wcz-layout 6.7.2 → 7.6.1

package/dist/middleware.js

@@ -0,0 +1,1051 @@
+import { h as e, i as t, u as n } from "./utils-C4oJ0tr5.js";
+import { z as r } from "zod";
+import { createMiddleware as i } from "@tanstack/react-start";
+//#region node_modules/jose/dist/webapi/lib/buffer_utils.js
+var a = new TextEncoder(), o = new TextDecoder();
+function s(...e) {
+	let t = e.reduce((e, { length: t }) => e + t, 0), n = new Uint8Array(t), r = 0;
+	for (let t of e) n.set(t, r), r += t.length;
+	return n;
+}
+function c(e) {
+	let t = new Uint8Array(e.length);
+	for (let n = 0; n < e.length; n++) {
+		let r = e.charCodeAt(n);
+		if (r > 127) throw TypeError("non-ASCII string encountered in encode()");
+		t[n] = r;
+	}
+	return t;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/base64.js
+function l(e) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(e);
+	let t = atob(e), n = new Uint8Array(t.length);
+	for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
+	return n;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/util/base64url.js
+function u(e) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof e == "string" ? e : o.decode(e), { alphabet: "base64url" });
+	let t = e;
+	t instanceof Uint8Array && (t = o.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/");
+	try {
+		return l(t);
+	} catch {
+		throw TypeError("The input to be decoded is not correctly encoded.");
+	}
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/crypto_key.js
+var d = (e, t = "algorithm.name") => /* @__PURE__ */ TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`), f = (e, t) => e.name === t;
+function p(e) {
+	return parseInt(e.name.slice(4), 10);
+}
+function m(e, t) {
+	if (p(e.hash) !== t) throw d(`SHA-${t}`, "algorithm.hash");
+}
+function h(e) {
+	switch (e) {
+		case "ES256": return "P-256";
+		case "ES384": return "P-384";
+		case "ES512": return "P-521";
+		default: throw Error("unreachable");
+	}
+}
+function g(e, t) {
+	if (t && !e.usages.includes(t)) throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`);
+}
+function _(e, t, n) {
+	switch (t) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+			if (!f(e.algorithm, "HMAC")) throw d("HMAC");
+			m(e.algorithm, parseInt(t.slice(2), 10));
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			if (!f(e.algorithm, "RSASSA-PKCS1-v1_5")) throw d("RSASSA-PKCS1-v1_5");
+			m(e.algorithm, parseInt(t.slice(2), 10));
+			break;
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			if (!f(e.algorithm, "RSA-PSS")) throw d("RSA-PSS");
+			m(e.algorithm, parseInt(t.slice(2), 10));
+			break;
+		case "Ed25519":
+		case "EdDSA":
+			if (!f(e.algorithm, "Ed25519")) throw d("Ed25519");
+			break;
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87":
+			if (!f(e.algorithm, t)) throw d(t);
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			if (!f(e.algorithm, "ECDSA")) throw d("ECDSA");
+			let n = h(t);
+			if (e.algorithm.namedCurve !== n) throw d(n, "algorithm.namedCurve");
+			break;
+		}
+		default: throw TypeError("CryptoKey does not support this operation");
+	}
+	g(e, n);
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/invalid_key_input.js
+function v(e, t, ...n) {
+	if (n = n.filter(Boolean), n.length > 2) {
+		let t = n.pop();
+		e += `one of type ${n.join(", ")}, or ${t}.`;
+	} else n.length === 2 ? e += `one of type ${n[0]} or ${n[1]}.` : e += `of type ${n[0]}.`;
+	return t == null ? e += ` Received ${t}` : typeof t == "function" && t.name ? e += ` Received function ${t.name}` : typeof t == "object" && t && t.constructor?.name && (e += ` Received an instance of ${t.constructor.name}`), e;
+}
+var y = (e, ...t) => v("Key must be ", e, ...t), b = (e, t, ...n) => v(`Key for the ${e} algorithm must be `, t, ...n), x = class extends Error {
+	static code = "ERR_JOSE_GENERIC";
+	code = "ERR_JOSE_GENERIC";
+	constructor(e, t) {
+		super(e, t), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+	}
+}, S = class extends x {
+	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	claim;
+	reason;
+	payload;
+	constructor(e, t, n = "unspecified", r = "unspecified") {
+		super(e, { cause: {
+			claim: n,
+			reason: r,
+			payload: t
+		} }), this.claim = n, this.reason = r, this.payload = t;
+	}
