@zuplo/runtime 5.1785.0 → 5.1786.0

package/index.minified.js

@@ -68,5 +68,5 @@ Signature verification is impossible without access to the original signed mater
 `+d}):new ae(e,t,{message:`No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? 
  If a webhook request is being forwarded by a third-party tool, ensure that the exact request body, including JSON formatting and new line style, is preserved.
 `+l+`
-`+d});let p=Math.floor((typeof u=="number"?u:Date.now())/1e3)-n.timestamp;if(o>0&&p>o)throw new ae(e,t,{message:"Timestamp outside the tolerance zone"});return!0}s(Wc,"validateComputedSignature");function Kc(t,e){return typeof t!="string"?null:t.split(",").reduce((n,r)=>{let o=r.split("=");return o[0]==="t"&&(n.timestamp=parseInt(o[1],10)),o[0]===e&&n.signatures.push(o[1]),n},{timestamp:-1,signatures:[]})}s(Kc,"parseHeader");function Jc(t,e){if(t.length!==e.length)return!1;let n=t.length,r=0;for(let o=0;o<n;++o)r|=t.charCodeAt(o)^e.charCodeAt(o);return r===0}s(Jc,"secureCompare");async function Yc(t,e){let n=new TextEncoder,r=await crypto.subtle.importKey("raw",n.encode(e),{name:"HMAC",hash:{name:"SHA-256"}},!1,["sign"]),o=await crypto.subtle.sign("hmac",r,n.encode(t)),i=new Uint8Array(o),a=new Array(i.length);for(let u=0;u<i.length;u++)a[u]=qr[i[u]];return a.join("")}s(Yc,"computeHMACSignatureAsync");var qr=new Array(256);for(let t=0;t<qr.length;t++)qr[t]=t.toString(16).padStart(2,"0");function D(t,e){let n=s((i,a,u)=>{let c=t[i];if(!(u&&c===void 0)){if(c===void 0)throw new g(`Value of '${String(i)}' on policy '${e}' is required, but no value was set. If using an environment variable, check that it is set correctly.`);if(a==="array"&&Array.isArray(c))throw new g(`Value of '${String(i)}' on policy '${e}' must be an array. Received type ${typeof c}.`);if(typeof c!==a)throw new g(`Value of '${String(i)}' on policy '${e}' must be of type ${a}. Received type ${typeof c}.`);if(typeof c=="string"&&c.length===0)throw new g(`Value of '${String(i)}' on policy '${e}' must be a non-empty string. The value received is empty. If using an environment variable, check that it is set correctly.`);if(typeof c=="number"&&isNaN(c))throw new g(`Value of '${String(i)}' on policy '${e}' must be valid number. If using an environment variable, check that it is set correctly.`)}},"validate"),r=s((i,a)=>(n(i,a,!0),{optional:r,required:o}),"optional"),o=s((i,a)=>(n(i,a,!1),{optional:r,required:o}),"required");return{optional:r,required:o}}s(D,"optionValidator");var cn=s(async(t,e,n,r)=>{D(n,r).required("signingSecret","string").optional("tolerance","number");let o=t.headers.get("stripe-signature");try{let i=await t.clone().text();await Ji(i,o,n.signingSecret)}catch(i){return e.log.error("Error validating stripe webhook",i),R.badRequest(t,e,{title:"Webhook Error",detail:i.message})}return t},"StripeWebhookVerificationInboundPolicy");function Yi(t){return t!==null&&typeof t=="object"&&"id"in t&&Q(t.id)&&"type"in t&&Q(t.type)}s(Yi,"isStripeWebhookEvent");var ln=class extends ue{static{s(this,"MeteringPlugin")}};var Qc={getSubscription:async({subscriptionId:t,stripeSecretKey:e,logger:n})=>{let r=await fetch(`https://api.stripe.com/v1/subscriptions/${t}`,{headers:{Authorization:`Bearer ${e}`}}),o=await r.json();if(r.status!==200){let i="Error retrieving subscription from Stripe API.";throw n.error(i,o),new I(i)}return o},getCustomer:async({customerId:t,stripeSecretKey:e,logger:n})=>{let r=await fetch(`https://api.stripe.com/v1/customers/${t}`,{headers:{Authorization:`Bearer ${e}`}}),o=await r.json();if(r.status!==200){let i="Error retrieving customer from Stripe API.";throw n.error(i,o),new I(i)}return o}},Qi=Qc;var $r="https://api-key-management-service-eq7z4lly2a-ue.a.run.app";async function Xi({apiKeyBucketName:t,stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r,managerEmail:o,managerSub:i,context:a}){let{authApiJWT:u}=h.instance,c=new URL(`/v1/buckets/${t}/consumers`,$r);c.searchParams.set("with-api-key","true");let l=crypto.randomUUID(),d={name:l,description:"API Subscription",tags:{subscriptionExternalId:e,planExternalIds:[n]},metadata:{stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r},managers:[{sub:i,email:o}]},p=await V({retryDelayMs:5,retries:2,logger:O.getLogger(a)},c.toString(),{method:"POST",headers:{Authorization:`Bearer ${u}`,"content-type":"application/json"},body:JSON.stringify(d)}),y=await p.json();if(p.status!==200){let m="Error creating API Key Consumer";throw a.log.error(m,y),new I(m)}return a.log.info("Successfully created API Key Consumer",{consumerId:l,stripeSubscriptionId:e,stripeProductId:n}),l}s(Xi,"createConsumer");async function es({apiKeyBucketName:t,stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r,managerEmail:o,context:i}){let{authApiJWT:a}=h.instance,u=new URL(`/v1/buckets/${t}/consumers`,$r);u.searchParams.set("with-api-key","true");let c=crypto.randomUUID(),l={name:c,description:"API Subscription",tags:{subscriptionExternalId:e,planExternalIds:[n]},metadata:{stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r},managers:[o]},d=await V({retryDelayMs:5,retries:2,logger:O.getLogger(i)},u.toString(),{method:"POST",headers:{Authorization:`Bearer ${a}`,"content-type":"application/json"},body:JSON.stringify(l)}),p=await d.json();if(d.status!==200){let y="Error creating API Key Consumer";throw i.log.error(y,p),new I(y)}return i.log.info("Successfully created API Key Consumer with Manager Invite",{consumerId:c,stripeSubscriptionId:e,stripeProductId:n}),c}s(es,"createConsumerInvite");async function ts({apiKeyBucketName:t,consumerId:e,context:n}){let{authApiJWT:r}=h.instance,o=new URL(`/v1/buckets/${t}/consumers/${e}`,$r);o.searchParams.set("with-api-key","true");let i=await V({retryDelayMs:5,retries:2,logger:O.getLogger(n)},o.toString(),{method:"DELETE",headers:{Authorization:`Bearer ${r}`,"content-type":"application/json"},body:JSON.stringify({})});if(i.status!==204){let a=await i.json(),u="Error deleting API Key Consumer";throw n.log.error(u,a),new I(u)}return n.log.info(`Successfully deleted API Key Consumer '${e}`),e}s(ts,"deleteConsumer");async function ns({context:t,stripeSubscriptionId:e,stripeProductId:n,customerKey:r,meteringBucketId:o,meteringBucketRegion:i,customerExternalId:a,subscriptionStatus:u}){let c={status:u,type:"periodic",renewalStrategy:"monthly",region:i,subscriptionExternalId:e,planExternalIds:[n],customerKey:r,customerExternalId:a},{authApiJWT:l,meteringServiceUrl:d}=h.instance;if(!_e(l))throw new T("No Zuplo JWT token set.");let p=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${d}/internal/v1/metering/${o}/subscriptions`,{headers:{Authorization:`Bearer ${l}`,"Content-Type":"application/json","zp-rid":t.requestId},method:"POST",body:JSON.stringify(c)});if(!p.ok){let y="Error creating metering subscription.",m;try{m=await p.json()}catch{m={status:p.status,statusText:p.statusText}}throw t.log.error(y,m),new I(y)}t.log.info("Successfully created/updated metering subscription.",c)}s(ns,"createSubscription");async function dt({context:t,meteringSubscriptionId:e,meteringBucketId:n,requestBody:r}){let{authApiJWT:o,meteringServiceUrl:i}=h.instance;if(!_e(o))throw new T("No Zuplo JWT token set.");let a=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${i}/internal/v1/metering/${n}/subscriptions/${e}`,{headers:{Authorization:`Bearer ${o}`,"Content-Type":"application/json","zp-rid":t.requestId},method:"PATCH",body:JSON.stringify(r)});if(!a.ok){let u=`Error updating metering subscription to '${JSON.stringify(r)}'.`,c;try{c=await a.json()}catch{c={status:a.status,statusText:a.statusText}}throw t.log.error(u,c),new I(u)}t.log.info(`Successfully update metering subscription to '${JSON.stringify(r)}'.`)}s(dt,"updateSubscription");async function pt({context:t,stripeSubscriptionId:e,stripeCustomerId:n,meteringBucketId:r}){let{authApiJWT:o,meteringServiceUrl:i}=h.instance;if(!_e(o))throw new T("No Zuplo JWT token set.");let a=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${i}/internal/v1/metering/${r}/subscriptions?subscriptionExternalId=${e}`,{headers:{Authorization:`Bearer ${o}`,"zp-rid":t.requestId},method:"GET"});if(!a.ok){let c="Error querying for metering subscription.",l;try{l=await a.json()}catch{l={status:a.status,statusText:a.statusText}}throw t.log.error(c,l),new I(c,l)}let u=await a.json();if(u.data.length===0){let c="Subscription was not found and the event was ignored by Stripe metering plugin webhook.";throw t.log.error(c),new I(c)}if(u.data[0].customerExternalId!==n){let c="A subscription was not found for the customer provided and the event was ignored by Stripe metering plugin webhook.";throw t.log.error(c),new I(c)}return u.data[0]}s(pt,"getSubscription");function dn(t){return t.replaceAll("_","-")}s(dn,"stripeStatusToMeteringStatus");async function Fr(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to have '.data.object.id' be the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.plan;if(!i||!i.product)return e.log.warn(`Invalid Stripe API result. Expected event '${n.id}' to have a plan data.`),R.badRequest(t,e,{detail:"Invalid Stripe API result. Expected event to have a plan data."});let a=n.data.object.customer;if(!a)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});let u=i.product,c;if(n.data.object.metadata&&n.data.object.metadata.zuplo_created_by_email&&n.data.object.metadata.zuplo_created_by_sub)c=await Xi({apiKeyBucketName:r.apiKeyBucketName,stripeProductId:u,stripeSubscriptionId:o,stripeCustomerId:a,managerEmail:n.data.object.metadata.zuplo_created_by_email,managerSub:n.data.object.metadata.zuplo_created_by_sub,context:e});else{let l=await Qi.getCustomer({logger:e.log,stripeSecretKey:r.stripeSecretKey,customerId:a});if(!l.email)return e.log.warn(`Invalid Stripe API result. Expected customer '${a}' to contain email address.`),R.badRequest(t,e,{detail:"Invalid Stripe API result. Expected customer to contain email address."});c=await es({apiKeyBucketName:r.apiKeyBucketName,stripeProductId:u,stripeSubscriptionId:o,stripeCustomerId:a,managerEmail:l.email,context:e})}if(!c)return R.internalServerError(t,e,{detail:"No consumer was created, skipping creation of subscription"});try{let l=dn(n.data.object.status);await ns({context:e,stripeProductId:u,stripeSubscriptionId:o,customerKey:c,meteringBucketId:r.meteringBucketId,meteringBucketRegion:r.meteringBucketRegion,customerExternalId:a,subscriptionStatus:l})}catch(l){return await ts({apiKeyBucketName:r.apiKeyBucketName,consumerId:c,context:e}),R.internalServerError(t,e,{detail:l.message})}return R.ok(t,e)}s(Fr,"onCustomerSubscriptionCreated");async function Br(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to have '.data.object.id' be the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.customer;if(!i)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});let a=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId});return await dt({context:e,meteringSubscriptionId:a.id,meteringBucketId:r.meteringBucketId,requestBody:{status:"canceled",planExternalIds:a.planExternalIds}}),R.ok(t,e)}s(Br,"onCustomerSubscriptionDeleted");async function jr(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to include '.data.object.id' as the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.customer;if(!i)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});if(n.data.previous_attributes){let a=n.data.previous_attributes;if(a.status&&a.status!==n.data.object.status){let u=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId}),c=dn(n.data.object.status);return await dt({context:e,meteringSubscriptionId:u.id,meteringBucketId:r.meteringBucketId,requestBody:{status:c,planExternalIds:u.planExternalIds}}),R.ok(t,e)}if(a.plan&&a.plan.product!==n.data.object.plan.product){let u=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId});return await dt({context:e,meteringSubscriptionId:u.id,meteringBucketId:r.meteringBucketId,requestBody:{status:u.status,planExternalIds:[n.data.object.plan.product]}}),R.ok(t,e)}}return e.log.warn(`This update event '${n.id}' is not supported by Stripe metering plugin webhook.`),R.badRequest(t,e,{detail:"This update event is not supported by Stripe metering plugin webhook."})}s(jr,"onCustomerSubscriptionUpdated");var zr=class extends ln{constructor(n){super();this.options=n}static{s(this,"StripeMeteringPlugin")}registerRoutes(n,r){let o=s(async(c,l)=>{if(this.options.__testMode===!0)return l.log.warn("Received Stripe webhook event of in test mode."),"success";let{meteringBucketId:d,apiKeyBucketName:p}=this.options;if(!d)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)d=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g("StripeMeteringPlugin - No 'meteringBucketId' property provided");if(!p)if(Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)p=Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new g("StripeMeteringPlugin - No 'apiKeyBucketName' property provided");if(!h.instance.build.ACCOUNT_NAME)throw new T("Build environment is not configured correctly. Expected 'ACCOUNT_NAME' to be set.");let y=this.options.meteringBucketRegion??"us-central1";if(!Xc(y))throw new g(`StripeMeteringPlugin - The value '${y}' on the property 'meteringBucketRegion' is invalid.`);let m=await c.json();if(!Yi(m))return R.badRequest(c,l,{detail:"The received body was not in the expected format."});switch(l.log.info(`Received Stripe webhook event of type '${m.type}' with ID '${m.id}'.`),m.type){case"customer.subscription.created":return await Fr(c,l,m,{meteringBucketId:d,apiKeyBucketName:p,meteringBucketRegion:y,stripeSecretKey:this.options.stripeSecretKey});case"customer.subscription.updated":return await jr(c,l,m,{meteringBucketId:d,apiKeyBucketName:p,meteringBucketRegion:y,stripeSecretKey:this.options.stripeSecretKey});case"customer.subscription.deleted":return await Br(c,l,m,{meteringBucketId:d});default:return R.badRequest(c,l,{detail:"Event is not supported by Stripe metering plugin webhook."})}},"stripeWebhookHandler"),i=oi({inboundPolicies:[{handler:cn,options:{signingSecret:this.options.webhooks.signingSecret,tolerance:this.options.webhooks.tolerance}}]}),a=new H({processors:[j,i],handler:o,gateway:r}),u=new k({label:"PLUGIN_STRIPE_WEBHOOK_ROUTE",methods:["POST"],path:this.options.webhooks.routePath??"/__plugins/stripe/webhooks",systemRouteName:"stripe-plugin"});n.addRoute(u,a.execute)}};function Xc(t){return t!==null&&typeof t=="string"&&["us-central1","europe-west4"].includes(t)}s(Xc,"isMetricsRegion");var os=new WeakMap,rs={},pn=class{static{s(this,"AmberfloMeteringPolicy")}static setRequestProperties(e,n){os.set(e,n)}};async function is(t,e,n,r){if(!n.statusCodes)throw new g(`Invalid AmberfloMeterInboundPolicy '${r}': options.statusCodes must be an array of HTTP status code numbers`);let o=Array.isArray(n.statusCodes)?n.statusCodes:Lt(n.statusCodes);return e.addResponseSendingFinalHook(async i=>{if(o.includes(i.status)){let a=os.get(e),u=n.customerId;if(n.customerIdPropertyPath){if(!t.user)throw new I(`Unable to apply customerIdPropertyPath '${n.customerIdPropertyPath}' as request.user is 'undefined'.`);u=Ie(t.user,n.customerIdPropertyPath,"customerIdPropertyPath")}let c=a?.customerId??u;if(!c){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': customerId cannot be undefined`);return}let l=a?.meterApiName??n.meterApiName;if(!l){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': meterApiName cannot be undefined`);return}let d=a?.meterValue??n.meterValue;if(!d){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': meterValue cannot be undefined`);return}let p={customerId:c,meterApiName:l,meterValue:d,meterTimeInMillis:Date.now(),dimensions:Object.apply(n.dimensions??