwIfStateUndefinedOrNull=va;function hR(t,e){if(va(t,e),!(0,$e.isString)(t))throw new et(e);return!0}o(hR,"throwIfStateNotString");G.throwIfStateNotString=hR;function fR(t,e){if(va(t,e),!(0,$e.isNumber)(t))throw new et(e);return!0}o(fR,"throwIfStateNotNumber");G.throwIfStateNotNumber=fR;function mR(t,e){if(va(t,e),!(0,$e.isObject)(t))throw new et(e);return!0}o(mR,"throwIfStateNotObject");G.throwIfStateNotObject=mR});var Vg=g(xn=>{"use strict";Object.defineProperty(xn,"__esModule",{value:!0});xn.InMemoryRedisClient=xn.StandardRedisClient=void 0;var Jd=D(),Ta=jg(),zd=class t{static{o(this,"StandardRedisClient")}static instance;redisClientUrl;clientAuthToken;userAgent;deploymentName;constructor(e,r,n,i){this.redisClientUrl=e,this.clientAuthToken=r,this.deploymentName=n,this.userAgent=i}static initialize(e,r,n,i){return(0,Ta.throwIfNotString)(e,"redisClientUrl"),(0,Ta.throwIfNotString)(r,"clientAuthToken"),t.instance||(t.instance=new t(e,r,n,i)),t.instance}isEnabled(){return this.redisClientUrl!==void 0&&this.clientAuthToken!==void 0}async fetch({url:e,body:r,method:n,requestId:i}){(0,Ta.throwIfNotString)(e,"url");let s=await fetch(`${this.redisClientUrl}${e}`,{method:n,body:r,headers:{"content-type":"application/json",authorization:`Bearer ${this.clientAuthToken}`,"zp-rid":i,"zp-dn":this.deploymentName,"User-Agent":this.userAgent}}),a=s.headers.get("Content-Type")?.includes("application/json")?await s.json():await s.text();if(s.ok)return a;throw s.status===401?new Jd.SystemError("Redis client failed with 401: Unauthorized"):new Jd.SystemError(`Redis client failed with (${s.status}): ${typeof a=="string"?a:JSON.stringify(a,null,2)}`)}};xn.StandardRedisClient=zd;var Wd=class{static{o(this,"InMemoryRedisClient")}keyValueStore;constructor(){this.keyValueStore=new Map}isEnabled(){return!0}fetch({url:e,body:r,method:n}){if((0,Ta.throwIfNotString)(e,"url"),n==="POST"&&e==="/rate-limit"){let{incrBy:i,expire:s,key:a}=JSON.parse(r),c=Date.now()+s*1e3,u=this.keyValueStore.get(a);u?Date.now()>u.expiresAt?this.keyValueStore.set(a,{value:i,expiresAt:c}):this.keyValueStore.set(a,{value:u.value+i,expiresAt:u.expiresAt}):this.keyValueStore.set(a,{value:i,expiresAt:c});let l=this.keyValueStore.get(a);return Promise.resolve({count:l.value,ttlSeconds:Math.round((l.expiresAt-Date.now())/1e3)})}throw new Jd.SystemError("The in-memory redis client only supports /rate-limit calls")}};xn.InMemoryRedisClient=Wd});var zg=g(Aa=>{"use strict";Object.defineProperty(Aa,"__esModule",{value:!0});Aa.RateLimitInboundPolicy=void 0;var yR=Er(),gR=ke(),_R=ur(),kt=D(),bR=ve(),Gg=Be(),vi=ee(),Bg=Vg(),Kg=Br(),Sa=(0,yR.debug)("zuplo:policies:RateLimitInboundPolicy"),ER="strict",wR=o(t=>{let e=t.headers.get("cf-connecting-ip")??t.headers.get("true-client-ip");if(e)return e;let r=t.headers.get("x-forwarded-for");return r?r.split(",")[0]:"127.0.0.1"},"getRealIP"),vR=o(async t=>({key:`ip-${wR(t)}`}),"getIP"),TR=o(async t=>({key:`user-${t.user?.sub??"anonymous"}`}),"getUser"),SR=o(async()=>({key:"all-2d77ce9d-9a3c-4206-9ab2-668cfd271095"}),"getAll"),Ia;function IR(t,e){let r;if(Ia)return Ia;if(vi.Environment.instance.isLocalDevelopment)return e.info("Using in-memory redis client for local development."),r=new Bg.InMemoryRedisClient,Ia=r,r;let{authApiJWT:n,redisURL:i}=vi.Environment.instance;if(!(0,Kg.isString)(i))throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - rate limit service URL not configured`);if(!(0,Kg.isString)(n))throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - service authentication not configured`);if(i&&(r=Bg.StandardRedisClient.initialize(i,n,vi.Environment.instance.deploymentName??"unknown",vi.Environment.instance.systemUserAgent)),!r||!r.isEnabled())throw new kt.SystemError(`RateLimitInboundPolicy '${t}' - no redis ('${r}') or redis.isEnabled ('${r?.isEnabled}) is false`);return Ia=r,r}o(IR,"getRedisClient");async function Jg(t,e,r,n,i){let s=Math.floor(e*60);return await r.fetch({url:"/rate-limit",method:"POST",body:JSON.stringify({incrBy:1,expire:s,key:t}),requestId:i})}o(Jg,"getCountAndUpdateExpiry");function AR(t,e){let r;if(t.rateLimitBy==="function"){if(!t.identifier)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier must be specified`);if(!t.identifier.module)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.module must be specified`);if(!t.identifier.export)throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.export must be specified`);if(r=t.identifier.module[t.identifier.export],!r||typeof r!="function")throw new kt.ConfigurationError(`RateLimitInboundPolicy '${e}' - Custom rate limit function must be a valid function`)}return o(async(i,s,a)=>{let c=await r(i,s,a);if(!c.key){let u=`RateLimitInboundPolicy '${a}' - Custom rate limit function must return a valid key property '${JSON.stringify(c,null,2)}'`;throw s.log.error(u),new kt.RuntimeError(u)}return c},"outerFunction")}o(AR,"wrapUserFunction");var PR="Retry-After",RR=o(async(t,e,r,n)=>{let i=Date.now(),s=Gg.SystemLogMap.getLogger(e),a=o((u,l)=>{if(r.throwOnFailure)throw new kt.SystemError(u,{cause:l});s.error(u,l)},"throwOrLog"),c=o((u,l)=>{let d={};return(!u||u==="retry-after")&&(d[PR]=l.toString()),bR.HttpProblems.tooManyRequests(t,e,void 0,d)},"rateLimited");try{let l={function:AR(r,n),user:TR,ip:vR,all:SR}[r.rateLimitBy],d=await l(t,e,n),p=d.key,y=d.requestsAllowed??r.requestsAllowed,h=d.timeWindowMinutes??r.timeWindowMinutes,m=r.headerMode??"retry-after",v=IR(n,s),S=`bucket/${vi.Environment.instance.build.BUILD_ID}/${n}/${p}`;if((r.mode??ER)==="async"){let C=await(0,_R.getPolicyCacheName)(n,r),re=new gR.ZoneCache(C,{logger:Gg.SystemLogMap.getLogger(e)}),ne=Jg(S,h,v,s,e.requestId),fe=await re.get(S);if(fe!==void 0&&fe<=Date.now()){Sa(`RateLimitInboundPolicy '${n}' - returning 429 from cache for '${S}' (async mode)`);let Ge=Math.round((fe-Date.now())/1e3);return c(m,Ge)}return e.addEventListener("responseSending",Ge=>{try{let E=Ge,F=E.mutableResponse;E.mutableResponse=(async()=>{let Ce=await ne;if(Ce.count>y){let Hc=Date.now()+Ce.ttlSeconds*1e3;return re.put(S,Hc,Ce.ttlSeconds).catch(Mp=>{throw s.error(Mp),Mp}),Sa(`RateLimitInboundPolicy '${n}' - returning 429 from redis for '${S}' (async mode)`),c(m,Ce.ttlSeconds)}return F})()}catch(E){s.error(`RateLimitInboundPolicy '${n}' -error in responseSending`,E)}}),t}let j=await Jg(S,h,v,s,e.requestId);return j.count>y?(Sa(`RateLimitInboundPolicy '${n}' - returning 429 from redis for '${S}' (strict mode)`),c(m,j.ttlSeconds)):t}catch(u){return a(u.message,u),t}finally{let u=Date.now()-i;Sa(`RateLimitInboundPolicy '${n}' - latency ${u}ms`)}},"RateLimitInboundPolicy");Aa.RateLimitInboundPolicy=RR});var Zg=g(Pa=>{"use strict";Object.defineProperty(Pa,"__esModule",{value:!0});Pa.ReadmeMetricsInboundPolicy=void 0;var OR=we(),Qd=ee(),Wg=ea(),Yd;function Qg(t){let e=[];for(let[r,n]of t)e.push({name:r,value:n});return e}o(Qg,"headersToNameValuePairs");function xR(t){let e=[];return Object.entries(t).forEach(([r,n])=>{e.push({name:r,value:n})}),e}o(xR,"queryToNameValueParis");function NR(t){if(t===null)return;let e=parseFloat(t);if(!isNaN(e))return e}o(NR,"parseIntOrUndefined");var Yg={};async function CR(t,e,r,n){let i=new Date,s=Date.now();return Yd||(Yd={name:"zuplo",version:Qd.Environment.instance.build.ZUPLO_VERSION,comment:`zuplo/${Qd.Environment.instance.build.ZUPLO_VERSION}`}),e.addResponseSendingFinalHook(async a=>{try{let c=r.userLabelPropertyPath&&t.user?(0,Wg.getValueFromRequestUser)(t.user,r.userLabelPropertyPath,"userLabelPropertyPath"):t.user?.sub,u=r.userEmailPropertyPath&&t.user?(0,Wg.getValueFromRequestUser)(t.user,r.userEmailPropertyPath,"userEmailPropertyPath"):void 0,l={clientIPAddress:t.headers.get("true-client-ip")??"",development:r.development!==void 0?r.development:Qd.Environment.instance.isDeno,group:{label:c,email:u,id:t.user?.sub??"anonymous"},request:{log:{creator:Yd,entries:[{startedDateTime:i.toISOString(),time:Date.now()-s,request:{method:t.method,url:r.useFullRequestPath?new URL(t.url).pathname:e.route.path,httpVersion:"2",headers:Qg(t.headers),queryString:xR(t.query)},response:{status:a.status,statusText:a.statusText,headers:Qg(a.headers),content:{size:NR(t.headers.get("content-length"))}}}]}}},d=Yg[r.apiKey];if(!d){let p=r.apiKey;d=new OR.BatchDispatch("readme-metering-inbound-policy",10,async y=>{try{let h=r.url??"https://metrics.readme.io/request",m=await fetch(h,{method:"POST",body:JSON.stringify(y),headers:{"content-type":"application/json",authorization:`Basic ${btoa(p+":")}`}});m.status!