+}, C = class extends x {
+	static code = "ERR_JWT_EXPIRED";
+	code = "ERR_JWT_EXPIRED";
+	claim;
+	reason;
+	payload;
+	constructor(e, t, n = "unspecified", r = "unspecified") {
+		super(e, { cause: {
+			claim: n,
+			reason: r,
+			payload: t
+		} }), this.claim = n, this.reason = r, this.payload = t;
+	}
+}, ee = class extends x {
+	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+	code = "ERR_JOSE_ALG_NOT_ALLOWED";
+}, w = class extends x {
+	static code = "ERR_JOSE_NOT_SUPPORTED";
+	code = "ERR_JOSE_NOT_SUPPORTED";
+}, T = class extends x {
+	static code = "ERR_JWS_INVALID";
+	code = "ERR_JWS_INVALID";
+}, E = class extends x {
+	static code = "ERR_JWT_INVALID";
+	code = "ERR_JWT_INVALID";
+}, D = class extends x {
+	static code = "ERR_JWKS_INVALID";
+	code = "ERR_JWKS_INVALID";
+}, O = class extends x {
+	static code = "ERR_JWKS_NO_MATCHING_KEY";
+	code = "ERR_JWKS_NO_MATCHING_KEY";
+	constructor(e = "no applicable key found in the JSON Web Key Set", t) {
+		super(e, t);
+	}
+}, te = class extends x {
+	[Symbol.asyncIterator];
+	static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	constructor(e = "multiple matching keys found in the JSON Web Key Set", t) {
+		super(e, t);
+	}
+}, ne = class extends x {
+	static code = "ERR_JWKS_TIMEOUT";
+	code = "ERR_JWKS_TIMEOUT";
+	constructor(e = "request timed out", t) {
+		super(e, t);
+	}
+}, re = class extends x {
+	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	constructor(e = "signature verification failed", t) {
+		super(e, t);
+	}
+}, k = (e) => {
+	if (e?.[Symbol.toStringTag] === "CryptoKey") return !0;
+	try {
+		return e instanceof CryptoKey;
+	} catch {
+		return !1;
+	}
+}, A = (e) => e?.[Symbol.toStringTag] === "KeyObject", j = (e) => k(e) || A(e);
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/helpers.js
+function M(e, t, n) {
+	try {
+		return u(e);
+	} catch {
+		throw new n(`Failed to base64url decode the ${t}`);
+	}
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/type_checks.js
+var ie = (e) => typeof e == "object" && !!e;
+function N(e) {
+	if (!ie(e) || Object.prototype.toString.call(e) !== "[object Object]") return !1;
+	if (Object.getPrototypeOf(e) === null) return !0;
+	let t = e;
+	for (; Object.getPrototypeOf(t) !== null;) t = Object.getPrototypeOf(t);
+	return Object.getPrototypeOf(e) === t;
+}
+function ae(...e) {
+	let t = e.filter(Boolean);
+	if (t.length === 0 || t.length === 1) return !0;
+	let n;
+	for (let e of t) {
+		let t = Object.keys(e);
+		if (!n || n.size === 0) {
+			n = new Set(t);
+			continue;
+		}
+		for (let e of t) {
+			if (n.has(e)) return !1;
+			n.add(e);
+		}
+	}
+	return !0;
+}
+var P = (e) => N(e) && typeof e.kty == "string", oe = (e) => e.kty !== "oct" && (e.kty === "AKP" && typeof e.priv == "string" || typeof e.d == "string"), se = (e) => e.kty !== "oct" && e.d === void 0 && e.priv === void 0, ce = (e) => e.kty === "oct" && typeof e.k == "string";
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/signing.js
+function le(e, t) {
+	if (e.startsWith("RS") || e.startsWith("PS")) {
+		let { modulusLength: n } = t.algorithm;
+		if (typeof n != "number" || n < 2048) throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`);
+	}
+}
+function ue(e, t) {
+	let n = `SHA-${e.slice(-3)}`;
+	switch (e) {
+		case "HS256":
+		case "HS384":
+		case "HS512": return {
+			hash: n,
+			name: "HMAC"
+		};
+		case "PS256":
+		case "PS384":
+		case "PS512": return {
+			hash: n,
+			name: "RSA-PSS",
+			saltLength: parseInt(e.slice(-3), 10) >> 3
+		};
+		case "RS256":
+		case "RS384":
+		case "RS512": return {
+			hash: n,
+			name: "RSASSA-PKCS1-v1_5"
+		};
+		case "ES256":
+		case "ES384":
+		case "ES512": return {
+			hash: n,
+			name: "ECDSA",
+			namedCurve: t.namedCurve
+		};
+		case "Ed25519":
+		case "EdDSA": return { name: "Ed25519" };
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87": return { name: e };
+		default: throw new w(`alg ${e} is not supported either by JOSE or your javascript runtime`);
+	}
+}
+async function de(e, t, n) {
+	if (t instanceof Uint8Array) {
+		if (!e.startsWith("HS")) throw TypeError(y(t, "CryptoKey", "KeyObject", "JSON Web Key"));
+		return crypto.subtle.importKey("raw", t, {
+			hash: `SHA-${e.slice(-3)}`,
+			name: "HMAC"