{},a?.dimensions)},y=rs[n.apiKey];if(!y){let m=n.apiKey,w=t.headers.get("zm-test-id")??"";y=new A("amberflo-ingest-meter",10,async P=>{try{let E=n.url??"https://app.amberflo.io/ingest",x=await fetch(E,{method:"POST",body:JSON.stringify(P),headers:{"content-type":"application/json","x-api-key":m,"zm-test-id":w}});x.ok||e.log.error(`Unexpected response in AmberfloMeteringInboundPolicy '${r}'. ${x.status}: ${await x.text()}`)}catch(E){throw e.log.error(`Error in AmberfloMeteringInboundPolicy '${r}': ${E.message}`),E}}),rs[m]=y}y.enqueue(p),e.waitUntil(y.waitUntilFlushed())}}),t}s(is,"AmberfloMeteringInboundPolicy");async function mn(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest({name:"SHA-256"},e);return[...new Uint8Array(n)].map(o=>o.toString(16).padStart(2,"0")).join("")}s(mn,"sha256");var ss=new Map;async function q(t,e){let n,r=ss.get(t);return r!==void 0?n=r:(n=`zuplo-policy-${await mn(JSON.stringify({policyName:t,options:e}))}`,ss.set(t,n)),n}s(q,"getPolicyCacheName");var as="key-metadata-cache-type";function el(t,e){return e.authScheme===""?t:t.replace(`${e.authScheme} `,"")}s(el,"getKeyValue");async function gn(t,e,n,r){if(!n.bucketName)if(Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)n.bucketName=Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new g(`ApiKeyInboundPolicy '${r}' - no bucketName property provided`);let o={authHeader:n.authHeader??"authorization",authScheme:n.authScheme??"Bearer",bucketName:n.bucketName,cacheTtlSeconds:n.cacheTtlSeconds??60,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests??!1,disableAutomaticallyAddingKeyHeaderToOpenApi:n.disableAutomaticallyAddingKeyHeaderToOpenApi??!1};if(o.cacheTtlSeconds<60)throw new g(`ApiKeyInboundPolicy '${r}' - minimum cacheTtlSeconds value is 60s, '${o.cacheTtlSeconds}' is invalid`);let i=s(E=>o.allowUnauthenticatedRequests?t:R.unauthorized(t,e,{detail:E}),"unauthorizedResponse"),a=t.headers.get(o.authHeader);if(!a)return i("No Authorization Header");if(!a.toLowerCase().startsWith(o.authScheme.toLowerCase()))return i("Invalid Authorization Scheme");let u=el(a,o);if(!u||u==="")return i("No key present");let c=await tl(u),l=await q(r,o),d=new N(l,e),p=await d.get(c);if(p&&p.isValid===!0)return t.user=p.user,t;if(p&&!p.isValid)return p.typeId!==as&&O.getLogger(e).error(`ApiKeyInboundPolicy '${r}' - cached metadata has invalid typeId '${p.typeId}'`,p),i("Authorization Failed");let y={key:u},m=await V({retryDelayMs:5,retries:2,logger:O.getLogger(e)},`${h.instance.apiKeyServiceUrl}/v1/$validate/${o.bucketName}`,{method:"POST",headers:{"content-type":"application/json","zp-rid":e.requestId,"zp-dn":h.instance.deploymentName??"unknown","User-Agent":h.instance.systemUserAgent},body:JSON.stringify(y)});if(m.status===401)return e.log.info(`ApiKeyInboundPolicy '${r}' - 401 response from Key Service`),i("Authorization Failed");if(m.status!==200){try{let E=await m.text(),x=JSON.parse(E);e.log.error("Unexpected response from key service",x)}catch{e.log.error("Invalid response from key service")}throw new I(`ApiKeyInboundPolicy '${r}' - unexpected response from Key Service. Status: ${m.status}`)}let w=await m.json(),P={isValid:!0,typeId:as,user:{sub:w.name,data:w.metadata}};return t.user=P.user,d.put(c,P,o.cacheTtlSeconds),t}s(gn,"ApiKeyInboundPolicy");async function tl(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(n)).map(i=>i.toString(16).padStart(2,"0")).join("")}s(tl,"hashValue");var us=gn;var mt=require("jose");var Vr={},nl=s(async(t,e)=>{if(!e.jwkUrl||typeof e.jwkUrl!="string")throw new g("Invalid State - jwkUrl not set");Vr[e.jwkUrl]||(Vr[e.jwkUrl]=(0,mt.createRemoteJWKSet)(new URL(e.jwkUrl),e.headers?{headers:e.headers}:void 0));let{payload:n}=await(0,mt.jwtVerify)(t,Vr[e.jwkUrl],{issuer:e.issuer,audience:e.audience});return n},"jwkVerifier"),rl=s(async(t,e)=>{let n;if(e.secret===void 0)throw new Error("secretVerifier requires secret to be defined");if(typeof e.secret=="string"){let i=new TextEncoder().encode(e.secret);n=new Uint8Array(i)}else n=e.secret;let{payload:r}=await(0,mt.jwtVerify)(t,n,{issuer:e.issuer,audience:e.audience});return r},"secretVerifier"),$=s(async(t,e,n,r)=>{let o=t.headers.get("Authorization"),i="bearer ",a=s(y=>R.unauthorized(t,e,{detail:y}),"unauthorizedResponse");if(!n.jwkUrl&&!n.secret)throw new g(`OpenIdJwtInboundPolicy policy '${r}': One of 'jwkUrl' or 'secret' options are required.`);if(n.jwkUrl&&n.secret)throw new g(`OpenIdJwtInboundPolicy policy '${r}': Only one of 'jwkUrl' and 'secret' options should be provided.`);let u=n.jwkUrl?nl:rl,l=await s(async()=>{if(!o)return a("No authorization header");if(o.toLowerCase().indexOf(i)!==0)return a("Invalid bearer token format for authorization header");let y=o.substring(i.length);if(!y||y.length===0)return a("No bearer token on authorization header");try{return await u(y,n)}catch(m){let w=new URL(t.url);return"code"in m&&m.code==="ERR_JWT_EXPIRED"?e.log.warn(`Expired token used on url: ${w.pathname} `,m):e.log.warn(`Invalid token on: ${t.method} ${w.pathname}`,m),a("Invalid token")}},"getJwtOrRejectedResponse")();if(l instanceof Response)return n.allowUnauthenticatedRequests===!0?t:l;let d=n.subPropertyName??"sub",p=l[d];return p?(t.user={sub:p,data:l},t):a(`Token is not valid, no '${d}' property found.`)},"OpenIdJwtInboundPolicy");var cs=s(async(t,e,n,r)=>$(t,e,{issuer:`https://${n.auth0Domain}/`,audience:n.audience,jwkUrl:`https://${n.auth0Domain}/.well-known/jwks.json`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r),"Auth0JwtInboundPolicy");var ls=s(async(t,e,n)=>{let r=t.headers.get("Authorization"),o="basic ",i=s(l=>R.unauthorized(t,e,{detail:l}),"unauthorizedResponse"),u=await s(async()=>{if(!r)return await i("No Authorization header");if(r.toLowerCase().indexOf(o)!==0)return await i("Invalid Basic token format for Authorization header");let l=r.substring(o.length);if(!l||l.length===0)return await i("No username:password provided");let d=atob(l).normalize(),p=d.indexOf(":");if(p===-1||/[\0-\x1F\x7F]/.test(d))return await i("Invalid basic token value - see https://tools.ietf.org/html/rfc5234#appendix-B.1");let y=d.substring(0,p),m=d.substring(p+1),w=n.accounts.find(P=>P.username===y&&P.password===m);return w||await i("Invalid username or password")},"getAccountOrRejectedResponse")();if(u instanceof Response)return n.allowUnauthenticatedRequests?t:u;let c=u.username;return t.user={sub:c,data:u.data},t},"BasicAuthInboundPolicy");var ol=["cdn-cache-control","cloudflare-cdn-cache-control","surrogate-control","cache-tag","expires"];async function il(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(n)).map(i=>i.toString(16).padStart(2,"0")).join("")}s(il,"digestMessage");var sl=s(async(t,e)=>{let n=[...e.dangerouslyIgnoreAuthorizationHeader===!0?[]:["authorization"],...e.headers??[]],r=[];for(let[d,p]of t.headers.entries())n.includes(d)&&r.push({key:d.toLowerCase(),value:p});r.sort((d,p)=>d.key.localeCompare(p.key));let o=await il(JSON.stringify(r)),i=new URL(t.url),a=new URLSearchParams(i.searchParams);a.set("_z-hdr-dgst",o);let u=e.cacheHttpMethods?.includes(t.method.toUpperCase())&&t.method.toUpperCase()!=="GET";u&&a.set("_z-original-method",t.method);let c=`${i.origin}${i.pathname}?${a}`;return new Request(c,{method:u?"GET":t.method})},"createCacheKeyRequest");async function ds(t,e,n,r){let o=await q(r,n),i=await caches.open(o),a=n?.cacheHttpMethods?.map(l=>l.toUpperCase())??["GET"],u=await sl(t,n),c=await i.match(u);return c||(e.addEventListener("responseSent",l=>{try{let d=n.statusCodes??[200,206,301,302,303,404,410],p=l.response.clone();if(!d.includes(p.status)||!a.includes(t.method.toUpperCase()))return;let y=n?.expirationSecondsTtl??60,m=new Response(p.body,p);ol.forEach(w=>m.headers.delete(w)),m.headers.set("cache-control",`s-maxage=${y}`),e.waitUntil(i.put(u,m))}catch(d){e.log.error(`Error in caching-inbound-policy '${r}': "${d.message}"`,d)}}),t)}s(ds,"CachingInboundPolicy");var ps=s(async(t,e,n,r)=>{if(!n.method)throw new g(`ChangeMethodInboundPolicy '${r}' options.method must be valid HttpMethod`);return new L(t,{method:n.method})},"ChangeMethodInboundPolicy");var ms=s(async(t,e,n)=>{let r=[...n.exclude??[]],o=new Headers;return r.forEach(a=>{let u=t.headers.get(a);u&&o.set(a,u)}),new L(t,{headers:o})},"ClearHeadersInboundPolicy");var gs=s(async(t,e,n,r)=>{let o=[...r.exclude??[]],i=new Headers;return o.forEach(u=>{let c=t.headers.get(u);c&&i.set(u,c)}),new Response(t.body,{headers:i,status:t.status,statusText:t.statusText})},"ClearHeadersOutboundPolicy");var fs=s(async(t,e,n,r)=>{let o=new URL(n.frontendApiUrl.startsWith("https://")||n.frontendApiUrl.startsWith("http://")?n.frontendApiUrl:`https://${n.frontendApiUrl}`),i=new URL(o);return i.pathname="/.well-known/jwks.json",$(t,e,{issuer:o.href.slice(0,-1),jwkUrl:i.toString(),allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)},"ClerkJwtInboundPolicy");var hs=s(async(t,e,n,r)=>{if(!n.userPoolId)throw new g("userPoolId must be set in the options for CognitoJwtInboundPolicy");if(!n.region)throw new g("region must be set in the options for CognitoJwtInboundPolicy");return $(t,e,{issuer:`https://cognito-idp.${n.region}.amazonaws.com/${n.userPoolId}`,jwkUrl:`https://cognito-idp.${n.region}.amazonaws.com/${n.userPoolId}/.well-known/jwks.json`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)},"CognitoJwtInboundPolicy");var ys=s(async(t,e,n,r)=>{if(!n.policies||n.policies.length===0)throw new g(`CompositeInboundPolicy '${r}' must have valid policies defined`);let o=M.instance,i=nt(n.policies,o?.routeData.policies);return sr(i)(t,e)},"CompositeInboundPolicy");var bs=s(async(t,e,n,r)=>{let o=t.headers.get("Authorization");if(!o)return R.unauthorized(t,e,{detail:"No authorization header"});let i=al(o);if(!i)return R.unauthorized(t,e,{detail:"Failed to parse token from Authorization header"});let a=await q(r,n),u=new N(a,e),c=await u.get(i);if(!c){let l=await fetch(n.introspectionUrl,{headers:{Authorization:"Basic "+btoa(`${n.clientId}:${n.clientSecret}`),Accept:"application/jwt","Content-Type":"application/x-www-form-urlencoded"},method:"POST",body:"token="+i+"&token_type_hint=access_token"}),d=await l.text();if(l.status===200)c=d,u.put(i,c,n.cacheDurationSeconds??600);else return l.status>=500?(e.log.error(`Error introspecting token - ${l.status}: '${d}'`),R.internalServerError(t,e,{detail:"Problem encountered authorizing the HTTP request"})):R.unauthorized(t,e)}return t.headers.set("Authorization",`Bearer ${c}`),t},"CurityPhantomTokenInboundPolicy");function al(t){return t.split(" ")[0]==="Bearer"?t.split(" ")[1]:null}s(al,"getToken");var ws=s(async(t,e,n,r)=>(D(n,r).required("projectId","string").optional("allowUnauthenticatedRequests","boolean"),$(t,e,{issuer:`https://securetoken.google.com/${n.projectId}`,audience:n.projectId,jwkUrl:"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)),"FirebaseJwtInboundPolicy");var Rs=s(async(t,e,n)=>{let r="application/x-www-form-urlencoded",o="multipart/form-data",i=t.headers.get("content-type")?.toLowerCase();if(!i||![o,r].includes(i))return n&&n.badRequestIfNotFormData?new Response(`Bad Request - expected content-type '${r}' or ${o}`,{status:400,statusText:"Bad Request"}):t;let a=await t.formData();if(n&&n.optionalHoneypotName&&a.get(n.optionalHoneypotName)!=="")return new Response("Bad Request",{status:400,statusText:"Bad Request"});let u={};for(let[d,p]of a)u[d]=p.toString();let c=new Headers(t.headers);return c.set("content-type","application/json"),c.delete("content-length"),new L(t,{body:JSON.stringify(u),headers:c})},"FormDataToJsonInboundPolicy");var qe="__unknown__",Ps=s(async(t,e,n,r)=>{let o={allow:{countries:Fe(n.allow?.countries,"allow.countries",r),regionCodes:Fe(n.allow?.regionCodes,"allow.regionCode",r),asns:Fe(n.allow?.asns,"allow.asOrganization",r)},block:{countries:Fe(n.block?.countries,"block.countries",r),regionCodes:Fe(n.block?.regionCodes,"block.regionCode",r),asns:Fe(n.block?.asns,"block.asOrganization",r)},ignoreUnknown:n.ignoreUnknown!==!1},i=e.incomingRequestProperties.country?.toLowerCase()??qe,a=e.incomingRequestProperties.regionCode?.toLowerCase()??qe,u=e.incomingRequestProperties.asn?.toString()??qe,c=o.ignoreUnknown&&i===qe,l=o.ignoreUnknown&&a===qe,d=o.ignoreUnknown&&u===qe,p=o.allow.countries,y=o.allow.regionCodes,m=o.allow.asns;if(p.length>0&&!p.includes(i)&&!c||y.length>0&&!y.includes(a)&&!l||m.length>0&&!m.includes(u)&&!d)return $e(t,e,r,i,a,u);let w=o.block.countries,P=o.block.regionCodes,E=o.block.asns;return w.length>0&&w.includes(i)&&!c||P.length>0&&P.includes(a)&&!l||E.length>0&&E.includes(u)&&!d?$e(t,e,r,i,a,u):t},"GeoFilterInboundPolicy");function $e(t,e,n,r,o,i){return e.log.debug(`Request blocked by GeoFilterInboundPolicy '${n}' (country: '${r}', regionCode: '${o}', asn: '${i}')`),R.forbidden(t,e,{geographicContext:{country:r,regionCode:o,asn:i}})}s($e,"blockedResponse");function Fe(t,e,n){if(typeof t=="string")return t.split(",").map(r=>r.trim().toLowerCase());if(typeof t>"u")return[];if(Array.isArray(t))return t.map(r=>r.trim().toLowerCase());throw new g(`Invalid '${e}' for GeoFilterInboundPolicy '${n}': '${t}', must be a string or string[]`)}s(Fe,"toLowerStringArray");var Is=s(async(t,e,n)=>{let r=t.user?.data.scope.split(" ")||[];if(!s((i,a)=>a.every(u=>i.includes(u)),"scopeChecker")(r,n.scopes)){let i={code:"UNAUTHORIZED",help_url:"https://zup.fail/UNAUTHORIZED",message:`JWT must have all the following scopes: ${n.scopes}`};return new Response(JSON.stringify(i),{status:401,statusText:"Unauthorized",headers:{"content-type":"application/json"}})}return t},"JWTScopeValidationInboundPolicy");var ul=new Set(["active","inactive","incomplete","incomplete-expired","trialing","past-due","canceled","unpaid"]),Es=s(async(t,e,n,r)=>{D(n,r).optional("allowRequestsWithoutSubscription","boolean").optional("bucketId","string");let o=O.getLogger(e),i=n.allowRequestsWithoutSubscription??!1;if(n.allowedSubscriptionStatuses)try{if(n.allowedSubscriptionStatuses.length===0)throw new g("Must set valid subscription statuses");let m=Ee(n.allowedSubscriptionStatuses),w=[];for(let P of m)ul.has(P)||w.push(P);if(w.length>0)throw new g(`Found the following invalid statuses: ${w.join(", ")}`)}catch(m){throw m instanceof g?new g(`LoadSubscriptionInboundPolicy '${r}' - The property 'allowedSubscriptionStatuses' is invalid. ${m.message}`):m}else n.allowedSubscriptionStatuses=["active","incomplete","trialing"];let a=n.allowedSubscriptionStatuses,u=t.user;if(!u)return i?t:R.unauthorized(t,e,{detail:"Unable to check subscription for anonymous user"});if(!n.bucketId)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)n.bucketId=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g(`LoadSubscriptionInboundPolicy '${r}' - no bucketId property provided`);let{authApiJWT:c,meteringServiceUrl:l}=h.instance,{sub:d}=u,p;try{let m=`${n.bucketId}-${d}`,w=new re(m,{logger:O.getLogger(e)}),P=await w.get(m);if(P)p=P,e.log.debug("Loading subscriptions from cache");else{let E=await fetch(`${l}/internal/v1/metering/${n.bucketId}/subscriptions?customerKey=${d}`,{headers:{Authorization:`Bearer ${c}`,"zp-rid":e.requestId},method:"GET"});if(!E.ok)return e.log.error(await E.text()),R.forbidden(t,e);p=await E.json(),w.put(m,p,15).catch(x=>{throw o.error(x),x})}}catch(m){o.error(`LoadSubscriptionInboundPolicy '${r}' -error in serviceResponse`,m)}let y=p&&p.data&&p.data.length>0?p.data[0]:void 0;return y?!a.includes(y.status)&&!i?(e.log.warn(`Subscription '${y.id}' has status '${y.status}' which is not part of the allowed statuses.