==202&&e.log.error(`Unexpected response in ReadmeMeteringInboundPolicy '${n}'. ${m.status}: '${await m.text()}'`)}catch(h){throw e.log.error(`Error in ReadmeMeteringInboundPolicy '${n}': '${h.message}'`),h}}),Yg[p]=d}d.enqueue(l),e.waitUntil(d.waitUntilFlushed())}catch(c){e.log.error(c)}}),t}o(CR,"ReadmeMetricsInboundPolicy");Pa.ReadmeMetricsInboundPolicy=CR});var Xg=g(Ra=>{"use strict";Object.defineProperty(Ra,"__esModule",{value:!0});Ra.RemoveHeadersInboundPolicy=void 0;var LR=ke(),DR=D(),UR=o(async(t,e,r,n)=>{let i=r?.headers;if(!i||!Array.isArray(i)||i.length===0)throw new DR.ConfigurationError(`RemoveHeadersInboundPolicy '${n}' options.headers must be a non-empty string array of header names`);let s=new Headers(t.headers);return i.forEach(c=>{s.delete(c)}),new LR.ZuploRequest(t,{headers:s})},"RemoveHeadersInboundPolicy");Ra.RemoveHeadersInboundPolicy=UR});var e_=g(Oa=>{"use strict";Object.defineProperty(Oa,"__esModule",{value:!0});Oa.RemoveHeadersOutboundPolicy=void 0;var MR=D(),kR=o(async(t,e,r,n,i)=>{let s=n?.headers;if(!s||!Array.isArray(s)||s.length===0)throw new MR.ConfigurationError(`RemoveHeadersOutboundPolicy '${i}' options.headers must be a non-empty string array of header names`);let a=new Headers(t.headers);return s.forEach(u=>{a.delete(u)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"RemoveHeadersOutboundPolicy");Oa.RemoveHeadersOutboundPolicy=kR});var t_=g(xa=>{"use strict";Object.defineProperty(xa,"__esModule",{value:!0});xa.RemoveQueryParamsInboundPolicy=void 0;var FR=ke(),HR=D(),qR=o(async(t,e,r,n)=>{let i=r.params;if(!i||!Array.isArray(i)||i.length===0)throw new HR.ConfigurationError(`RemoveQueryParamsInboundPolicy '${n}' options.params must be a non-empty string array of header names`);let s=new URL(t.url);return i.forEach(c=>{s.searchParams.delete(c)}),new FR.ZuploRequest(s.toString(),t)},"RemoveQueryParamsInboundPolicy");xa.RemoveQueryParamsInboundPolicy=qR});var r_=g(Na=>{"use strict";Object.defineProperty(Na,"__esModule",{value:!0});Na.ReplaceStringOutboundPolicy=void 0;var $R=o(async(t,e,r,n)=>{let i=await t.text(),s=n.mode==="regexp"?new RegExp(n.match,"gm"):n.match,a=i.replaceAll(s,n.replaceWith);return new Response(a,{headers:t.headers,status:t.status,statusText:t.statusText})},"ReplaceStringOutboundPolicy");Na.ReplaceStringOutboundPolicy=$R});var i_=g(Ca=>{"use strict";Object.defineProperty(Ca,"__esModule",{value:!0});Ca.RequestSizeLimitInboundPolicy=void 0;var n_=o(()=>new Response("Maximum request size exceeded",{status:413,statusText:"Payload Too Large"}),"payloadTooLarge"),jR=o(async(t,e,r)=>{let n=r.trustContentLengthHeader??!1;if(["GET","HEAD"].includes(t.method))return t;let i=t.headers.get("content-length"),s=i!==null?parseInt(i):void 0;return s&&!isNaN(s)&&s>r.maxSizeInBytes?n_():s&&n?t:(await t.clone().text()).length>r.maxSizeInBytes?n_():t},"RequestSizeLimitInboundPolicy");Ca.RequestSizeLimitInboundPolicy=jR});var La=g(tt=>{"use strict";Object.defineProperty(tt,"__esModule",{value:!0});tt.sanitizedIdentifierName=tt.getIdForRefSchema=tt.getIdForRequestBodySchema=tt.getIdForParameterSchema=tt.getRawOperationDataIdentifierName=void 0;function VR(t,e,r){return`_${Cr(t+"_"+e+"_"+r)}`}o(VR,"getRawOperationDataIdentifierName");tt.getRawOperationDataIdentifierName=VR;function GR(t,e,r,n){return`_${Cr(t.toLowerCase())}_`+e.toLowerCase()+"_"+r.toLowerCase()+`_${n.toLowerCase()}`}o(GR,"getIdForParameterSchema");tt.getIdForParameterSchema=GR;function BR(t,e,r){return`_${Cr(t.toLowerCase())}_`+e.toLowerCase()+`_rb_${Cr(r.toLowerCase())}`}o(BR,"getIdForRequestBodySchema");tt.getIdForRequestBodySchema=BR;function KR(t,e){return`_${Cr(t)}__${Cr(e)}`}o(KR,"getIdForRefSchema");tt.getIdForRefSchema=KR;function Cr(t){let e=[];for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);n>="0".charCodeAt(0)&&n<="9".charCodeAt(0)||n>="A".charCodeAt(0)&&n<="Z".charCodeAt(0)||n>="a".charCodeAt(0)&&n<="z".charCodeAt(0)?e.push(t.charAt(r)):e.push("_")}return e.join("")}o(Cr,"sanitizedIdentifierName");tt.sanitizedIdentifierName=Cr});var Ti=g(Le=>{"use strict";Object.defineProperty(Le,"__esModule",{value:!0});Le.getErrorsFromValidator=Le.shouldReject=Le.shouldLog=Le.logErrors=Le.validateParameters=Le.getParametersForOperation=void 0;var JR=un(),Da=Lr(),zR=La(),WR=o(t=>{let e=t.route.raw();return e.parameters?e.parameters.map(n=>({name:n.name,location:n.in,required:n.required,deprecated:n.deprecated,allowEmptyValue:n.allowEmptyValue})):[]},"getParametersForOperation");Le.getParametersForOperation=WR;var QR=o((t,e,r,n,i)=>{let s=[],a=!0,c=[];return t.forEach(u=>{if(u.required&&!e[u.name])a=!1,s.push(`Required ${i} parameter '${u.name}' not found`);else{let l=(0,zR.getIdForParameterSchema)(r,n,i,u.name),d=JR.Gateway.instance.schemaValidator[l],p=d(e[u.name]),y=(0,Le.getErrorsFromValidator)(d.errors);p||(a=!1,c.push(`${i} parameter: ${u.name} : ${e[u.name]}`),s.push(`Invalid value for ${i} parameter: '${u.name}' ${y.join(", ")}`))}}),{isValid:a,invalidValues:c,errors:s}},"validateParameters");Le.validateParameters=QR;var YR=o((t,e,r,n,i)=>{n?t.log[e](r,n,i):t.log[e](r,i)},"logErrors");Le.logErrors=YR;var ZR=o(t=>t===Da.ValidationOptions.logOnly||t===Da.ValidationOptions.rejectAndLog,"shouldLog");Le.shouldLog=ZR;var XR=o(t=>t===Da.ValidationOptions.rejectOnly||t===Da.ValidationOptions.rejectAndLog,"shouldReject");Le.shouldReject=XR;var eO=o(t=>t?.map(e=>e.instancePath===void 0||e.instancePath===""?e.message??"Unknown validation error":e.instancePath.replace("/","")+" "+e.message)??["Unknown validation error"],"getErrorsFromValidator");Le.getErrorsFromValidator=eO});var o_=g(Ma=>{"use strict";Object.defineProperty(Ma,"__esModule",{value:!0});Ma.handleBodyValidation=void 0;var tO=un(),rO=Lr(),Ua=ve(),nO=La(),Je=Ti();async function iO(t,e,r){if(!r.validateBody||r.validateBody===rO.ValidationOptions.none)return;let n;try{n=await e.clone().json()}catch(h){let m=`Error in request body for method : ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,v=Ua.HttpProblems.badRequest(e,t,{detail:`${m}, see errors property for more details`,errors:`${h}`});if((0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",m,[n],h),(0,Je.shouldReject)(r.validateBody))return v}if(!e.headers.get("Content-Type")){let h=`No content-type header defined in incoming request to ${e.method} in route: ${t.route.path}`,m=Ua.HttpProblems.badRequest(e,t,{detail:h});return(0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",h,[n],[h]),(0,Je.shouldReject)(r.validateBody)?m:void 0}let i=e.headers.get("Content-Type"),s=i.indexOf(";");s>-1&&(i=i.substring(0,s));let a=(0,nO.getIdForRequestBodySchema)(t.route.path,e.method,i),c=tO.Gateway.instance.schemaValidator[a];if(!c){let h=`No schema defined for method: ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,m=Ua.HttpProblems.badRequest(e,t,{detail:h});return(0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",h,[n],[h]),(0,Je.shouldReject)(r.validateBody)?m:void 0}if(c(n))return;let l=c.errors,d="Request body did not pass validation",p=(0,Je.getErrorsFromValidator)(l),y=Ua.HttpProblems.badRequest(e,t,{detail:`${d}, see errors property for more details`,errors:p});if((0,Je.shouldLog)(r.validateBody)&&(0,Je.logErrors)(t,r.logLevel??"info",d,[n],p),(0,Je.shouldReject)(r.validateBody))return y}o(iO,"handleBodyValidation");Ma.handleBodyValidation=iO});var s_=g(ka=>{"use strict";Object.defineProperty(ka,"__esModule",{value:!0});ka.handleHeadersValidation=void 0;var oO=Lr(),sO=ve(),Si=Ti();function aO(t,e,r){if(!r.validateHeaders||r.validateHeaders===oO.ValidationOptions.none)return;let n={};e.headers.forEach((a,c)=>{n[c]=a});let i=(0,Si.getParametersForOperation)(t),s=(0,Si.validateParameters)(i.filter(a=>a.location==="header"),n,t.route.path,e.method.toLowerCase(),"header");if(!s.isValid){let a="Header validation failed",c=sO.HttpProblems.badRequest(e,t,{detail:`${a}, see errors property for more details`,errors:s.errors});if((0,Si.shouldLog)(r.validateHeaders)&&(0,Si.logErrors)(t,r.logLevel??"info",a,s.invalidValues,s.errors),(0,Si.shouldReject)(r.validateHeaders))return c}}o(aO,"handleHeadersValidation");ka.handleHeadersValidation=aO});var a_=g(Fa=>{"use strict";Object.defineProperty(Fa,"__esModule",{value:!0});Fa.handlePathParameterValidation=void 0;var cO=Lr(),uO=ve(),Ii=Ti();function lO(t,e,r){if(!r.validatePathParameters||r.validatePathParameters===cO.ValidationOptions.none)return;let n=(0,Ii.getParametersForOperation)(t),i=(0,Ii.validateParameters)(n.filter(s=>s.location==="path"),e.params,t.route.path,e.method.toLowerCase(),"path");if(!i.isValid){let s="Path parameters validation failed",a=uO.HttpProblems.badRequest(e,t,{detail:`${s}, see errors property for more details`,errors:i.errors});if((0,Ii.shouldLog)(r.validatePathParameters)&&(0,Ii.logErrors)(t,r.logLevel??"info",s,i.invalidValues,i.errors),(0,Ii.shouldReject)(r.validatePathParameters))return a}}o(lO,"handlePathParameterValidation");Fa.handlePathParameterValidation=lO});var c_=g(Ha=>{"use strict";Object.defineProperty(Ha,"__esModule",{value:!0});Ha.handleQueryParameterValidation=void 0;var dO=Lr(),pO=ve(),Ai=Ti();function hO(t,e,r){if(!r.validateQueryParameters||r.validateQueryParameters===dO.ValidationOptions.none)return;let n=(0,Ai.getParametersForOperation)(t),i=(0,Ai.validateParameters)(n.filter(s=>s.location==="query"),e.query,t.route.path,e.method.toLowerCase(),"query");if(!i.isValid){let s="Query parameters validation failed",a=pO.HttpProblems.badRequest(e,t,{detail:`${s}, see errors property for more details`,errors:i.errors});if((0,Ai.shouldLog)(r.validateQueryParameters)&&(0,Ai.logErrors)(t,r.logLevel??"info",s,i.invalidValues,i.errors),(0,Ai.shouldReject)(r.validateQueryParameters))return a}}o(hO,"handleQueryParameterValidation");Ha.handleQueryParameterValidation=hO});var Lr=g(Ft=>{"use strict";Object.defineProperty(Ft,"__esModule",{value:!0});Ft.SchemaBasedRequestValidation=Ft.RequestValidationInboundPolicy=Ft.ValidationOptions=void 0;var fO=o_(),mO=s_(),yO=a_(),gO=c_(),u_;(function(t){t.none="none",t.logOnly="log-only",t.rejectAndLog="reject-and-log",t.rejectOnly="reject-only"})(u_||(Ft.ValidationOptions=u_={}));var _O=o(async(t,e,r)=>{let n=(0,gO.handleQueryParameterValidation)(e,t,r);if(n!==void 0||(n=(0,yO.handlePathParameterValidation)(e,t,r),n!==void 0)||(n=(0,mO.handleHeadersValidation)(e,t,r),n!==void 0))return n;let i=await(0,fO.handleBodyValidation)(e,t,r);return i!