+		}, !1, [n]);
+	}
+	return _(t, e, n), t;
+}
+async function fe(e, t, n, r) {
+	let i = await de(e, t, "verify");
+	le(e, i);
+	let a = ue(e, i.algorithm);
+	try {
+		return await crypto.subtle.verify(a, i, n, r);
+	} catch {
+		return !1;
+	}
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/jwk_to_key.js
+var F = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
+function pe(e) {
+	let t, n;
+	switch (e.kty) {
+		case "AKP":
+			switch (e.alg) {
+				case "ML-DSA-44":
+				case "ML-DSA-65":
+				case "ML-DSA-87":
+					t = { name: e.alg }, n = e.priv ? ["sign"] : ["verify"];
+					break;
+				default: throw new w(F);
+			}
+			break;
+		case "RSA":
+			switch (e.alg) {
+				case "PS256":
+				case "PS384":
+				case "PS512":
+					t = {
+						name: "RSA-PSS",
+						hash: `SHA-${e.alg.slice(-3)}`
+					}, n = e.d ? ["sign"] : ["verify"];
+					break;
+				case "RS256":
+				case "RS384":
+				case "RS512":
+					t = {
+						name: "RSASSA-PKCS1-v1_5",
+						hash: `SHA-${e.alg.slice(-3)}`
+					}, n = e.d ? ["sign"] : ["verify"];
+					break;
+				case "RSA-OAEP":
+				case "RSA-OAEP-256":
+				case "RSA-OAEP-384":
+				case "RSA-OAEP-512":
+					t = {
+						name: "RSA-OAEP",
+						hash: `SHA-${parseInt(e.alg.slice(-3), 10) || 1}`
+					}, n = e.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					break;
+				default: throw new w(F);
+			}
+			break;
+		case "EC":
+			switch (e.alg) {
+				case "ES256":
+				case "ES384":
+				case "ES512":
+					t = {
+						name: "ECDSA",
+						namedCurve: {
+							ES256: "P-256",
+							ES384: "P-384",
+							ES512: "P-521"
+						}[e.alg]
+					}, n = e.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					t = {
+						name: "ECDH",
+						namedCurve: e.crv
+					}, n = e.d ? ["deriveBits"] : [];
+					break;
+				default: throw new w(F);
+			}
+			break;
+		case "OKP":
+			switch (e.alg) {
+				case "Ed25519":
+				case "EdDSA":
+					t = { name: "Ed25519" }, n = e.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					t = { name: e.crv }, n = e.d ? ["deriveBits"] : [];
+					break;
+				default: throw new w(F);
+			}
+			break;
+		default: throw new w("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+	}
+	return {
+		algorithm: t,
+		keyUsages: n
+	};
+}
+async function I(e) {
+	if (!e.alg) throw TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	let { algorithm: t, keyUsages: n } = pe(e), r = { ...e };
+	return r.kty !== "AKP" && delete r.alg, delete r.use, crypto.subtle.importKey("jwk", r, t, e.ext ?? !(e.d || e.priv), e.key_ops ?? n);
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/normalize_key.js
+var L = "given KeyObject instance cannot be used for this algorithm", R, z = async (e, t, n, r = !1) => {
+	R ||= /* @__PURE__ */ new WeakMap();
+	let i = R.get(e);
+	if (i?.[n]) return i[n];
+	let a = await I({
+		...t,
+		alg: n
+	});
+	return r && Object.freeze(e), i ? i[n] = a : R.set(e, { [n]: a }), a;
+}, me = (e, t) => {
+	R ||= /* @__PURE__ */ new WeakMap();
+	let n = R.get(e);
+	if (n?.[t]) return n[t];
+	let r = e.type === "public", i = !!r, a;
+	if (e.asymmetricKeyType === "x25519") {
+		switch (t) {
+			case "ECDH-ES":
+			case "ECDH-ES+A128KW":
+			case "ECDH-ES+A192KW":
+			case "ECDH-ES+A256KW": break;
+			default: throw TypeError(L);
+		}
+		a = e.toCryptoKey(e.asymmetricKeyType, i, r ? [] : ["deriveBits"]);
+	}
+	if (e.asymmetricKeyType === "ed25519") {
+		if (t !== "EdDSA" && t !== "Ed25519") throw TypeError(L);
+		a = e.toCryptoKey(e.asymmetricKeyType, i, [r ? "verify" : "sign"]);
+	}
+	switch (e.asymmetricKeyType) {
+		case "ml-dsa-44":
+		case "ml-dsa-65":
+		case "ml-dsa-87":
+			if (t !== e.asymmetricKeyType.toUpperCase()) throw TypeError(L);
+			a = e.toCryptoKey(e.asymmetricKeyType, i, [r ? "verify" : "sign"]);
+	}
+	if (e.asymmetricKeyType === "rsa") {
+		let n;
+		switch (t) {
+			case "RSA-OAEP":
+				n = "SHA-1";
+				break;
+			case "RS256":
+			case "PS256":
+			case "RSA-OAEP-256":
+				n = "SHA-256";
+				break;
+			case "RS384":
+			case "PS384":
+			case "RSA-OAEP-384":
+				n = "SHA-384";
+				break;
+			case "RS512":
+			case "PS512":
+			case "RSA-OAEP-512":
+				n = "SHA-512";
+				break;
+			default: throw TypeError(L);
+		}