`),R.unauthorized(t,e,{detail:"No valid subscription found"})):(a.includes(y.status)&&(e.log.debug(`Loading subscription '${y.id}' for user sub '${d}' to ContextData`),le.set(e,We,y)),t):(e.log.warn("No valid subscription found"),i?t:R.unauthorized(t,e,{detail:"No valid subscription found"}))},"LoadSubscriptionInboundPolicy");var xs=s(async(t,e,n,r)=>{D(n,r).optional("allowRequestsWithoutSubscription","boolean").optional("allowRequestsOverQuota","boolean").optional("bucketId","string");let o=O.getLogger(e);if(!n.meterOnStatusCodes)throw new g(`Invalid MeteringInboundPolicy '${r}': options.meterOnStatusCodes must be an array of HTTP status code numbers`);let i=Array.isArray(n.meterOnStatusCodes)?n.meterOnStatusCodes:Lt(n.meterOnStatusCodes);e.addResponseSendingFinalHook(async(p,y,m)=>{let w=le.get(m,We);if((n.allowRequestsWithoutSubscription??!1)&&!w){m.log.debug(`MeteringInboundPolicy '${r}' - no subscription found and allowRequestsWithoutSubscription is true`);return}if(!n.bucketId)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)n.bucketId=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g(`MeteringInboundPolicy '${r}' - no bucketId property provided`);let{authApiJWT:E,meteringServiceUrl:x}=h.instance;if(i.includes(p.status)&&w&&n.meters){m.log.debug(`MeteringInboundPolicy '${r}' - Updating subscription '${w.id}' with meters '${JSON.stringify(n.meters)} on response status '${p.status}'`);try{let C=await fetch(`${x}/internal/v1/metering/${n.bucketId}/subscriptions/${w.id}/quotas/consume`,{headers:{Authorization:`Bearer ${E}`,"zp-rid":m.requestId},method:"POST",body:JSON.stringify({meters:n.meters})});C.ok||(m.log.error(`MeteringInboundPolicy '${r}' -error in serviceResponse: ${C.status} - ${C.statusText}`),o.error(`MeteringInboundPolicy '${r}' -error in serviceResponse: ${C.status} - ${C.statusText}`))}catch(C){m.log.error(`MeteringInboundPolicy '${r}' -error in serviceResponse`),o.error(`MeteringInboundPolicy '${r}' -error in serviceResponse`,C)}}});let a=le.get(e,We),u=n.allowRequestsWithoutSubscription??!1,c=n.allowRequestsOverQuota??!1;if(!a)return u?t:(e.log.warn("Subscription is not available for user"),R.paymentRequired(t,e,{detail:"Subscription is not available for user",title:"No Subscription"}));if(a&&Object.keys(a.quotas).length===0)return e.log.error(`Quota is not set up for subscription '${a.id}'`),R.tooManyRequests(t,e,{detail:"Quota is not set up for the user's subscription",title:"Quota Exceeded"});let d=Object.keys(n.meters).filter(p=>!Object.keys(a.quotas).includes(p));if(d.length>0)return e.log.warn(`The following policy meters are not present in the subscription: ${d.join(", ")}`),R.tooManyRequests(t,e,{detail:`The following policy meters are not present in the subscription: ${d.join(", ")}`,title:"Quota Exceeded"});for(let p of Object.keys(a.quotas))if(a.quotas[p]<=0&&!c)return R.tooManyRequests(t,e,{detail:`Quota exceeded for meter '${p}'`,title:"Quota Exceeded"});return t},"MeteringInboundPolicy");var Ss=s(async(t,e,n,r)=>{let o=e.route.raw().responses;if(!o)return Gr(r,t,e,"No responses defined in the OpenAPI document. Add some responses with examples to use this policy.");let i=Object.keys(o),a=[];if(i.length===0)return Gr(r,t,e,"No response object defined under responses in the OpenAPI document. Add some response objects with examples to use this policy.");if(i.forEach(u=>{o[u].content&&Object.keys(o[u].content).forEach(l=>{let d=o[u].content[l].examples;d&&Object.keys(d).forEach(y=>{a.push({responseName:u,contentName:l,exampleName:y,exampleValue:d[y]})})})}),a=a.filter(u=>!(n.responsePrefixFilter&&!u.responseName.startsWith(n.responsePrefixFilter)||n.contentType&&u.contentName!==n.contentType||n.exampleName&&u.exampleName!==n.exampleName)),n.random&&a.length>1){let u=Math.floor(Math.random()*a.length);return vs(a[u])}else return a.length>0?vs(a[0]):Gr(r,t,e,"No examples matching the mocking options found in the OpenAPI document. Add examples to the OpenAPI document matching the options for this policy or change the mocking options to match the examples in the OpenAPI document.")},"MockApiInboundPolicy");function vs(t){let e=JSON.stringify(t.exampleValue,null,2),n=new Headers;switch(n.set("Content-Type",t.contentName),t.responseName){case"1XX":return new Response(e,{status:100,headers:n});case"2XX":return new Response(e,{status:200,headers:n});case"3XX":return new Response(e,{status:300,headers:n});case"4XX":return new Response(e,{status:400,headers:n});case"5XX":case"default":return new Response(e,{status:500,headers:n});default:return new Response(e,{status:Number(t.responseName),headers:n})}}s(vs,"generateResponse");var Gr=s((t,e,n,r)=>{let o=`Error in policy: ${t} - On route ${e.method} ${n.route.path}. ${r}`;return R.internalServerError(e,n,{detail:o})},"getProblemDetailResponse");var cl="Incoming",ll={logRequestBody:!0,logResponseBody:!0};function Ts(t){let e={};return t.forEach((n,r)=>{e[r]=n}),e}s(Ts,"headersToObject");function Os(){return new Date().toISOString()}s(Os,"timestamp");var Wr=new WeakMap,dl={};function Ls(t,e){let n=Wr.get(t);n||(n=dl);let r=Object.assign({...n},e);Wr.set(t,r)}s(Ls,"setMoesifContext");async function Cs(t,e){let n=t.headers.get("content-type");if(n&&n.indexOf("json")!==0)try{return await t.clone().json()}catch(o){e.log.error(o)}let r=await t.clone().text();return e.log.debug({textBody:r}),r}s(Cs,"readBody");var pl={},Kr;function As(){if(!Kr)throw new I("Invalid State - no _lastLogger");return Kr}s(As,"getLastLogger");function ml(t){let e=pl[t];return e||(e=new A("moesif-inbound",100,async n=>{let r=JSON.stringify(n);As().debug("posting",r);let o=await fetch("https://api.moesif.net/v1/events/batch",{method:"POST",headers:{"content-type":"application/json","X-Moesif-Application-Id":t},body:r});o.ok||As().error({status:o.status,body:await o.text()})})),e}s(ml,"getDispatcher");async function _s(t,e,n,r){Kr=e.log;let o=Os(),i=Object.assign(ll,n);if(!i.applicationId)throw new Error(`Invalid configuration for MoesifInboundPolicy '${r}' - applicationId is required`);let a=i.logRequestBody?await Cs(t,e):void 0;return e.addResponseSendingFinalHook(async(u,c)=>{let l=ml(i.applicationId),d=t.headers.get("true-client-ip"),p=Wr.get(e)??{},y={time:o,uri:t.url,verb:t.method,body:a,ip_address:d??void 0,api_version:p.apiVersion,headers:Ts(t.headers)},m=i.logResponseBody?await Cs(u,e):void 0,w={time:Os(),status:u.status,headers:Ts(u.headers),body:m},P={request:y,response:w,user_id:p.userId??c.user?.sub,session_token:p.sessionToken,company_id:p.companyId,metadata:p.metadata,direction:cl};l.enqueue(P),e.waitUntil(l.waitUntilFlushed())}),t}s(_s,"MoesifInboundPolicy");var ks=s(async(t,e,n,r)=>$(t,e,{issuer:n.issuerUrl,audience:n.audience,jwkUrl:`${n.issuerUrl}/v1/keys`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r),"OktaJwtInboundPolicy");var Ds=require("jose");var Jr,Hs=s(async(t,e,n,r)=>{if(!Jr)try{Jr=await(0,Ds.importSPKI)(n.verifierKey,"RS256")}catch(o){throw e.log.error("Could not import verifier key"),o}return $(t,e,{issuer:n.authUrl,secret:Jr,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests,subPropertyName:"user_id"},r)},"PropelAuthJwtInboundPolicy");var Ns=Te(Re());var fn=class extends Error{static{s(this,"ValidationError")}constructor(e){super(e)}},Yr=class extends fn{static{s(this,"ArgumentUndefinedError")}constructor(e){super(`The argument '${e}' is undefined.`)}},Qr=class extends fn{static{s(this,"ArgumentTypeError")}constructor(e,n){super(`The argument '${e}' must be of type '${n}'.`)}};function gl(t,e){if(Qo(t))throw new Yr(e)}s(gl,"throwIfUndefinedOrNull");function gt(t,e){if(gl(t,e),!Q(t))throw new Qr(e,"string")}s(gt,"throwIfNotString");var hn=class t{static{s(this,"StandardRedisClient")}static instance;redisClientUrl;clientAuthToken;userAgent;deploymentName;constructor(e,n,r,o){this.redisClientUrl=e,this.clientAuthToken=n,this.deploymentName=r,this.userAgent=o}static initialize(e,n,r,o){return gt(e,"redisClientUrl"),gt(n,"clientAuthToken"),t.instance||(t.instance=new t(e,n,r,o)),t.instance}isEnabled(){return this.redisClientUrl!==void 0&&this.clientAuthToken!==void 0}async fetch({url:e,body:n,method:r,requestId:o}){gt(e,"url");let i=await fetch(`${this.redisClientUrl}${e}`,{method:r,body:n,headers:{"content-type":"application/json",authorization:`Bearer ${this.clientAuthToken}`,"zp-rid":o,"zp-dn":this.deploymentName,"User-Agent":this.userAgent}}),a=i.headers.get("Content-Type")?.includes("application/json")?await i.json():await i.text();if(i.ok)return a;throw i.status===401?new T("Redis client failed with 401: Unauthorized"):new T(`Redis client failed with (${i.status}): ${typeof a=="string"?a:JSON.stringify(a,null,2)}`)}},yn=class{static{s(this,"InMemoryRedisClient")}keyValueStore;constructor(){this.keyValueStore=new Map}isEnabled(){return!0}fetch({url:e,body:n,method:r}){if(gt(e,"url"),r==="POST"&&e==="/rate-limit"){let{incrBy:o,expire:i,key:a}=JSON.parse(n),u=Date.now()+i*1e3,c=this.keyValueStore.get(a);c?Date.now()>c.expiresAt?this.keyValueStore.set(a,{value:o,expiresAt:u}):this.keyValueStore.set(a,{value:c.value+o,expiresAt:c.expiresAt}):this.keyValueStore.set(a,{value:o,expiresAt:u});let l=this.keyValueStore.get(a);return Promise.resolve({count:l.value,ttlSeconds:Math.round((l.expiresAt-Date.now())/1e3)})}throw new T("The in-memory redis client only supports /rate-limit calls")}};var bn=(0,Ns.debug)("zuplo:policies:RateLimitInboundPolicy"),fl="strict",hl=s(t=>{let e=t.headers.get("cf-connecting-ip")??t.headers.get("true-client-ip");if(e)return e;let n=t.headers.get("x-forwarded-for");return n?n.split(",")[0]:"127.0.0.1"},"getRealIP"),yl=s(async t=>({key:`ip-${hl(t)}`}),"getIP"),bl=s(async t=>({key:`user-${t.user?.sub??"anonymous"}`}),"getUser"),wl=s(async()=>({key:"all-2d77ce9d-9a3c-4206-9ab2-668cfd271095"}),"getAll"),wn;function Rl(t,e){let n;if(wn)return wn;if(h.instance.isLocalDevelopment)return e.info("Using in-memory redis client for local development."),n=new yn,wn=n,n;let{authApiJWT:r,redisURL:o}=h.instance;if(!Q(o))throw new T(`RateLimitInboundPolicy '${t}' - rate limit service URL not configured`);if(!Q(r))throw new T(`RateLimitInboundPolicy '${t}' - service authentication not configured`);if(o&&(n=hn.initialize(o,r,h.instance.deploymentName??"unknown",h.instance.systemUserAgent)),!n||!n.isEnabled())throw new T(`RateLimitInboundPolicy '${t}' - no redis ('${n}') or redis.isEnabled ('${n?.isEnabled}) is false`);return wn=n,n}s(Rl,"getRedisClient");async function Us(t,e,n,r,o){let i=Math.floor(e*60);return await n.fetch({url:"/rate-limit",method:"POST",body:JSON.stringify({incrBy:1,expire:i,key:t}),requestId:o})}s(Us,"getCountAndUpdateExpiry");function Pl(t,e){let n;if(t.rateLimitBy==="function"){if(!t.identifier)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier must be specified`);if(!t.identifier.module)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.module must be specified`);if(!t.identifier.export)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.export must be specified`);if(n=t.identifier.module[t.identifier.export],!n||typeof n!="function")throw new g(`RateLimitInboundPolicy '${e}' - Custom rate limit function must be a valid function`)}return s(async(o,i,a)=>{let u=await n(o,i,a);if(!u.key){let c=`RateLimitInboundPolicy '${a}' - Custom rate limit function must return a valid key property '${JSON.stringify(u,null,2)}'`;throw i.log.error(c),new I(c)}return u},"outerFunction")}s(Pl,"wrapUserFunction");var Il="Retry-After",Xr=s(async(t,e,n,r)=>{let o=Date.now(),i=O.getLogger(e),a=s((c,l)=>{if(n.throwOnFailure)throw new T(c,{cause:l});i.error(c,l)},"throwOrLog"),u=s((c,l)=>{let d={};return(!c||c==="retry-after")&&(d[Il]=l.toString()),R.tooManyRequests(t,e,void 0,d)},"rateLimited");try{let l={function:Pl(n,r),user:bl,ip:yl,all:wl}[n.rateLimitBy],d=await l(t,e,r),p=d.key,y=d.requestsAllowed??n.requestsAllowed,m=d.timeWindowMinutes??n.timeWindowMinutes,w=n.headerMode??"retry-after",P=Rl(r,i),x=`bucket/${h.instance.build.BUILD_ID}/${r}/${p}`;if((n.mode??fl)==="async"){let _=await q(r,n),G=new re(_,{logger:O.getLogger(e)}),J=Us(x,m,P,i,e.requestId),Y=await G.get(x);if(Y!==void 0&&Y<=Date.now()){bn(`RateLimitInboundPolicy '${r}' - returning 429 from cache for '${x}' (async mode)`);let ve=Math.round((Y-Date.now())/1e3);return u(w,ve)}return e.addEventListener("responseSending",ve=>{try{let Se=ve,Tn=Se.mutableResponse;Se.mutableResponse=(async()=>{let ft=await J;if(ft.count>y){let ha=Date.now()+ft.ttlSeconds*1e3,ya=G.put(x,ha,ft.ttlSeconds).catch(uo=>{throw i.error(new T("Error caching rate limit result.",{cause:uo})),uo});return e.waitUntil(ya),bn(`RateLimitInboundPolicy '${r}' - returning 429 from redis for '${x}' (async mode)`),u(w,ft.ttlSeconds)}return Tn})()}catch(Se){i.error(`RateLimitInboundPolicy '${r}' -error in responseSending`,Se)}}),t}let F=await Us(x,m,P,i,e.requestId);return F.count>y?(bn(`RateLimitInboundPolicy '${r}' - returning 429 from redis for '${x}' (strict mode)`),u(w,F.ttlSeconds)):t}catch(c){return a(c.message,c),t}finally{let c=Date.now()-o;bn(`RateLimitInboundPolicy '${r}' - latency ${c}ms`)}},"RateLimitInboundPolicy");var eo;function Ms(t){let e=[];for(let[n,r]of t)e.push({name:n,value:r});return e}s(Ms,"headersToNameValuePairs");function El(t){let e=[];return Object.entries(t).forEach(([n,r])=>{e.push({name:n,value:r})}),e}s(El,"queryToNameValueParis");function xl(t){if(t===null)return;let e=parseFloat(t);if(!isNaN(e))return e}s(xl,"parseIntOrUndefined");var Zs={};async function qs(t,e,n,r){let o=new Date,i=Date.now();return eo||(eo={name:"zuplo",version:h.instance.build.ZUPLO_VERSION,comment:`zuplo/${h.instance.build.ZUPLO_VERSION}`}),e.addResponseSendingFinalHook(async a=>{try{let u=n.userLabelPropertyPath&&t.user?Ie(t.user,n.userLabelPropertyPath,"userLabelPropertyPath"):t.user?.sub,c=n.userEmailPropertyPath&&t.user?Ie(t.user,n.userEmailPropertyPath,"userEmailPropertyPath"):void 0,l={clientIPAddress:t.headers.get("true-client-ip")??"",development:n.development!==void 0?n.development:h.instance.isDeno,group:{label:u,email:c,id:t.user?.sub??"anonymous"},request:{log:{creator:eo,entries:[{startedDateTime:o.toISOString(),time:Date.now()-i,request:{method:t.method,url:n.useFullRequestPath?new URL(t.url).pathname:e.route.path,httpVersion:"2",headers:Ms(t.headers),queryString:El(t.query)},response:{status:a.status,statusText:a.statusText,headers:Ms(a.headers),content:{size:xl(t.headers.get("content-length"))}}}]}}},d=Zs[n.apiKey];if(!d){let p=n.apiKey;d=new A("readme-metering-inbound-policy",10,async y=>{try{let m=n.url??"https://metrics.readme.io/request",w=await fetch(m,{method:"POST",body:JSON.stringify(y),headers:{"content-type":"application/json",authorization:`Basic ${btoa(p+":")}`}});w.status!==202&&e.log.error(`Unexpected response in ReadmeMeteringInboundPolicy '${r}'. ${w.status}: '${await w.text()}'`)}catch(m){throw e.log.error(`Error in ReadmeMeteringInboundPolicy '${r}': '${m.message}'`),m}}),Zs[p]=d}d.enqueue(l),e.waitUntil(d.waitUntilFlushed())}catch(u){e.log.error(u)}}),t}s(qs,"ReadmeMetricsInboundPolicy");var $s=s(async(t,e,n,r)=>{let o=n?.headers;if(!o||!Array.isArray(o)||o.length===0)throw new g(`RemoveHeadersInboundPolicy '${r}' options.headers must be a non-empty string array of header names`);let i=new Headers(t.headers);return o.forEach(u=>{i.delete(u)}),new L(t,{headers:i})},"RemoveHeadersInboundPolicy");var Fs=s(async(t,e,n,r,o)=>{let i=r?.headers;if(!i||!Array.isArray(i)||i.length===0)throw new g(`RemoveHeadersOutboundPolicy '${o}' options.headers must be a non-empty string array of header names`);let a=new Headers(t.headers);return i.forEach(c=>{a.delete(c)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"RemoveHeadersOutboundPolicy");var Bs=s(async(t,e,n,r)=>{let o=n.params;if(!o||!Array.isArray(o)||o.length===0)throw new g(`RemoveQueryParamsInboundPolicy '${r}' options.params must be a non-empty string array of header names`);let i=new URL(t.url);return o.forEach(u=>{i.searchParams.delete(u)}),new L(i.toString(),t)},"RemoveQueryParamsInboundPolicy");var js=s(async(t,e,n,r)=>{let o=await t.text(),i=r.mode==="regexp"?new RegExp(r.match,"gm"):r.match,a=o.replaceAll(i,r.replaceWith);return new Response(a,{headers:t.headers,status:t.status,statusText:t.statusText})},"ReplaceStringOutboundPolicy");var zs=s(()=>new Response("Maximum request size exceeded",{status:413,statusText:"Payload Too Large"}),"payloadTooLarge"),Vs=s(async(t,e,n)=>{let r=n.trustContentLengthHeader??!1;if(["GET","HEAD"].includes(t.method))return t;let o=t.headers.get("content-length"),i=o!