==void 0?i:t},"RequestValidationInboundPolicy");Ft.RequestValidationInboundPolicy=_O;Ft.SchemaBasedRequestValidation=Ft.RequestValidationInboundPolicy});var l_=g(qa=>{"use strict";Object.defineProperty(qa,"__esModule",{value:!0});qa.RequireOriginInboundPolicy=void 0;var bO=ke(),EO=D(),wO=o(async(t,e,r,n)=>{if(r.origins===void 0||r.origins.length===0)throw new EO.ConfigurationError(`RequireOriginInboundPolicy '${n}' configuration error - no allowed origins specified`);let i=typeof r.origins=="string"?r.origins.split(","):r.origins;i=i.map(a=>a.trim());let s=t.headers.get("origin");if(!s||!i.includes(s)){let a=r.failureDetail??"Forbidden";return bO.HttpProblems.forbidden(t,e,{detail:a})}return t},"RequireOriginInboundPolicy");qa.RequireOriginInboundPolicy=wO});var d_=g($a=>{"use strict";Object.defineProperty($a,"__esModule",{value:!0});$a.SetBodyInboundPolicy=void 0;var vO=ke(),TO=o(async(t,e,r)=>new vO.ZuploRequest(t,{body:r.body}),"SetBodyInboundPolicy");$a.SetBodyInboundPolicy=TO});var h_=g(ja=>{"use strict";Object.defineProperty(ja,"__esModule",{value:!0});ja.SetHeadersInboundPolicy=void 0;var SO=ke(),p_=D(),IO=o(async(t,e,r,n)=>{let i=r.headers;if(!i||!Array.isArray(i)||i.length==0)throw new p_.ConfigurationError(`SetHeadersInboundPolicy '${n}' options.headers must be a valid array of { name, value }`);let s=new Headers(t.headers);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new p_.ConfigurationError(`SetHeadersInboundPolicy '${n}' each option.headers[] entry must have a name property`);let u=c.overwrite===void 0?!0:c.overwrite;(!s.has(c.name)||u)&&s.set(c.name,c.value)}),new SO.ZuploRequest(t,{headers:s})},"SetHeadersInboundPolicy");ja.SetHeadersInboundPolicy=IO});var m_=g(Va=>{"use strict";Object.defineProperty(Va,"__esModule",{value:!0});Va.SetHeadersOutboundPolicy=void 0;var f_=D(),AO=o(async(t,e,r,n,i)=>{let s=n.headers;if(!s||!Array.isArray(s)||s.length==0)throw new f_.ConfigurationError(`SetHeadersOutboundPolicy '${i}' options.headers must be a valid array of { name, value }`);let a=new Headers(t.headers);return s.forEach(u=>{if(!u.name||u.name.length===0)throw new f_.ConfigurationError(`SetHeadersOutboundPolicy '${i}' each option.headers[] entry must have a name property`);let l=u.overwrite===void 0?!0:u.overwrite;(!a.has(u.name)||l)&&a.set(u.name,u.value)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"SetHeadersOutboundPolicy");Va.SetHeadersOutboundPolicy=AO});var g_=g(Ga=>{"use strict";Object.defineProperty(Ga,"__esModule",{value:!0});Ga.SetQueryParamsInboundPolicy=void 0;var PO=ke(),y_=D(),RO=o(async(t,e,r,n)=>{let i=r.params;if(!i||!Array.isArray(i)||i.length==0)throw new y_.ConfigurationError(`SetQueryParamsInboundPolicy '${n}' options.params must be a valid array of { name, value }`);let s=new URL(t.url);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new y_.ConfigurationError(`SetQueryParamsInboundPolicy '${n}' each option.params[] entry must have a name property`);let u=c.overwrite===void 0?!0:c.overwrite;(!s.searchParams.has(c.name)||u)&&s.searchParams.set(c.name,c.value)}),new PO.ZuploRequest(s.toString(),t)},"SetQueryParamsInboundPolicy");Ga.SetQueryParamsInboundPolicy=RO});var __=g(Ba=>{"use strict";Object.defineProperty(Ba,"__esModule",{value:!0});Ba.SetStatusOutboundPolicy=void 0;var OO=o(async(t,e,r,n,i)=>{if(!n.status||isNaN(n.status)||n.status<100||n.status>599)throw new Error(`Invalid SetStatusOutboundPolicy '${i}' - status must be a valid number between 100 and 599, not '${n.status}'`);return new Response(t.body,{headers:t.headers,status:n.status,statusText:n.statusText??t.statusText})},"SetStatusOutboundPolicy");Ba.SetStatusOutboundPolicy=OO});var b_=g(Ka=>{"use strict";Object.defineProperty(Ka,"__esModule",{value:!0});Ka.SleepInboundPolicy=void 0;var xO=D(),NO=o(async t=>new Promise(r=>{setTimeout(r,t)}),"sleep"),CO=o(async(t,e,r,n)=>{if(!r||r.sleepInMs===void 0||isNaN(r.sleepInMs))throw new xO.ConfigurationError(`SleepInboundPolicy '${n} must have a valid options.sleepInMs value`);return await NO(r.sleepInMs),t},"SleepInboundPolicy");Ka.SleepInboundPolicy=CO});var w_=g(Ja=>{"use strict";Object.defineProperty(Ja,"__esModule",{value:!0});Ja.SupabaseJwtInboundPolicy=void 0;var LO=ke(),E_=D(),DO=ve(),UO=lr(),MO=Mt(),kO=o(async(t,e,r,n)=>{(0,UO.optionValidator)(r,n).required("secret","string").optional("allowUnauthenticatedRequests","boolean").optional("requiredClaims","object");let i={secret:r.secret,allowUnauthenticatedRequests:r.allowUnauthenticatedRequests??!1},s=await(0,MO.OpenIdJwtInboundPolicy)(t,e,i,n);if(s instanceof Response)return s;if(!(s instanceof LO.ZuploRequest))throw new E_.SystemError("Invalid State - SupabaseJwtInboundPolicy encountered a non-response that wasn't a ZuploRequest type')");let a=r.requiredClaims;if(!a)return s;let c=t.user?.data.app_metadata;if(!c)throw new E_.RuntimeError(`SupabaseJwtInboundPolicy policy '${n}' - has requiredClaims but the JWT token had no app_metadata property`);let u=Object.keys(a),l=[];return u.forEach(d=>{let p=a[d];Array.isArray(p)?p.includes(c[d])||l.push(d):p!==c[d]&&l.push(d)}),l.length>0?DO.HttpProblems.unauthorized(t,e,{detail:`Invalid JWT token - missing valid claims ${l.join(", ")}`}):s},"SupabaseJwtInboundPolicy");Ja.SupabaseJwtInboundPolicy=kO});var T_=g(za=>{"use strict";Object.defineProperty(za,"__esModule",{value:!0});za.UpstreamAzureAdServiceAuthInboundPolicy=void 0;var FO=ur(),HO=_r(),v_=D(),qO=Be(),$O=ms(),jO=lr(),VO=o(async(t,e,r,n)=>{(0,jO.optionValidator)(r,n).required("activeDirectoryTenantId","string").required("activeDirectoryClientId","string").required("activeDirectoryClientSecret","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number");let i=await(0,FO.getPolicyCacheName)(n,r),s=new HO.MemoryZoneReadThroughCache(i,{logger:qO.SystemLogMap.getLogger(e)}),a=await s.get(n);if(!a){let c=await GO(r,e);s.put(n,c.access_token,c.expires_in-(r.expirationOffsetSeconds??300)),a=c.access_token}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamAzureAdServiceAuthInboundPolicy");za.UpstreamAzureAdServiceAuthInboundPolicy=VO;async function GO(t,e){let r=new URLSearchParams({client_id:t.activeDirectoryClientId,scope:`${t.activeDirectoryClientId}/.default`,client_secret:t.activeDirectoryClientSecret,grant_type:"client_credentials"}),n=await(0,$O.fetchRetry)({retries:t.tokenRetries??3,retryDelayMs:10},`https://login.microsoftonline.com/${t.activeDirectoryTenantId}/oauth2/v2.0/token`,{headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST",body:r});if(n.status!==200){try{let s=await n.text();e.log.error("Could not get token from Azure AD",s)}catch{}throw new v_.RuntimeError("Could not get token from Azure AD")}let i=await n.json();if(i&&typeof i=="object"&&"access_token"in i&&typeof i.access_token=="string"&&"expires_in"in i&&typeof i.expires_in=="number")return{access_token:i.access_token,expires_in:i.expires_in};throw new v_.RuntimeError("Response returned from Azure AD is not in the expected format.")}o(GO,"getAccessToken")});var I_=g(Wa=>{"use strict";Object.defineProperty(Wa,"__esModule",{value:!0});Wa.UpstreamFirebaseAdminAuthInboundPolicy=void 0;var BO=ur(),KO=_r(),JO=D(),zO=Be(),Zd=sn(),WO=lr(),S_="https://accounts.google.com/o/oauth2/token",Xd,QO=o(async(t,e,r,n)=>{(0,WO.optionValidator)(r,n).required("serviceAccountJson","string"),Xd||(Xd=await Zd.GcpServiceAccount.init(r.serviceAccountJson));let i={scope:["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/firebase.database","https://www.googleapis.com/auth/firebase.messaging","https://www.googleapis.com/auth/identitytoolkit","https://www.googleapis.com/auth/userinfo.email"].join(" ")},s=await(0,BO.getPolicyCacheName)(n,r),a=new KO.MemoryZoneReadThroughCache(s,{logger:zO.SystemLogMap.getLogger(e)}),c=await a.get(n);if(!c){let u=await(0,Zd.getTokenFromGcpServiceAccount)({serviceAccount:Xd,audience:S_,payload:i}),l=await(0,Zd.exchangeGgpJwtForIdToken)(S_,u,{retries:r.tokenRetries??3,retryDelayMs:10});if(!l.access_token)throw new JO.RuntimeError("Invalid OAuth response from Firebase");c=l.access_token,a.put(n,c,(l.expires_in??3600)-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${c}`),t},"UpstreamFirebaseAdminAuthInboundPolicy");Wa.UpstreamFirebaseAdminAuthInboundPolicy=QO});var A_=g(Qa=>{"use strict";Object.defineProperty(Qa,"__esModule",{value:!0});Qa.UpstreamFirebaseUserAuthInboundPolicy=void 0;var YO=ur(),ZO=_r(),Nn=D(),XO=Be(),e0=Ud(),ep=sn(),t0=ea(),r0=lr(),n0="https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",i0=["acr","amr","at_hash","aud","auth_time","azp","cnf","c_hash","exp","iat","iss","jti","nbf","nonce"],tp,o0=o(async(t,e,r,n)=>{if((0,r0.optionValidator)(r,n).required("serviceAccountJson","string").required("webApiKey","string").optional("developerClaims","object").optional("userId","string").optional("userIdPropertyPath","string"),!r.userId&&!r.userIdPropertyPath)throw new Nn.ConfigurationError(`Either 'userId' or 'userIdPropertyPath' options must be set on policy '${n}'.`);let i={};if(typeof r.developerClaims<"u"){for(let p in r.developerClaims)if(Object.prototype.hasOwnProperty.call(r.developerClaims,p)){if(i0.indexOf(p)!==-1)throw new Nn.ConfigurationError(`Developer claim "${p}" is reserved and cannot be specified.`);i[p]=r.developerClaims[p]}}tp||(tp=await ep.GcpServiceAccount.init(r.serviceAccountJson));let s=r.userId;if(!s&&!r.userIdPropertyPath){if(!t.user)throw new Nn.RuntimeError("Unable to set userId for upstream auth policy as request.user is 'undefined'. Do you have an authentication policy before this policy?.");s=t.user?.sub}else if(r.userIdPropertyPath){if(!t.user)throw new Nn.RuntimeError(`Unable to apply userIdPropertyPath '${r.userIdPropertyPath}' as request.user is 'undefined'. Do you have an authentication policy before this policy?