+		if (t.startsWith("RSA-OAEP")) return e.toCryptoKey({
+			name: "RSA-OAEP",
+			hash: n
+		}, i, r ? ["encrypt"] : ["decrypt"]);
+		a = e.toCryptoKey({
+			name: t.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+			hash: n
+		}, i, [r ? "verify" : "sign"]);
+	}
+	if (e.asymmetricKeyType === "ec") {
+		let n = new Map([
+			["prime256v1", "P-256"],
+			["secp384r1", "P-384"],
+			["secp521r1", "P-521"]
+		]).get(e.asymmetricKeyDetails?.namedCurve);
+		if (!n) throw TypeError(L);
+		let o = {
+			ES256: "P-256",
+			ES384: "P-384",
+			ES512: "P-521"
+		};
+		o[t] && n === o[t] && (a = e.toCryptoKey({
+			name: "ECDSA",
+			namedCurve: n
+		}, i, [r ? "verify" : "sign"])), t.startsWith("ECDH-ES") && (a = e.toCryptoKey({
+			name: "ECDH",
+			namedCurve: n
+		}, i, r ? [] : ["deriveBits"]));
+	}
+	if (!a) throw TypeError(L);
+	return n ? n[t] = a : R.set(e, { [t]: a }), a;
+};
+async function he(e, t) {
+	if (e instanceof Uint8Array || k(e)) return e;
+	if (A(e)) {
+		if (e.type === "secret") return e.export();
+		if ("toCryptoKey" in e && typeof e.toCryptoKey == "function") try {
+			return me(e, t);
+		} catch (e) {
+			if (e instanceof TypeError) throw e;
+		}
+		return z(e, e.export({ format: "jwk" }), t);
+	}
+	if (P(e)) return e.k ? u(e.k) : z(e, e, t, !0);
+	throw Error("unreachable");
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/key/import.js
+async function ge(e, t, n) {
+	if (!N(e)) throw TypeError("JWK must be an object");
+	let r;
+	switch (t ??= e.alg, r ??= n?.extractable ?? e.ext, e.kty) {
+		case "oct":
+			if (typeof e.k != "string" || !e.k) throw TypeError("missing \"k\" (Key Value) Parameter value");
+			return u(e.k);
+		case "RSA":
+			if ("oth" in e && e.oth !== void 0) throw new w("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
+			return I({
+				...e,
+				alg: t,
+				ext: r
+			});
+		case "AKP":
+			if (typeof e.alg != "string" || !e.alg) throw TypeError("missing \"alg\" (Algorithm) Parameter value");
+			if (t !== void 0 && t !== e.alg) throw TypeError("JWK alg and alg option value mismatch");
+			return I({
+				...e,
+				ext: r
+			});
+		case "EC":
+		case "OKP": return I({
+			...e,
+			alg: t,
+			ext: r
+		});
+		default: throw new w("Unsupported \"kty\" (Key Type) Parameter value");
+	}
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/validate_crit.js
+function _e(e, t, n, r, i) {
+	if (i.crit !== void 0 && r?.crit === void 0) throw new e("\"crit\" (Critical) Header Parameter MUST be integrity protected");
+	if (!r || r.crit === void 0) return /* @__PURE__ */ new Set();
+	if (!Array.isArray(r.crit) || r.crit.length === 0 || r.crit.some((e) => typeof e != "string" || e.length === 0)) throw new e("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	let a;
+	a = n === void 0 ? t : new Map([...Object.entries(n), ...t.entries()]);
+	for (let t of r.crit) {
+		if (!a.has(t)) throw new w(`Extension Header Parameter "${t}" is not recognized`);
+		if (i[t] === void 0) throw new e(`Extension Header Parameter "${t}" is missing`);
+		if (a.get(t) && r[t] === void 0) throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`);
+	}
+	return new Set(r.crit);
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/validate_algorithms.js
+function ve(e, t) {
+	if (t !== void 0 && (!Array.isArray(t) || t.some((e) => typeof e != "string"))) throw TypeError(`"${e}" option must be an array of strings`);
+	if (t) return new Set(t);
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/check_key_type.js
+var B = (e) => e?.[Symbol.toStringTag], V = (e, t, n) => {
+	if (t.use !== void 0) {
+		let e;
+		switch (n) {
+			case "sign":
+			case "verify":
+				e = "sig";
+				break;
+			case "encrypt":
+			case "decrypt":
+				e = "enc";
+				break;
+		}
+		if (t.use !== e) throw TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`);
+	}
+	if (t.alg !== void 0 && t.alg !== e) throw TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);
+	if (Array.isArray(t.key_ops)) {
+		let r;
+		switch (!0) {
+			case n === "sign" || n === "verify":
+			case e === "dir":
+			case e.includes("CBC-HS"):
+				r = n;
+				break;
+			case e.startsWith("PBES2"):
+				r = "deriveBits";
+				break;
+			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):