==null?parseInt(o):void 0;return i&&!isNaN(i)&&i>n.maxSizeInBytes?zs():i&&r?t:(await t.clone().text()).length>n.maxSizeInBytes?zs():t},"RequestSizeLimitInboundPolicy");function Gs(t,e,n){return`_${be(t+"_"+e+"_"+n)}`}s(Gs,"getRawOperationDataIdentifierName");function Rn(t,e,n,r){return`_${be(t.toLowerCase())}_`+e.toLowerCase()+"_"+n.toLowerCase()+`_${r.toLowerCase()}`}s(Rn,"getIdForParameterSchema");function Pn(t,e,n){return`_${be(t.toLowerCase())}_`+e.toLowerCase()+`_rb_${be(n.toLowerCase())}`}s(Pn,"getIdForRequestBodySchema");function Ws(t,e){return`_${be(t)}__${be(e)}`}s(Ws,"getIdForRefSchema");function be(t){let e=[];for(let n=0;n<t.length;n++){let r=t.charCodeAt(n);r>="0".charCodeAt(0)&&r<="9".charCodeAt(0)||r>="A".charCodeAt(0)&&r<="Z".charCodeAt(0)||r>="a".charCodeAt(0)&&r<="z".charCodeAt(0)?e.push(t.charAt(n)):e.push("_")}return e.join("")}s(be,"sanitizedIdentifierName");var Be=s(t=>{let e=t.route.raw();return e.parameters?e.parameters.map(r=>({name:r.name,location:r.in,required:r.required,deprecated:r.deprecated,allowEmptyValue:r.allowEmptyValue})):[]},"getParametersForOperation"),je=s((t,e,n,r,o)=>{let i=[],a=!0,u=[];return t.forEach(c=>{let l=c.required||o==="path";if(l&&!e[c.name])a=!1,i.push(`Required ${o} parameter '${c.name}' not found`);else if(!(!l&&!e[c.name])){let d=Rn(n,r,o,c.name),p=M.instance.schemaValidator[d],y=p(e[c.name]),m=to(p.errors);y||(a=!1,u.push(`${o} parameter: ${c.name} : ${e[c.name]}`),i.push(`Invalid value for ${o} parameter: '${c.name}' ${m.join(", ")}`))}}),{isValid:a,invalidValues:u,errors:i}},"validateParameters"),ee=s((t,e,n,r,o)=>{r?t.log[e](n,r,o):t.log[e](n,o)},"logErrors"),te=s(t=>t==="log-only"||t==="reject-and-log","shouldLog"),ne=s(t=>t==="reject-only"||t==="reject-and-log","shouldReject"),to=s(t=>t?.map(e=>e.instancePath===void 0||e.instancePath===""?e.message??"Unknown validation error":e.instancePath.replace("/","")+" "+e.message)??["Unknown validation error"],"getErrorsFromValidator");async function Ks(t,e,n){if(!n.validateBody||n.validateBody==="none")return;let r;try{r=await e.clone().json()}catch(m){let w=`Error in request body for method : ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,P=R.badRequest(e,t,{detail:`${w}, see errors property for more details`,errors:`${m}`});if(te(n.validateBody)&&ee(t,n.logLevel??"info",w,[r],m),ne(n.validateBody))return P}if(!e.headers.get("Content-Type")){let m=`No content-type header defined in incoming request to ${e.method} in route: ${t.route.path}`,w=R.badRequest(e,t,{detail:m});return te(n.validateBody)&&ee(t,n.logLevel??"info",m,[r],[m]),ne(n.validateBody)?w:void 0}let o=e.headers.get("Content-Type"),i=o.indexOf(";");i>-1&&(o=o.substring(0,i));let a=Pn(t.route.path,e.method,o),u=M.instance.schemaValidator[a];if(!u){let m=`No schema defined for method: ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,w=R.badRequest(e,t,{detail:m});return te(n.validateBody)&&ee(t,n.logLevel??"info",m,[r],[m]),ne(n.validateBody)?w:void 0}if(u(r))return;let l=u.errors,d="Request body did not pass validation",p=to(l),y=R.badRequest(e,t,{detail:`${d}, see errors property for more details`,errors:p});if(te(n.validateBody)&&ee(t,n.logLevel??"info",d,[r],p),ne(n.validateBody))return y}s(Ks,"handleBodyValidation");function Js(t,e,n){if(!n.validateHeaders||n.validateHeaders==="none")return;let r={};e.headers.forEach((a,u)=>{r[u]=a});let o=Be(t),i=je(o.filter(a=>a.location==="header"),r,t.route.path,e.method.toLowerCase(),"header");if(!i.isValid){let a="Header validation failed",u=R.badRequest(e,t,{detail:`${a}, see errors property for more details`,errors:i.errors});if(te(n.validateHeaders)&&ee(t,n.logLevel??"info",a,i.invalidValues,i.errors),ne(n.validateHeaders))return u}}s(Js,"handleHeadersValidation");function Ys(t,e,n){if(!n.validatePathParameters||n.validatePathParameters==="none")return;let r=Be(t),o=je(r.filter(i=>i.location==="path"),e.params,t.route.path,e.method.toLowerCase(),"path");if(!o.isValid){let i="Path parameters validation failed",a=R.badRequest(e,t,{detail:`${i}, see errors property for more details`,errors:o.errors});if(te(n.validatePathParameters)&&ee(t,n.logLevel??"info",i,o.invalidValues,o.errors),ne(n.validatePathParameters))return a}}s(Ys,"handlePathParameterValidation");function Qs(t,e,n){if(!n.validateQueryParameters||n.validateQueryParameters==="none")return;let r=Be(t),o=je(r.filter(i=>i.location==="query"),e.query,t.route.path,e.method.toLowerCase(),"query");if(!o.isValid){let i="Query parameters validation failed",a=R.badRequest(e,t,{detail:`${i}, see errors property for more details`,errors:o.errors});if(te(n.validateQueryParameters)&&ee(t,n.logLevel??"info",i,o.invalidValues,o.errors),ne(n.validateQueryParameters))return a}}s(Qs,"handleQueryParameterValidation");var no=s(async(t,e,n)=>{let r=Qs(e,t,n);if(r!==void 0||(r=Ys(e,t,n),r!==void 0)||(r=Js(e,t,n),r!==void 0))return r;let o=await Ks(e,t,n);return o!==void 0?o:t},"RequestValidationInboundPolicy"),Xs=no;var ea=s(async(t,e,n,r)=>{if(n.origins===void 0||n.origins.length===0)throw new g(`RequireOriginInboundPolicy '${r}' configuration error - no allowed origins specified`);let o=typeof n.origins=="string"?n.origins.split(","):n.origins;o=o.map(a=>a.trim());let i=t.headers.get("origin");if(!i||!o.includes(i)){let a=n.failureDetail??"Forbidden";return R.forbidden(t,e,{detail:a})}return t},"RequireOriginInboundPolicy");var ta=s(async(t,e,n)=>new L(t,{body:n.body}),"SetBodyInboundPolicy");var na=s(async(t,e,n,r)=>{let o=n.headers;if(!o||!Array.isArray(o)||o.length==0)throw new g(`SetHeadersInboundPolicy '${r}' options.headers must be a valid array of { name, value }`);let i=new Headers(t.headers);return o.forEach(u=>{if(!u.name||u.name.length===0)throw new g(`SetHeadersInboundPolicy '${r}' each option.headers[] entry must have a name property`);let c=u.overwrite===void 0?!0:u.overwrite;(!i.has(u.name)||c)&&i.set(u.name,u.value)}),new L(t,{headers:i})},"SetHeadersInboundPolicy");var ra=s(async(t,e,n,r,o)=>{let i=r.headers;if(!i||!Array.isArray(i)||i.length==0)throw new g(`SetHeadersOutboundPolicy '${o}' options.headers must be a valid array of { name, value }`);let a=new Headers(t.headers);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new g(`SetHeadersOutboundPolicy '${o}' each option.headers[] entry must have a name property`);let l=c.overwrite===void 0?!0:c.overwrite;(!a.has(c.name)||l)&&a.set(c.name,c.value)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"SetHeadersOutboundPolicy");var oa=s(async(t,e,n,r)=>{let o=n.params;if(!o||!Array.isArray(o)||o.length==0)throw new g(`SetQueryParamsInboundPolicy '${r}' options.params must be a valid array of { name, value }`);let i=new URL(t.url);return o.forEach(u=>{if(!u.name||u.name.length===0)throw new g(`SetQueryParamsInboundPolicy '${r}' each option.params[] entry must have a name property`);let c=u.overwrite===void 0?!0:u.overwrite;(!i.searchParams.has(u.name)||c)&&i.searchParams.set(u.name,u.value)}),new L(i.toString(),t)},"SetQueryParamsInboundPolicy");var ia=s(async(t,e,n,r,o)=>{if(!r.status||isNaN(r.status)||r.status<100||r.status>599)throw new Error(`Invalid SetStatusOutboundPolicy '${o}' - status must be a valid number between 100 and 599, not '${r.status}'`);return new Response(t.body,{headers:t.headers,status:r.status,statusText:r.statusText??t.statusText})},"SetStatusOutboundPolicy");var vl=s(async t=>new Promise(n=>{setTimeout(n,t)}),"sleep"),sa=s(async(t,e,n,r)=>{if(!n||n.sleepInMs===void 0||isNaN(n.sleepInMs))throw new g(`SleepInboundPolicy '${r} must have a valid options.sleepInMs value`);return await vl(n.sleepInMs),t},"SleepInboundPolicy");var aa=s(async(t,e,n,r)=>{D(n,r).required("secret","string").optional("allowUnauthenticatedRequests","boolean").optional("requiredClaims","object");let o={secret:n.secret,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests??!1},i=await $(t,e,o,r);if(i instanceof Response)return i;if(!(i instanceof L))throw new T("Invalid State - SupabaseJwtInboundPolicy encountered a non-response that wasn't a ZuploRequest type')");let a=n.requiredClaims;if(!a)return i;let u=t.user?.data.app_metadata;if(!u)throw new I(`SupabaseJwtInboundPolicy policy '${r}' - has requiredClaims but the JWT token had no app_metadata property`);let c=Object.keys(a),l=[];return c.forEach(d=>{let p=a[d];Array.isArray(p)?p.includes(u[d])||l.push(d):p!==u[d]&&l.push(d)}),l.length>0?R.unauthorized(t,e,{detail:`Invalid JWT token - missing valid claims ${l.join(", ")}`}):i},"SupabaseJwtInboundPolicy");var ua=s(async(t,e,n,r)=>{D(n,r).required("activeDirectoryTenantId","string").required("activeDirectoryClientId","string").required("activeDirectoryClientSecret","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number");let o=await q(r,n),i=new N(o,e),a=await i.get(r);if(!a){let u=await Sl(n,e);i.put(r,u.access_token,u.expires_in-(n.expirationOffsetSeconds??300)),a=u.access_token}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamAzureAdServiceAuthInboundPolicy");async function Sl(t,e){let n=new URLSearchParams({client_id:t.activeDirectoryClientId,scope:`${t.activeDirectoryClientId}/.default`,client_secret:t.activeDirectoryClientSecret,grant_type:"client_credentials"}),r=await V({retries:t.tokenRetries??3,retryDelayMs:10},`https://login.microsoftonline.com/${t.activeDirectoryTenantId}/oauth2/v2.0/token`,{headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST",body:n});if(r.status!==200){try{let i=await r.text();e.log.error("Could not get token from Azure AD",i)}catch{}throw new I("Could not get token from Azure AD")}let o=await r.json();if(o&&typeof o=="object"&&"access_token"in o&&typeof o.access_token=="string"&&"expires_in"in o&&typeof o.expires_in=="number")return{access_token:o.access_token,expires_in:o.expires_in};throw new I("Response returned from Azure AD is not in the expected format.")}s(Sl,"getAccessToken");var ca="https://accounts.google.com/o/oauth2/token",ro,la=s(async(t,e,n,r)=>{D(n,r).required("serviceAccountJson","string"),ro||(ro=await W.init(n.serviceAccountJson));let o={scope:["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/firebase.database","https://www.googleapis.com/auth/firebase.messaging","https://www.googleapis.com/auth/identitytoolkit","https://www.googleapis.com/auth/userinfo.email"].join(" ")},i=await q(r,n),a=new N(i,e),u=await a.get(r);if(!u){let c=await ie({serviceAccount:ro,audience:ca,payload:o}),l=await Zt(ca,c,{retries:n.tokenRetries??3,retryDelayMs:10});if(!l.access_token)throw new I("Invalid OAuth response from Firebase");u=l.access_token,a.put(r,u,(l.expires_in??3600)-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${u}`),t},"UpstreamFirebaseAdminAuthInboundPolicy");var Tl="https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",Ol=["acr","amr","at_hash","aud","auth_time","azp","cnf","c_hash","exp","iat","iss","jti","nbf","nonce"],oo,da=s(async(t,e,n,r)=>{if(D(n,r).required("serviceAccountJson","string").required("webApiKey","string").optional("developerClaims","object").optional("userId","string").optional("userIdPropertyPath","string"),!n.userId&&!n.userIdPropertyPath)throw new g(`Either 'userId' or 'userIdPropertyPath' options must be set on policy '${r}'.`);let o={};if(typeof n.developerClaims<"u"){for(let p in n.developerClaims)if(Object.prototype.hasOwnProperty.call(n.developerClaims,p)){if(Ol.indexOf(p)!==-1)throw new g(`Developer claim "${p}" is reserved and cannot be specified.`);o[p]=n.developerClaims[p]}}oo||(oo=await W.init(n.serviceAccountJson));let i=n.userId;if(!i&&!n.userIdPropertyPath){if(!t.user)throw new I("Unable to set userId for upstream auth policy as request.user is 'undefined'. Do you have an authentication policy before this policy?.");i=t.user?.sub}else if(n.userIdPropertyPath){if(!t.user)throw new I(`Unable to apply userIdPropertyPath '${n.userIdPropertyPath}' as request.user is 'undefined'. Do you have an authentication policy before this policy?`);i=Ie(t.user,n.userIdPropertyPath,"userIdPropertyPath")}if(!i)throw new I(`Unable to determine user from for the policy ${r}`);let a=await q(r,n),u=new N(a,e),c={uid:i,claims:o},l=await mn(JSON.stringify(c)),d=await u.get(l);if(!d){let p=await ie({serviceAccount:oo,audience:Tl,payload:c}),y=`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${n.webApiKey}`,m=await fi(y,p,{retries:n.tokenRetries??3,retryDelayMs:10});if(!m.idToken)throw new I("Invalid token response from Firebase");d=m.idToken,u.put(l,d,(m.expiresIn?parseInt(m.expiresIn):3600)-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${d}`),t},"UpstreamFirebaseUserAuthInboundPolicy");var io,pa=s(async(t,e,n,r)=>{D(n,r).required("audience","string").required("serviceAccountJson","string"),io||(io=await W.init(n.serviceAccountJson));let o=await ie({serviceAccount:io,audience:n.audience});return t.headers.set("Authorization",`Bearer ${o}`),t},"UpstreamGcpJwtInboundPolicy");var ma="https://www.googleapis.com/oauth2/v4/token",so,ga=s(async(t,e,n,r)=>{D(n,r).required("serviceAccountJson","string").optional("audience","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number"),so||(so=await W.init(n.serviceAccountJson));let o={};if(n.scopes&&n.audience)throw new g("UpstreamGcpServiceAuthInboundPolicy - Either the 'scopes' or the 'audience' property can be set, not both.");if(n.scopes)try{let c=Ee(n.scopes);o.scope=c.join(" ")}catch(c){throw c instanceof g?new g(`UpstreamGcpServiceAuthInboundPolicy - The property 'scopes' is invalid. ${c.message}`):c}n.audience&&(o.target_audience=`${n.audience}`);let i=await q(r,n),a;n.useMemoryCacheOnly?a=new Oe(i):a=new N(i,e);let u=await a.get(r);if(!u){let c=await ie({serviceAccount:so,audience:ma,payload:o}),l=await Zt(ma,c,{retries:n.tokenRetries??3,retryDelayMs:10});if(n.audience){if(!l.id_token)throw new I("Invalid token response from GCP");u=l.id_token}else{if(!l.access_token)throw new I("Invalid token response from GCP");u=l.access_token}a.put(r,u,3600-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${u}`),t},"UpstreamGcpServiceAuthInboundPolicy");var fa=s(async(t,e,n)=>{let r=t.clone(),o;try{o=await r.json()}catch{return R.badRequest(t,e,{detail:"Invalid JSON body - expected well-formed JSON document"})}if(n.validator(o))return t;let{errors:a}=n.validator;if(!a)throw new T("Invalid state - validator error object is undefined even though validation failed.");let u=a.map(c=>c.instancePath===void 0||c.instancePath===""?"Body "+c.message:c.instancePath.replace("/","")+" "+c.message);return R.badRequest(t,e,{detail:"Incoming body did not pass schema validation",errors:u})},"ValidateJsonSchemaInbound");var In=class{static{s(this,"ServiceProviderImpl")}services=new Map;addService(e,n){if(this.services.get(e))throw new T(`A service with the name ${e} already exists -- you cannot have duplicate services`);this.services.set(e,n)}getService(e){return this.services.get(e)}};var ao=["sha-1","sha-256","sha-384","sha-512"],En=class{static{s(this,"BaseCryptoBeta")}};var xn=class extends En{static{s(this,"WorkerCryptoBeta")}async digest(e,n){if(!ao.includes(e.toLowerCase()))throw new I(`Algorithm ${e} is not supported. Try using ${ao.join(", ")}`);let r=new TextEncoder().encode(n),o=await crypto.subtle.digest(e,r);return Array.from(new Uint8Array(o)).map(u=>u.toString(16).padStart(2,"0")).join("")}};var vn=class{constructor(e){this.context=e}static{s(this,"BaseKeyValueStore")}};var Sn=class extends vn{static{s(this,"WorkerKeyValueStore")}#e;constructor(e){super(e);let r=globalThis.ZUPLO_KV;if(!r)throw new ht("The Key Value Store feature is not enabled for this project.");this.#e=r}put(e,n,r){if(typeof e!="string")throw new g("value must be of type string");return this.#e.put(e,n,r?{expirationTtl:r.expirationSecondsTtl}:void 0)}get(e,n){return this.#e.get(e,{type:"text",cacheTtl:n?.cacheSecondsTtl})}delete(e){return this.#e.delete(e)}};