`);s=(0,t0.getValueFromRequestUser)(t.user,r.userIdPropertyPath,"userIdPropertyPath")}if(!s)throw new Nn.RuntimeError(`Unable to determine user from for the policy ${n}`);let a=await(0,YO.getPolicyCacheName)(n,r),c=new ZO.MemoryZoneReadThroughCache(a,{logger:XO.SystemLogMap.getLogger(e)}),u={uid:s,claims:i},l=await(0,e0.sha256)(JSON.stringify(u)),d=await c.get(l);if(!d){let p=await(0,ep.getTokenFromGcpServiceAccount)({serviceAccount:tp,audience:n0,payload:u}),y=`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${r.webApiKey}`,h=await(0,ep.exchangeFirebaseJwtForIdToken)(y,p,{retries:r.tokenRetries??3,retryDelayMs:10});if(!h.idToken)throw new Nn.RuntimeError("Invalid token response from Firebase");d=h.idToken,c.put(l,d,(h.expiresIn?parseInt(h.expiresIn):3600)-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${d}`),t},"UpstreamFirebaseUserAuthInboundPolicy");Qa.UpstreamFirebaseUserAuthInboundPolicy=o0});var R_=g(Ya=>{"use strict";Object.defineProperty(Ya,"__esModule",{value:!0});Ya.UpstreamGcpJwtInboundPolicy=void 0;var P_=sn(),s0=lr(),rp,a0=o(async(t,e,r,n)=>{(0,s0.optionValidator)(r,n).required("audience","string").required("serviceAccountJson","string"),rp||(rp=await P_.GcpServiceAccount.init(r.serviceAccountJson));let i=await(0,P_.getTokenFromGcpServiceAccount)({serviceAccount:rp,audience:r.audience});return t.headers.set("Authorization",`Bearer ${i}`),t},"UpstreamGcpJwtInboundPolicy");Ya.UpstreamGcpJwtInboundPolicy=a0});var x_=g(Za=>{"use strict";Object.defineProperty(Za,"__esModule",{value:!0});Za.UpstreamGcpServiceAuthInboundPolicy=void 0;var c0=ur(),u0=Kc(),l0=_r(),d0=D(),np=sn(),p0=lr(),O_="https://www.googleapis.com/oauth2/v4/token",ip,h0=o(async(t,e,r,n)=>{(0,p0.optionValidator)(r,n).required("audience","string").required("serviceAccountJson","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number"),ip||(ip=await np.GcpServiceAccount.init(r.serviceAccountJson));let i=await(0,c0.getPolicyCacheName)(n,r),s;r.useMemoryCacheOnly?s=new u0.MemoryCache(i):s=new l0.MemoryZoneReadThroughCache(i,e);let a=await s.get(n);if(!a){let c=await(0,np.getTokenFromGcpServiceAccount)({serviceAccount:ip,audience:O_,payload:{target_audience:`${r.audience}`}}),{id_token:u}=await(0,np.exchangeGgpJwtForIdToken)(O_,c,{retries:r.tokenRetries??3,retryDelayMs:10});if(!u)throw new d0.RuntimeError("Invalid token response from GCP");a=u,s.put(n,a,3600-(r.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamGcpServiceAuthInboundPolicy");Za.UpstreamGcpServiceAuthInboundPolicy=h0});var C_=g(Xa=>{"use strict";Object.defineProperty(Xa,"__esModule",{value:!0});Xa.ValidateJsonSchemaInbound=void 0;var f0=D(),N_=ve(),m0=o(async(t,e,r)=>{let n=t.clone(),i;try{i=await n.json()}catch{return N_.HttpProblems.badRequest(t,e,{detail:"Invalid JSON body - expected well-formed JSON document"})}if(r.validator(i))return t;let{errors:a}=r.validator;if(!a)throw new f0.SystemError("Invalid state - validator error object is undefined even though validation failed.");let c=a.map(u=>u.instancePath===void 0||u.instancePath===""?"Body "+u.message:u.instancePath.replace("/","")+" "+u.message);return N_.HttpProblems.badRequest(t,e,{detail:"Incoming body did not pass schema validation",errors:c})},"ValidateJsonSchemaInbound");Xa.ValidateJsonSchemaInbound=m0});var L_=g(dr=>{"use strict";Object.defineProperty(dr,"__esModule",{value:!0});dr.serialize=dr.ContentTypes=void 0;dr.ContentTypes={Json:"application/json",Form:"application/x-www-form-urlencoded"};function y0(t,e){if(t!==null)return e&&typeof t=="string"?t:typeof t=="object"&&e?.startsWith(dr.ContentTypes.Form)?new URLSearchParams(t).toString():typeof t=="object"&&e?.startsWith(dr.ContentTypes.Json)||!e?JSON.stringify(t):t}o(y0,"serialize");dr.serialize=y0});var D_=g(ec=>{"use strict";Object.defineProperty(ec,"__esModule",{value:!0});ec.ServiceProviderImpl=void 0;var g0=D(),op=class t{static{o(this,"ServiceProviderImpl")}static#e;services=new Map;constructor(){}static getInstance(){return t.#e||(t.#e=new t),t.#e}setInstance(e){t.#e=e}addService(e,r){if(this.services.get(e))throw new g0.SystemError(`A service with the name ${e} already exists -- you cannot have duplicate services`);this.services.set(e,r)}getService(e){return this.services.get(e)}};ec.ServiceProviderImpl=op});var U_=g(sp=>{"use strict";Object.defineProperty(sp,"__esModule",{value:!0});var _0={100:"Continue",101:"Switching Protocols",102:"Processing",103:"Early Hints",200:"OK",201:"Created",202:"Accepted",203:"Non-Authoritative Information",204:"No Content",205:"Reset Content",206:"Partial Content",207:"Multi-Status",208:"Already Reported",226:"IM Used",300:"Multiple Choices",301:"Moved Permanently",302:"Found",303:"See Other",304:"Not Modified",305:"Use Proxy",307:"Temporary Redirect",308:"Permanent Redirect",400:"Bad Request",401:"Unauthorized",402:"Payment Required",403:"Forbidden",404:"Not Found",405:"Method Not Allowed",406:"Not Acceptable",407:"Proxy Authentication Required",408:"Request Timeout",409:"Conflict",410:"Gone",411:"Length Required",412:"Precondition Failed",413:"Payload Too Large",414:"URI Too Long",415:"Unsupported Media Type",416:"Range Not Satisfiable",417:"Expectation Failed",418:"I'm a Teapot",421:"Misdirected Request",422:"Unprocessable Entity",423:"Locked",424:"Failed Dependency",425:"Too Early",426:"Upgrade Required",428:"Precondition Required",429:"Too Many Requests",431:"Request Header Fields Too Large",451:"Unavailable For Legal Reasons",500:"Internal Server Error",501:"Not Implemented",502:"Bad Gateway",503:"Service Unavailable",504:"Gateway Timeout",505:"HTTP Version Not Supported",506:"Variant Also Negotiates",507:"Insufficient Storage",508:"Loop Detected",509:"Bandwidth Limit Exceeded",510:"Not Extended",511:"Network Authentication Required"};sp.default=_0});var ke=g(f=>{"use strict";var b0=f&&f.__createBinding||(Object.create?function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,n,i)}:function(t,e,r,n){n===void 0&&(n=r),t[n]=e[r]}),M_=f&&f.__exportStar||function(t,e){for(var r in t)r!=="default"&&!Object.prototype.hasOwnProperty.call(e,r)&&b0(e,t,r)},E0=f&&f.__importDefault||function(t){return t&&t.__esModule?t:{default:t}};Object.defineProperty(f,"__esModule",{value:!0});f.ReadmeMetricsInboundPolicy=f.RateLimitInboundPolicy=f.BasicRateLimitInboundPolicy=f.PropelAuthJwtInboundPolicy=f.OpenIdJwtInboundPolicy=f.OktaJwtInboundPolicy=f.setMoesifContext=f.MoesifInboundPolicy=f.MockApiInboundPolicy=f.JWTScopeValidationInboundPolicy=f.GeoFilterInboundPolicy=f.FormDataToJsonInboundPolicy=f.FirebaseJwtInboundPolicy=f.CompositeInboundPolicy=f.CognitoJwtInboundPolicy=f.ClerkJwtInboundPolicy=f.ClearHeadersOutboundPolicy=f.ClearHeadersInboundPolicy=f.ChangeMethodInboundPolicy=f.CachingInboundPolicy=f.BasicAuthInboundPolicy=f.Auth0JwtInboundPolicy=f.ApiKeyInboundPolicy=f.ApiAuthKeyInboundPolicy=f.AmberfloMeteringPolicy=f.AmberfloMeteringInboundPolicy=f.AuditLogPlugin=f.AuditLogDataStaxProvider=f.HttpStatusCode=f.webSocketPipelineHandler=f.webSocketHandler=f.urlRewriteHandler=f.urlForwardHandler=f.redirectHandler=f.openApiSpecHandler=f.awsLambdaHandler=f.AwsLambdaHandlerExtensions=f.purgeGatewayCache=f.Handler=f.originalFetch=f.ConfigurationError=f.isZuploReadableEnvVariableName=f.isRestrictedEnvVariableName=f.environment=f.ContextData=f.ResponseSentEvent=f.ResponseSendingEvent=f.VALID_COMPATIBILITY_DATES=f.ZoneCache=f.MemoryZoneReadThroughCache=void 0;f.sanitizedIdentifierName=f.getRawOperationDataIdentifierName=f.getIdForRequestBodySchema=f.getIdForRefSchema=f.getIdForParameterSchema=f.SystemLogMap=f.httpStatuses=f.SYSTEM_LOGGER=f.API_KEY=f.ServiceProviderImpl=f.serialize=f.ContentTypes=f.Router=f.LookupResult=f.SystemRouteName=f.ZuploRequest=f.ProblemResponseFormatter=f.HttpProblems=f.ValidateJsonSchemaInbound=f.UpstreamGcpServiceAuthInboundPolicy=f.UpstreamGcpJwtInboundPolicy=f.UpstreamFirebaseUserAuthInboundPolicy=f.UpstreamFirebaseAdminAuthInboundPolicy=f.UpstreamAzureAdServiceAuthInboundPolicy=f.SupabaseJwtInboundPolicy=f.SleepInboundPolicy=f.SetStatusOutboundPolicy=f.SetQueryParamsInboundPolicy=f.SetHeadersOutboundPolicy=f.SetHeadersInboundPolicy=f.SetBodyInboundPolicy=f.RequireOriginInboundPolicy=f.SchemaBasedRequestValidation=f.RequestValidationInboundPolicy=f.RequestSizeLimitInboundPolicy=f.ReplaceStringOutboundPolicy=f.RemoveQueryParamsInboundPolicy=f.RemoveHeadersOutboundPolicy=f.RemoveHeadersInboundPolicy=void 0;jp();var w0=_r();Object.defineProperty(f,"MemoryZoneReadThroughCache",{enumerable:!0,get:function(){return w0.MemoryZoneReadThroughCache}});var v0=Wc();Object.defineProperty(f,"ZoneCache",{enumerable:!0,get:function(){return v0.ZoneCache}});var T0=Gp();Object.defineProperty(f,"VALID_COMPATIBILITY_DATES",{enumerable:!0,get:function(){return T0.VALID_COMPATIBILITY_DATES}});var k_=wr();Object.defineProperty(f,"ResponseSendingEvent",{enumerable:!0,get:function(){return k_.ResponseSendingEvent}});Object.defineProperty(f,"ResponseSentEvent",{enumerable:!0,get:function(){return k_.ResponseSentEvent}});var S0=ay();Object.defineProperty(f,"ContextData",{enumerable:!0,get:function(){return S0.ContextData}});var ap=Xl();Object.defineProperty(f,"environment",{enumerable:!0,get:function(){return ap.environment}});Object.defineProperty(f,"isRestrictedEnvVariableName",{enumerable:!0,get:function(){return ap.isRestrictedEnvVariableName}});Object.defineProperty(f,"isZuploReadableEnvVariableName",{enumerable:!0,get:function(){return ap.isZuploReadableEnvVariableName}});var I0=D();Object.defineProperty(f,"ConfigurationError",{enumerable:!0,get:function(){return I0.ConfigurationError}});var A0=td();Object.defineProperty(f,"originalFetch",{enumerable:!0,get:function(){return A0.originalFetch}});var F_=yy();Object.defineProperty(f,"Handler",{enumerable:!0,get:function(){return