+				r = !e.includes("GCM") && e.endsWith("KW") ? n === "encrypt" ? "wrapKey" : "unwrapKey" : n;
+				break;
+			case n === "encrypt" && e.startsWith("RSA"):
+				r = "wrapKey";
+				break;
+			case n === "decrypt":
+				r = e.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+				break;
+		}
+		if (r && t.key_ops?.includes?.(r) === !1) throw TypeError(`Invalid key for this operation, its "key_ops" must include "${r}" when present`);
+	}
+	return !0;
+}, ye = (e, t, n) => {
+	if (!(t instanceof Uint8Array)) {
+		if (P(t)) {
+			if (ce(t) && V(e, t, n)) return;
+			throw TypeError("JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present");
+		}
+		if (!j(t)) throw TypeError(b(e, t, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+		if (t.type !== "secret") throw TypeError(`${B(t)} instances for symmetric algorithms must be of type "secret"`);
+	}
+}, be = (e, t, n) => {
+	if (P(t)) switch (n) {
+		case "decrypt":
+		case "sign":
+			if (oe(t) && V(e, t, n)) return;
+			throw TypeError("JSON Web Key for this operation must be a private JWK");
+		case "encrypt":
+		case "verify":
+			if (se(t) && V(e, t, n)) return;
+			throw TypeError("JSON Web Key for this operation must be a public JWK");
+	}
+	if (!j(t)) throw TypeError(b(e, t, "CryptoKey", "KeyObject", "JSON Web Key"));
+	if (t.type === "secret") throw TypeError(`${B(t)} instances for asymmetric algorithms must not be of type "secret"`);
+	if (t.type === "public") switch (n) {
+		case "sign": throw TypeError(`${B(t)} instances for asymmetric algorithm signing must be of type "private"`);
+		case "decrypt": throw TypeError(`${B(t)} instances for asymmetric algorithm decryption must be of type "private"`);
+	}
+	if (t.type === "private") switch (n) {
+		case "verify": throw TypeError(`${B(t)} instances for asymmetric algorithm verifying must be of type "public"`);
+		case "encrypt": throw TypeError(`${B(t)} instances for asymmetric algorithm encryption must be of type "public"`);
+	}
+};
+function xe(e, t, n) {
+	switch (e.substring(0, 2)) {
+		case "A1":
+		case "A2":
+		case "di":
+		case "HS":
+		case "PB":
+			ye(e, t, n);
+			break;
+		default: be(e, t, n);
+	}
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/jws/flattened/verify.js
+async function Se(e, t, n) {
+	if (!N(e)) throw new T("Flattened JWS must be an object");
+	if (e.protected === void 0 && e.header === void 0) throw new T("Flattened JWS must have either of the \"protected\" or \"header\" members");
+	if (e.protected !== void 0 && typeof e.protected != "string") throw new T("JWS Protected Header incorrect type");
+	if (e.payload === void 0) throw new T("JWS Payload missing");
+	if (typeof e.signature != "string") throw new T("JWS Signature missing or incorrect type");
+	if (e.header !== void 0 && !N(e.header)) throw new T("JWS Unprotected Header incorrect type");
+	let r = {};
+	if (e.protected) try {
+		let t = u(e.protected);
+		r = JSON.parse(o.decode(t));
+	} catch {
+		throw new T("JWS Protected Header is invalid");
+	}
+	if (!ae(r, e.header)) throw new T("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+	let i = {
+		...r,
+		...e.header
+	}, l = _e(T, new Map([["b64", !0]]), n?.crit, r, i), d = !0;
+	if (l.has("b64") && (d = r.b64, typeof d != "boolean")) throw new T("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+	let { alg: f } = i;
+	if (typeof f != "string" || !f) throw new T("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	let p = n && ve("algorithms", n.algorithms);
+	if (p && !p.has(f)) throw new ee("\"alg\" (Algorithm) Header Parameter value not allowed");
+	if (d) {
+		if (typeof e.payload != "string") throw new T("JWS Payload must be a string");
+	} else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array)) throw new T("JWS Payload must be a string or an Uint8Array instance");
+	let m = !1;
+	typeof t == "function" && (t = await t(r, e), m = !0), xe(f, t, "verify");
+	let h = s(e.protected === void 0 ? new Uint8Array() : c(e.protected), c("."), typeof e.payload == "string" ? d ? c(e.payload) : a.encode(e.payload) : e.payload), g = M(e.signature, "signature", T), _ = await he(t, f);
+	if (!await fe(f, _, g, h)) throw new re();
+	let v;
+	v = d ? M(e.payload, "payload", T) : typeof e.payload == "string" ? a.encode(e.payload) : e.payload;
+	let y = { payload: v };
+	return e.protected !== void 0 && (y.protectedHeader = r), e.header !== void 0 && (y.unprotectedHeader = e.header), m ? {
+		...y,
+		key: _
+	} : y;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/jws/compact/verify.js
+async function Ce(e, t, n) {
+	if (e instanceof Uint8Array && (e = o.decode(e)), typeof e != "string") throw new T("Compact JWS must be a string or Uint8Array");
+	let { 0: r, 1: i, 2: a, length: s } = e.split(".");
+	if (s !== 3) throw new T("Invalid Compact JWS");
+	let c = await Se({
+		payload: i,
+		protected: r,
+		signature: a
+	}, t, n), l = {
+		payload: c.payload,
+		protectedHeader: c.protectedHeader
+	};
+	return typeof t == "function" ? {
+		...l,
+		key: c.key
+	} : l;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var we = (e) => Math.floor(e.getTime() / 1e3), H = 60, U = H * 60, W = U * 24, Te = W * 7, Ee = W * 365.25, De = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function G(e) {
+	let t = De.exec(e);
+	if (!t || t[4] && t[1]) throw TypeError("Invalid time period format");
+	let n = parseFloat(t[2]), r = t[3].toLowerCase(), i;
+	switch (r) {
+		case "sec":
+		case "secs":
+		case "second":
+		case "seconds":
+		case "s":
+			i = Math.round(n);
+			break;
+		case "minute":
+		case "minutes":
+		case "min":
+		case "mins":
+		case "m":
+			i = Math.round(n * H);
+			break;
+		case "hour":
+		case "hours":
+		case "hr":
+		case "hrs":
+		case "h":
+			i = Math.round(n * U);
+			break;
+		case "day":
+		case "days":
+		case "d":
+			i = Math.round(n * W);
+			break;
+		case "week":
+		case "weeks":
+		case "w":
+			i = Math.round(n * Te);
+			break;
+		default:
+			i = Math.round(n * Ee);
+			break;
+	}
+	return t[1] === "-" || t[4] === "ago" ? -i : i;
+}
+var K = (e) => e.includes("/") ? e.toLowerCase() : `application/${e.toLowerCase()}`, Oe = (e, t) => typeof e == "string" ? t.includes(e) : Array.isArray(e) ? t.some(Set.prototype.has.bind(new Set(e))) : !1;
+function ke(e, t, n = {}) {
+	let r;
+	try {
+		r = JSON.parse(o.decode(t));
+	} catch {}
+	if (!N(r)) throw new E("JWT Claims Set must be a top-level JSON object");
+	let { typ: i } = n;
+	if (i && (typeof e.typ != "string" || K(e.typ) !== K(i))) throw new S("unexpected \"typ\" JWT header value", r, "typ", "check_failed");
+	let { requiredClaims: a = [], issuer: s, subject: c, audience: l, maxTokenAge: u } = n, d = [...a];
+	u !== void 0 && d.push("iat"), l !== void 0 && d.push("aud"), c !== void 0 && d.push("sub"), s !== void 0 && d.push("iss");
+	for (let e of new Set(d.reverse())) if (!(e in r)) throw new S(`missing required "${e}" claim`, r, e, "missing");
+	if (s && !(Array.isArray(s) ? s : [s]).includes(r.iss)) throw new S("unexpected \"iss\" claim value", r, "iss", "check_failed");
+	if (c && r.sub !== c) throw new S("unexpected \"sub\" claim value", r, "sub", "check_failed");
+	if (l && !Oe(r.aud, typeof l == "string" ? [l] : l)) throw new S("unexpected \"aud\" claim value", r, "aud", "check_failed");
+	let f;
+	switch (typeof n.clockTolerance) {
+		case "string":
+			f = G(n.clockTolerance);
+			break;
+		case "number":
+			f = n.clockTolerance;
+			break;
+		case "undefined":
+			f = 0;
+			break;
+		default: throw TypeError("Invalid clockTolerance option type");
+	}
+	let { currentDate: p } = n, m = we(p || /* @__PURE__ */ new Date());
+	if ((r.iat !== void 0 || u) && typeof r.iat != "number") throw new S("\"iat\" claim must be a number", r, "iat", "invalid");
+	if (r.nbf !== void 0) {
+		if (typeof r.nbf != "number") throw new S("\"nbf\" claim must be a number", r, "nbf", "invalid");
+		if (r.nbf > m + f) throw new S("\"nbf\" claim timestamp check failed", r, "nbf", "check_failed");
+	}
+	if (r.exp !== void 0) {
+		if (typeof r.exp != "number") throw new S("\"exp\" claim must be a number", r, "exp", "invalid");
+		if (r.exp <= m - f) throw new C("\"exp\" claim timestamp check failed", r, "exp", "check_failed");
+	}
+	if (u) {
+		let e = m - r.iat, t = typeof u == "number" ? u : G(u);
+		if (e - f > t) throw new C("\"iat\" claim timestamp check failed (too far in the past)", r, "iat", "check_failed");
+		if (e < 0 - f) throw new S("\"iat\" claim timestamp check failed (it should be in the past)", r, "iat", "check_failed");
+	}
+	return r;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/jwt/verify.js
+async function Ae(e, t, n) {
+	let r = await Ce(e, t, n);
+	if (r.protectedHeader.crit?.includes("b64") && r.protectedHeader.b64 === !1) throw new E("JWTs MUST NOT use unencoded payload");
+	let i = {
+		payload: ke(r.protectedHeader, r.payload, n),
+		protectedHeader: r.protectedHeader
+	};
+	return typeof t == "function" ? {
+		...i,
+		key: r.key
+	} : i;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/jwks/local.js
+function je(e) {
+	switch (typeof e == "string" && e.slice(0, 2)) {
+		case "RS":
+		case "PS": return "RSA";
+		case "ES": return "EC";
+		case "Ed": return "OKP";
+		case "ML": return "AKP";
+		default: throw new w("Unsupported \"alg\" value for a JSON Web Key Set");
+	}
+}
+function Me(e) {
+	return e && typeof e == "object" && Array.isArray(e.keys) && e.keys.every(Ne);
+}
+function Ne(e) {
+	return N(e);
+}
+var Pe = class {
+	#e;
+	#t = /* @__PURE__ */ new WeakMap();
+	constructor(e) {
+		if (!Me(e)) throw new D("JSON Web Key Set malformed");
+		this.#e = structuredClone(e);
+	}
+	jwks() {
+		return this.#e;
+	}
+	async getKey(e, t) {
+		let { alg: n, kid: r } = {
+			...e,
+			...t?.header
+		}, i = je(n), a = this.#e.keys.filter((e) => {
+			let t = i === e.kty;
+			if (t && typeof r == "string" && (t = r === e.kid), t && (typeof e.alg == "string" || i === "AKP") && (t = n === e.alg), t && typeof e.use == "string" && (t = e.use === "sig"), t && Array.isArray(e.key_ops) && (t = e.key_ops.includes("verify")), t) switch (n) {
+				case "ES256":
+					t = e.crv === "P-256";
+					break;
+				case "ES384":
+					t = e.crv === "P-384";
+					break;
+				case "ES512":
+					t = e.crv === "P-521";
+					break;
+				case "Ed25519":
+				case "EdDSA":
+					t = e.crv === "Ed25519";
+					break;
+			}
+			return t;
+		}), { 0: o, length: s } = a;
+		if (s === 0) throw new O();
+		if (s !== 1) {
+			let e = new te(), t = this.#t;
+			throw e[Symbol.asyncIterator] = async function* () {
+				for (let e of a) try {
+					yield await q(t, e, n);
+				} catch {}
+			}, e;
+		}
+		return q(this.#t, o, n);
+	}
+};
+async function q(e, t, n) {
+	let r = e.get(t) || e.set(t, {}).get(t);
+	if (r[n] === void 0) {
+		let e = await ge({
+			...t,
+			ext: !0
+		}, n);
+		if (e instanceof Uint8Array || e.type !== "public") throw new D("JSON Web Key Set members must be public keys");
+		r[n] = e;
+	}
+	return r[n];
+}
+function J(e) {
+	let t = new Pe(e), n = async (e, n) => t.getKey(e, n);
+	return Object.defineProperties(n, { jwks: {
+		value: () => structuredClone(t.jwks()),
+		enumerable: !1,
+		configurable: !1,
+		writable: !1
+	} }), n;
+}
+//#endregion
+//#region node_modules/jose/dist/webapi/jwks/remote.js
+function Fe() {
+	return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+var Y;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (Y = "jose/v6.2.2");
+var Ie = Symbol();
+async function Le(e, t, n, r = fetch) {
+	let i = await r(e, {
+		method: "GET",
+		signal: n,
+		redirect: "manual",
+		headers: t
+	}).catch((e) => {
+		throw e.name === "TimeoutError" ? new ne() : e;
+	});
+	if (i.status !== 200) throw new x("Expected 200 OK from the JSON Web Key Set HTTP response");
+	try {
+		return await i.json();
+	} catch {
+		throw new x("Failed to parse the JSON Web Key Set HTTP response as JSON");
+	}
+}
+var X = Symbol();
+function Re(e, t) {
+	return !(typeof e != "object" || !e || !("uat" in e) || typeof e.uat != "number" || Date.now() - e.uat >= t || !("jwks" in e) || !N(e.jwks) || !Array.isArray(e.jwks.keys) || !Array.prototype.every.call(e.jwks.keys, N));
+}
+var ze = class {
+	#e;
+	#t;
+	#n;
+	#r;
+	#i;
+	#a;
+	#o;
+	#s;
+	#c;
+	#l;
+	constructor(e, t) {
+		if (!(e instanceof URL)) throw TypeError("url must be an instance of URL");
+		this.#e = new URL(e.href), this.#t = typeof t?.timeoutDuration == "number" ? t?.timeoutDuration : 5e3, this.#n = typeof t?.cooldownDuration == "number" ? t?.cooldownDuration : 3e4, this.#r = typeof t?.cacheMaxAge == "number" ? t?.cacheMaxAge : 6e5, this.#o = new Headers(t?.headers), Y && !this.#o.has("User-Agent") && this.#o.set("User-Agent", Y), this.#o.has("accept") || (this.#o.set("accept", "application/json"), this.#o.append("accept", "application/jwk-set+json")), this.#s = t?.[Ie], t?.[X] !== void 0 && (this.#l = t?.[X], Re(t?.[X], this.#r) && (this.#i = this.#l.uat, this.#c = J(this.#l.jwks)));
+	}
+	pendingFetch() {
+		return !!this.#a;
+	}
+	coolingDown() {
+		return typeof this.#i == "number" ? Date.now() < this.#i + this.#n : !1;
+	}
+	fresh() {
+		return typeof this.#i == "number" ? Date.now() < this.#i + this.#r : !1;
+	}
+	jwks() {
+		return this.#c?.jwks();
+	}
+	async getKey(e, t) {
+		(!this.#c || !this.fresh()) && await this.reload();
+		try {
+			return await this.#c(e, t);
+		} catch (n) {
+			if (n instanceof O && this.coolingDown() === !1) return await this.reload(), this.#c(e, t);
+			throw n;
+		}
+	}
+	async reload() {
+		this.#a && Fe() && (this.#a = void 0), this.#a ||= Le(this.#e.href, this.#o, AbortSignal.timeout(this.#t), this.#s).then((e) => {
+			this.#c = J(e), this.#l && (this.#l.uat = Date.now(), this.#l.jwks = e), this.#i = Date.now(), this.#a = void 0;
+		}).catch((e) => {
+			throw this.#a = void 0, e;
+		}), await this.#a;
+	}
+};
+function Be(e, t) {
+	let n = new ze(e, t), r = async (e, t) => n.getKey(e, t);
+	return Object.defineProperties(r, {
+		coolingDown: {
+			get: () => n.coolingDown(),
+			enumerable: !0,
+			configurable: !1
+		},
+		fresh: {
+			get: () => n.fresh(),
+			enumerable: !0,
+			configurable: !1
+		},
+		reload: {
+			value: () => n.reload(),
+			enumerable: !0,
+			configurable: !1,
+			writable: !1
+		},
+		reloading: {
+			get: () => n.pendingFetch(),
+			enumerable: !0,
+			configurable: !1
+		},
+		jwks: {
+			value: () => n.jwks(),
+			enumerable: !0,
+			configurable: !1,
+			writable: !1
+		}
+	}), r;
+}
+//#endregion
+//#region src/middleware/authMiddleware.ts
+var Ve = i().server(async ({ next: e, request: n }) => {
+	let r = n.headers.get("Authorization");
+	if (!r?.startsWith("Bearer")) throw Response.json({ message: "Unauthorized: Invalid Authorization header" }, { status: 401 });
+	let i;
+	try {
+		i = await Q(r.substring(7));
+	} catch (e) {
+		throw Response.json({ message: e instanceof Error ? e.message : "Unauthorized: Invalid access token" }, { status: 401 });
+	}
+	return e({ context: { user: t(i) } });
+}), He = i().server(async ({ next: e, request: n }) => {
+	let r = n.headers.get("Authorization");
+	if (!r?.startsWith("Bearer")) return e({ context: { user: null } });
+	let i;
+	try {
+		i = await Q(r.substring(7));
+	} catch (e) {
+		throw Response.json({ message: e instanceof Error ? e.message : "Unauthorized: Invalid access token" }, { status: 401 });
+	}
+	return e({ context: { user: t(i) } });
+});
+function Z(e) {
+	return e?.optional ? He : Ve;
+}
+var Ue = (e) => i().middleware([Z()]).server(async ({ next: t, context: n }) => {
+	if (n.user.hasPermission(e)) return t();
+	throw Response.json({ message: `Forbidden: User ${n.user.name} is not authorized to access this resource` }, { status: 403 });
+}), We = (e) => i({ type: "function" }).client(async ({ next: t }) => {
+	try {
+		return t({ headers: { Authorization: `Bearer ${await n(e)}` } });
+	} catch {
+		return t();
+	}
+});
+async function Q(t) {
+	let { payload: n } = await Ae(t, Ge(), {
+		issuer: `https://login.microsoftonline.com/${e.ENTRA_TENANT_ID}/v2.0`,
+		audience: e.ENTRA_CLIENT_ID
+	});
+	return n;
+}
+var $ = null;
+function Ge() {
+	return $ ??= Be(new URL(`https://login.microsoftonline.com/${e.ENTRA_TENANT_ID}/discovery/v2.0/keys`)), $;
+}
+//#endregion
+//#region src/middleware/validationMiddleware.ts
+var Ke = (e) => i().server(async ({ next: t, request: n }) => {
+	let i = await n.json(), a = e.safeParse(i);
+	if (!a.success) {
+		let { fieldErrors: e } = r.flattenError(a.error), t = Object.keys(e)[0], n = e[t]?.[0];
+		if (t && n) {
+			let e = t.charAt(0).toUpperCase() + t.slice(1), r = n.replace(/^Invalid input:\s*/i, "").toLowerCase();
+			return Response.json({ message: `${e} - ${r}` }, { status: 400 });
+		}
+		return Response.json({ message: "Validation failed" }, { status: 400 });
+	}
+	return await t({ context: { data: a.data } });
+});
+//#endregion
+export { Z as authenticationMiddleware, Ue as authorizationMiddleware, We as serverFnAccessTokenMiddleware, Ke as validationMiddleware };
+
+//# sourceMappingURL=middleware.js.map