+`+d});let p=Math.floor((typeof u=="number"?u:Date.now())/1e3)-n.timestamp;if(o>0&&p>o)throw new ae(e,t,{message:"Timestamp outside the tolerance zone"});return!0}s(Wc,"validateComputedSignature");function Kc(t,e){return typeof t!="string"?null:t.split(",").reduce((n,r)=>{let o=r.split("=");return o[0]==="t"&&(n.timestamp=parseInt(o[1],10)),o[0]===e&&n.signatures.push(o[1]),n},{timestamp:-1,signatures:[]})}s(Kc,"parseHeader");function Jc(t,e){if(t.length!==e.length)return!1;let n=t.length,r=0;for(let o=0;o<n;++o)r|=t.charCodeAt(o)^e.charCodeAt(o);return r===0}s(Jc,"secureCompare");async function Yc(t,e){let n=new TextEncoder,r=await crypto.subtle.importKey("raw",n.encode(e),{name:"HMAC",hash:{name:"SHA-256"}},!1,["sign"]),o=await crypto.subtle.sign("hmac",r,n.encode(t)),i=new Uint8Array(o),a=new Array(i.length);for(let u=0;u<i.length;u++)a[u]=qr[i[u]];return a.join("")}s(Yc,"computeHMACSignatureAsync");var qr=new Array(256);for(let t=0;t<qr.length;t++)qr[t]=t.toString(16).padStart(2,"0");function D(t,e){let n=s((i,a,u)=>{let c=t[i];if(!(u&&c===void 0)){if(c===void 0)throw new g(`Value of '${String(i)}' on policy '${e}' is required, but no value was set. If using an environment variable, check that it is set correctly.`);if(a==="array"&&Array.isArray(c))throw new g(`Value of '${String(i)}' on policy '${e}' must be an array. Received type ${typeof c}.`);if(typeof c!==a)throw new g(`Value of '${String(i)}' on policy '${e}' must be of type ${a}. Received type ${typeof c}.`);if(typeof c=="string"&&c.length===0)throw new g(`Value of '${String(i)}' on policy '${e}' must be a non-empty string. The value received is empty. If using an environment variable, check that it is set correctly.`);if(typeof c=="number"&&isNaN(c))throw new g(`Value of '${String(i)}' on policy '${e}' must be valid number. If using an environment variable, check that it is set correctly.`)}},"validate"),r=s((i,a)=>(n(i,a,!0),{optional:r,required:o}),"optional"),o=s((i,a)=>(n(i,a,!1),{optional:r,required:o}),"required");return{optional:r,required:o}}s(D,"optionValidator");var cn=s(async(t,e,n,r)=>{D(n,r).required("signingSecret","string").optional("tolerance","number");let o=t.headers.get("stripe-signature");try{let i=await t.clone().text();await Ji(i,o,n.signingSecret)}catch(i){return e.log.error("Error validating stripe webhook",i),R.badRequest(t,e,{title:"Webhook Error",detail:i.message})}return t},"StripeWebhookVerificationInboundPolicy");function Yi(t){return t!==null&&typeof t=="object"&&"id"in t&&Q(t.id)&&"type"in t&&Q(t.type)}s(Yi,"isStripeWebhookEvent");var ln=class extends ue{static{s(this,"MeteringPlugin")}};var Qc={getSubscription:async({subscriptionId:t,stripeSecretKey:e,logger:n})=>{let r=await fetch(`https://api.stripe.com/v1/subscriptions/${t}`,{headers:{Authorization:`Bearer ${e}`}}),o=await r.json();if(r.status!==200){let i="Error retrieving subscription from Stripe API.";throw n.error(i,o),new I(i)}return o},getCustomer:async({customerId:t,stripeSecretKey:e,logger:n})=>{let r=await fetch(`https://api.stripe.com/v1/customers/${t}`,{headers:{Authorization:`Bearer ${e}`}}),o=await r.json();if(r.status!==200){let i="Error retrieving customer from Stripe API.";throw n.error(i,o),new I(i)}return o}},Qi=Qc;var $r="https://api-key-management-service-eq7z4lly2a-ue.a.run.app";async function Xi({apiKeyBucketName:t,stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r,managerEmail:o,managerSub:i,context:a}){let{authApiJWT:u}=h.instance,c=new URL(`/v1/buckets/${t}/consumers`,$r);c.searchParams.set("with-api-key","true");let l=crypto.randomUUID(),d={name:l,description:"API Subscription",tags:{subscriptionExternalId:e,planExternalIds:[n]},metadata:{stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r},managers:[{sub:i,email:o}]},p=await V({retryDelayMs:5,retries:2,logger:O.getLogger(a)},c.toString(),{method:"POST",headers:{Authorization:`Bearer ${u}`,"content-type":"application/json"},body:JSON.stringify(d)}),y=await p.json();if(p.status!==200){let m="Error creating API Key Consumer";throw a.log.error(m,y),new I(m)}return a.log.info("Successfully created API Key Consumer",{consumerId:l,stripeSubscriptionId:e,stripeProductId:n}),l}s(Xi,"createConsumer");async function es({apiKeyBucketName:t,stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r,managerEmail:o,context:i}){let{authApiJWT:a}=h.instance,u=new URL(`/v1/buckets/${t}/consumers`,$r);u.searchParams.set("with-api-key","true");let c=crypto.randomUUID(),l={name:c,description:"API Subscription",tags:{subscriptionExternalId:e,planExternalIds:[n]},metadata:{stripeSubscriptionId:e,stripeProductId:n,stripeCustomerId:r},managers:[o]},d=await V({retryDelayMs:5,retries:2,logger:O.getLogger(i)},u.toString(),{method:"POST",headers:{Authorization:`Bearer ${a}`,"content-type":"application/json"},body:JSON.stringify(l)}),p=await d.json();if(d.status!==200){let y="Error creating API Key Consumer";throw i.log.error(y,p),new I(y)}return i.log.info("Successfully created API Key Consumer with Manager Invite",{consumerId:c,stripeSubscriptionId:e,stripeProductId:n}),c}s(es,"createConsumerInvite");async function ts({apiKeyBucketName:t,consumerId:e,context:n}){let{authApiJWT:r}=h.instance,o=new URL(`/v1/buckets/${t}/consumers/${e}`,$r);o.searchParams.set("with-api-key","true");let i=await V({retryDelayMs:5,retries:2,logger:O.getLogger(n)},o.toString(),{method:"DELETE",headers:{Authorization:`Bearer ${r}`,"content-type":"application/json"},body:JSON.stringify({})});if(i.status!==204){let a=await i.json(),u="Error deleting API Key Consumer";throw n.log.error(u,a),new I(u)}return n.log.info(`Successfully deleted API Key Consumer '${e}`),e}s(ts,"deleteConsumer");async function ns({context:t,stripeSubscriptionId:e,stripeProductId:n,customerKey:r,meteringBucketId:o,meteringBucketRegion:i,customerExternalId:a,subscriptionStatus:u}){let c={status:u,type:"periodic",renewalStrategy:"monthly",region:i,subscriptionExternalId:e,planExternalIds:[n],customerKey:r,customerExternalId:a},{authApiJWT:l,meteringServiceUrl:d}=h.instance;if(!_e(l))throw new T("No Zuplo JWT token set.");let p=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${d}/internal/v1/metering/${o}/subscriptions`,{headers:{Authorization:`Bearer ${l}`,"Content-Type":"application/json","zp-rid":t.requestId},method:"POST",body:JSON.stringify(c)});if(!p.ok){let y="Error creating metering subscription.",m;try{m=await p.json()}catch{m={status:p.status,statusText:p.statusText}}throw t.log.error(y,m),new I(y)}t.log.info("Successfully created/updated metering subscription.",c)}s(ns,"createSubscription");async function dt({context:t,meteringSubscriptionId:e,meteringBucketId:n,requestBody:r}){let{authApiJWT:o,meteringServiceUrl:i}=h.instance;if(!_e(o))throw new T("No Zuplo JWT token set.");let a=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${i}/internal/v1/metering/${n}/subscriptions/${e}`,{headers:{Authorization:`Bearer ${o}`,"Content-Type":"application/json","zp-rid":t.requestId},method:"PATCH",body:JSON.stringify(r)});if(!a.ok){let u=`Error updating metering subscription to '${JSON.stringify(r)}'.`,c;try{c=await a.json()}catch{c={status:a.status,statusText:a.statusText}}throw t.log.error(u,c),new I(u)}t.log.info(`Successfully update metering subscription to '${JSON.stringify(r)}'.`)}s(dt,"updateSubscription");async function pt({context:t,stripeSubscriptionId:e,stripeCustomerId:n,meteringBucketId:r}){let{authApiJWT:o,meteringServiceUrl:i}=h.instance;if(!_e(o))throw new T("No Zuplo JWT token set.");let a=await V({retryDelayMs:5,retries:2,logger:O.getLogger(t)},`${i}/internal/v1/metering/${r}/subscriptions?subscriptionExternalId=${e}`,{headers:{Authorization:`Bearer ${o}`,"zp-rid":t.requestId},method:"GET"});if(!a.ok){let c="Error querying for metering subscription.",l;try{l=await a.json()}catch{l={status:a.status,statusText:a.statusText}}throw t.log.error(c,l),new I(c,l)}let u=await a.json();if(u.data.length===0){let c="Subscription was not found and the event was ignored by Stripe metering plugin webhook.";throw t.log.error(c),new I(c)}if(u.data[0].customerExternalId!==n){let c="A subscription was not found for the customer provided and the event was ignored by Stripe metering plugin webhook.";throw t.log.error(c),new I(c)}return u.data[0]}s(pt,"getSubscription");function dn(t){return t.replaceAll("_","-")}s(dn,"stripeStatusToMeteringStatus");async function Fr(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to have '.data.object.id' be the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.plan;if(!i||!i.product)return e.log.warn(`Invalid Stripe API result. Expected event '${n.id}' to have a plan data.`),R.badRequest(t,e,{detail:"Invalid Stripe API result. Expected event to have a plan data."});let a=n.data.object.customer;if(!a)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});let u=i.product,c;if(n.data.object.metadata&&n.data.object.metadata.zuplo_created_by_email&&n.data.object.metadata.zuplo_created_by_sub)c=await Xi({apiKeyBucketName:r.apiKeyBucketName,stripeProductId:u,stripeSubscriptionId:o,stripeCustomerId:a,managerEmail:n.data.object.metadata.zuplo_created_by_email,managerSub:n.data.object.metadata.zuplo_created_by_sub,context:e});else{let l=await Qi.getCustomer({logger:e.log,stripeSecretKey:r.stripeSecretKey,customerId:a});if(!l.email)return e.log.warn(`Invalid Stripe API result. Expected customer '${a}' to contain email address.`),R.badRequest(t,e,{detail:"Invalid Stripe API result. Expected customer to contain email address."});c=await es({apiKeyBucketName:r.apiKeyBucketName,stripeProductId:u,stripeSubscriptionId:o,stripeCustomerId:a,managerEmail:l.email,context:e})}if(!c)return R.internalServerError(t,e,{detail:"No consumer was created, skipping creation of subscription"});try{let l=dn(n.data.object.status);await ns({context:e,stripeProductId:u,stripeSubscriptionId:o,customerKey:c,meteringBucketId:r.meteringBucketId,meteringBucketRegion:r.meteringBucketRegion,customerExternalId:a,subscriptionStatus:l})}catch(l){return await ts({apiKeyBucketName:r.apiKeyBucketName,consumerId:c,context:e}),R.internalServerError(t,e,{detail:l.message})}return R.ok(t,e)}s(Fr,"onCustomerSubscriptionCreated");async function Br(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to have '.data.object.id' be the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.customer;if(!i)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});let a=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId});return await dt({context:e,meteringSubscriptionId:a.id,meteringBucketId:r.meteringBucketId,requestBody:{status:"canceled",planExternalIds:a.planExternalIds}}),R.ok(t,e)}s(Br,"onCustomerSubscriptionDeleted");async function jr(t,e,n,r){let o=n.data.object.id;if(!o)return e.log.warn(`Invalid Stripe webhook event. Expected event '${n.id}' to include '.data.object.id' as the subscription ID.`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.id' to be the subscription ID."});let i=n.data.object.customer;if(!i)return e.log.warn(`Invalid Stripe webhook event. Expected '.data.object.customer' to be provided by event '${n.id}'`),R.badRequest(t,e,{detail:"Invalid Stripe webhook event. Expected '.data.object.customer' to be provided"});if(n.data.previous_attributes){let a=n.data.previous_attributes;if(a.status&&a.status!==n.data.object.status){let u=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId}),c=dn(n.data.object.status);return await dt({context:e,meteringSubscriptionId:u.id,meteringBucketId:r.meteringBucketId,requestBody:{status:c,planExternalIds:u.planExternalIds}}),R.ok(t,e)}if(a.plan&&a.plan.product!==n.data.object.plan.product){let u=await pt({context:e,stripeSubscriptionId:o,stripeCustomerId:i,meteringBucketId:r.meteringBucketId});return await dt({context:e,meteringSubscriptionId:u.id,meteringBucketId:r.meteringBucketId,requestBody:{status:u.status,planExternalIds:[n.data.object.plan.product]}}),R.ok(t,e)}}return e.log.warn(`This update event '${n.id}' is not supported by Stripe metering plugin webhook.`),R.badRequest(t,e,{detail:"This update event is not supported by Stripe metering plugin webhook."})}s(jr,"onCustomerSubscriptionUpdated");var zr=class extends ln{constructor(n){super();this.options=n}static{s(this,"StripeMeteringPlugin")}registerRoutes(n,r){let o=s(async(c,l)=>{if(this.options.__testMode===!0)return l.log.warn("Received Stripe webhook event of in test mode."),"success";let{meteringBucketId:d,apiKeyBucketName:p}=this.options;if(!d)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)d=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g("StripeMeteringPlugin - No 'meteringBucketId' property provided");if(!p)if(Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)p=Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new g("StripeMeteringPlugin - No 'apiKeyBucketName' property provided");if(!h.instance.build.ACCOUNT_NAME)throw new T("Build environment is not configured correctly. Expected 'ACCOUNT_NAME' to be set.");let y=this.options.meteringBucketRegion??"us-central1";if(!Xc(y))throw new g(`StripeMeteringPlugin - The value '${y}' on the property 'meteringBucketRegion' is invalid.`);let m=await c.json();if(!Yi(m))return R.badRequest(c,l,{detail:"The received body was not in the expected format."});switch(l.log.info(`Received Stripe webhook event of type '${m.type}' with ID '${m.id}'.`),m.type){case"customer.subscription.created":return await Fr(c,l,m,{meteringBucketId:d,apiKeyBucketName:p,meteringBucketRegion:y,stripeSecretKey:this.options.stripeSecretKey});case"customer.subscription.updated":return await jr(c,l,m,{meteringBucketId:d,apiKeyBucketName:p,meteringBucketRegion:y,stripeSecretKey:this.options.stripeSecretKey});case"customer.subscription.deleted":return await Br(c,l,m,{meteringBucketId:d});default:return R.badRequest(c,l,{detail:"Event is not supported by Stripe metering plugin webhook."})}},"stripeWebhookHandler"),i=oi({inboundPolicies:[{handler:cn,options:{signingSecret:this.options.webhooks.signingSecret,tolerance:this.options.webhooks.tolerance}}]}),a=new H({processors:[j,i],handler:o,gateway:r}),u=new k({label:"PLUGIN_STRIPE_WEBHOOK_ROUTE",methods:["POST"],path:this.options.webhooks.routePath??"/__plugins/stripe/webhooks",systemRouteName:"stripe-plugin"});n.addRoute(u,a.execute)}};function Xc(t){return t!==null&&typeof t=="string"&&["us-central1","europe-west4"].includes(t)}s(Xc,"isMetricsRegion");var os=new WeakMap,rs={},pn=class{static{s(this,"AmberfloMeteringPolicy")}static setRequestProperties(e,n){os.set(e,n)}};async function is(t,e,n,r){if(!n.statusCodes)throw new g(`Invalid AmberfloMeterInboundPolicy '${r}': options.statusCodes must be an array of HTTP status code numbers`);let o=Array.isArray(n.statusCodes)?n.statusCodes:Lt(n.statusCodes);return e.addResponseSendingFinalHook(async i=>{if(o.includes(i.status)){let a=os.get(e),u=n.customerId;if(n.customerIdPropertyPath){if(!t.user)throw new I(`Unable to apply customerIdPropertyPath '${n.customerIdPropertyPath}' as request.user is 'undefined'.`);u=Ie(t.user,n.customerIdPropertyPath,"customerIdPropertyPath")}let c=a?.customerId??u;if(!c){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': customerId cannot be undefined`);return}let l=a?.meterApiName??n.meterApiName;if(!l){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': meterApiName cannot be undefined`);return}let d=a?.meterValue??n.meterValue;if(!d){e.log.error(`Error in AmberfloMeterInboundPolicy '${r}': meterValue cannot be undefined`);return}let p={customerId:c,meterApiName:l,meterValue:d,meterTimeInMillis:Date.now(),dimensions:Object.apply(n.dimensions??{},a?.dimensions)},y=rs[n.apiKey];if(!y){let m=n.apiKey,w=t.headers.get("zm-test-id")??"";y=new A("amberflo-ingest-meter",10,async P=>{try{let E=n.url??"https://app.amberflo.io/ingest",x=await fetch(E,{method:"POST",body:JSON.stringify(P),headers:{"content-type":"application/json","x-api-key":m,"zm-test-id":w}});x.ok||e.log.error(`Unexpected response in AmberfloMeteringInboundPolicy '${r}'. ${x.status}: ${await x.text()}`)}catch(E){throw e.log.error(`Error in AmberfloMeteringInboundPolicy '${r}': ${E.message}`),E}}),rs[m]=y}y.enqueue(p),e.waitUntil(y.waitUntilFlushed())}}),t}s(is,"AmberfloMeteringInboundPolicy");async function mn(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest({name:"SHA-256"},e);return[...new Uint8Array(n)].map(o=>o.toString(16).padStart(2,"0")).join("")}s(mn,"sha256");var ss=new Map;async function q(t,e){let n,r=ss.get(t);return r!