F_.Handler}});Object.defineProperty(f,"purgeGatewayCache",{enumerable:!0,get:function(){return F_.purgeGatewayCache}});var H_=Ly();Object.defineProperty(f,"AwsLambdaHandlerExtensions",{enumerable:!0,get:function(){return H_.AwsLambdaHandlerExtensions}});Object.defineProperty(f,"awsLambdaHandler",{enumerable:!0,get:function(){return H_.awsLambdaHandler}});var P0=Uy();Object.defineProperty(f,"openApiSpecHandler",{enumerable:!0,get:function(){return P0.openApiSpecHandler}});var R0=My();Object.defineProperty(f,"redirectHandler",{enumerable:!0,get:function(){return R0.redirectHandler}});var O0=Fy();Object.defineProperty(f,"urlForwardHandler",{enumerable:!0,get:function(){return O0.urlForwardHandler}});var x0=qy();Object.defineProperty(f,"urlRewriteHandler",{enumerable:!0,get:function(){return x0.urlRewriteHandler}});var N0=jy();Object.defineProperty(f,"webSocketHandler",{enumerable:!0,get:function(){return N0.webSocketHandler}});var C0=By();Object.defineProperty(f,"webSocketPipelineHandler",{enumerable:!0,get:function(){return C0.webSocketPipelineHandler}});var L0=fu();Object.defineProperty(f,"HttpStatusCode",{enumerable:!0,get:function(){return L0.HttpStatusCode}});M_(Xy(),f);M_(rg(),f);var D0=ng();Object.defineProperty(f,"AuditLogDataStaxProvider",{enumerable:!0,get:function(){return D0.AuditLogDataStaxProvider}});var U0=og();Object.defineProperty(f,"AuditLogPlugin",{enumerable:!0,get:function(){return U0.AuditLogPlugin}});var q_=pg();Object.defineProperty(f,"AmberfloMeteringInboundPolicy",{enumerable:!0,get:function(){return q_.AmberfloMeteringInboundPolicy}});Object.defineProperty(f,"AmberfloMeteringPolicy",{enumerable:!0,get:function(){return q_.AmberfloMeteringPolicy}});var $_=gg();Object.defineProperty(f,"ApiAuthKeyInboundPolicy",{enumerable:!0,get:function(){return $_.ApiAuthKeyInboundPolicy}});Object.defineProperty(f,"ApiKeyInboundPolicy",{enumerable:!0,get:function(){return $_.ApiKeyInboundPolicy}});var M0=_g();Object.defineProperty(f,"Auth0JwtInboundPolicy",{enumerable:!0,get:function(){return M0.Auth0JwtInboundPolicy}});var k0=bg();Object.defineProperty(f,"BasicAuthInboundPolicy",{enumerable:!0,get:function(){return k0.BasicAuthInboundPolicy}});var F0=Eg();Object.defineProperty(f,"CachingInboundPolicy",{enumerable:!0,get:function(){return F0.CachingInboundPolicy}});var H0=wg();Object.defineProperty(f,"ChangeMethodInboundPolicy",{enumerable:!0,get:function(){return H0.ChangeMethodInboundPolicy}});var q0=vg();Object.defineProperty(f,"ClearHeadersInboundPolicy",{enumerable:!0,get:function(){return q0.ClearHeadersInboundPolicy}});var $0=Tg();Object.defineProperty(f,"ClearHeadersOutboundPolicy",{enumerable:!0,get:function(){return $0.ClearHeadersOutboundPolicy}});var j0=Sg();Object.defineProperty(f,"ClerkJwtInboundPolicy",{enumerable:!0,get:function(){return j0.ClerkJwtInboundPolicy}});var V0=Ag();Object.defineProperty(f,"CognitoJwtInboundPolicy",{enumerable:!0,get:function(){return V0.CognitoJwtInboundPolicy}});var G0=Rg();Object.defineProperty(f,"CompositeInboundPolicy",{enumerable:!0,get:function(){return G0.CompositeInboundPolicy}});var B0=Og();Object.defineProperty(f,"FirebaseJwtInboundPolicy",{enumerable:!0,get:function(){return B0.FirebaseJwtInboundPolicy}});var K0=xg();Object.defineProperty(f,"FormDataToJsonInboundPolicy",{enumerable:!0,get:function(){return K0.FormDataToJsonInboundPolicy}});var J0=Ng();Object.defineProperty(f,"GeoFilterInboundPolicy",{enumerable:!0,get:function(){return J0.GeoFilterInboundPolicy}});var z0=Cg();Object.defineProperty(f,"JWTScopeValidationInboundPolicy",{enumerable:!0,get:function(){return z0.JWTScopeValidationInboundPolicy}});var W0=Dg();Object.defineProperty(f,"MockApiInboundPolicy",{enumerable:!0,get:function(){return W0.MockApiInboundPolicy}});var j_=Hg();Object.defineProperty(f,"MoesifInboundPolicy",{enumerable:!0,get:function(){return j_.MoesifInboundPolicy}});Object.defineProperty(f,"setMoesifContext",{enumerable:!0,get:function(){return j_.setMoesifContext}});var Q0=qg();Object.defineProperty(f,"OktaJwtInboundPolicy",{enumerable:!0,get:function(){return Q0.OktaJwtInboundPolicy}});var Y0=Mt();Object.defineProperty(f,"OpenIdJwtInboundPolicy",{enumerable:!0,get:function(){return Y0.OpenIdJwtInboundPolicy}});var Z0=$g();Object.defineProperty(f,"PropelAuthJwtInboundPolicy",{enumerable:!0,get:function(){return Z0.PropelAuthJwtInboundPolicy}});var V_=zg();Object.defineProperty(f,"BasicRateLimitInboundPolicy",{enumerable:!0,get:function(){return V_.RateLimitInboundPolicy}});Object.defineProperty(f,"RateLimitInboundPolicy",{enumerable:!0,get:function(){return V_.RateLimitInboundPolicy}});var X0=Zg();Object.defineProperty(f,"ReadmeMetricsInboundPolicy",{enumerable:!0,get:function(){return X0.ReadmeMetricsInboundPolicy}});var ex=Xg();Object.defineProperty(f,"RemoveHeadersInboundPolicy",{enumerable:!0,get:function(){return ex.RemoveHeadersInboundPolicy}});var tx=e_();Object.defineProperty(f,"RemoveHeadersOutboundPolicy",{enumerable:!0,get:function(){return tx.RemoveHeadersOutboundPolicy}});var rx=t_();Object.defineProperty(f,"RemoveQueryParamsInboundPolicy",{enumerable:!0,get:function(){return rx.RemoveQueryParamsInboundPolicy}});var nx=r_();Object.defineProperty(f,"ReplaceStringOutboundPolicy",{enumerable:!0,get:function(){return nx.ReplaceStringOutboundPolicy}});var ix=i_();Object.defineProperty(f,"RequestSizeLimitInboundPolicy",{enumerable:!0,get:function(){return ix.RequestSizeLimitInboundPolicy}});var G_=Lr();Object.defineProperty(f,"RequestValidationInboundPolicy",{enumerable:!0,get:function(){return G_.RequestValidationInboundPolicy}});Object.defineProperty(f,"SchemaBasedRequestValidation",{enumerable:!0,get:function(){return G_.SchemaBasedRequestValidation}});var ox=l_();Object.defineProperty(f,"RequireOriginInboundPolicy",{enumerable:!0,get:function(){return ox.RequireOriginInboundPolicy}});var sx=d_();Object.defineProperty(f,"SetBodyInboundPolicy",{enumerable:!0,get:function(){return sx.SetBodyInboundPolicy}});var ax=h_();Object.defineProperty(f,"SetHeadersInboundPolicy",{enumerable:!0,get:function(){return ax.SetHeadersInboundPolicy}});var cx=m_();Object.defineProperty(f,"SetHeadersOutboundPolicy",{enumerable:!0,get:function(){return cx.SetHeadersOutboundPolicy}});var ux=g_();Object.defineProperty(f,"SetQueryParamsInboundPolicy",{enumerable:!0,get:function(){return ux.SetQueryParamsInboundPolicy}});var lx=__();Object.defineProperty(f,"SetStatusOutboundPolicy",{enumerable:!0,get:function(){return lx.SetStatusOutboundPolicy}});var dx=b_();Object.defineProperty(f,"SleepInboundPolicy",{enumerable:!0,get:function(){return dx.SleepInboundPolicy}});var px=w_();Object.defineProperty(f,"SupabaseJwtInboundPolicy",{enumerable:!0,get:function(){return px.SupabaseJwtInboundPolicy}});var hx=T_();Object.defineProperty(f,"UpstreamAzureAdServiceAuthInboundPolicy",{enumerable:!0,get:function(){return hx.UpstreamAzureAdServiceAuthInboundPolicy}});var fx=I_();Object.defineProperty(f,"UpstreamFirebaseAdminAuthInboundPolicy",{enumerable:!0,get:function(){return fx.UpstreamFirebaseAdminAuthInboundPolicy}});var mx=A_();Object.defineProperty(f,"UpstreamFirebaseUserAuthInboundPolicy",{enumerable:!0,get:function(){return mx.UpstreamFirebaseUserAuthInboundPolicy}});var yx=R_();Object.defineProperty(f,"UpstreamGcpJwtInboundPolicy",{enumerable:!0,get:function(){return yx.UpstreamGcpJwtInboundPolicy}});var gx=x_();Object.defineProperty(f,"UpstreamGcpServiceAuthInboundPolicy",{enumerable:!0,get:function(){return gx.UpstreamGcpServiceAuthInboundPolicy}});var _x=C_();Object.defineProperty(f,"ValidateJsonSchemaInbound",{enumerable:!0,get:function(){return _x.ValidateJsonSchemaInbound}});var bx=ve();Object.defineProperty(f,"HttpProblems",{enumerable:!0,get:function(){return bx.HttpProblems}});var Ex=io();Object.defineProperty(f,"ProblemResponseFormatter",{enumerable:!0,get:function(){return Ex.ProblemResponseFormatter}});var wx=Wn();Object.defineProperty(f,"ZuploRequest",{enumerable:!0,get:function(){return wx.ZuploRequest}});var vx=Sr();Object.defineProperty(f,"SystemRouteName",{enumerable:!0,get:function(){return vx.SystemRouteName}});var B_=Gl();Object.defineProperty(f,"LookupResult",{enumerable:!0,get:function(){return B_.LookupResult}});Object.defineProperty(f,"Router",{enumerable:!0,get:function(){return B_.Router}});var K_=L_();Object.defineProperty(f,"ContentTypes",{enumerable:!0,get:function(){return K_.ContentTypes}});Object.defineProperty(f,"serialize",{enumerable:!0,get:function(){return K_.serialize}});var Tx=D_();Object.defineProperty(f,"ServiceProviderImpl",{enumerable:!0,get:function(){return Tx.ServiceProviderImpl}});var J_=Tu();Object.defineProperty(f,"API_KEY",{enumerable:!0,get:function(){return J_.API_KEY}});Object.defineProperty(f,"SYSTEM_LOGGER",{enumerable:!0,get:function(){return J_.SYSTEM_LOGGER}});var Sx=U_();Object.defineProperty(f,"httpStatuses",{enumerable:!0,get:function(){return E0(Sx).default}});var Ix=Be();Object.defineProperty(f,"SystemLogMap",{enumerable:!0,get:function(){return Ix.SystemLogMap}});var Pi=La();Object.defineProperty(f,"getIdForParameterSchema",{enumerable:!0,get:function(){return Pi.getIdForParameterSchema}});Object.defineProperty(f,"getIdForRefSchema",{enumerable:!0,get:function(){return Pi.getIdForRefSchema}});Object.defineProperty(f,"getIdForRequestBodySchema",{enumerable:!0,get:function(){return Pi.getIdForRequestBodySchema}});Object.defineProperty(f,"getRawOperationDataIdentifierName",{enumerable:!0,get:function(){return Pi.getRawOperationDataIdentifierName}});Object.defineProperty(f,"sanitizedIdentifierName",{enumerable:!0,get:function(){return Pi.sanitizedIdentifierName}})});var z_=g(Cn=>{"use strict";Object.defineProperty(Cn,"__esModule",{value:!0});Cn.BaseCryptoBeta=Cn.supportedDigests=void 0;Cn.supportedDigests=["sha-1","sha-256","sha-384","sha-512"];var cp=class{static{o(this,"BaseCryptoBeta")}};Cn.BaseCryptoBeta=cp});var W_=g(tc=>{"use strict";Object.defineProperty(tc,"__esModule",{value:!0});tc.WorkerCryptoBeta=void 0;var up=z_(),Ax=D(),lp=class extends up.BaseCryptoBeta{static{o(this,"WorkerCryptoBeta")}async digest(e,r){if(!up.supportedDigests.includes(e.toLowerCase()))throw new Ax.RuntimeError(`Algorithm ${e} is not supported. Try using ${up.supportedDigests.join(", ")}`);let n=new TextEncoder().encode(r),i=await crypto.subtle.digest(e,n);return Array.from(new Uint8Array(i)).map(c=>c.toString(16).padStart(2,"0")).join("")}};tc.WorkerCryptoBeta=lp});var Q_=g(rc=>{"use strict";Object.defineProperty(rc,"__esModule",{value:!0});rc.BaseKeyValueStore=void 0;var dp=class{static{o(this,"BaseKeyValueStore")}context;constructor(e){this.context=e}};rc.BaseKeyValueStore=dp});var Z_=g(nc=>{"use strict";Object.defineProperty(nc,"__esModule",{value:!0});nc.WorkerKeyValueStore=void 0;var Y_=D(),Px=Q_(),pp=class extends Px.BaseKeyValueStore{static{o(this,"WorkerKeyValueStore")}#e;constructor(e){super(e);let n=globalThis.ZUPLO_KV;if(!n)throw new Y_.FeatureNotEnabledError("The Key Value Store feature is not enabled for this project.");this.#e=n}put(e,r,n){if(typeof e!="string")throw new Y_.ConfigurationError("value must be of type string");return this.#e.put(e,r,n?{expirationTtl:n.expirationSecondsTtl}:void 0)}get(e,r){return this.#e.get(e,{type:"text",cacheTtl:r?.cacheSecondsTtl})}delete(e){return this.#e.delete(e)}};nc.WorkerKeyValueStore=pp});var Ot=g(ct=>{"use strict";var Rx=ct&&ct.__createBinding||(Object.create?function(t,e,r,n){n===void 0&&(n=r);var i=Object.getOwnPropertyDescriptor(e,r);(!i||("get"in i?!e.__esModule:i.writable||i.configurable))&&(i={enumerable:!0,get:function(){return e[r]}}),Object.defineProperty(t,n,i)}:function(t,e,r,n){n===void 0&&(n=r),t[n]=e[r]}),Ox=ct&&ct.__exportStar||function(t,e){for(var r in t)r!=="default"&&!Object.prototype.hasOwnProperty.call(e,r)&&Rx(e,t,r)};Object.defineProperty(ct,"__esModule",{value:!0});ct.KeyValueStore=ct.CryptoBeta=void 0;Ox(ke(),ct);var xx=W_();Object.defineProperty(ct,"CryptoBeta",{enumerable:!0,get:function(){return xx.WorkerCryptoBeta}});var Nx=Z_();Object.defineProperty(ct,"KeyValueStore",{enumerable:!0,get:function(){return Nx.WorkerKeyValueStore}})});var FN={};Vi(FN,{GraphQLComplexityLimitInboundPolicy:()=>xb,GraphQLDisableIntrospectionInboundPolicy:()=>Cb});module.exports=Gi(FN);var Gn=Fp(Ot());function B(t,e){if(!!!t)throw new Error(e)}o(B,"devAssert");function be(t){return typeof t=="object"&&t!==null}o(be,"isObjectLike");function Tt(t,e){if(!!!t)throw new Error(e??"Unexpected invariant triggered.")}o(Tt,"invariant");var Cx=/\r\n|[\n\r]/g;function Ln(t,e){let r=0,n=1;for(let i of t.body.matchAll(Cx)){if(typeof i.index=="number"||Tt(!1),i.index>=e)break;r=i.index+i[0].length,n+=1}return{line:n,column:e+1-r}}o(Ln,"getLocation");function hp(t){return ic(t.source,Ln(t.source,t.start))}o(hp,"printLocation");function ic(t,e){let r=t.locationOffset.column-1,n="".padStart(r)+t.body,i=e.line-1,s=t.locationOffset.line-1,a=e.line+s,c=e.line===1?r:0,u=e.column+c,l=`${t.name}:${a}:${u}
 `,d=n.split(/\r\n|[\n\r]/g),p=d[i];if(p.length>120){let y=Math.floor(u/80),h=u%80,m=[];for(let v=0;v<p.length;v+=80)m.push(p.slice(v,v+80));return l+X_([[`${a} |`,m[0]],...m.slice(1,y+1).map(v=>["|",v]),["|","^".padStart(h)],["|",m[y+1]]])}return l+X_([[`${a-1} |`,d[i-1]],[`${a} |`,p],["|","^".padStart(u)],[`${a+1} |`,d[i+1]]])}o(ic,"printSourceLocation");function X_(t){let e=t.filter(([n,i])=>i!==void 0),r=Math.max(...e.map(([n])=>n.length));return e.map(([n,i])=>n.padStart(r)+(i?" "+i:"")).join(`
 `)}o(X_,"printPrefixedLines");function Lx(t){let e=t[0];return e==null||"kind"in e||"length"in e?{nodes:e,source:t[1],positions:t[2],path:t[3],originalError:t[4],extensions:t[5]}:e}o(Lx,"toNormalizedOptions");var N=class t extends Error{static{o(this,"GraphQLError")}constructor(e,...r){var n,i,s;let{nodes:a,source:c,positions:u,path:l,originalError:d,extensions:p}=Lx(r);super(e),this.name="GraphQLError",this.path=l??void 0,this.originalError=d??void 0,this.nodes=eb(Array.isArray(a)?a:a?[a]:void 0);let y=eb((n=this.nodes)===null||n===void 0?void 0:n.map(m=>m.loc).filter(m=>m!=null));this.source=c??(y==null||(i=y[0])===null||i===void 0?void 0:i.source),this.positions=u??y?.map(m=>m.start),this.locations=u&&c?u.map(m=>Ln(c,m)):y?.map(m=>Ln(m.source,m.start));let h=be(d?.extensions)?d?.extensions:void 0;this.extensions=(s=p??h)!==null&&s!==void 0?s:Object.create(null),Object.defineProperties(this,{message:{writable:!0,enumerable:!0},name:{enumerable:!1},nodes:{enumerable:!1},source:{enumerable:!1},positions:{enumerable:!1},originalError:{enumerable:!1}}),d!=null&&d.stack?Object.defineProperty(this,"stack",{value:d.stack,writable:!0,configurable:!0}):Error.captureStackTrace?Error.captureStackTrace(this,t):Object.defineProperty(this,"stack",{value:Error().stack,writable:!0,configurable:!0})}get[Symbol.toStringTag](){return"GraphQLError"}toString(){let e=this.message;if(this.nodes)for(let r of this.nodes)r.loc&&(e+=`
 
@@ -217,5 +217,5 @@ In some cases, you need to provide options to alter GraphQL's execution behavior
         }
       }
     }
-  `}o(Mc,"getIntrospectionQuery");function kc(t,e){be(t)&&be(t.__schema)||B(!1,`Invalid or incomplete introspection result. Ensure that you are passing "data" property of introspection response and no "errors" was returned alongside: ${A(t)}.`);let r=t.__schema,n=St(r.types,E=>E.name,E=>y(E));for(let E of[...Sp,...Cp])n[E.name]&&(n[E.name]=E);let i=r.queryType?d(r.queryType):null,s=r.mutationType?d(r.mutationType):null,a=r.subscriptionType?d(r.subscriptionType):null,c=r.directives?r.directives.map(Ge):[];return new Hi({description:r.description,query:i,mutation:s,subscription:a,types:Object.values(n),directives:c,assumeValid:e?.assumeValid});function u(E){if(E.kind===X.LIST){let F=E.ofType;if(!F)throw new Error("Decorated type deeper than introspection query.");return new de(u(F))}if(E.kind===X.NON_NULL){let F=E.ofType;if(!F)throw new Error("Decorated type deeper than introspection query.");let Ce=u(F);return new $(vc(Ce))}return l(E)}function l(E){let F=E.name;if(!F)throw new Error(`Unknown type reference: ${A(E)}.`);let Ce=n[F];if(!Ce)throw new Error(`Invalid or incomplete schema, unknown type: ${F}. Ensure that a full introspection query is used in order to build a client schema.`);return Ce}function d(E){return bc(l(E))}function p(E){return Ec(l(E))}function y(E){if(E!=null&&E.name!=null&&E.kind!=null)switch(E.kind){case X.SCALAR:return h(E);case X.OBJECT:return v(E);case X.INTERFACE:return T(E);case X.UNION:return S(E);case X.ENUM:return k(E);case X.INPUT_OBJECT:return j(E)}let F=A(E);throw new Error(`Invalid or incomplete introspection result. Ensure that a full introspection query is used in order to build a client schema: ${F}.`)}function h(E){return new We({name:E.name,description:E.description,specifiedByURL:E.specifiedByURL})}function m(E){if(E.interfaces===null&&E.kind===X.INTERFACE)return[];if(!E.interfaces){let F=A(E);throw new Error(`Introspection result missing interfaces: ${F}.`)}return E.interfaces.map(p)}function v(E){return new xe({name:E.name,description:E.description,interfaces:()=>m(E),fields:()=>C(E)})}function T(E){return new Ht({name:E.name,description:E.description,interfaces:()=>m(E),fields:()=>C(E)})}function S(E){if(!E.possibleTypes){let F=A(E);throw new Error(`Introspection result missing possibleTypes: ${F}.`)}return new Ur({name:E.name,description:E.description,types:()=>E.possibleTypes.map(d)})}function k(E){if(!E.enumValues){let F=A(E);throw new Error(`Introspection result missing enumValues: ${F}.`)}return new It({name:E.name,description:E.description,values:St(E.enumValues,F=>F.name,F=>({description:F.description,deprecationReason:F.deprecationReason}))})}function j(E){if(!E.inputFields){let F=A(E);throw new Error(`Introspection result missing inputFields: ${F}.`)}return new Mr({name:E.name,description:E.description,fields:()=>ne(E.inputFields)})}function C(E){if(!E.fields)throw new Error(`Introspection result missing fields: ${A(E)}.`);return St(E.fields,F=>F.name,re)}function re(E){let F=u(E.type);if(!qt(F)){let Ce=A(F);throw new Error(`Introspection must provide output type for fields, but received: ${Ce}.`)}if(!E.args){let Ce=A(E);throw new Error(`Introspection result missing field args: ${Ce}.`)}return{description:E.description,deprecationReason:E.deprecationReason,type:F,args:ne(E.args)}}function ne(E){return St(E,F=>F.name,fe)}function fe(E){let F=u(E.type);if(!Ye(F)){let Hc=A(F);throw new Error(`Introspection must provide input type for arguments, but received: ${Hc}.`)}let Ce=E.defaultValue!=null?Pt(pc(E.defaultValue),F):void 0;return{description:E.description,type:F,defaultValue:Ce,deprecationReason:E.deprecationReason}}function Ge(E){if(!E.args){let F=A(E);throw new Error(`Introspection result missing directive args: ${F}.`)}if(!E.locations){let F=A(E);throw new Error(`Introspection result missing directive locations: ${F}.`)}return new dt({name:E.name,description:E.description,isRepeatable:E.isRepeatable,locations:E.locations.slice(),args:ne(E.args)})}}o(kc,"buildClientSchema");function NN(t,e){return`The query exceeds the maximum complexity of ${t}. Actual complexity is ${e}`}o(NN,"queryComplexityMessage");function Pb(t){let e=new gr(t.schema),r=[],n=new jn(t.schema,t.query,e,s=>r.push(s)),i=new Up(n,{maximumComplexity:t.maximumComplexity??1/0,estimators:t.estimators,variables:t.variables,operationName:t.operationName,context:t.context});if(pr(t.query,$n(e,i)),r.length)throw r.pop();return i.complexity}o(Pb,"getComplexity");var Up=class{static{o(this,"QueryComplexity")}context;complexity;options;OperationDefinition;estimators;includeDirectiveDef;skipDirectiveDef;variableValues;requestContext;constructor(e,r){if(Number(r.maximumComplexity)<=0)throw new Error("Maximum query complexity must be a positive number");this.context=e,this.complexity=0,this.options=r,this.includeDirectiveDef=this.context.getSchema().getDirective("include")||void 0,this.skipDirectiveDef=this.context.getSchema().getDirective("skip")||void 0,this.estimators=r.estimators,this.variableValues={},this.requestContext=r.context,this.OperationDefinition={enter:this.onOperationDefinitionEnter,leave:this.onOperationDefinitionLeave}}onOperationDefinitionEnter(e){if(typeof this.options.operationName=="string"&&this.options.operationName!==e.name?.value)return;let{coerced:r,errors:n}=Dc(this.context.getSchema(),e.variableDefinitions?[...e.variableDefinitions]:[],this.options.variables??{});if(n&&n.length){n.forEach(s=>this.context.reportError(s));return}this.variableValues=r||{};let i=this.context.getSchema();switch(e.operation){case"query":{let s=i.getQueryType();if(!s)throw new Error("Schema does not define the required query root type");this.complexity+=this.nodeComplexity(e,s);break}case"mutation":{let s=i.getMutationType();if(!s)throw new Error("Schema does not define the required mutation root type");this.complexity+=this.nodeComplexity(e,s);break}case"subscription":{let s=i.getSubscriptionType();if(!s)throw new Error("Schema does not define the required mutation subscription type");this.complexity+=this.nodeComplexity(e,s);break}default:throw new Error(`Query complexity could not be calculated for operation of type ${e.operation}`)}}onOperationDefinitionLeave(e){if(!(typeof this.options.operationName=="string"&&this.options.operationName!==e.name?.value)&&(this.options.onComplete&&this.options.onComplete(this.complexity),this.complexity>this.options.maximumComplexity))return this.context.reportError(this.createError())}nodeComplexity(e,r){if(e.selectionSet){let n={};(r instanceof xe||r instanceof Ht)&&(n=r.getFields());let i;mr(r)?i=this.context.getSchema().getPossibleTypes(r).map(a=>a.name):i=[r.name];let s=e.selectionSet.selections.reduce((a,c)=>{let u=a,l=!0,d=!1;for(let p of c.directives??[])switch(p.name.value){case"include":{let h=this.includeDirectiveDef&&ji(this.includeDirectiveDef,c,this.variableValues||{});typeof h?.if=="boolean"&&(l=h.if);break}case"skip":{let h=this.skipDirectiveDef&&ji(this.skipDirectiveDef,c,this.variableValues||{});typeof h?.if=="boolean"&&(d=h.if);break}}if(!l||d)return a;switch(c.kind){case _.FIELD:{let p=n[c.name.value];if(!p)break;let y=lt(p.type),h;try{h=$i(p,c,this.variableValues||{})}catch(S){return this.context.reportError(S),a}let m=0;At(y)&&(m=this.nodeComplexity(c,y));let v={childComplexity:m,args:h,field:p,node:c,type:r,context:this.requestContext};if(!this.estimators.find(S=>{let k=S(v);return typeof k=="number"&&!isNaN(k)?(u=Vn(k,a,i),!0):!1}))return this.context.reportError(new N(`No complexity could be calculated for field ${r.name}.${p.name}. At least one complexity estimator has to return a complexity score.`)),a;break}case _.FRAGMENT_SPREAD:{let p=this.context.getFragment(c.name.value);if(!p)break;let y=this.context.getSchema().getType(p.typeCondition.name.value);if(!At(y))break;let h=this.nodeComplexity(p,y);mr(y)?u=Vn(h,a,this.context.getSchema().getPossibleTypes(y).map(m=>m.name)):u=Vn(h,a,[y.name]);break}case _.INLINE_FRAGMENT:{let p=r;if(c.typeCondition&&c.typeCondition.name&&(p=this.context.getSchema().getType(c.typeCondition.name.value)||p,!At(p)))break;let y=this.nodeComplexity(c,p);mr(p)?u=Vn(y,a,this.context.getSchema().getPossibleTypes(p).map(h=>h.name)):u=Vn(y,a,[p.name]);break}default:{u=Vn(this.nodeComplexity(c,r),a,i);break}}return u},{});return s?Math.max(...Object.values(s),0):NaN}return 0}createError(){return typeof this.options.createError=="function"?this.options.createError(this.options.maximumComplexity,this.complexity):new N(NN(this.options.maximumComplexity,this.complexity))}};function Vn(t,e,r){for(let n of r)Object.prototype.hasOwnProperty.call(e,n)?e[n]+=t:e[n]=t;return e}o(Vn,"addComplexities");function Rb(t){let e=t?.defaultComplexity??1;return r=>e+r.childComplexity}o(Rb,"simpleEstimator");var Ob=o((t,e,r={})=>{let{definitions:n}=t,i=CN(n),s=LN(n);return Object.entries(s).map(([a,c])=>Fc(c,i,0,e,a,r))},"depthLimit");function CN(t){return t.reduce((e,r)=>(r.kind===_.FRAGMENT_DEFINITION&&(e[r?.name?.value??""]=r),e),{})}o(CN,"getFragments");function LN(t){return t.reduce((e,r)=>{if(r.kind===_.OPERATION_DEFINITION){let n=r?.name?.value??"";e[n]=r}return e},{})}o(LN,"getQueriesAndMutations");function Fc(t,e,r,n,i,s){if(r>n)throw s?.onLimitReached?.(r,i),new N(`${i||"Your query"} exceeds maximum operation depth of ${n}`,{nodes:[t]});let a=s?.ignore??[/^__/];switch(t.kind){case _.FIELD:return DN(t,a)||!t.selectionSet?0:1+Math.max(...t.selectionSet.selections.map(c=>Fc(c,e,r+1,n,i,s)));case _.FRAGMENT_SPREAD:return Fc(e[t.name.value],e,r,n,i,s);case _.INLINE_FRAGMENT:case _.FRAGMENT_DEFINITION:case _.OPERATION_DEFINITION:return Math.max(...t.selectionSet.selections.map(c=>Fc(c,e,r,n,i,s)));default:throw new Error("uh oh! depth crawler cannot handle: "+t.kind)}}o(Fc,"determineDepth");var DN=o((t,e)=>e.find(r=>t.name.value.match(r)!==null)||!1,"isIgnored");var UN=o(async(t,e)=>{if(!e.complexityLimit)throw new Gn.ConfigurationError("No complexity maximum defined, you need to pass a maxComplexity to the policy");let n=e.endpointUrl;if(!n)throw new Gn.ConfigurationError("No GraphQL endpoint, you need to pass a endpointUrl to the policy");let i=Mc(),c=(await(await fetch(n,{method:"POST",body:JSON.stringify({query:i}),headers:{"Content-Type":"application/json"}})).json()).data;if(!c||!c?.__schema)throw new N("GraphQL introspection query failed, enable introspection or pass a schema url in configuration.");let u=kc(c,{assumeValid:!0}),l=Pb({estimators:[Rb({defaultComplexity:1})],schema:u,query:t,variables:{count:10}});if(e.complexityLimit&&l>e.complexityLimit)throw new N(`Query is too complex (${l}/${e.complexityLimit}), remove some fields and try again`)},"applyComplexityLimitPolicy"),MN=o(async(t,e)=>{let r=e.depthLimit;if(!r)throw new Gn.ConfigurationError("No maximum depth defined, you need to pass a maxDepth to the policy");return Math.max(...Ob(t,r))},"applyDepthLimitPolicy"),xb=o(async(t,e,r)=>{let n=Gn.SystemLogMap.getLogger(e);try{let s=await t.clone().json(),a=dc(s.query);r.useDepthLimit&&await MN(a,r.useDepthLimit),r.useComplexityLimit&&await UN(a,r.useComplexityLimit)}catch(i){if(i instanceof N)return n.info(i),new Response(JSON.stringify(i.toJSON()),{status:400,headers:{"Content-Type":"application/json"}});throw i}return t},"GraphQLComplexityLimitInboundPolicy");var Nb=Fp(Ot());function kN(t){if(!t)return!1;let e=t.replace(/\s/g,"");return e.includes("__schema")||e.includes("__type")}o(kN,"isIntrospectionQuery");var Cb=o(async(t,e,r)=>{let i=await t.clone().json();return kN(i.query)?Nb.HttpProblems.forbidden(t,e,{detail:"Introspection queries are not allowed"}):t},"GraphQLDisableIntrospectionInboundPolicy");
+  `}o(Mc,"getIntrospectionQuery");function kc(t,e){be(t)&&be(t.__schema)||B(!1,`Invalid or incomplete introspection result. Ensure that you are passing "data" property of introspection response and no "errors" was returned alongside: ${A(t)}.`);let r=t.__schema,n=St(r.types,E=>E.name,E=>y(E));for(let E of[...Sp,...Cp])n[E.name]&&(n[E.name]=E);let i=r.queryType?d(r.queryType):null,s=r.mutationType?d(r.mutationType):null,a=r.subscriptionType?d(r.subscriptionType):null,c=r.directives?r.directives.map(Ge):[];return new Hi({description:r.description,query:i,mutation:s,subscription:a,types:Object.values(n),directives:c,assumeValid:e?.assumeValid});function u(E){if(E.kind===X.LIST){let F=E.ofType;if(!F)throw new Error("Decorated type deeper than introspection query.");return new de(u(F))}if(E.kind===X.NON_NULL){let F=E.ofType;if(!F)throw new Error("Decorated type deeper than introspection query.");let Ce=u(F);return new $(vc(Ce))}return l(E)}function l(E){let F=E.name;if(!F)throw new Error(`Unknown type reference: ${A(E)}.`);let Ce=n[F];if(!Ce)throw new Error(`Invalid or incomplete schema, unknown type: ${F}. Ensure that a full introspection query is used in order to build a client schema.`);return Ce}function d(E){return bc(l(E))}function p(E){return Ec(l(E))}function y(E){if(E!=null&&E.name!=null&&E.kind!=null)switch(E.kind){case X.SCALAR:return h(E);case X.OBJECT:return v(E);case X.INTERFACE:return T(E);case X.UNION:return S(E);case X.ENUM:return k(E);case X.INPUT_OBJECT:return j(E)}let F=A(E);throw new Error(`Invalid or incomplete introspection result. Ensure that a full introspection query is used in order to build a client schema: ${F}.`)}function h(E){return new We({name:E.name,description:E.description,specifiedByURL:E.specifiedByURL})}function m(E){if(E.interfaces===null&&E.kind===X.INTERFACE)return[];if(!E.interfaces){let F=A(E);throw new Error(`Introspection result missing interfaces: ${F}.`)}return E.interfaces.map(p)}function v(E){return new xe({name:E.name,description:E.description,interfaces:()=>m(E),fields:()=>C(E)})}function T(E){return new Ht({name:E.name,description:E.description,interfaces:()=>m(E),fields:()=>C(E)})}function S(E){if(!E.possibleTypes){let F=A(E);throw new Error(`Introspection result missing possibleTypes: ${F}.`)}return new Ur({name:E.name,description:E.description,types:()=>E.possibleTypes.map(d)})}function k(E){if(!E.enumValues){let F=A(E);throw new Error(`Introspection result missing enumValues: ${F}.`)}return new It({name:E.name,description:E.description,values:St(E.enumValues,F=>F.name,F=>({description:F.description,deprecationReason:F.deprecationReason}))})}function j(E){if(!E.inputFields){let F=A(E);throw new Error(`Introspection result missing inputFields: ${F}.`)}return new Mr({name:E.name,description:E.description,fields:()=>ne(E.inputFields)})}function C(E){if(!E.fields)throw new Error(`Introspection result missing fields: ${A(E)}.`);return St(E.fields,F=>F.name,re)}function re(E){let F=u(E.type);if(!qt(F)){let Ce=A(F);throw new Error(`Introspection must provide output type for fields, but received: ${Ce}.`)}if(!E.args){let Ce=A(E);throw new Error(`Introspection result missing field args: ${Ce}.`)}return{description:E.description,deprecationReason:E.deprecationReason,type:F,args:ne(E.args)}}function ne(E){return St(E,F=>F.name,fe)}function fe(E){let F=u(E.type);if(!Ye(F)){let Hc=A(F);throw new Error(`Introspection must provide input type for arguments, but received: ${Hc}.`)}let Ce=E.defaultValue!=null?Pt(pc(E.defaultValue),F):void 0;return{description:E.description,type:F,defaultValue:Ce,deprecationReason:E.deprecationReason}}function Ge(E){if(!E.args){let F=A(E);throw new Error(`Introspection result missing directive args: ${F}.`)}if(!E.locations){let F=A(E);throw new Error(`Introspection result missing directive locations: ${F}.`)}return new dt({name:E.name,description:E.description,isRepeatable:E.isRepeatable,locations:E.locations.slice(),args:ne(E.args)})}}o(kc,"buildClientSchema");function NN(t,e){return`The query exceeds the maximum complexity of ${t}. Actual complexity is ${e}`}o(NN,"queryComplexityMessage");function Pb(t){let e=new gr(t.schema),r=[],n=new jn(t.schema,t.query,e,s=>r.push(s)),i=new Up(n,{maximumComplexity:t.maximumComplexity??1/0,estimators:t.estimators,variables:t.variables,operationName:t.operationName,context:t.context});if(pr(t.query,$n(e,i)),r.length)throw r.pop();return i.complexity}o(Pb,"getComplexity");var Up=class{static{o(this,"QueryComplexity")}context;complexity;options;OperationDefinition;estimators;includeDirectiveDef;skipDirectiveDef;variableValues;requestContext;constructor(e,r){if(Number(r.maximumComplexity)<=0)throw new Error("Maximum query complexity must be a positive number");this.context=e,this.complexity=0,this.options=r,this.includeDirectiveDef=this.context.getSchema().getDirective("include")||void 0,this.skipDirectiveDef=this.context.getSchema().getDirective("skip")||void 0,this.estimators=r.estimators,this.variableValues={},this.requestContext=r.context,this.OperationDefinition={enter:this.onOperationDefinitionEnter,leave:this.onOperationDefinitionLeave}}onOperationDefinitionEnter(e){if(typeof this.options.operationName=="string"&&this.options.operationName!==e.name?.value)return;let{coerced:r,errors:n}=Dc(this.context.getSchema(),e.variableDefinitions?[...e.variableDefinitions]:[],this.options.variables??{});if(n&&n.length){n.forEach(s=>this.context.reportError(s));return}this.variableValues=r||{};let i=this.context.getSchema();switch(e.operation){case"query":{let s=i.getQueryType();if(!s)throw new Error("Schema does not define the required query root type");this.complexity+=this.nodeComplexity(e,s);break}case"mutation":{let s=i.getMutationType();if(!s)throw new Error("Schema does not define the required mutation root type");this.complexity+=this.nodeComplexity(e,s);break}case"subscription":{let s=i.getSubscriptionType();if(!s)throw new Error("Schema does not define the required mutation subscription type");this.complexity+=this.nodeComplexity(e,s);break}default:throw new Error(`Query complexity could not be calculated for operation of type ${e.operation}`)}}onOperationDefinitionLeave(e){if(!(typeof this.options.operationName=="string"&&this.options.operationName!==e.name?.value)&&(this.options.onComplete&&this.options.onComplete(this.complexity),this.complexity>this.options.maximumComplexity))return this.context.reportError(this.createError())}nodeComplexity(e,r){if(e.selectionSet){let n={};(r instanceof xe||r instanceof Ht)&&(n=r.getFields());let i;mr(r)?i=this.context.getSchema().getPossibleTypes(r).map(a=>a.name):i=[r.name];let s=e.selectionSet.selections.reduce((a,c)=>{let u=a,l=!0,d=!1;for(let p of c.directives??[])switch(p.name.value){case"include":{let h=this.includeDirectiveDef&&ji(this.includeDirectiveDef,c,this.variableValues||{});typeof h?.if=="boolean"&&(l=h.if);break}case"skip":{let h=this.skipDirectiveDef&&ji(this.skipDirectiveDef,c,this.variableValues||{});typeof h?.if=="boolean"&&(d=h.if);break}}if(!l||d)return a;switch(c.kind){case _.FIELD:{let p=n[c.name.value];if(!p)break;let y=lt(p.type),h;try{h=$i(p,c,this.variableValues||{})}catch(S){return this.context.reportError(S),a}let m=0;At(y)&&(m=this.nodeComplexity(c,y));let v={childComplexity:m,args:h,field:p,node:c,type:r,context:this.requestContext};if(!this.estimators.find(S=>{let k=S(v);return typeof k=="number"&&!isNaN(k)?(u=Vn(k,a,i),!0):!1}))return this.context.reportError(new N(`No complexity could be calculated for field ${r.name}.${p.name}. At least one complexity estimator has to return a complexity score.`)),a;break}case _.FRAGMENT_SPREAD:{let p=this.context.getFragment(c.name.value);if(!p)break;let y=this.context.getSchema().getType(p.typeCondition.name.value);if(!At(y))break;let h=this.nodeComplexity(p,y);mr(y)?u=Vn(h,a,this.context.getSchema().getPossibleTypes(y).map(m=>m.name)):u=Vn(h,a,[y.name]);break}case _.INLINE_FRAGMENT:{let p=r;if(c.typeCondition&&c.typeCondition.name&&(p=this.context.getSchema().getType(c.typeCondition.name.value)||p,!At(p)))break;let y=this.nodeComplexity(c,p);mr(p)?u=Vn(y,a,this.context.getSchema().getPossibleTypes(p).map(h=>h.name)):u=Vn(y,a,[p.name]);break}default:{u=Vn(this.nodeComplexity(c,r),a,i);break}}return u},{});return s?Math.max(...Object.values(s),0):NaN}return 0}createError(){return typeof this.options.createError=="function"?this.options.createError(this.options.maximumComplexity,this.complexity):new N(NN(this.options.maximumComplexity,this.complexity))}};function Vn(t,e,r){for(let n of r)Object.prototype.hasOwnProperty.call(e,n)?e[n]+=t:e[n]=t;return e}o(Vn,"addComplexities");function Rb(t){let e=t?.defaultComplexity??1;return r=>e+r.childComplexity}o(Rb,"simpleEstimator");var Ob=o((t,e,r={})=>{let{definitions:n}=t,i=CN(n),s=LN(n);return Object.entries(s).map(([a,c])=>Fc(c,i,0,e,a,r))},"depthLimit");function CN(t){return t.reduce((e,r)=>(r.kind===_.FRAGMENT_DEFINITION&&(e[r?.name?.value??""]=r),e),{})}o(CN,"getFragments");function LN(t){return t.reduce((e,r)=>{if(r.kind===_.OPERATION_DEFINITION){let n=r?.name?.value??"";e[n]=r}return e},{})}o(LN,"getQueriesAndMutations");function Fc(t,e,r,n,i,s){if(r>n)throw s?.onLimitReached?.(r,i),new N(`${i||"Your query"} exceeds maximum operation depth of ${n}`,{nodes:[t]});let a=s?.ignore??[/^__/];switch(t.kind){case _.FIELD:return DN(t,a)||!t.selectionSet?0:1+Math.max(...t.selectionSet.selections.map(c=>Fc(c,e,r+1,n,i,s)));case _.FRAGMENT_SPREAD:return Fc(e[t.name.value],e,r,n,i,s);case _.INLINE_FRAGMENT:case _.FRAGMENT_DEFINITION:case _.OPERATION_DEFINITION:return Math.max(...t.selectionSet.selections.map(c=>Fc(c,e,r,n,i,s)));default:throw new Error("uh oh! depth crawler cannot handle: "+t.kind)}}o(Fc,"determineDepth");var DN=o((t,e)=>e.find(r=>t.name.value.match(r)!==null)||!1,"isIgnored");var UN=o(async(t,e)=>{if(!e.complexityLimit)throw new Gn.ConfigurationError("No complexity maximum defined, you need to pass a maxComplexity to the policy");let n=e.endpointUrl;if(!n)throw new Gn.ConfigurationError("No GraphQL endpoint, you need to pass a endpointUrl to the policy");let i=Mc(),c=(await(await fetch(n,{method:"POST",body:JSON.stringify({query:i}),headers:{"Content-Type":"application/json"}})).json()).data;if(!c||!c?.__schema)throw new N("GraphQL introspection query failed, enable introspection or pass a schema url in configuration.");let u=kc(c,{assumeValid:!0}),l=Pb({estimators:[Rb({defaultComplexity:1})],schema:u,query:t,variables:{count:10}});if(e.complexityLimit&&l>e.complexityLimit)throw new N(`Query is too complex (${l}/${e.complexityLimit}), remove some fields and try again`)},"applyComplexityLimitPolicy"),MN=o(async(t,e)=>{let r=e.depthLimit;if(!r)throw new Gn.ConfigurationError("No maximum depth defined, you need to pass a maxDepth to the policy");return Math.max(...Ob(t,r))},"applyDepthLimitPolicy"),xb=o(async(t,e,r)=>{let n=Gn.SystemLogMap.getLogger(e);try{let s=await t.clone().json(),a=dc(s.query);r.useDepthLimit&&await MN(a,r.useDepthLimit),r.useComplexityLimit&&await UN(a,r.useComplexityLimit)}catch(i){if(i instanceof N)return n.info(i),new Response(JSON.stringify(i.toJSON()),{status:400,headers:{"Content-Type":"application/json"}});throw i}return t},"GraphQLComplexityLimitInboundPolicy");var Nb=Fp(Ot());function kN(t){if(!t)return!1;let e=t.replace(/\s/g,"");return e.includes("__schema")||e.includes("__type")}o(kN,"isIntrospectionQuery");var Cb=o(async(t,e)=>{let n=await t.clone().json();return kN(n.query)?Nb.HttpProblems.forbidden(t,e,{detail:"Introspection queries are not allowed"}):t},"GraphQLDisableIntrospectionInboundPolicy");
 /*! For license information please see index.minified.js.LEGAL.txt */