==void 0?n=r:(n=`zuplo-policy-${await mn(JSON.stringify({policyName:t,options:e}))}`,ss.set(t,n)),n}s(q,"getPolicyCacheName");var as="key-metadata-cache-type";function el(t,e){return e.authScheme===""?t:t.replace(`${e.authScheme} `,"")}s(el,"getKeyValue");async function gn(t,e,n,r){if(!n.bucketName)if(Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME)n.bucketName=Z.ZUPLO_API_KEY_SERVICE_BUCKET_NAME;else throw new g(`ApiKeyInboundPolicy '${r}' - no bucketName property provided`);let o={authHeader:n.authHeader??"authorization",authScheme:n.authScheme??"Bearer",bucketName:n.bucketName,cacheTtlSeconds:n.cacheTtlSeconds??60,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests??!1,disableAutomaticallyAddingKeyHeaderToOpenApi:n.disableAutomaticallyAddingKeyHeaderToOpenApi??!1};if(o.cacheTtlSeconds<60)throw new g(`ApiKeyInboundPolicy '${r}' - minimum cacheTtlSeconds value is 60s, '${o.cacheTtlSeconds}' is invalid`);let i=s(E=>o.allowUnauthenticatedRequests?t:R.unauthorized(t,e,{detail:E}),"unauthorizedResponse"),a=t.headers.get(o.authHeader);if(!a)return i("No Authorization Header");if(!a.toLowerCase().startsWith(o.authScheme.toLowerCase()))return i("Invalid Authorization Scheme");let u=el(a,o);if(!u||u==="")return i("No key present");let c=await tl(u),l=await q(r,o),d=new N(l,e),p=await d.get(c);if(p&&p.isValid===!0)return t.user=p.user,t;if(p&&!p.isValid)return p.typeId!==as&&O.getLogger(e).error(`ApiKeyInboundPolicy '${r}' - cached metadata has invalid typeId '${p.typeId}'`,p),i("Authorization Failed");let y={key:u},m=await V({retryDelayMs:5,retries:2,logger:O.getLogger(e)},`${h.instance.apiKeyServiceUrl}/v1/$validate/${o.bucketName}`,{method:"POST",headers:{"content-type":"application/json","zp-rid":e.requestId,"zp-dn":h.instance.deploymentName??"unknown","User-Agent":h.instance.systemUserAgent},body:JSON.stringify(y)});if(m.status===401)return e.log.info(`ApiKeyInboundPolicy '${r}' - 401 response from Key Service`),i("Authorization Failed");if(m.status!==200){try{let E=await m.text(),x=JSON.parse(E);e.log.error("Unexpected response from key service",x)}catch{e.log.error("Invalid response from key service")}throw new I(`ApiKeyInboundPolicy '${r}' - unexpected response from Key Service. Status: ${m.status}`)}let w=await m.json(),P={isValid:!0,typeId:as,user:{sub:w.name,data:w.metadata}};return t.user=P.user,d.put(c,P,o.cacheTtlSeconds),t}s(gn,"ApiKeyInboundPolicy");async function tl(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(n)).map(i=>i.toString(16).padStart(2,"0")).join("")}s(tl,"hashValue");var us=gn;var mt=require("jose");var Vr={},nl=s(async(t,e)=>{if(!e.jwkUrl||typeof e.jwkUrl!="string")throw new g("Invalid State - jwkUrl not set");Vr[e.jwkUrl]||(Vr[e.jwkUrl]=(0,mt.createRemoteJWKSet)(new URL(e.jwkUrl),e.headers?{headers:e.headers}:void 0));let{payload:n}=await(0,mt.jwtVerify)(t,Vr[e.jwkUrl],{issuer:e.issuer,audience:e.audience});return n},"jwkVerifier"),rl=s(async(t,e)=>{let n;if(e.secret===void 0)throw new Error("secretVerifier requires secret to be defined");if(typeof e.secret=="string"){let i=new TextEncoder().encode(e.secret);n=new Uint8Array(i)}else n=e.secret;let{payload:r}=await(0,mt.jwtVerify)(t,n,{issuer:e.issuer,audience:e.audience});return r},"secretVerifier"),$=s(async(t,e,n,r)=>{let o=t.headers.get("Authorization"),i="bearer ",a=s(y=>R.unauthorized(t,e,{detail:y}),"unauthorizedResponse");if(!n.jwkUrl&&!n.secret)throw new g(`OpenIdJwtInboundPolicy policy '${r}': One of 'jwkUrl' or 'secret' options are required.`);if(n.jwkUrl&&n.secret)throw new g(`OpenIdJwtInboundPolicy policy '${r}': Only one of 'jwkUrl' and 'secret' options should be provided.`);let u=n.jwkUrl?nl:rl,l=await s(async()=>{if(!o)return a("No authorization header");if(o.toLowerCase().indexOf(i)!==0)return a("Invalid bearer token format for authorization header");let y=o.substring(i.length);if(!y||y.length===0)return a("No bearer token on authorization header");try{return await u(y,n)}catch(m){let w=new URL(t.url);return"code"in m&&m.code==="ERR_JWT_EXPIRED"?e.log.warn(`Expired token used on url: ${w.pathname} `,m):e.log.warn(`Invalid token on: ${t.method} ${w.pathname}`,m),a("Invalid token")}},"getJwtOrRejectedResponse")();if(l instanceof Response)return n.allowUnauthenticatedRequests===!0?t:l;let d=n.subPropertyName??"sub",p=l[d];return p?(t.user={sub:p,data:l},t):a(`Token is not valid, no '${d}' property found.`)},"OpenIdJwtInboundPolicy");var cs=s(async(t,e,n,r)=>$(t,e,{issuer:`https://${n.auth0Domain}/`,audience:n.audience,jwkUrl:`https://${n.auth0Domain}/.well-known/jwks.json`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r),"Auth0JwtInboundPolicy");var ls=s(async(t,e,n)=>{let r=t.headers.get("Authorization"),o="basic ",i=s(l=>R.unauthorized(t,e,{detail:l}),"unauthorizedResponse"),u=await s(async()=>{if(!r)return await i("No Authorization header");if(r.toLowerCase().indexOf(o)!==0)return await i("Invalid Basic token format for Authorization header");let l=r.substring(o.length);if(!l||l.length===0)return await i("No username:password provided");let d=atob(l).normalize(),p=d.indexOf(":");if(p===-1||/[\0-\x1F\x7F]/.test(d))return await i("Invalid basic token value - see https://tools.ietf.org/html/rfc5234#appendix-B.1");let y=d.substring(0,p),m=d.substring(p+1),w=n.accounts.find(P=>P.username===y&&P.password===m);return w||await i("Invalid username or password")},"getAccountOrRejectedResponse")();if(u instanceof Response)return n.allowUnauthenticatedRequests?t:u;let c=u.username;return t.user={sub:c,data:u.data},t},"BasicAuthInboundPolicy");var ol=["cdn-cache-control","cloudflare-cdn-cache-control","surrogate-control","cache-tag","expires"];async function il(t){let e=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",e);return Array.from(new Uint8Array(n)).map(i=>i.toString(16).padStart(2,"0")).join("")}s(il,"digestMessage");var sl=s(async(t,e)=>{let n=[...e.dangerouslyIgnoreAuthorizationHeader===!0?[]:["authorization"],...e.headers??[]],r=[];for(let[d,p]of t.headers.entries())n.includes(d)&&r.push({key:d.toLowerCase(),value:p});r.sort((d,p)=>d.key.localeCompare(p.key));let o=await il(JSON.stringify(r)),i=new URL(t.url),a=new URLSearchParams(i.searchParams);a.set("_z-hdr-dgst",o);let u=e.cacheHttpMethods?.includes(t.method.toUpperCase())&&t.method.toUpperCase()!=="GET";u&&a.set("_z-original-method",t.method);let c=`${i.origin}${i.pathname}?${a}`;return new Request(c,{method:u?"GET":t.method})},"createCacheKeyRequest");async function ds(t,e,n,r){let o=await q(r,n),i=await caches.open(o),a=n?.cacheHttpMethods?.map(l=>l.toUpperCase())??["GET"],u=await sl(t,n),c=await i.match(u);return c||(e.addEventListener("responseSent",l=>{try{let d=n.statusCodes??[200,206,301,302,303,404,410],p=l.response.clone();if(!d.includes(p.status)||!a.includes(t.method.toUpperCase()))return;let y=n?.expirationSecondsTtl??60,m=new Response(p.body,p);ol.forEach(w=>m.headers.delete(w)),m.headers.set("cache-control",`s-maxage=${y}`),e.waitUntil(i.put(u,m))}catch(d){e.log.error(`Error in caching-inbound-policy '${r}': "${d.message}"`,d)}}),t)}s(ds,"CachingInboundPolicy");var ps=s(async(t,e,n,r)=>{if(!n.method)throw new g(`ChangeMethodInboundPolicy '${r}' options.method must be valid HttpMethod`);return new L(t,{method:n.method})},"ChangeMethodInboundPolicy");var ms=s(async(t,e,n)=>{let r=[...n.exclude??[]],o=new Headers;return r.forEach(a=>{let u=t.headers.get(a);u&&o.set(a,u)}),new L(t,{headers:o})},"ClearHeadersInboundPolicy");var gs=s(async(t,e,n,r)=>{let o=[...r.exclude??[]],i=new Headers;return o.forEach(u=>{let c=t.headers.get(u);c&&i.set(u,c)}),new Response(t.body,{headers:i,status:t.status,statusText:t.statusText})},"ClearHeadersOutboundPolicy");var fs=s(async(t,e,n,r)=>{let o=new URL(n.frontendApiUrl.startsWith("https://")||n.frontendApiUrl.startsWith("http://")?n.frontendApiUrl:`https://${n.frontendApiUrl}`),i=new URL(o);return i.pathname="/.well-known/jwks.json",$(t,e,{issuer:o.href.slice(0,-1),jwkUrl:i.toString(),allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)},"ClerkJwtInboundPolicy");var hs=s(async(t,e,n,r)=>{if(!n.userPoolId)throw new g("userPoolId must be set in the options for CognitoJwtInboundPolicy");if(!n.region)throw new g("region must be set in the options for CognitoJwtInboundPolicy");return $(t,e,{issuer:`https://cognito-idp.${n.region}.amazonaws.com/${n.userPoolId}`,jwkUrl:`https://cognito-idp.${n.region}.amazonaws.com/${n.userPoolId}/.well-known/jwks.json`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)},"CognitoJwtInboundPolicy");var ys=s(async(t,e,n,r)=>{if(!n.policies||n.policies.length===0)throw new g(`CompositeInboundPolicy '${r}' must have valid policies defined`);let o=M.instance,i=nt(n.policies,o?.routeData.policies);return sr(i)(t,e)},"CompositeInboundPolicy");var bs=s(async(t,e,n,r)=>{let o=t.headers.get("Authorization");if(!o)return R.unauthorized(t,e,{detail:"No authorization header"});let i=al(o);if(!i)return R.unauthorized(t,e,{detail:"Failed to parse token from Authorization header"});let a=await q(r,n),u=new N(a,e),c=await u.get(i);if(!c){let l=await fetch(n.introspectionUrl,{headers:{Authorization:"Basic "+btoa(`${n.clientId}:${n.clientSecret}`),Accept:"application/jwt","Content-Type":"application/x-www-form-urlencoded"},method:"POST",body:"token="+i+"&token_type_hint=access_token"}),d=await l.text();if(l.status===200)c=d,u.put(i,c,n.cacheDurationSeconds??600);else return l.status>=500?(e.log.error(`Error introspecting token - ${l.status}: '${d}'`),R.internalServerError(t,e,{detail:"Problem encountered authorizing the HTTP request"})):R.unauthorized(t,e)}return t.headers.set("Authorization",`Bearer ${c}`),t},"CurityPhantomTokenInboundPolicy");function al(t){return t.split(" ")[0]==="Bearer"?t.split(" ")[1]:null}s(al,"getToken");var ws=s(async(t,e,n,r)=>(D(n,r).required("projectId","string").optional("allowUnauthenticatedRequests","boolean"),$(t,e,{issuer:`https://securetoken.google.com/${n.projectId}`,audience:n.projectId,jwkUrl:"https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com",allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r)),"FirebaseJwtInboundPolicy");var Rs=s(async(t,e,n)=>{let r="application/x-www-form-urlencoded",o="multipart/form-data",i=t.headers.get("content-type")?.toLowerCase();if(!i||![o,r].includes(i))return n&&n.badRequestIfNotFormData?new Response(`Bad Request - expected content-type '${r}' or ${o}`,{status:400,statusText:"Bad Request"}):t;let a=await t.formData();if(n&&n.optionalHoneypotName&&a.get(n.optionalHoneypotName)!=="")return new Response("Bad Request",{status:400,statusText:"Bad Request"});let u={};for(let[d,p]of a)u[d]=p.toString();let c=new Headers(t.headers);return c.set("content-type","application/json"),c.delete("content-length"),new L(t,{body:JSON.stringify(u),headers:c})},"FormDataToJsonInboundPolicy");var qe="__unknown__",Ps=s(async(t,e,n,r)=>{let o={allow:{countries:Fe(n.allow?.countries,"allow.countries",r),regionCodes:Fe(n.allow?.regionCodes,"allow.regionCode",r),asns:Fe(n.allow?.asns,"allow.asOrganization",r)},block:{countries:Fe(n.block?.countries,"block.countries",r),regionCodes:Fe(n.block?.regionCodes,"block.regionCode",r),asns:Fe(n.block?.asns,"block.asOrganization",r)},ignoreUnknown:n.ignoreUnknown!==!1},i=e.incomingRequestProperties.country?.toLowerCase()??qe,a=e.incomingRequestProperties.regionCode?.toLowerCase()??qe,u=e.incomingRequestProperties.asn?.toString()??qe,c=o.ignoreUnknown&&i===qe,l=o.ignoreUnknown&&a===qe,d=o.ignoreUnknown&&u===qe,p=o.allow.countries,y=o.allow.regionCodes,m=o.allow.asns;if(p.length>0&&!p.includes(i)&&!c||y.length>0&&!y.includes(a)&&!l||m.length>0&&!m.includes(u)&&!d)return $e(t,e,r,i,a,u);let w=o.block.countries,P=o.block.regionCodes,E=o.block.asns;return w.length>0&&w.includes(i)&&!c||P.length>0&&P.includes(a)&&!l||E.length>0&&E.includes(u)&&!d?$e(t,e,r,i,a,u):t},"GeoFilterInboundPolicy");function $e(t,e,n,r,o,i){return e.log.debug(`Request blocked by GeoFilterInboundPolicy '${n}' (country: '${r}', regionCode: '${o}', asn: '${i}')`),R.forbidden(t,e,{geographicContext:{country:r,regionCode:o,asn:i}})}s($e,"blockedResponse");function Fe(t,e,n){if(typeof t=="string")return t.split(",").map(r=>r.trim().toLowerCase());if(typeof t>"u")return[];if(Array.isArray(t))return t.map(r=>r.trim().toLowerCase());throw new g(`Invalid '${e}' for GeoFilterInboundPolicy '${n}': '${t}', must be a string or string[]`)}s(Fe,"toLowerStringArray");var Is=s(async(t,e,n)=>{let r=t.user?.data.scope.split(" ")||[];if(!s((i,a)=>a.every(u=>i.includes(u)),"scopeChecker")(r,n.scopes)){let i={code:"UNAUTHORIZED",help_url:"https://zup.fail/UNAUTHORIZED",message:`JWT must have all the following scopes: ${n.scopes}`};return new Response(JSON.stringify(i),{status:401,statusText:"Unauthorized",headers:{"content-type":"application/json"}})}return t},"JWTScopeValidationInboundPolicy");var ul=new Set(["active","inactive","incomplete","incomplete-expired","trialing","past-due","canceled","unpaid"]),Es=s(async(t,e,n,r)=>{D(n,r).optional("allowRequestsWithoutSubscription","boolean").optional("bucketId","string");let o=O.getLogger(e),i=n.allowRequestsWithoutSubscription??!1;if(n.allowedSubscriptionStatuses)try{if(n.allowedSubscriptionStatuses.length===0)throw new g("Must set valid subscription statuses");let m=Ee(n.allowedSubscriptionStatuses),w=[];for(let P of m)ul.has(P)||w.push(P);if(w.length>0)throw new g(`Found the following invalid statuses: ${w.join(", ")}`)}catch(m){throw m instanceof g?new g(`LoadSubscriptionInboundPolicy '${r}' - The property 'allowedSubscriptionStatuses' is invalid. ${m.message}`):m}else n.allowedSubscriptionStatuses=["active","incomplete","trialing"];let a=n.allowedSubscriptionStatuses,u=t.user;if(!u)return i?t:R.unauthorized(t,e,{detail:"Unable to check subscription for anonymous user"});if(!n.bucketId)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)n.bucketId=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g(`LoadSubscriptionInboundPolicy '${r}' - no bucketId property provided`);let{authApiJWT:c,meteringServiceUrl:l}=h.instance,{sub:d}=u,p;try{let m=`${n.bucketId}-${d}`,w=new re(m,{logger:O.getLogger(e)}),P=await w.get(m);if(P)p=P,e.log.debug("Loading subscriptions from cache");else{let E=await fetch(`${l}/internal/v1/metering/${n.bucketId}/subscriptions?customerKey=${d}`,{headers:{Authorization:`Bearer ${c}`,"zp-rid":e.requestId},method:"GET"});if(!E.ok)return e.log.error(await E.text()),R.forbidden(t,e);p=await E.json(),w.put(m,p,15).catch(x=>{throw o.error(x),x})}}catch(m){o.error(`LoadSubscriptionInboundPolicy '${r}' -error in serviceResponse`,m)}let y=p&&p.data&&p.data.length>0?p.data[0]:void 0;return y?!a.includes(y.status)&&!i?(e.log.warn(`Subscription '${y.id}' has status '${y.status}' which is not part of the allowed statuses.`),R.unauthorized(t,e,{detail:"No valid subscription found"})):(a.includes(y.status)&&(e.log.debug(`Loading subscription '${y.id}' for user sub '${d}' to ContextData`),le.set(e,We,y)),t):(e.log.warn("No valid subscription found"),i?t:R.unauthorized(t,e,{detail:"No valid subscription found"}))},"LoadSubscriptionInboundPolicy");var xs=s(async(t,e,n,r)=>{D(n,r).optional("allowRequestsWithoutSubscription","boolean").optional("allowRequestsOverQuota","boolean").optional("bucketId","string");let o=O.getLogger(e);if(!n.meterOnStatusCodes)throw new g(`Invalid MeteringInboundPolicy '${r}': options.meterOnStatusCodes must be an array of HTTP status code numbers`);let i=Array.isArray(n.meterOnStatusCodes)?n.meterOnStatusCodes:Lt(n.meterOnStatusCodes);try{let p=[];for(let y in n.meters)typeof n.meters[y]!="number"&&p.push(y);if(p.length>0)throw new g(`Non-numeric values found in properties: ${p.join(", ")}`)}catch(p){throw p instanceof g?new g(`MeteringInboundPolicy '${r}' - The property 'meters' is invalid. ${p.message}`):p}e.addResponseSendingFinalHook(async(p,y,m)=>{let w=le.get(m,We);if((n.allowRequestsWithoutSubscription??!1)&&!w){m.log.debug(`MeteringInboundPolicy '${r}' - no subscription found and allowRequestsWithoutSubscription is true`);return}if(!n.bucketId)if(Z.ZUPLO_METERING_SERVICE_BUCKET_ID)n.bucketId=Z.ZUPLO_METERING_SERVICE_BUCKET_ID;else throw new g(`MeteringInboundPolicy '${r}' - no bucketId property provided`);let{authApiJWT:E,meteringServiceUrl:x}=h.instance;if(i.includes(p.status)&&w&&n.meters){m.log.debug(`MeteringInboundPolicy '${r}' - Updating subscription '${w.id}' with meters '${JSON.stringify(n.meters)} on response status '${p.status}'`);try{let C=await fetch(`${x}/internal/v1/metering/${n.bucketId}/subscriptions/${w.id}/quotas/consume`,{headers:{Authorization:`Bearer ${E}`,"zp-rid":m.requestId},method:"POST",body:JSON.stringify({meters:n.meters})});C.ok||(m.log.error(`MeteringInboundPolicy '${r}' -error in serviceResponse: ${C.status} - ${C.statusText}`),o.error(`MeteringInboundPolicy '${r}' -error in serviceResponse: ${C.status} - ${C.statusText}`))}catch(C){m.log.error(`MeteringInboundPolicy '${r}' -error in serviceResponse`),o.error(`MeteringInboundPolicy '${r}' -error in serviceResponse`,C)}}});let a=le.get(e,We),u=n.allowRequestsWithoutSubscription??!1,c=n.allowRequestsOverQuota??!1;if(!a)return u?t:(e.log.warn("Subscription is not available for user"),R.paymentRequired(t,e,{detail:"Subscription is not available for user",title:"No Subscription"}));if(a&&Object.keys(a.quotas).length===0)return e.log.error(`Quota is not set up for subscription '${a.id}'`),R.tooManyRequests(t,e,{detail:"Quota is not set up for the user's subscription",title:"Quota Exceeded"});let d=Object.keys(n.meters).filter(p=>!Object.keys(a.quotas).includes(p));if(d.length>0)return e.log.warn(`The following policy meters are not present in the subscription: ${d.join(", ")}`),R.tooManyRequests(t,e,{detail:`The following policy meters are not present in the subscription: ${d.join(", ")}`,title:"Quota Exceeded"});for(let p of Object.keys(a.quotas))if(a.quotas[p]<=0&&!c)return R.tooManyRequests(t,e,{detail:`Quota exceeded for meter '${p}'`,title:"Quota Exceeded"});return t},"MeteringInboundPolicy");var Ss=s(async(t,e,n,r)=>{let o=e.route.raw().responses;if(!o)return Gr(r,t,e,"No responses defined in the OpenAPI document. Add some responses with examples to use this policy.");let i=Object.keys(o),a=[];if(i.length===0)return Gr(r,t,e,"No response object defined under responses in the OpenAPI document. Add some response objects with examples to use this policy.");if(i.forEach(u=>{o[u].content&&Object.keys(o[u].content).forEach(l=>{let d=o[u].content[l].examples;d&&Object.keys(d).forEach(y=>{a.push({responseName:u,contentName:l,exampleName:y,exampleValue:d[y]})})})}),a=a.filter(u=>!(n.responsePrefixFilter&&!u.responseName.startsWith(n.responsePrefixFilter)||n.contentType&&u.contentName!==n.contentType||n.exampleName&&u.exampleName!==n.exampleName)),n.random&&a.length>1){let u=Math.floor(Math.random()*a.length);return vs(a[u])}else return a.length>0?vs(a[0]):Gr(r,t,e,"No examples matching the mocking options found in the OpenAPI document. Add examples to the OpenAPI document matching the options for this policy or change the mocking options to match the examples in the OpenAPI document.")},"MockApiInboundPolicy");function vs(t){let e=JSON.stringify(t.exampleValue,null,2),n=new Headers;switch(n.set("Content-Type",t.contentName),t.responseName){case"1XX":return new Response(e,{status:100,headers:n});case"2XX":return new Response(e,{status:200,headers:n});case"3XX":return new Response(e,{status:300,headers:n});case"4XX":return new Response(e,{status:400,headers:n});case"5XX":case"default":return new Response(e,{status:500,headers:n});default:return new Response(e,{status:Number(t.responseName),headers:n})}}s(vs,"generateResponse");var Gr=s((t,e,n,r)=>{let o=`Error in policy: ${t} - On route ${e.method} ${n.route.path}. ${r}`;return R.internalServerError(e,n,{detail:o})},"getProblemDetailResponse");var cl="Incoming",ll={logRequestBody:!0,logResponseBody:!0};function Ts(t){let e={};return t.forEach((n,r)=>{e[r]=n}),e}s(Ts,"headersToObject");function Os(){return new Date().toISOString()}s(Os,"timestamp");var Wr=new WeakMap,dl={};function Ls(t,e){let n=Wr.get(t);n||(n=dl);let r=Object.assign({...n},e);Wr.set(t,r)}s(Ls,"setMoesifContext");async function Cs(t,e){let n=t.headers.get("content-type");if(n&&n.indexOf("json")!==0)try{return await t.clone().json()}catch(o){e.log.error(o)}let r=await t.clone().text();return e.log.debug({textBody:r}),r}s(Cs,"readBody");var pl={},Kr;function As(){if(!Kr)throw new I("Invalid State - no _lastLogger");return Kr}s(As,"getLastLogger");function ml(t){let e=pl[t];return e||(e=new A("moesif-inbound",100,async n=>{let r=JSON.stringify(n);As().debug("posting",r);let o=await fetch("https://api.moesif.net/v1/events/batch",{method:"POST",headers:{"content-type":"application/json","X-Moesif-Application-Id":t},body:r});o.ok||As().error({status:o.status,body:await o.text()})})),e}s(ml,"getDispatcher");async function _s(t,e,n,r){Kr=e.log;let o=Os(),i=Object.assign(ll,n);if(!i.applicationId)throw new Error(`Invalid configuration for MoesifInboundPolicy '${r}' - applicationId is required`);let a=i.logRequestBody?await Cs(t,e):void 0;return e.addResponseSendingFinalHook(async(u,c)=>{let l=ml(i.applicationId),d=t.headers.get("true-client-ip"),p=Wr.get(e)??{},y={time:o,uri:t.url,verb:t.method,body:a,ip_address:d??void 0,api_version:p.apiVersion,headers:Ts(t.headers)},m=i.logResponseBody?await Cs(u,e):void 0,w={time:Os(),status:u.status,headers:Ts(u.headers),body:m},P={request:y,response:w,user_id:p.userId??c.user?.sub,session_token:p.sessionToken,company_id:p.companyId,metadata:p.metadata,direction:cl};l.enqueue(P),e.waitUntil(l.waitUntilFlushed())}),t}s(_s,"MoesifInboundPolicy");var ks=s(async(t,e,n,r)=>$(t,e,{issuer:n.issuerUrl,audience:n.audience,jwkUrl:`${n.issuerUrl}/v1/keys`,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests},r),"OktaJwtInboundPolicy");var Ds=require("jose");var Jr,Hs=s(async(t,e,n,r)=>{if(!Jr)try{Jr=await(0,Ds.importSPKI)(n.verifierKey,"RS256")}catch(o){throw e.log.error("Could not import verifier key"),o}return $(t,e,{issuer:n.authUrl,secret:Jr,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests,subPropertyName:"user_id"},r)},"PropelAuthJwtInboundPolicy");var Ns=Te(Re());var fn=class extends Error{static{s(this,"ValidationError")}constructor(e){super(e)}},Yr=class extends fn{static{s(this,"ArgumentUndefinedError")}constructor(e){super(`The argument '${e}' is undefined.`)}},Qr=class extends fn{static{s(this,"ArgumentTypeError")}constructor(e,n){super(`The argument '${e}' must be of type '${n}'.`)}};function gl(t,e){if(Qo(t))throw new Yr(e)}s(gl,"throwIfUndefinedOrNull");function gt(t,e){if(gl(t,e),!Q(t))throw new Qr(e,"string")}s(gt,"throwIfNotString");var hn=class t{static{s(this,"StandardRedisClient")}static instance;redisClientUrl;clientAuthToken;userAgent;deploymentName;constructor(e,n,r,o){this.redisClientUrl=e,this.clientAuthToken=n,this.deploymentName=r,this.userAgent=o}static initialize(e,n,r,o){return gt(e,"redisClientUrl"),gt(n,"clientAuthToken"),t.instance||(t.instance=new t(e,n,r,o)),t.instance}isEnabled(){return this.redisClientUrl!==void 0&&this.clientAuthToken!==void 0}async fetch({url:e,body:n,method:r,requestId:o}){gt(e,"url");let i=await fetch(`${this.redisClientUrl}${e}`,{method:r,body:n,headers:{"content-type":"application/json",authorization:`Bearer ${this.clientAuthToken}`,"zp-rid":o,"zp-dn":this.deploymentName,"User-Agent":this.userAgent}}),a=i.headers.get("Content-Type")?.includes("application/json")?await i.json():await i.text();if(i.ok)return a;throw i.status===401?new T("Redis client failed with 401: Unauthorized"):new T(`Redis client failed with (${i.status}): ${typeof a=="string"?a:JSON.stringify(a,null,2)}`)}},yn=class{static{s(this,"InMemoryRedisClient")}keyValueStore;constructor(){this.keyValueStore=new Map}isEnabled(){return!0}fetch({url:e,body:n,method:r}){if(gt(e,"url"),r==="POST"&&e==="/rate-limit"){let{incrBy:o,expire:i,key:a}=JSON.parse(n),u=Date.now()+i*1e3,c=this.keyValueStore.get(a);c?Date.now()>c.expiresAt?this.keyValueStore.set(a,{value:o,expiresAt:u}):this.keyValueStore.set(a,{value:c.value+o,expiresAt:c.expiresAt}):this.keyValueStore.set(a,{value:o,expiresAt:u});let l=this.keyValueStore.get(a);return Promise.resolve({count:l.value,ttlSeconds:Math.round((l.expiresAt-Date.now())/1e3)})}throw new T("The in-memory redis client only supports /rate-limit calls")}};var bn=(0,Ns.debug)("zuplo:policies:RateLimitInboundPolicy"),fl="strict",hl=s(t=>{let e=t.headers.get("cf-connecting-ip")??t.headers.get("true-client-ip");if(e)return e;let n=t.headers.get("x-forwarded-for");return n?n.split(",")[0]:"127.0.0.1"},"getRealIP"),yl=s(async t=>({key:`ip-${hl(t)}`}),"getIP"),bl=s(async t=>({key:`user-${t.user?.sub??"anonymous"}`}),"getUser"),wl=s(async()=>({key:"all-2d77ce9d-9a3c-4206-9ab2-668cfd271095"}),"getAll"),wn;function Rl(t,e){let n;if(wn)return wn;if(h.instance.isLocalDevelopment)return e.info("Using in-memory redis client for local development."),n=new yn,wn=n,n;let{authApiJWT:r,redisURL:o}=h.instance;if(!Q(o))throw new T(`RateLimitInboundPolicy '${t}' - rate limit service URL not configured`);if(!Q(r))throw new T(`RateLimitInboundPolicy '${t}' - service authentication not configured`);if(o&&(n=hn.initialize(o,r,h.instance.deploymentName??"unknown",h.instance.systemUserAgent)),!n||!n.isEnabled())throw new T(`RateLimitInboundPolicy '${t}' - no redis ('${n}') or redis.isEnabled ('${n?.isEnabled}) is false`);return wn=n,n}s(Rl,"getRedisClient");async function Us(t,e,n,r,o){let i=Math.floor(e*60);return await n.fetch({url:"/rate-limit",method:"POST",body:JSON.stringify({incrBy:1,expire:i,key:t}),requestId:o})}s(Us,"getCountAndUpdateExpiry");function Pl(t,e){let n;if(t.rateLimitBy==="function"){if(!t.identifier)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier must be specified`);if(!t.identifier.module)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.module must be specified`);if(!t.identifier.export)throw new g(`RateLimitInboundPolicy '${e}' - If rateLimitBy set to 'function' options.identifier.export must be specified`);if(n=t.identifier.module[t.identifier.export],!n||typeof n!="function")throw new g(`RateLimitInboundPolicy '${e}' - Custom rate limit function must be a valid function`)}return s(async(o,i,a)=>{let u=await n(o,i,a);if(!u.key){let c=`RateLimitInboundPolicy '${a}' - Custom rate limit function must return a valid key property '${JSON.stringify(u,null,2)}'`;throw i.log.error(c),new I(c)}return u},"outerFunction")}s(Pl,"wrapUserFunction");var Il="Retry-After",Xr=s(async(t,e,n,r)=>{let o=Date.now(),i=O.getLogger(e),a=s((c,l)=>{if(n.throwOnFailure)throw new T(c,{cause:l});i.error(c,l)},"throwOrLog"),u=s((c,l)=>{let d={};return(!c||c==="retry-after")&&(d[Il]=l.toString()),R.tooManyRequests(t,e,void 0,d)},"rateLimited");try{let l={function:Pl(n,r),user:bl,ip:yl,all:wl}[n.rateLimitBy],d=await l(t,e,r),p=d.key,y=d.requestsAllowed??n.requestsAllowed,m=d.timeWindowMinutes??n.timeWindowMinutes,w=n.headerMode??"retry-after",P=Rl(r,i),x=`bucket/${h.instance.build.BUILD_ID}/${r}/${p}`;if((n.mode??fl)==="async"){let _=await q(r,n),G=new re(_,{logger:O.getLogger(e)}),J=Us(x,m,P,i,e.requestId),Y=await G.get(x);if(Y!==void 0&&Y<=Date.now()){bn(`RateLimitInboundPolicy '${r}' - returning 429 from cache for '${x}' (async mode)`);let ve=Math.round((Y-Date.now())/1e3);return u(w,ve)}return e.addEventListener("responseSending",ve=>{try{let Se=ve,Tn=Se.mutableResponse;Se.mutableResponse=(async()=>{let ft=await J;if(ft.count>y){let ha=Date.now()+ft.ttlSeconds*1e3,ya=G.put(x,ha,ft.ttlSeconds).catch(uo=>{throw i.error(new T("Error caching rate limit result.",{cause:uo})),uo});return e.waitUntil(ya),bn(`RateLimitInboundPolicy '${r}' - returning 429 from redis for '${x}' (async mode)`),u(w,ft.ttlSeconds)}return Tn})()}catch(Se){i.error(`RateLimitInboundPolicy '${r}' -error in responseSending`,Se)}}),t}let F=await Us(x,m,P,i,e.requestId);return F.count>y?(bn(`RateLimitInboundPolicy '${r}' - returning 429 from redis for '${x}' (strict mode)`),u(w,F.ttlSeconds)):t}catch(c){return a(c.message,c),t}finally{let c=Date.now()-o;bn(`RateLimitInboundPolicy '${r}' - latency ${c}ms`)}},"RateLimitInboundPolicy");var eo;function Ms(t){let e=[];for(let[n,r]of t)e.push({name:n,value:r});return e}s(Ms,"headersToNameValuePairs");function El(t){let e=[];return Object.entries(t).forEach(([n,r])=>{e.push({name:n,value:r})}),e}s(El,"queryToNameValueParis");function xl(t){if(t===null)return;let e=parseFloat(t);if(!isNaN(e))return e}s(xl,"parseIntOrUndefined");var Zs={};async function qs(t,e,n,r){let o=new Date,i=Date.now();return eo||(eo={name:"zuplo",version:h.instance.build.ZUPLO_VERSION,comment:`zuplo/${h.instance.build.ZUPLO_VERSION}`}),e.addResponseSendingFinalHook(async a=>{try{let u=n.userLabelPropertyPath&&t.user?Ie(t.user,n.userLabelPropertyPath,"userLabelPropertyPath"):t.user?.sub,c=n.userEmailPropertyPath&&t.user?Ie(t.user,n.userEmailPropertyPath,"userEmailPropertyPath"):void 0,l={clientIPAddress:t.headers.get("true-client-ip")??"",development:n.development!==void 0?n.development:h.instance.isDeno,group:{label:u,email:c,id:t.user?.sub??"anonymous"},request:{log:{creator:eo,entries:[{startedDateTime:o.toISOString(),time:Date.now()-i,request:{method:t.method,url:n.useFullRequestPath?new URL(t.url).pathname:e.route.path,httpVersion:"2",headers:Ms(t.headers),queryString:El(t.query)},response:{status:a.status,statusText:a.statusText,headers:Ms(a.headers),content:{size:xl(t.headers.get("content-length"))}}}]}}},d=Zs[n.apiKey];if(!d){let p=n.apiKey;d=new A("readme-metering-inbound-policy",10,async y=>{try{let m=n.url??"https://metrics.readme.io/request",w=await fetch(m,{method:"POST",body:JSON.stringify(y),headers:{"content-type":"application/json",authorization:`Basic ${btoa(p+":")}`}});w.status!==202&&e.log.error(`Unexpected response in ReadmeMeteringInboundPolicy '${r}'. ${w.status}: '${await w.text()}'`)}catch(m){throw e.log.error(`Error in ReadmeMeteringInboundPolicy '${r}': '${m.message}'`),m}}),Zs[p]=d}d.enqueue(l),e.waitUntil(d.waitUntilFlushed())}catch(u){e.log.error(u)}}),t}s(qs,"ReadmeMetricsInboundPolicy");var $s=s(async(t,e,n,r)=>{let o=n?.headers;if(!o||!Array.isArray(o)||o.length===0)throw new g(`RemoveHeadersInboundPolicy '${r}' options.headers must be a non-empty string array of header names`);let i=new Headers(t.headers);return o.forEach(u=>{i.delete(u)}),new L(t,{headers:i})},"RemoveHeadersInboundPolicy");var Fs=s(async(t,e,n,r,o)=>{let i=r?.headers;if(!i||!Array.isArray(i)||i.length===0)throw new g(`RemoveHeadersOutboundPolicy '${o}' options.headers must be a non-empty string array of header names`);let a=new Headers(t.headers);return i.forEach(c=>{a.delete(c)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"RemoveHeadersOutboundPolicy");var Bs=s(async(t,e,n,r)=>{let o=n.params;if(!o||!Array.isArray(o)||o.length===0)throw new g(`RemoveQueryParamsInboundPolicy '${r}' options.params must be a non-empty string array of header names`);let i=new URL(t.url);return o.forEach(u=>{i.searchParams.delete(u)}),new L(i.toString(),t)},"RemoveQueryParamsInboundPolicy");var js=s(async(t,e,n,r)=>{let o=await t.text(),i=r.mode==="regexp"?new RegExp(r.match,"gm"):r.match,a=o.replaceAll(i,r.replaceWith);return new Response(a,{headers:t.headers,status:t.status,statusText:t.statusText})},"ReplaceStringOutboundPolicy");var zs=s(()=>new Response("Maximum request size exceeded",{status:413,statusText:"Payload Too Large"}),"payloadTooLarge"),Vs=s(async(t,e,n)=>{let r=n.trustContentLengthHeader??!1;if(["GET","HEAD"].includes(t.method))return t;let o=t.headers.get("content-length"),i=o!==null?parseInt(o):void 0;return i&&!isNaN(i)&&i>n.maxSizeInBytes?zs():i&&r?t:(await t.clone().text()).length>n.maxSizeInBytes?zs():t},"RequestSizeLimitInboundPolicy");function Gs(t,e,n){return`_${be(t+"_"+e+"_"+n)}`}s(Gs,"getRawOperationDataIdentifierName");function Rn(t,e,n,r){return`_${be(t.toLowerCase())}_`+e.toLowerCase()+"_"+n.toLowerCase()+`_${r.toLowerCase()}`}s(Rn,"getIdForParameterSchema");function Pn(t,e,n){return`_${be(t.toLowerCase())}_`+e.toLowerCase()+`_rb_${be(n.toLowerCase())}`}s(Pn,"getIdForRequestBodySchema");function Ws(t,e){return`_${be(t)}__${be(e)}`}s(Ws,"getIdForRefSchema");function be(t){let e=[];for(let n=0;n<t.length;n++){let r=t.charCodeAt(n);r>="0".charCodeAt(0)&&r<="9".charCodeAt(0)||r>="A".charCodeAt(0)&&r<="Z".charCodeAt(0)||r>="a".charCodeAt(0)&&r<="z".charCodeAt(0)?e.push(t.charAt(n)):e.push("_")}return e.join("")}s(be,"sanitizedIdentifierName");var Be=s(t=>{let e=t.route.raw();return e.parameters?e.parameters.map(r=>({name:r.name,location:r.in,required:r.required,deprecated:r.deprecated,allowEmptyValue:r.allowEmptyValue})):[]},"getParametersForOperation"),je=s((t,e,n,r,o)=>{let i=[],a=!0,u=[];return t.forEach(c=>{let l=c.required||o==="path";if(l&&!e[c.name])a=!1,i.push(`Required ${o} parameter '${c.name}' not found`);else if(!(!l&&!e[c.name])){let d=Rn(n,r,o,c.name),p=M.instance.schemaValidator[d],y=p(e[c.name]),m=to(p.errors);y||(a=!1,u.push(`${o} parameter: ${c.name} : ${e[c.name]}`),i.push(`Invalid value for ${o} parameter: '${c.name}' ${m.join(", ")}`))}}),{isValid:a,invalidValues:u,errors:i}},"validateParameters"),ee=s((t,e,n,r,o)=>{r?t.log[e](n,r,o):t.log[e](n,o)},"logErrors"),te=s(t=>t==="log-only"||t==="reject-and-log","shouldLog"),ne=s(t=>t==="reject-only"||t==="reject-and-log","shouldReject"),to=s(t=>t?.map(e=>e.instancePath===void 0||e.instancePath===""?e.message??"Unknown validation error":e.instancePath.replace("/","")+" "+e.message)??["Unknown validation error"],"getErrorsFromValidator");async function Ks(t,e,n){if(!n.validateBody||n.validateBody==="none")return;let r;try{r=await e.clone().json()}catch(m){let w=`Error in request body for method : ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,P=R.badRequest(e,t,{detail:`${w}, see errors property for more details`,errors:`${m}`});if(te(n.validateBody)&&ee(t,n.logLevel??"info",w,[r],m),ne(n.validateBody))return P}if(!e.headers.get("Content-Type")){let m=`No content-type header defined in incoming request to ${e.method} in route: ${t.route.path}`,w=R.badRequest(e,t,{detail:m});return te(n.validateBody)&&ee(t,n.logLevel??"info",m,[r],[m]),ne(n.validateBody)?w:void 0}let o=e.headers.get("Content-Type"),i=o.indexOf(";");i>-1&&(o=o.substring(0,i));let a=Pn(t.route.path,e.method,o),u=M.instance.schemaValidator[a];if(!u){let m=`No schema defined for method: ${e.method} in route: ${t.route.path} with content-type: ${e.headers.get("Content-Type")}`,w=R.badRequest(e,t,{detail:m});return te(n.validateBody)&&ee(t,n.logLevel??"info",m,[r],[m]),ne(n.validateBody)?w:void 0}if(u(r))return;let l=u.errors,d="Request body did not pass validation",p=to(l),y=R.badRequest(e,t,{detail:`${d}, see errors property for more details`,errors:p});if(te(n.validateBody)&&ee(t,n.logLevel??"info",d,[r],p),ne(n.validateBody))return y}s(Ks,"handleBodyValidation");function Js(t,e,n){if(!n.validateHeaders||n.validateHeaders==="none")return;let r={};e.headers.forEach((a,u)=>{r[u]=a});let o=Be(t),i=je(o.filter(a=>a.location==="header"),r,t.route.path,e.method.toLowerCase(),"header");if(!i.isValid){let a="Header validation failed",u=R.badRequest(e,t,{detail:`${a}, see errors property for more details`,errors:i.errors});if(te(n.validateHeaders)&&ee(t,n.logLevel??"info",a,i.invalidValues,i.errors),ne(n.validateHeaders))return u}}s(Js,"handleHeadersValidation");function Ys(t,e,n){if(!n.validatePathParameters||n.validatePathParameters==="none")return;let r=Be(t),o=je(r.filter(i=>i.location==="path"),e.params,t.route.path,e.method.toLowerCase(),"path");if(!o.isValid){let i="Path parameters validation failed",a=R.badRequest(e,t,{detail:`${i}, see errors property for more details`,errors:o.errors});if(te(n.validatePathParameters)&&ee(t,n.logLevel??"info",i,o.invalidValues,o.errors),ne(n.validatePathParameters))return a}}s(Ys,"handlePathParameterValidation");function Qs(t,e,n){if(!n.validateQueryParameters||n.validateQueryParameters==="none")return;let r=Be(t),o=je(r.filter(i=>i.location==="query"),e.query,t.route.path,e.method.toLowerCase(),"query");if(!o.isValid){let i="Query parameters validation failed",a=R.badRequest(e,t,{detail:`${i}, see errors property for more details`,errors:o.errors});if(te(n.validateQueryParameters)&&ee(t,n.logLevel??"info",i,o.invalidValues,o.errors),ne(n.validateQueryParameters))return a}}s(Qs,"handleQueryParameterValidation");var no=s(async(t,e,n)=>{let r=Qs(e,t,n);if(r!==void 0||(r=Ys(e,t,n),r!==void 0)||(r=Js(e,t,n),r!==void 0))return r;let o=await Ks(e,t,n);return o!==void 0?o:t},"RequestValidationInboundPolicy"),Xs=no;var ea=s(async(t,e,n,r)=>{if(n.origins===void 0||n.origins.length===0)throw new g(`RequireOriginInboundPolicy '${r}' configuration error - no allowed origins specified`);let o=typeof n.origins=="string"?n.origins.split(","):n.origins;o=o.map(a=>a.trim());let i=t.headers.get("origin");if(!i||!o.includes(i)){let a=n.failureDetail??"Forbidden";return R.forbidden(t,e,{detail:a})}return t},"RequireOriginInboundPolicy");var ta=s(async(t,e,n)=>new L(t,{body:n.body}),"SetBodyInboundPolicy");var na=s(async(t,e,n,r)=>{let o=n.headers;if(!o||!Array.isArray(o)||o.length==0)throw new g(`SetHeadersInboundPolicy '${r}' options.headers must be a valid array of { name, value }`);let i=new Headers(t.headers);return o.forEach(u=>{if(!u.name||u.name.length===0)throw new g(`SetHeadersInboundPolicy '${r}' each option.headers[] entry must have a name property`);let c=u.overwrite===void 0?!0:u.overwrite;(!i.has(u.name)||c)&&i.set(u.name,u.value)}),new L(t,{headers:i})},"SetHeadersInboundPolicy");var ra=s(async(t,e,n,r,o)=>{let i=r.headers;if(!i||!Array.isArray(i)||i.length==0)throw new g(`SetHeadersOutboundPolicy '${o}' options.headers must be a valid array of { name, value }`);let a=new Headers(t.headers);return i.forEach(c=>{if(!c.name||c.name.length===0)throw new g(`SetHeadersOutboundPolicy '${o}' each option.headers[] entry must have a name property`);let l=c.overwrite===void 0?!0:c.overwrite;(!a.has(c.name)||l)&&a.set(c.name,c.value)}),new Response(t.body,{headers:a,status:t.status,statusText:t.statusText})},"SetHeadersOutboundPolicy");var oa=s(async(t,e,n,r)=>{let o=n.params;if(!o||!Array.isArray(o)||o.length==0)throw new g(`SetQueryParamsInboundPolicy '${r}' options.params must be a valid array of { name, value }`);let i=new URL(t.url);return o.forEach(u=>{if(!u.name||u.name.length===0)throw new g(`SetQueryParamsInboundPolicy '${r}' each option.params[] entry must have a name property`);let c=u.overwrite===void 0?!0:u.overwrite;(!i.searchParams.has(u.name)||c)&&i.searchParams.set(u.name,u.value)}),new L(i.toString(),t)},"SetQueryParamsInboundPolicy");var ia=s(async(t,e,n,r,o)=>{if(!r.status||isNaN(r.status)||r.status<100||r.status>599)throw new Error(`Invalid SetStatusOutboundPolicy '${o}' - status must be a valid number between 100 and 599, not '${r.status}'`);return new Response(t.body,{headers:t.headers,status:r.status,statusText:r.statusText??t.statusText})},"SetStatusOutboundPolicy");var vl=s(async t=>new Promise(n=>{setTimeout(n,t)}),"sleep"),sa=s(async(t,e,n,r)=>{if(!n||n.sleepInMs===void 0||isNaN(n.sleepInMs))throw new g(`SleepInboundPolicy '${r} must have a valid options.sleepInMs value`);return await vl(n.sleepInMs),t},"SleepInboundPolicy");var aa=s(async(t,e,n,r)=>{D(n,r).required("secret","string").optional("allowUnauthenticatedRequests","boolean").optional("requiredClaims","object");let o={secret:n.secret,allowUnauthenticatedRequests:n.allowUnauthenticatedRequests??!1},i=await $(t,e,o,r);if(i instanceof Response)return i;if(!(i instanceof L))throw new T("Invalid State - SupabaseJwtInboundPolicy encountered a non-response that wasn't a ZuploRequest type')");let a=n.requiredClaims;if(!a)return i;let u=t.user?.data.app_metadata;if(!u)throw new I(`SupabaseJwtInboundPolicy policy '${r}' - has requiredClaims but the JWT token had no app_metadata property`);let c=Object.keys(a),l=[];return c.forEach(d=>{let p=a[d];Array.isArray(p)?p.includes(u[d])||l.push(d):p!==u[d]&&l.push(d)}),l.length>0?R.unauthorized(t,e,{detail:`Invalid JWT token - missing valid claims ${l.join(", ")}`}):i},"SupabaseJwtInboundPolicy");var ua=s(async(t,e,n,r)=>{D(n,r).required("activeDirectoryTenantId","string").required("activeDirectoryClientId","string").required("activeDirectoryClientSecret","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number");let o=await q(r,n),i=new N(o,e),a=await i.get(r);if(!a){let u=await Sl(n,e);i.put(r,u.access_token,u.expires_in-(n.expirationOffsetSeconds??300)),a=u.access_token}return t.headers.set("Authorization",`Bearer ${a}`),t},"UpstreamAzureAdServiceAuthInboundPolicy");async function Sl(t,e){let n=new URLSearchParams({client_id:t.activeDirectoryClientId,scope:`${t.activeDirectoryClientId}/.default`,client_secret:t.activeDirectoryClientSecret,grant_type:"client_credentials"}),r=await V({retries:t.tokenRetries??3,retryDelayMs:10},`https://login.microsoftonline.com/${t.activeDirectoryTenantId}/oauth2/v2.0/token`,{headers:{"content-type":"application/x-www-form-urlencoded"},method:"POST",body:n});if(r.status!==200){try{let i=await r.text();e.log.error("Could not get token from Azure AD",i)}catch{}throw new I("Could not get token from Azure AD")}let o=await r.json();if(o&&typeof o=="object"&&"access_token"in o&&typeof o.access_token=="string"&&"expires_in"in o&&typeof o.expires_in=="number")return{access_token:o.access_token,expires_in:o.expires_in};throw new I("Response returned from Azure AD is not in the expected format.")}s(Sl,"getAccessToken");var ca="https://accounts.google.com/o/oauth2/token",ro,la=s(async(t,e,n,r)=>{D(n,r).required("serviceAccountJson","string"),ro||(ro=await W.init(n.serviceAccountJson));let o={scope:["https://www.googleapis.com/auth/cloud-platform","https://www.googleapis.com/auth/firebase.database","https://www.googleapis.com/auth/firebase.messaging","https://www.googleapis.com/auth/identitytoolkit","https://www.googleapis.com/auth/userinfo.email"].join(" ")},i=await q(r,n),a=new N(i,e),u=await a.get(r);if(!u){let c=await ie({serviceAccount:ro,audience:ca,payload:o}),l=await Zt(ca,c,{retries:n.tokenRetries??3,retryDelayMs:10});if(!l.access_token)throw new I("Invalid OAuth response from Firebase");u=l.access_token,a.put(r,u,(l.expires_in??3600)-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${u}`),t},"UpstreamFirebaseAdminAuthInboundPolicy");var Tl="https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit",Ol=["acr","amr","at_hash","aud","auth_time","azp","cnf","c_hash","exp","iat","iss","jti","nbf","nonce"],oo,da=s(async(t,e,n,r)=>{if(D(n,r).required("serviceAccountJson","string").required("webApiKey","string").optional("developerClaims","object").optional("userId","string").optional("userIdPropertyPath","string"),!n.userId&&!n.userIdPropertyPath)throw new g(`Either 'userId' or 'userIdPropertyPath' options must be set on policy '${r}'.`);let o={};if(typeof n.developerClaims<"u"){for(let p in n.developerClaims)if(Object.prototype.hasOwnProperty.call(n.developerClaims,p)){if(Ol.indexOf(p)!==-1)throw new g(`Developer claim "${p}" is reserved and cannot be specified.`);o[p]=n.developerClaims[p]}}oo||(oo=await W.init(n.serviceAccountJson));let i=n.userId;if(!i&&!n.userIdPropertyPath){if(!t.user)throw new I("Unable to set userId for upstream auth policy as request.user is 'undefined'. Do you have an authentication policy before this policy?.");i=t.user?.sub}else if(n.userIdPropertyPath){if(!t.user)throw new I(`Unable to apply userIdPropertyPath '${n.userIdPropertyPath}' as request.user is 'undefined'. Do you have an authentication policy before this policy?`);i=Ie(t.user,n.userIdPropertyPath,"userIdPropertyPath")}if(!i)throw new I(`Unable to determine user from for the policy ${r}`);let a=await q(r,n),u=new N(a,e),c={uid:i,claims:o},l=await mn(JSON.stringify(c)),d=await u.get(l);if(!d){let p=await ie({serviceAccount:oo,audience:Tl,payload:c}),y=`https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken?key=${n.webApiKey}`,m=await fi(y,p,{retries:n.tokenRetries??3,retryDelayMs:10});if(!m.idToken)throw new I("Invalid token response from Firebase");d=m.idToken,u.put(l,d,(m.expiresIn?parseInt(m.expiresIn):3600)-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${d}`),t},"UpstreamFirebaseUserAuthInboundPolicy");var io,pa=s(async(t,e,n,r)=>{D(n,r).required("audience","string").required("serviceAccountJson","string"),io||(io=await W.init(n.serviceAccountJson));let o=await ie({serviceAccount:io,audience:n.audience});return t.headers.set("Authorization",`Bearer ${o}`),t},"UpstreamGcpJwtInboundPolicy");var ma="https://www.googleapis.com/oauth2/v4/token",so,ga=s(async(t,e,n,r)=>{D(n,r).required("serviceAccountJson","string").optional("audience","string").optional("tokenRetries","number").optional("expirationOffsetSeconds","number"),so||(so=await W.init(n.serviceAccountJson));let o={};if(n.scopes&&n.audience)throw new g("UpstreamGcpServiceAuthInboundPolicy - Either the 'scopes' or the 'audience' property can be set, not both.");if(n.scopes)try{let c=Ee(n.scopes);o.scope=c.join(" ")}catch(c){throw c instanceof g?new g(`UpstreamGcpServiceAuthInboundPolicy - The property 'scopes' is invalid. ${c.message}`):c}n.audience&&(o.target_audience=`${n.audience}`);let i=await q(r,n),a;n.useMemoryCacheOnly?a=new Oe(i):a=new N(i,e);let u=await a.get(r);if(!u){let c=await ie({serviceAccount:so,audience:ma,payload:o}),l=await Zt(ma,c,{retries:n.tokenRetries??3,retryDelayMs:10});if(n.audience){if(!l.id_token)throw new I("Invalid token response from GCP");u=l.id_token}else{if(!l.access_token)throw new I("Invalid token response from GCP");u=l.access_token}a.put(r,u,3600-(n.expirationOffsetSeconds??300))}return t.headers.set("Authorization",`Bearer ${u}`),t},"UpstreamGcpServiceAuthInboundPolicy");var fa=s(async(t,e,n)=>{let r=t.clone(),o;try{o=await r.json()}catch{return R.badRequest(t,e,{detail:"Invalid JSON body - expected well-formed JSON document"})}if(n.validator(o))return t;let{errors:a}=n.validator;if(!a)throw new T("Invalid state - validator error object is undefined even though validation failed.");let u=a.map(c=>c.instancePath===void 0||c.instancePath===""?"Body "+c.message:c.instancePath.replace("/","")+" "+c.message);return R.badRequest(t,e,{detail:"Incoming body did not pass schema validation",errors:u})},"ValidateJsonSchemaInbound");var In=class{static{s(this,"ServiceProviderImpl")}services=new Map;addService(e,n){if(this.services.get(e))throw new T(`A service with the name ${e} already exists -- you cannot have duplicate services`);this.services.set(e,n)}getService(e){return this.services.get(e)}};var ao=["sha-1","sha-256","sha-384","sha-512"],En=class{static{s(this,"BaseCryptoBeta")}};var xn=class extends En{static{s(this,"WorkerCryptoBeta")}async digest(e,n){if(!ao.includes(e.toLowerCase()))throw new I(`Algorithm ${e} is not supported. Try using ${ao.join(", ")}`);let r=new TextEncoder().encode(n),o=await crypto.subtle.digest(e,r);return Array.from(new Uint8Array(o)).map(u=>u.toString(16).padStart(2,"0")).join("")}};var vn=class{constructor(e){this.context=e}static{s(this,"BaseKeyValueStore")}};var Sn=class extends vn{static{s(this,"WorkerKeyValueStore")}#e;constructor(e){super(e);let r=globalThis.ZUPLO_KV;if(!r)throw new ht("The Key Value Store feature is not enabled for this project.");this.#e=r}put(e,n,r){if(typeof e!="string")throw new g("value must be of type string");return this.#e.put(e,n,r?{expirationTtl:r.expirationSecondsTtl}:void 0)}get(e,n){return this.#e.get(e,{type:"text",cacheTtl:n?.cacheSecondsTtl})}delete(e){return this.#e.delete(e)}};
 /*! For license information please see index.minified.js.LEGAL.txt */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/runtime",
-  "version": "5.1785.0",
+  "version": "5.1786.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {