@auth-craft/aws-cf-stack 1.1.1 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/.env.example +24 -0
  2. package/README.md +129 -0
  3. package/assets/gateway/worker.js +1 -1
  4. package/assets/lambda/index.mjs +32 -32
  5. package/lib/common.sh +16 -1
  6. package/lib/deploy-gateway.sh +96 -4
  7. package/package.json +1 -1
  8. package/wrangler/wrangler.toml +5 -0
package/assets/lambda/index.mjs CHANGED
@@ -1,65 +1,65 @@
1
- var QA=Object.create;var Yl=Object.defineProperty;var ZA=Object.getOwnPropertyDescriptor;var eT=Object.getOwnPropertyNames;var tT=Object.getPrototypeOf,rT=Object.prototype.hasOwnProperty;var ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e)=>()=>(t&&(e=t(t=0)),e);var he=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Va=(t,e)=>{for(var r in e)Yl(t,r,{get:e[r],enumerable:!0})},nT=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of eT(e))!rT.call(t,i)&&i!==r&&Yl(t,i,{get:()=>e[i],enumerable:!(n=ZA(e,i))||n.enumerable});return t};var Of=(t,e,r)=>(r=t!=null?QA(tT(t)):{},nT(e||!t||!t.__esModule?Yl(r,"default",{value:t,enumerable:!0}):r,t));function rt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function ru(t,e,r){if(e<0||e>=Ga)throw new RangeError(`value must be >= 0 and <= ${Ga-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function nu(t){let e=Math.floor(t/Ga),r=t%Ga,n=new Uint8Array(8);return ru(n,e,0),ru(n,r,4),n}function $a(t){let e=new Uint8Array(4);return ru(e,t),e}function ze(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var Yn,ct,Ga,Tt=Q(()=>{Yn=new TextEncoder,ct=new TextDecoder,Ga=2**32});function Zs(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function Wa(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var iu=Q(()=>{});var za={};Va(za,{decode:()=>dt,encode:()=>De});function dt(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:ct.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=ct.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return Wa(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function De(t){let e=t;return typeof e=="string"&&(e=Yn.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Zs(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var pt=Q(()=>{Tt();iu()});function aT(t){return parseInt(t.name.slice(4),10)}function Ja(t,e){if(aT(t.hash)!==e)throw Dt(`SHA-${e}`,"algorithm.hash")}function cT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function Cf(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function Df(t,e,r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Pr(t.algorithm,"HMAC"))throw Dt("HMAC");Ja(t.algorithm,parseInt(e.slice(2),10));break}case"RS256":case"RS384":case"RS512":{if(!Pr(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Dt("RSASSA-PKCS1-v1_5");Ja(t.algorithm,parseInt(e.slice(2),10));break}case"PS256":case"PS384":case"PS512":{if(!Pr(t.algorithm,"RSA-PSS"))throw Dt("RSA-PSS");Ja(t.algorithm,parseInt(e.slice(2),10));break}case"Ed25519":case"EdDSA":{if(!Pr(t.algorithm,"Ed25519"))throw Dt("Ed25519");break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{if(!Pr(t.algorithm,e))throw Dt(e);break}case"ES256":case"ES384":case"ES512":{if(!Pr(t.algorithm,"ECDSA"))throw Dt("ECDSA");let n=cT(e);if(t.algorithm.namedCurve!==n)throw Dt(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Cf(t,r)}function Jt(t,e,r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Pr(t.algorithm,"AES-GCM"))throw Dt("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Pr(t.algorithm,"AES-KW"))throw Dt("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":break;default:throw Dt("ECDH or X25519")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Pr(t.algorithm,"PBKDF2"))throw Dt("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Pr(t.algorithm,"RSA-OAEP"))throw Dt("RSA-OAEP");Ja(t.algorithm,parseInt(e.slice(9),10)||1);break}default:throw new TypeError("CryptoKey does not support this operation")}Cf(t,r)}var Dt,Pr,Xn=Q(()=>{Dt=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`),Pr=(t,e)=>t.name===e});function Pf(t,e,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var nr,su,Qn=Q(()=>{nr=(t,...e)=>Pf("Key must be ",t,...e),su=(t,e,...r)=>Pf(`Key for the ${t} algorithm must be `,e,...r)});var ou={};Va(ou,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>nt,JOSENotSupported:()=>re,JWEDecryptionFailed:()=>Zr,JWEInvalid:()=>q,JWKInvalid:()=>eo,JWKSInvalid:()=>Ki,JWKSMultipleMatchingKeys:()=>to,JWKSNoMatchingKey:()=>Zn,JWKSTimeout:()=>ro,JWSInvalid:()=>Ee,JWSSignatureVerificationFailed:()=>ei,JWTClaimValidationFailed:()=>ft,JWTExpired:()=>Mi,JWTInvalid:()=>Xe});var nt,ft,Mi,Tn,re,Zr,q,Ee,Xe,eo,Ki,Zn,to,ro,ei,Te=Q(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Mi=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},re=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Zr=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},q=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},Ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},Xe=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},eo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},Ki=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},Zn=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},to=class extends nt{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ro=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},ei=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function Hi(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,ti,no,In=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ti=t=>t?.[Symbol.toStringTag]==="KeyObject",no=t=>hr(t)||ti(t)});function Xa(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Ya(t,e){let r=t.byteLength<<3;if(r!==e)throw new q(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Uf(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Lf(t,e){if(e.length<<3!==Uf(t))throw new q("Invalid Initialization Vector length")}async function Mf(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(nr(e,"Uint8Array"));let n=parseInt(t.slice(1,4),10),i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return{encKey:i,macKey:s,keySize:n}}async function Kf(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function uT(t,e,r,n,i){let{encKey:s,macKey:o,keySize:a}=await Mf(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=rt(i,n,c,nu(i.length<<3)),d=await Kf(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function dT(t,e){if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign(r,n,t)),s=new Uint8Array(await crypto.subtle.sign(r,n,e)),o=0,a=-1;for(;++a<32;)o|=i[a]^s[a];return o===0}async function pT(t,e,r,n,i,s){let{encKey:o,macKey:a,keySize:c}=await Mf(t,e,"decrypt"),l=rt(s,n,r,nu(s.length<<3)),d=await Kf(a,l,c),p;try{p=await dT(i,d)}catch{}if(!p)throw new Zr;let m;try{m=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!m)throw new Zr;return m}async function fT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Jt(r,t,"encrypt"),s=r);let o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function mT(t,e,r,n,i,s){let o;e instanceof Uint8Array?o=await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Jt(e,t,"decrypt"),o=e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,rt(r,i)))}catch{throw new Zr}}async function Qa(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(nr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));switch(n?Lf(t,n):n=lT(t),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Ya(r,parseInt(t.slice(-3),10)),uT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Ya(r,parseInt(t.slice(1,4),10)),fT(t,e,r,n,i);default:throw new re(Hf)}}async function Za(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(nr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new q("JWE Initialization Vector missing");if(!i)throw new q("JWE Authentication Tag missing");switch(Lf(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Ya(e,parseInt(t.slice(-3),10)),pT(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Ya(e,parseInt(t.slice(1,4),10)),mT(t,e,r,n,i,s);default:throw new re(Hf)}}var Ur,lT,Hf,ri=Q(()=>{Tt();Xn();Qn();Te();In();Ur=t=>crypto.getRandomValues(new Uint8Array(Xa(t)>>3));lT=t=>crypto.getRandomValues(new Uint8Array(Uf(t)>>3));Hf="Unsupported JWE Content Encryption Algorithm"});function Ge(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function Pt(t,e,r){try{return dt(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}async function tc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var ec,Er=Q(()=>{pt();ec=Symbol()});function be(t){if(!hT(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function Lr(...t){let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0}var hT,ni,Ff,Vf,Bf,Qe=Q(()=>{hT=t=>typeof t=="object"&&t!==null;ni=t=>be(t)&&typeof t.kty=="string",Ff=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Vf=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,Bf=t=>t.kty==="oct"&&typeof t.k=="string"});function qf(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function jf(t,e,r){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):(Jt(t,e,r),t)}async function io(t,e,r){let n=await jf(e,t,"wrapKey");qf(n,t);let i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function so(t,e,r){let n=await jf(e,t,"unwrapKey");qf(n,t);let i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}var au=Q(()=>{Xn()});function cu(t){return rt($a(t.length),t)}async function yT(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=new Uint8Array(4+t.length+r.length);c.set($a(a),0),c.set(t,4),c.set(r,4+t.length);let l=await tc("sha256",c);o.set(l,(a-1)*i)}return o.slice(0,n)}async function lu(t,e,r,n,i=new Uint8Array,s=new Uint8Array){Jt(t,"ECDH"),Jt(e,"ECDH","deriveBits");let o=cu(ze(r)),a=cu(i),c=cu(s),l=$a(n),d=new Uint8Array,p=rt(o,a,c,l,d),m=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,gT(t)));return yT(m,n,p)}function gT(t){return t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3}function uu(t){switch(t.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return t.algorithm.name==="X25519"}}var $f=Q(()=>{Tt();Xn();Er()});function AT(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Jt(t,e,"deriveBits"),t)}async function Wf(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new q("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new q("PBES2 Count Input must be a positive integer");let i=TT(e,t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await AT(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}async function zf(t,e,r,n=2048,i=crypto.getRandomValues(new Uint8Array(16))){let s=await Wf(i,t,n,e);return{encryptedKey:await io(t.slice(-6),s,r),p2c:n,p2s:De(i)}}async function Jf(t,e,r,n,i){let s=await Wf(i,t,n,e);return so(t.slice(-6),s,r)}var TT,Yf=Q(()=>{pt();au();Xn();Tt();Te();TT=(t,e)=>rt(ze(t),Uint8Array.of(0),e)});function oo(t,e){if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}}function Xf(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:parseInt(t.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:t};default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}async function Qf(t,e,r){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(nr(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}return Df(e,t,r),e}async function Zf(t,e,r){let n=await Qf(t,e,"sign");oo(t,n);let i=await crypto.subtle.sign(Xf(t,n.algorithm),n,r);return new Uint8Array(i)}async function em(t,e,r,n){let i=await Qf(t,e,"verify");oo(t,i);let s=Xf(t,i.algorithm);try{return await crypto.subtle.verify(s,i,r,n)}catch{return!1}}var rc=Q(()=>{Te();Xn();Qn()});async function rm(t,e,r){return Jt(e,t,"encrypt"),oo(t,e),new Uint8Array(await crypto.subtle.encrypt(tm(t),e,r))}async function nm(t,e,r){return Jt(e,t,"decrypt"),oo(t,e),new Uint8Array(await crypto.subtle.decrypt(tm(t),e,r))}var tm,im=Q(()=>{Xn();rc();Te();tm=t=>{switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}});function xT(t){let e,r;switch(t.kty){case"AKP":{switch(t.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:t.alg},r=t.priv?["sign"]:["verify"];break;default:throw new re(nc)}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new re(nc)}break}case"EC":{switch(t.alg){case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t.alg]},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(nc)}break}case"OKP":{switch(t.alg){case"Ed25519":case"EdDSA":e={name:"Ed25519"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(nc)}break}default:throw new re('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}async function Fi(t){if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:e,keyUsages:r}=xT(t),n={...t};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,e,t.ext??!(t.d||t.priv),t.key_ops??r)}var nc,du=Q(()=>{Te();nc='Invalid or unsupported JWK "alg" (Algorithm) Parameter value'});async function ir(t,e){if(t instanceof Uint8Array||hr(t))return t;if(ti(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return bT(t,e)}catch(n){if(n instanceof TypeError)throw n}let r=t.export({format:"jwk"});return sm(t,r,e)}if(ni(t))return t.k?dt(t.k):sm(t,t,e,!0);throw new Error("unreachable")}var Vi,Bi,sm,bT,ii=Q(()=>{Qe();pt();du();In();Vi="given KeyObject instance cannot be used for this algorithm",sm=async(t,e,r,n=!1)=>{Bi||=new WeakMap;let i=Bi.get(t);if(i?.[r])return i[r];let s=await Fi({...e,alg:r});return n&&Object.freeze(t),i?i[r]=s:Bi.set(t,{[r]:s}),s},bT=(t,e)=>{Bi||=new WeakMap;let r=Bi.get(t);if(r?.[e])return r[e];let n=t.type==="public",i=!!n,s;if(t.asymmetricKeyType==="x25519"){switch(e){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Vi)}s=t.toCryptoKey(t.asymmetricKeyType,i,n?[]:["deriveBits"])}if(t.asymmetricKeyType==="ed25519"){if(e!=="EdDSA"&&e!=="Ed25519")throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}switch(t.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":{if(e!==t.asymmetricKeyType.toUpperCase())throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}}if(t.asymmetricKeyType==="rsa"){let o;switch(e){case"RSA-OAEP":o="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":o="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":o="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError(Vi)}if(e.startsWith("RSA-OAEP"))return t.toCryptoKey({name:"RSA-OAEP",hash:o},i,n?["encrypt"]:["decrypt"]);s=t.toCryptoKey({name:e.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},i,[n?"verify":"sign"])}if(t.asymmetricKeyType==="ec"){let a=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(t.asymmetricKeyDetails?.namedCurve);if(!a)throw new TypeError(Vi);let c={ES256:"P-256",ES384:"P-384",ES512:"P-521"};c[e]&&a===c[e]&&(s=t.toCryptoKey({name:"ECDSA",namedCurve:a},i,[n?"verify":"sign"])),e.startsWith("ECDH-ES")&&(s=t.toCryptoKey({name:"ECDH",namedCurve:a},i,n?[]:["deriveBits"]))}if(!s)throw new TypeError(Vi);return r?r[e]=s:Bi.set(t,{[e]:s}),s}});function wT(t){Mr(t,48,"Invalid PKCS#8 structure"),yr(t),Mr(t,2,"Expected version field");let e=yr(t);t.pos+=e,Mr(t,48,"Expected algorithm identifier");let r=yr(t);return{algIdStart:t.pos,algIdLength:r}}function NT(t){Mr(t,48,"Invalid SPKI structure"),yr(t),Mr(t,48,"Expected algorithm identifier");let e=yr(t);return{algIdStart:t.pos,algIdLength:e}}function RT(t){let e=mu(t);Mr(e,48,"Invalid certificate structure"),yr(e),Mr(e,48,"Invalid tbsCertificate structure"),yr(e),t[e.pos]===160?fu(e,6):fu(e,5);let r=e.pos;Mr(e,48,"Invalid SPKI structure");let n=yr(e);return t.subarray(r,r+n+(e.pos-r))}function OT(t){let e=hu(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);return RT(e)}var om,am,cm,lm,pu,mu,yr,fu,Mr,um,ST,dm,pm,hu,fm,Eu,mm,yu=Q(()=>{Qn();iu();Te();In();om=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
1
+ var rT=Object.create;var Zl=Object.defineProperty;var nT=Object.getOwnPropertyDescriptor;var iT=Object.getOwnPropertyNames;var sT=Object.getPrototypeOf,oT=Object.prototype.hasOwnProperty;var ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e)=>()=>(t&&(e=t(t=0)),e);var he=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Ba=(t,e)=>{for(var r in e)Zl(t,r,{get:e[r],enumerable:!0})},aT=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of iT(e))!oT.call(t,i)&&i!==r&&Zl(t,i,{get:()=>e[i],enumerable:!(n=nT(e,i))||n.enumerable});return t};var Pf=(t,e,r)=>(r=t!=null?rT(sT(t)):{},aT(e||!t||!t.__esModule?Zl(r,"default",{value:t,enumerable:!0}):r,t));function rt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function su(t,e,r){if(e<0||e>=$a)throw new RangeError(`value must be >= 0 and <= ${$a-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function ou(t){let e=Math.floor(t/$a),r=t%$a,n=new Uint8Array(8);return su(n,e,0),su(n,r,4),n}function Wa(t){let e=new Uint8Array(4);return su(e,t),e}function ze(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var Yn,ct,$a,Tt=Q(()=>{Yn=new TextEncoder,ct=new TextDecoder,$a=2**32});function Zs(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function za(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var au=Q(()=>{});var Ja={};Ba(Ja,{decode:()=>dt,encode:()=>De});function dt(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:ct.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=ct.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return za(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function De(t){let e=t;return typeof e=="string"&&(e=Yn.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Zs(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var pt=Q(()=>{Tt();au()});function dT(t){return parseInt(t.name.slice(4),10)}function Ya(t,e){if(dT(t.hash)!==e)throw Dt(`SHA-${e}`,"algorithm.hash")}function pT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function Lf(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function Mf(t,e,r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Pr(t.algorithm,"HMAC"))throw Dt("HMAC");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"RS256":case"RS384":case"RS512":{if(!Pr(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Dt("RSASSA-PKCS1-v1_5");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"PS256":case"PS384":case"PS512":{if(!Pr(t.algorithm,"RSA-PSS"))throw Dt("RSA-PSS");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"Ed25519":case"EdDSA":{if(!Pr(t.algorithm,"Ed25519"))throw Dt("Ed25519");break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{if(!Pr(t.algorithm,e))throw Dt(e);break}case"ES256":case"ES384":case"ES512":{if(!Pr(t.algorithm,"ECDSA"))throw Dt("ECDSA");let n=pT(e);if(t.algorithm.namedCurve!==n)throw Dt(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}function Jt(t,e,r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Pr(t.algorithm,"AES-GCM"))throw Dt("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Pr(t.algorithm,"AES-KW"))throw Dt("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":break;default:throw Dt("ECDH or X25519")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Pr(t.algorithm,"PBKDF2"))throw Dt("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Pr(t.algorithm,"RSA-OAEP"))throw Dt("RSA-OAEP");Ya(t.algorithm,parseInt(e.slice(9),10)||1);break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}var Dt,Pr,Xn=Q(()=>{Dt=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`),Pr=(t,e)=>t.name===e});function Kf(t,e,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var nr,cu,Qn=Q(()=>{nr=(t,...e)=>Kf("Key must be ",t,...e),cu=(t,e,...r)=>Kf(`Key for the ${t} algorithm must be `,e,...r)});var lu={};Ba(lu,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>nt,JOSENotSupported:()=>re,JWEDecryptionFailed:()=>Zr,JWEInvalid:()=>q,JWKInvalid:()=>eo,JWKSInvalid:()=>Ki,JWKSMultipleMatchingKeys:()=>to,JWKSNoMatchingKey:()=>Zn,JWKSTimeout:()=>ro,JWSInvalid:()=>Ee,JWSSignatureVerificationFailed:()=>ei,JWTClaimValidationFailed:()=>ft,JWTExpired:()=>Mi,JWTInvalid:()=>Xe});var nt,ft,Mi,Tn,re,Zr,q,Ee,Xe,eo,Ki,Zn,to,ro,ei,Te=Q(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Mi=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},re=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Zr=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},q=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},Ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},Xe=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},eo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},Ki=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},Zn=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},to=class extends nt{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ro=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},ei=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function Hi(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,ti,no,In=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ti=t=>t?.[Symbol.toStringTag]==="KeyObject",no=t=>hr(t)||ti(t)});function Qa(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Xa(t,e){let r=t.byteLength<<3;if(r!==e)throw new q(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Hf(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Ff(t,e){if(e.length<<3!==Hf(t))throw new q("Invalid Initialization Vector length")}async function Vf(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(nr(e,"Uint8Array"));let n=parseInt(t.slice(1,4),10),i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return{encKey:i,macKey:s,keySize:n}}async function Bf(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function mT(t,e,r,n,i){let{encKey:s,macKey:o,keySize:a}=await Vf(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=rt(i,n,c,ou(i.length<<3)),d=await Bf(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function hT(t,e){if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign(r,n,t)),s=new Uint8Array(await crypto.subtle.sign(r,n,e)),o=0,a=-1;for(;++a<32;)o|=i[a]^s[a];return o===0}async function ET(t,e,r,n,i,s){let{encKey:o,macKey:a,keySize:c}=await Vf(t,e,"decrypt"),l=rt(s,n,r,ou(s.length<<3)),d=await Bf(a,l,c),p;try{p=await hT(i,d)}catch{}if(!p)throw new Zr;let m;try{m=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!m)throw new Zr;return m}async function yT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Jt(r,t,"encrypt"),s=r);let o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function gT(t,e,r,n,i,s){let o;e instanceof Uint8Array?o=await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Jt(e,t,"decrypt"),o=e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,rt(r,i)))}catch{throw new Zr}}async function Za(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(nr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));switch(n?Ff(t,n):n=fT(t),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(-3),10)),mT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(1,4),10)),yT(t,e,r,n,i);default:throw new re(qf)}}async function ec(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(nr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new q("JWE Initialization Vector missing");if(!i)throw new q("JWE Authentication Tag missing");switch(Ff(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(-3),10)),ET(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(1,4),10)),gT(t,e,r,n,i,s);default:throw new re(qf)}}var Ur,fT,qf,ri=Q(()=>{Tt();Xn();Qn();Te();In();Ur=t=>crypto.getRandomValues(new Uint8Array(Qa(t)>>3));fT=t=>crypto.getRandomValues(new Uint8Array(Hf(t)>>3));qf="Unsupported JWE Content Encryption Algorithm"});function Ge(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function Pt(t,e,r){try{return dt(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}async function rc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var tc,Er=Q(()=>{pt();tc=Symbol()});function be(t){if(!vT(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function Lr(...t){let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0}var vT,ni,jf,Gf,$f,Qe=Q(()=>{vT=t=>typeof t=="object"&&t!==null;ni=t=>be(t)&&typeof t.kty=="string",jf=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Gf=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,$f=t=>t.kty==="oct"&&typeof t.k=="string"});function Wf(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function zf(t,e,r){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):(Jt(t,e,r),t)}async function io(t,e,r){let n=await zf(e,t,"wrapKey");Wf(n,t);let i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function so(t,e,r){let n=await zf(e,t,"unwrapKey");Wf(n,t);let i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}var uu=Q(()=>{Xn()});function du(t){return rt(Wa(t.length),t)}async function TT(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=new Uint8Array(4+t.length+r.length);c.set(Wa(a),0),c.set(t,4),c.set(r,4+t.length);let l=await rc("sha256",c);o.set(l,(a-1)*i)}return o.slice(0,n)}async function pu(t,e,r,n,i=new Uint8Array,s=new Uint8Array){Jt(t,"ECDH"),Jt(e,"ECDH","deriveBits");let o=du(ze(r)),a=du(i),c=du(s),l=Wa(n),d=new Uint8Array,p=rt(o,a,c,l,d),m=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,IT(t)));return TT(m,n,p)}function IT(t){return t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3}function fu(t){switch(t.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return t.algorithm.name==="X25519"}}var Yf=Q(()=>{Tt();Xn();Er()});function xT(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Jt(t,e,"deriveBits"),t)}async function Xf(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new q("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new q("PBES2 Count Input must be a positive integer");let i=bT(e,t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await xT(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}async function Qf(t,e,r,n=2048,i=crypto.getRandomValues(new Uint8Array(16))){let s=await Xf(i,t,n,e);return{encryptedKey:await io(t.slice(-6),s,r),p2c:n,p2s:De(i)}}async function Zf(t,e,r,n,i){let s=await Xf(i,t,n,e);return so(t.slice(-6),s,r)}var bT,em=Q(()=>{pt();uu();Xn();Tt();Te();bT=(t,e)=>rt(ze(t),Uint8Array.of(0),e)});function oo(t,e){if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}}function tm(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:parseInt(t.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:t};default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}async function rm(t,e,r){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(nr(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}return Mf(e,t,r),e}async function nm(t,e,r){let n=await rm(t,e,"sign");oo(t,n);let i=await crypto.subtle.sign(tm(t,n.algorithm),n,r);return new Uint8Array(i)}async function im(t,e,r,n){let i=await rm(t,e,"verify");oo(t,i);let s=tm(t,i.algorithm);try{return await crypto.subtle.verify(s,i,r,n)}catch{return!1}}var nc=Q(()=>{Te();Xn();Qn()});async function om(t,e,r){return Jt(e,t,"encrypt"),oo(t,e),new Uint8Array(await crypto.subtle.encrypt(sm(t),e,r))}async function am(t,e,r){return Jt(e,t,"decrypt"),oo(t,e),new Uint8Array(await crypto.subtle.decrypt(sm(t),e,r))}var sm,cm=Q(()=>{Xn();nc();Te();sm=t=>{switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}});function wT(t){let e,r;switch(t.kty){case"AKP":{switch(t.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:t.alg},r=t.priv?["sign"]:["verify"];break;default:throw new re(ic)}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new re(ic)}break}case"EC":{switch(t.alg){case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t.alg]},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}case"OKP":{switch(t.alg){case"Ed25519":case"EdDSA":e={name:"Ed25519"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}default:throw new re('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}async function Fi(t){if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:e,keyUsages:r}=wT(t),n={...t};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,e,t.ext??!(t.d||t.priv),t.key_ops??r)}var ic,mu=Q(()=>{Te();ic='Invalid or unsupported JWK "alg" (Algorithm) Parameter value'});async function ir(t,e){if(t instanceof Uint8Array||hr(t))return t;if(ti(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return RT(t,e)}catch(n){if(n instanceof TypeError)throw n}let r=t.export({format:"jwk"});return lm(t,r,e)}if(ni(t))return t.k?dt(t.k):lm(t,t,e,!0);throw new Error("unreachable")}var Vi,Bi,lm,RT,ii=Q(()=>{Qe();pt();mu();In();Vi="given KeyObject instance cannot be used for this algorithm",lm=async(t,e,r,n=!1)=>{Bi||=new WeakMap;let i=Bi.get(t);if(i?.[r])return i[r];let s=await Fi({...e,alg:r});return n&&Object.freeze(t),i?i[r]=s:Bi.set(t,{[r]:s}),s},RT=(t,e)=>{Bi||=new WeakMap;let r=Bi.get(t);if(r?.[e])return r[e];let n=t.type==="public",i=!!n,s;if(t.asymmetricKeyType==="x25519"){switch(e){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Vi)}s=t.toCryptoKey(t.asymmetricKeyType,i,n?[]:["deriveBits"])}if(t.asymmetricKeyType==="ed25519"){if(e!=="EdDSA"&&e!=="Ed25519")throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}switch(t.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":{if(e!==t.asymmetricKeyType.toUpperCase())throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}}if(t.asymmetricKeyType==="rsa"){let o;switch(e){case"RSA-OAEP":o="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":o="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":o="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError(Vi)}if(e.startsWith("RSA-OAEP"))return t.toCryptoKey({name:"RSA-OAEP",hash:o},i,n?["encrypt"]:["decrypt"]);s=t.toCryptoKey({name:e.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},i,[n?"verify":"sign"])}if(t.asymmetricKeyType==="ec"){let a=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(t.asymmetricKeyDetails?.namedCurve);if(!a)throw new TypeError(Vi);let c={ES256:"P-256",ES384:"P-384",ES512:"P-521"};c[e]&&a===c[e]&&(s=t.toCryptoKey({name:"ECDSA",namedCurve:a},i,[n?"verify":"sign"])),e.startsWith("ECDH-ES")&&(s=t.toCryptoKey({name:"ECDH",namedCurve:a},i,n?[]:["deriveBits"]))}if(!s)throw new TypeError(Vi);return r?r[e]=s:Bi.set(t,{[e]:s}),s}});function kT(t){Mr(t,48,"Invalid PKCS#8 structure"),yr(t),Mr(t,2,"Expected version field");let e=yr(t);t.pos+=e,Mr(t,48,"Expected algorithm identifier");let r=yr(t);return{algIdStart:t.pos,algIdLength:r}}function CT(t){Mr(t,48,"Invalid SPKI structure"),yr(t),Mr(t,48,"Expected algorithm identifier");let e=yr(t);return{algIdStart:t.pos,algIdLength:e}}function DT(t){let e=yu(t);Mr(e,48,"Invalid certificate structure"),yr(e),Mr(e,48,"Invalid tbsCertificate structure"),yr(e),t[e.pos]===160?Eu(e,6):Eu(e,5);let r=e.pos;Mr(e,48,"Invalid SPKI structure");let n=yr(e);return t.subarray(r,r+n+(e.pos-r))}function PT(t){let e=gu(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);return DT(e)}var um,dm,pm,fm,hu,yu,yr,Eu,Mr,mm,OT,hm,Em,gu,ym,vu,gm,Au=Q(()=>{Qn();au();Te();In();um=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
2
2
  `);return`-----BEGIN ${e}-----
3
3
  ${r}
4
- -----END ${e}-----`},am=async(t,e,r)=>{if(ti(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!hr(r))throw new TypeError(nr(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return om(Zs(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},cm=t=>am("public","spki",t),lm=t=>am("private","pkcs8",t),pu=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},mu=t=>({data:t,pos:0}),yr=t=>{let e=t.data[t.pos++];if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|t.data[t.pos++];return n}return e},fu=(t,e=1)=>{if(e<=0)return;t.pos++;let r=yr(t);t.pos+=r,e>1&&fu(t,e-1)},Mr=(t,e,r)=>{if(t.data[t.pos++]!==e)throw new Error(r)},um=(t,e)=>{let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},ST=t=>{Mr(t,6,"Expected algorithm OID");let e=yr(t);return um(t,e)};dm=t=>{let e=ST(t);if(pu(e,[43,101,110]))return"X25519";if(!pu(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mr(t,6,"Expected curve OID");let r=yr(t),n=um(t,r);for(let{name:i,oid:s}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(pu(n,s))return i;throw new Error("Unsupported named curve")},pm=async(t,e,r,n)=>{let i,s,o=t==="spki",a=()=>o?["verify"]:["sign"],c=()=>o?["encrypt","wrapKey"]:["decrypt","unwrapKey"];switch(r){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:`SHA-${parseInt(r.slice(-3),10)||1}`},s=c();break;case"ES256":case"ES384":case"ES512":{i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[r]},s=a();break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{try{let l=n.getNamedCurve(e);i=l==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:l}}catch{throw new re("Invalid or unsupported key format")}s=o?[]:["deriveBits"];break}case"Ed25519":case"EdDSA":i={name:"Ed25519"},s=a();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:r},s=a();break;default:throw new re('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(t,e,i,n?.extractable??!!o,s)},hu=(t,e)=>Wa(t.replace(e,"")),fm=(t,e,r)=>{let n=hu(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=mu(s);return wT(o),dm(o)}),pm("pkcs8",n,e,i)},Eu=(t,e,r)=>{let n=hu(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=mu(s);return NT(o),dm(o)}),pm("spki",n,e,i)};mm=(t,e,r)=>{let n;try{n=OT(t)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return Eu(om(Zs(n),"PUBLIC KEY"),e,r)}});async function ic(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return Eu(t,e,r)}async function hm(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return mm(t,e,r)}async function ao(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return fm(t,e,r)}async function it(t,e,r){if(!be(t))throw new TypeError("JWK must be an object");let n;switch(e??=t.alg,n??=r?.extractable??t.ext,t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return dt(t.k);case"RSA":if("oth"in t&&t.oth!==void 0)throw new re('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Fi({...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return Fi({...t,ext:n})}case"EC":case"OKP":return Fi({...t,alg:e,ext:n});default:throw new re('Unsupported "kty" (Key Type) Parameter value')}}var co=Q(()=>{pt();yu();du();Te();Qe()});async function Em(t){if(ti(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!hr(t))throw new TypeError(nr(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await crypto.subtle.exportKey("jwk",t);return s.kty==="AKP"&&(s.alg=n),s}var ym=Q(()=>{Qn();pt();In()});async function gm(t){return cm(t)}async function vm(t){return lm(t)}async function qi(t){return Em(t)}var sc=Q(()=>{yu();ym()});async function Am(t,e,r,n){let i=t.slice(0,7),s=await Qa(i,r,e,n,new Uint8Array);return{encryptedKey:s.ciphertext,iv:De(s.iv),tag:De(s.tag)}}async function Tm(t,e,r,n,i){let s=t.slice(0,7);return Za(s,e,r,n,i,new Uint8Array)}var Im=Q(()=>{ri();pt()});function lo(t){if(t===void 0)throw new q("JWE Encrypted Key missing")}async function xm(t,e,r,n,i){switch(t){case"dir":{if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!be(n.epk))throw new q('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(Hi(e),!uu(e))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await it(n.epk,t);Hi(s);let o,a;if(n.apu!==void 0){if(typeof n.apu!="string")throw new q('JOSE Header "apu" (Agreement PartyUInfo) invalid');o=Pt(n.apu,"apu",q)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new q('JOSE Header "apv" (Agreement PartyVInfo) invalid');a=Pt(n.apv,"apv",q)}let c=await lu(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?Xa(n.enc):parseInt(t.slice(-5,-2),10),o,a);return t==="ECDH-ES"?c:(lo(r),so(t.slice(-6),c,r))}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return lo(r),Hi(e),nm(t,e,r);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(lo(r),typeof n.p2c!="number")throw new q('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new q('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new q('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let o;return o=Pt(n.p2s,"p2s",q),Jf(t,e,r,n.p2c,o)}case"A128KW":case"A192KW":case"A256KW":return lo(r),so(t,e,r);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(lo(r),typeof n.iv!="string")throw new q('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new q('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=Pt(n.iv,"iv",q);let o;return o=Pt(n.tag,"tag",q),Tm(t,e,r,s,o)}default:throw new re(_m)}}async function oc(t,e,r,n,i={}){let s,o,a;switch(t){case"dir":{a=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(Hi(r),!uu(r))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:c,apv:l}=i,d;i.epk?d=await ir(i.epk,t):d=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let{x:p,y:m,crv:E,kty:v}=await qi(d),b=await lu(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?Xa(e):parseInt(t.slice(-5,-2),10),c,l);if(o={epk:{x:p,crv:E,kty:v}},v==="EC"&&(o.epk.y=m),c&&(o.apu=De(c)),l&&(o.apv=De(l)),t==="ECDH-ES"){a=b;break}a=n||Ur(e);let k=t.slice(-6);s=await io(k,b,a);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{a=n||Ur(e),Hi(r),s=await rm(t,r,a);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{a=n||Ur(e);let{p2c:c,p2s:l}=i;({encryptedKey:s,...o}=await zf(t,r,a,c,l));break}case"A128KW":case"A192KW":case"A256KW":{a=n||Ur(e),s=await io(t,r,a);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{a=n||Ur(e);let{iv:c}=i;({encryptedKey:s,...o}=await Am(t,r,a,c));break}default:throw new re(_m)}return{cek:a,encryptedKey:s,parameters:o}}var _m,ac=Q(()=>{au();$f();Yf();im();pt();ii();Te();Er();ri();co();sc();Qe();Im();In();_m='Invalid or unsupported "alg" (JWE Algorithm) header value'});function Kr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let o of n.crit){if(!s.has(o))throw new re(`Extension Header Parameter "${o}" is not recognized`);if(i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s.get(o)&&n[o]===void 0)throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)}var ji=Q(()=>{Te()});function uo(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}var gu=Q(()=>{});function Hr(t,e,r){switch(t.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":kT(t,e,r);break;default:CT(t,e,r)}}var Gi,vu,kT,CT,$i=Q(()=>{Qn();In();Qe();Gi=t=>t?.[Symbol.toStringTag],vu=(t,e,r)=>{if(e.use!==void 0){let n;switch(r){case"sign":case"verify":n="sig";break;case"encrypt":case"decrypt":n="enc";break}if(e.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(e.alg!==void 0&&e.alg!==t)throw new TypeError(`Invalid key for this operation, its "alg" must be "${t}" when present`);if(Array.isArray(e.key_ops)){let n;switch(!0){case(r==="sign"||r==="verify"):case t==="dir":case t.includes("CBC-HS"):n=r;break;case t.startsWith("PBES2"):n="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(t):!t.includes("GCM")&&t.endsWith("KW")?n=r==="encrypt"?"wrapKey":"unwrapKey":n=r;break;case(r==="encrypt"&&t.startsWith("RSA")):n="wrapKey";break;case r==="decrypt":n=t.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&e.key_ops?.includes?.(n)===!1)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return!0},kT=(t,e,r)=>{if(!(e instanceof Uint8Array)){if(ni(e)){if(Bf(e)&&vu(t,e,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!no(e))throw new TypeError(su(t,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(e.type!=="secret")throw new TypeError(`${Gi(e)} instances for symmetric algorithms must be of type "secret"`)}},CT=(t,e,r)=>{if(ni(e))switch(r){case"decrypt":case"sign":if(Ff(e)&&vu(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if(Vf(e)&&vu(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!no(e))throw new TypeError(su(t,e,"CryptoKey","KeyObject","JSON Web Key"));if(e.type==="secret")throw new TypeError(`${Gi(e)} instances for asymmetric algorithms must not be of type "secret"`);if(e.type==="public")switch(r){case"sign":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm decryption must be of type "private"`)}if(e.type==="private")switch(r){case"verify":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm encryption must be of type "public"`)}}});function bm(t){if(typeof globalThis[t]>"u")throw new re(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Sm(t){bm("CompressionStream");let e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let n=[],i=e.readable.getReader();for(;;){let{value:s,done:o}=await i.read();if(o)break;n.push(s)}return rt(...n)}async function wm(t,e){bm("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});let i=[],s=0,o=r.readable.getReader();for(;;){let{value:a,done:c}=await o.read();if(c)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new q("Decompressed plaintext exceeded the configured limit")}return rt(...i)}var Au=Q(()=>{Te();Tt()});async function Wi(t,e,r){if(!be(t))throw new q("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new q("JOSE Header missing");if(t.iv!==void 0&&typeof t.iv!="string")throw new q("JWE Initialization Vector incorrect type");if(typeof t.ciphertext!="string")throw new q("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new q("JWE Authentication Tag incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new q("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new q("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new q("JWE AAD incorrect type");if(t.header!==void 0&&!be(t.header))throw new q("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!be(t.unprotected))throw new q("JWE Per-Recipient Unprotected Header incorrect type");let n;if(t.protected)try{let G=dt(t.protected);n=JSON.parse(ct.decode(G))}catch{throw new q("JWE Protected Header is invalid")}if(!Lr(n,t.header,t.unprotected))throw new q("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let i={...n,...t.header,...t.unprotected};if(Kr(q,new Map,r?.crit,n,i),i.zip!==void 0&&i.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(i.zip!==void 0&&!n?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:s,enc:o}=i;if(typeof s!="string"||!s)throw new q("missing JWE Algorithm (alg) in JWE Header");if(typeof o!="string"||!o)throw new q("missing JWE Encryption Algorithm (enc) in JWE Header");let a=r&&uo("keyManagementAlgorithms",r.keyManagementAlgorithms),c=r&&uo("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(a&&!a.has(s)||!a&&s.startsWith("PBES2"))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(c&&!c.has(o))throw new Tn('"enc" (Encryption Algorithm) Header Parameter value not allowed');let l;t.encrypted_key!==void 0&&(l=Pt(t.encrypted_key,"encrypted_key",q));let d=!1;typeof e=="function"&&(e=await e(n,t),d=!0),Hr(s==="dir"?o:s,e,"decrypt");let p=await ir(e,s),m;try{m=await xm(s,p,l,i,r)}catch(G){if(G instanceof TypeError||G instanceof q||G instanceof re)throw G;m=Ur(o)}let E,v;t.iv!==void 0&&(E=Pt(t.iv,"iv",q)),t.tag!==void 0&&(v=Pt(t.tag,"tag",q));let b=t.protected!==void 0?ze(t.protected):new Uint8Array,k;t.aad!==void 0?k=rt(b,ze("."),ze(t.aad)):k=b;let C=Pt(t.ciphertext,"ciphertext",q),L=await Za(o,m,C,E,v,k),B={plaintext:L};if(i.zip==="DEF"){let G=r?.maxDecompressedLength??25e4;if(G===0)throw new re('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(G!==1/0&&(!Number.isSafeInteger(G)||G<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");B.plaintext=await wm(L,G).catch(j=>{throw j instanceof q?j:new q("Failed to decompress plaintext",{cause:j})})}return t.protected!==void 0&&(B.protectedHeader=n),t.aad!==void 0&&(B.additionalAuthenticatedData=Pt(t.aad,"aad",q)),t.unprotected!==void 0&&(B.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(B.unprotectedHeader=t.header),d?{...B,key:p}:B}var cc=Q(()=>{pt();ri();Er();Te();Qe();Qe();ac();Tt();ri();ji();gu();ii();$i();Au()});async function lc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new q("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:o,4:a,length:c}=t.split(".");if(c!==5)throw new q("Invalid Compact JWE");let l=await Wi({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var Tu=Q(()=>{cc();Te();Tt()});async function Nm(t,e,r){if(!be(t))throw new q("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(be))throw new q("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new q("JWE Recipients has no members");for(let n of t.recipients)try{return await Wi({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Zr}var Rm=Q(()=>{cc();Te();Qe()});var en,uc=Q(()=>{pt();Er();ri();ac();Te();Qe();Tt();ji();ii();$i();Au();en=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return Ge(this.#o,"setKeyManagementParameters"),this.#o=e,this}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return Ge(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return Ge(this.#s,"setUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}setContentEncryptionKey(e){return Ge(this.#i,"setContentEncryptionKey"),this.#i=e,this}setInitializationVector(e){return Ge(this.#a,"setInitializationVector"),this.#a=e,this}async encrypt(e,r){if(!this.#t&&!this.#s&&!this.#r)throw new q("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!Lr(this.#t,this.#s,this.#r))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this.#t,...this.#s,...this.#r};if(Kr(q,new Map,r?.crit,this.#t,n),n.zip!==void 0&&n.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(n.zip!==void 0&&!this.#t?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let o;if(this.#i&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);Hr(i==="dir"?s:i,e,"encrypt");let a;{let C,L=await ir(e,i);({cek:a,encryptedKey:o,parameters:C}=await oc(i,s,L,this.#i,this.#o)),C&&(r&&ec in r?this.#s?this.#s={...this.#s,...C}:this.setUnprotectedHeader(C):this.#t?this.#t={...this.#t,...C}:this.setProtectedHeader(C))}let c,l,d,p;if(this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array),this.#n){p=De(this.#n);let C=ze(p);c=rt(d,ze("."),C)}else c=d;let m=this.#e;n.zip==="DEF"&&(m=await Sm(m).catch(C=>{throw new q("Failed to compress plaintext",{cause:C})}));let{ciphertext:E,tag:v,iv:b}=await Qa(s,m,a,this.#a,c),k={ciphertext:De(E)};return b&&(k.iv=De(b)),v&&(k.tag=De(v)),o&&(k.encrypted_key=De(o)),p&&(k.aad=p),this.#t&&(k.protected=l),this.#r&&(k.unprotected=this.#r),this.#s&&(k.header=this.#s),k}}});var Iu,dc,Om=Q(()=>{uc();Er();Te();ri();Qe();ac();pt();ji();ii();$i();Iu=class{#e;unprotectedHeader;keyManagementParameters;key;options;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}setKeyManagementParameters(e){return Ge(this.keyManagementParameters,"setKeyManagementParameters"),this.keyManagementParameters=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},dc=class{#e;#t=[];#r;#s;#n;constructor(e){this.#e=e}addRecipient(e,r){let n=new Iu(this,e,{crit:r?.crit});return this.#t.push(n),n}setProtectedHeader(e){return Ge(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Ge(this.#s,"setSharedUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}async encrypt(){if(!this.#t.length)throw new q("at least one recipient must be added");if(this.#t.length===1){let[i]=this.#t,s=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(i.unprotectedHeader).encrypt(i.key,{...i.options}),o={ciphertext:s.ciphertext,iv:s.iv,recipients:[{}],tag:s.tag};return s.aad&&(o.aad=s.aad),s.protected&&(o.protected=s.protected),s.unprotected&&(o.unprotected=s.unprotected),s.encrypted_key&&(o.recipients[0].encrypted_key=s.encrypted_key),s.header&&(o.recipients[0].header=s.header),o}let e;for(let i=0;i<this.#t.length;i++){let s=this.#t[i];if(!Lr(this.#r,this.#s,s.unprotectedHeader))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let o={...this.#r,...this.#s,...s.unprotectedHeader},{alg:a}=o;if(typeof a!="string"||!a)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(a==="dir"||a==="ECDH-ES")throw new q('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof o.enc!="string"||!o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!e)e=o.enc;else if(e!==o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(Kr(q,new Map,s.options.crit,this.#r,o),o.zip!==void 0&&o.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(o.zip!==void 0&&!this.#r?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}let r=Ur(e),n={ciphertext:"",recipients:[]};for(let i=0;i<this.#t.length;i++){let s=this.#t[i],o={};if(n.recipients.push(o),i===0){let p=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setContentEncryptionKey(r).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(s.unprotectedHeader).setKeyManagementParameters(s.keyManagementParameters).encrypt(s.key,{...s.options,[ec]:!0});n.ciphertext=p.ciphertext,n.iv=p.iv,n.tag=p.tag,p.aad&&(n.aad=p.aad),p.protected&&(n.protected=p.protected),p.unprotected&&(n.unprotected=p.unprotected),o.encrypted_key=p.encrypted_key,p.header&&(o.header=p.header);continue}let a=s.unprotectedHeader?.alg||this.#r?.alg||this.#s?.alg;Hr(a==="dir"?e:a,s.key,"encrypt");let c=await ir(s.key,a),{encryptedKey:l,parameters:d}=await oc(a,e,c,r,s.keyManagementParameters);o.encrypted_key=De(l),(s.unprotectedHeader||d)&&(o.header={...s.unprotectedHeader,...d})}return n}}});async function zi(t,e,r){if(!be(t))throw new Ee("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new Ee('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new Ee("JWS Protected Header incorrect type");if(t.payload===void 0)throw new Ee("JWS Payload missing");if(typeof t.signature!="string")throw new Ee("JWS Signature missing or incorrect type");if(t.header!==void 0&&!be(t.header))throw new Ee("JWS Unprotected Header incorrect type");let n={};if(t.protected)try{let k=dt(t.protected);n=JSON.parse(ct.decode(k))}catch{throw new Ee("JWS Protected Header is invalid")}if(!Lr(n,t.header))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let i={...n,...t.header},s=Kr(Ee,new Map([["b64",!0]]),r?.crit,n,i),o=!0;if(s.has("b64")&&(o=n.b64,typeof o!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=i;if(typeof a!="string"||!a)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let c=r&&uo("algorithms",r.algorithms);if(c&&!c.has(a))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(o){if(typeof t.payload!="string")throw new Ee("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new Ee("JWS Payload must be a string or an Uint8Array instance");let l=!1;typeof e=="function"&&(e=await e(n,t),l=!0),Hr(a,e,"verify");let d=rt(t.protected!==void 0?ze(t.protected):new Uint8Array,ze("."),typeof t.payload=="string"?o?ze(t.payload):Yn.encode(t.payload):t.payload),p=Pt(t.signature,"signature",Ee),m=await ir(e,a);if(!await em(a,m,p,d))throw new ei;let v;o?v=Pt(t.payload,"payload",Ee):typeof t.payload=="string"?v=Yn.encode(t.payload):v=t.payload;let b={payload:v};return t.protected!==void 0&&(b.protectedHeader=n),t.header!==void 0&&(b.unprotectedHeader=t.header),l?{...b,key:m}:b}var pc=Q(()=>{pt();rc();Te();Tt();Er();Qe();Qe();$i();ji();gu();ii()});async function fc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new Ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new Ee("Invalid Compact JWS");let a=await zi({payload:i,protected:n,signature:s},e,r),c={payload:a.payload,protectedHeader:a.protectedHeader};return typeof e=="function"?{...c,key:a.key}:c}var _u=Q(()=>{pc();Te();Tt()});async function km(t,e,r){if(!be(t))throw new Ee("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(be))throw new Ee("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await zi({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new ei}var Cm=Q(()=>{pc();Te();Qe()});function po(t){let e=UT.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");let r=parseFloat(e[2]),n=e[3].toLowerCase(),i;switch(n){case"sec":case"secs":case"second":case"seconds":case"s":i=Math.round(r);break;case"minute":case"minutes":case"min":case"mins":case"m":i=Math.round(r*Pm);break;case"hour":case"hours":case"hr":case"hrs":case"h":i=Math.round(r*Um);break;case"day":case"days":case"d":i=Math.round(r*xu);break;case"week":case"weeks":case"w":i=Math.round(r*DT);break;default:i=Math.round(r*PT);break}return e[1]==="-"||e[4]==="ago"?-i:i}function si(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function Ji(t,e,r={}){let n;try{n=JSON.parse(ct.decode(e))}catch{}if(!be(n))throw new Xe("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i&&(typeof t.typ!="string"||Dm(t.typ)!==Dm(i)))throw new ft('unexpected "typ" JWT header value',n,"typ","check_failed");let{requiredClaims:s=[],issuer:o,subject:a,audience:c,maxTokenAge:l}=r,d=[...s];l!==void 0&&d.push("iat"),c!==void 0&&d.push("aud"),a!==void 0&&d.push("sub"),o!==void 0&&d.push("iss");for(let v of new Set(d.reverse()))if(!(v in n))throw new ft(`missing required "${v}" claim`,n,v,"missing");if(o&&!(Array.isArray(o)?o:[o]).includes(n.iss))throw new ft('unexpected "iss" claim value',n,"iss","check_failed");if(a&&n.sub!==a)throw new ft('unexpected "sub" claim value',n,"sub","check_failed");if(c&&!LT(n.aud,typeof c=="string"?[c]:c))throw new ft('unexpected "aud" claim value',n,"aud","check_failed");let p;switch(typeof r.clockTolerance){case"string":p=po(r.clockTolerance);break;case"number":p=r.clockTolerance;break;case"undefined":p=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:m}=r,E=_n(m||new Date);if((n.iat!==void 0||l)&&typeof n.iat!="number")throw new ft('"iat" claim must be a number',n,"iat","invalid");if(n.nbf!==void 0){if(typeof n.nbf!="number")throw new ft('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>E+p)throw new ft('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(n.exp!==void 0){if(typeof n.exp!="number")throw new ft('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=E-p)throw new Mi('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){let v=E-n.iat,b=typeof l=="number"?l:po(l);if(v-p>b)throw new Mi('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(v<0-p)throw new ft('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var _n,Pm,Um,xu,DT,PT,UT,Dm,LT,xn,Yi=Q(()=>{Te();Tt();Qe();_n=t=>Math.floor(t.getTime()/1e3),Pm=60,Um=Pm*60,xu=Um*24,DT=xu*7,PT=xu*365.25,UT=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;Dm=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,LT=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1;xn=class{#e;constructor(e){if(!be(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return Yn.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){typeof e=="number"?this.#e.nbf=si("setNotBefore",e):e instanceof Date?this.#e.nbf=si("setNotBefore",_n(e)):this.#e.nbf=_n(new Date)+po(e)}set exp(e){typeof e=="number"?this.#e.exp=si("setExpirationTime",e):e instanceof Date?this.#e.exp=si("setExpirationTime",_n(e)):this.#e.exp=_n(new Date)+po(e)}set iat(e){e===void 0?this.#e.iat=_n(new Date):e instanceof Date?this.#e.iat=si("setIssuedAt",_n(e)):typeof e=="string"?this.#e.iat=si("setIssuedAt",_n(new Date)+po(e)):this.#e.iat=si("setIssuedAt",e)}}});async function bn(t,e,r){let n=await fc(t,e,r);if(n.protectedHeader.crit?.includes("b64")&&n.protectedHeader.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");let s={payload:Ji(n.protectedHeader,n.payload,r),protectedHeader:n.protectedHeader};return typeof e=="function"?{...s,key:n.key}:s}var Lm=Q(()=>{_u();Yi();Te()});async function Mm(t,e,r){let n=await lc(t,e,r),i=Ji(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ft('replicated "iss" claim header parameter mismatch',i,"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ft('replicated "sub" claim header parameter mismatch',i,"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ft('replicated "aud" claim header parameter mismatch',i,"aud","mismatch");let o={payload:i,protectedHeader:s};return typeof e=="function"?{...o,key:n.key}:o}var Km=Q(()=>{Tu();Yi();Te()});var Xi,bu=Q(()=>{uc();Xi=class{#e;constructor(e){this.#e=new en(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var Sn,mc=Q(()=>{pt();rc();Qe();Te();Tt();$i();ji();ii();Er();Sn=class{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return Ge(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){if(!this.#t&&!this.#r)throw new Ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Lr(this.#t,this.#r))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this.#t,...this.#r},i=Kr(Ee,new Map([["b64",!0]]),r?.crit,this.#t,n),s=!0;if(i.has("b64")&&(s=this.#t.b64,typeof s!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');Hr(o,e,"sign");let a,c;s?(a=De(this.#e),c=ze(a)):(c=this.#e,a="");let l,d;this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array);let p=rt(d,ze("."),c),m=await ir(e,o),E=await Zf(o,m,p),v={signature:De(E),payload:a};return this.#r&&(v.header=this.#r),this.#t&&(v.protected=l),v}}});var Qi,Su=Q(()=>{mc();Qi=class{#e;constructor(e){this.#e=new Sn(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}async sign(e,r){let n=await this.#e.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var wu,hc,Hm=Q(()=>{mc();Te();Er();wu=class{#e;protectedHeader;unprotectedHeader;options;key;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setProtectedHeader(e){return Ge(this.protectedHeader,"setProtectedHeader"),this.protectedHeader=e,this}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},hc=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new wu(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new Ee("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this.#t.length;r++){let n=this.#t[r],i=new Sn(this.#e);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...o}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new Ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(o)}return e}}});var Zi,Fm=Q(()=>{Su();Te();Yi();Zi=class{#e;#t;constructor(e={}){this.#t=new xn(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){let n=new Qi(this.#t.data());if(n.setProtectedHeader(this.#e),Array.isArray(this.#e?.crit)&&this.#e.crit.includes("b64")&&this.#e.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}});var Ec,Vm=Q(()=>{bu();Yi();Er();Ec=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e={}){this.#o=new xn(e)}setIssuer(e){return this.#o.iss=e,this}setSubject(e){return this.#o.sub=e,this}setAudience(e){return this.#o.aud=e,this}setJti(e){return this.#o.jti=e,this}setNotBefore(e){return this.#o.nbf=e,this}setExpirationTime(e){return this.#o.exp=e,this}setIssuedAt(e){return this.#o.iat=e,this}setProtectedHeader(e){return Ge(this.#s,"setProtectedHeader"),this.#s=e,this}setKeyManagementParameters(e){return Ge(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return Ge(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Ge(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#n=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,r){let n=new Xi(this.#o.data());return this.#s&&(this.#n||this.#i||this.#a)&&(this.#s={...this.#s,iss:this.#n?this.#o.iss:void 0,sub:this.#i?this.#o.sub:void 0,aud:this.#a?this.#o.aud:void 0}),n.setProtectedHeader(this.#s),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}});async function Nu(t,e){let r;if(ni(t))r=t;else if(no(t))r=await qi(t);else throw new TypeError(nr(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":Fr(r.alg,'"alg" (Algorithm) Parameter'),Fr(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":Fr(r.crv,'"crv" (Curve) Parameter'),Fr(r.x,'"x" (X Coordinate) Parameter'),Fr(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":Fr(r.crv,'"crv" (Subtype of Key Pair) Parameter'),Fr(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":Fr(r.e,'"e" (Exponent) Parameter'),Fr(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":Fr(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new re('"kty" (Key Type) Parameter missing or unsupported')}let i=ze(JSON.stringify(n));return De(await tc(e,i))}async function Bm(t,e){e??="sha256";let r=await Nu(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var Fr,qm=Q(()=>{Er();pt();Te();Tt();In();Qe();sc();Qn();Fr=(t,e)=>{if(typeof t!="string"||!t)throw new eo(`${e} missing or invalid`)}});async function jm(t,e){let r={...t,...e?.header};if(!be(r.jwk))throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await it({...r.jwk,ext:!0},r.alg);if(n instanceof Uint8Array||n.type!=="public")throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var Gm=Q(()=>{co();Qe();Te()});function MT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new re('Unsupported "alg" value for a JSON Web Key Set')}}function KT(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(HT)}function HT(t){return be(t)}async function $m(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await it({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Ki("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function fo(t){let e=new Ru(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperties(r,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),r}var Ru,Ou=Q(()=>{co();Te();Qe();Ru=class{#e;#t=new WeakMap;constructor(e){if(!KT(e))throw new Ki("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=MT(n),o=this.#e.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&(typeof l.alg=="string"||s==="AKP")&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break;case"Ed25519":case"EdDSA":d=l.crv==="Ed25519";break}return d}),{0:a,length:c}=o;if(c===0)throw new Zn;if(c!==1){let l=new to,d=this.#t;throw l[Symbol.asyncIterator]=async function*(){for(let p of o)try{yield await $m(d,p,n)}catch{}},l}return $m(this.#t,a,n)}}});function FT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function VT(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new ro:s});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function BT(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>=e||!("jwks"in t)||!be(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,be))}function Wm(t,e){let r=new Cu(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>r.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>r.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>r.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>r.jwks(),enumerable:!0,configurable:!1,writable:!1}}),n}var ku,Du,mo,Cu,zm=Q(()=>{Te();Ou();Qe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(ku="jose/v6.2.3");Du=Symbol();mo=Symbol();Cu=class{#e;#t;#r;#s;#n;#i;#a;#o;#l;#c;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href),this.#t=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this.#r=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this.#s=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5,this.#a=new Headers(r?.headers),ku&&!this.#a.has("User-Agent")&&this.#a.set("User-Agent",ku),this.#a.has("accept")||(this.#a.set("accept","application/json"),this.#a.append("accept","application/jwk-set+json")),this.#o=r?.[Du],r?.[mo]!==void 0&&(this.#c=r?.[mo],BT(r?.[mo],this.#s)&&(this.#n=this.#c.uat,this.#l=fo(this.#c.jwks)))}pendingFetch(){return!!this.#i}coolingDown(){return typeof this.#n=="number"?Date.now()<this.#n+this.#r:!1}fresh(){return typeof this.#n=="number"?Date.now()<this.#n+this.#s:!1}jwks(){return this.#l?.jwks()}async getKey(e,r){(!this.#l||!this.fresh())&&await this.reload();try{return await this.#l(e,r)}catch(n){if(n instanceof Zn&&this.coolingDown()===!1)return await this.reload(),this.#l(e,r);throw n}}async reload(){this.#i&&FT()&&(this.#i=void 0),this.#i||=VT(this.#e.href,this.#a,AbortSignal.timeout(this.#t),this.#o).then(e=>{this.#l=fo(e),this.#c&&(this.#c.uat=Date.now(),this.#c.jwks=e),this.#n=Date.now(),this.#i=void 0}).catch(e=>{throw this.#i=void 0,e}),await this.#i}}});var yc,Jm=Q(()=>{pt();Tt();Te();Yi();yc=class{#e;constructor(e={}){this.#e=new xn(e)}encode(){let e=De(JSON.stringify({alg:"none"})),r=De(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new Xe("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new Xe("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(ct.decode(dt(n))),a.alg!=="none")throw new Error}catch{throw new Xe("Invalid Unsecured JWT")}return{payload:Ji(a,dt(i),r),header:a}}}});function Ym(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ct.decode(dt(e)));if(!be(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var Xm=Q(()=>{pt();Tt();Qe()});function Qm(t){if(typeof t!="string")throw new Xe("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new Xe("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new Xe("Invalid JWT");if(!e)throw new Xe("JWTs must contain a payload");let n;try{n=dt(e)}catch{throw new Xe("Failed to base64url decode the payload")}let i;try{i=JSON.parse(ct.decode(n))}catch{throw new Xe("Failed to parse the decoded payload as JSON")}if(!be(i))throw new Xe("Invalid JWT Claims Set");return i}var Zm=Q(()=>{pt();Tt();Qe();Te()});function Pu(t){let e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new re("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function eh(t,e){let r,n;switch(t){case"PS256":case"PS384":case"PS512":r={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Pu(e)},n=["sign","verify"];break;case"RS256":case"RS384":case"RS512":r={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Pu(e)},n=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":r={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Pu(e)},n=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"},n=["sign","verify"];break;case"ES384":r={name:"ECDSA",namedCurve:"P-384"},n=["sign","verify"];break;case"ES512":r={name:"ECDSA",namedCurve:"P-521"},n=["sign","verify"];break;case"Ed25519":case"EdDSA":{n=["sign","verify"],r={name:"Ed25519"};break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{n=["sign","verify"],r={name:t};break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{n=["deriveBits"];let i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":{r={name:"ECDH",namedCurve:i};break}case"X25519":r={name:"X25519"};break;default:throw new re("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}break}default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(r,e?.extractable??!1,n)}var th=Q(()=>{Te()});async function rh(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}var nh=Q(()=>{Te()});var ih={};Va(ih,{CompactEncrypt:()=>Xi,CompactSign:()=>Qi,EmbeddedJWK:()=>jm,EncryptJWT:()=>Ec,FlattenedEncrypt:()=>en,FlattenedSign:()=>Sn,GeneralEncrypt:()=>dc,GeneralSign:()=>hc,SignJWT:()=>Zi,UnsecuredJWT:()=>yc,base64url:()=>za,calculateJwkThumbprint:()=>Nu,calculateJwkThumbprintUri:()=>Bm,compactDecrypt:()=>lc,compactVerify:()=>fc,createLocalJWKSet:()=>fo,createRemoteJWKSet:()=>Wm,cryptoRuntime:()=>qT,customFetch:()=>Du,decodeJwt:()=>Qm,decodeProtectedHeader:()=>Ym,errors:()=>ou,exportJWK:()=>qi,exportPKCS8:()=>vm,exportSPKI:()=>gm,flattenedDecrypt:()=>Wi,flattenedVerify:()=>zi,generalDecrypt:()=>Nm,generalVerify:()=>km,generateKeyPair:()=>eh,generateSecret:()=>rh,importJWK:()=>it,importPKCS8:()=>ao,importSPKI:()=>ic,importX509:()=>hm,jwksCache:()=>mo,jwtDecrypt:()=>Mm,jwtVerify:()=>bn});var qT,ho=Q(()=>{Tu();cc();Rm();Om();_u();pc();Cm();Lm();Km();bu();uc();Su();mc();Hm();Fm();Vm();qm();Gm();Ou();zm();Jm();sc();co();Xm();Zm();Te();th();nh();pt();qT="WebCryptoAPI"});var Yy=he((sa,bl)=>{(function(t,e){"use strict";var r="",n="?",i="function",s="undefined",o="object",a="string",c="major",l="model",d="name",p="type",m="vendor",E="version",v="architecture",b="console",k="mobile",C="tablet",L="smarttv",B="wearable",G="embedded",j=500,$="Amazon",te="Apple",A="ASUS",x="BlackBerry",S="Browser",y="Chrome",I="Edge",N="Firefox",R="Google",w="Huawei",O="LG",P="Microsoft",U="Motorola",K="Opera",W="Samsung",J="Sharp",de="Sony",ke="Xiaomi",He="Zebra",fe="Facebook",we="Chromium OS",at="Mac OS",Ri=function(ve,Ce){var pe={};for(var Me in ve)Ce[Me]&&Ce[Me].length%2===0?pe[Me]=Ce[Me].concat(ve[Me]):pe[Me]=ve[Me];return pe},gn=function(ve){for(var Ce={},pe=0;pe<ve.length;pe++)Ce[ve[pe].toUpperCase()]=ve[pe];return Ce},Oi=function(ve,Ce){return typeof ve===a?wt(Ce).indexOf(wt(ve))!==-1:!1},wt=function(ve){return ve.toLowerCase()},Gn=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},Nt=function(ve,Ce){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof Ce===s?ve:ve.substring(0,j)},Ye=function(ve,Ce){for(var pe=0,Me,Xr,kr,Oe,ie,Cr;pe<Ce.length&&!ie;){var Jl=Ce[pe],Rf=Ce[pe+1];for(Me=Xr=0;Me<Jl.length&&!ie&&Jl[Me];)if(ie=Jl[Me++].exec(ve),ie)for(kr=0;kr<Rf.length;kr++)Cr=ie[++Xr],Oe=Rf[kr],typeof Oe===o&&Oe.length>0?Oe.length===2?typeof Oe[1]==i?this[Oe[0]]=Oe[1].call(this,Cr):this[Oe[0]]=Oe[1]:Oe.length===3?typeof Oe[1]===i&&!(Oe[1].exec&&Oe[1].test)?this[Oe[0]]=Cr?Oe[1].call(this,Cr,Oe[2]):e:this[Oe[0]]=Cr?Cr.replace(Oe[1],Oe[2]):e:Oe.length===4&&(this[Oe[0]]=Cr?Oe[3].call(this,Cr.replace(Oe[1],Oe[2])):e):this[Oe]=Cr||e;pe+=2}},Le=function(ve,Ce){for(var pe in Ce)if(typeof Ce[pe]===o&&Ce[pe].length>0){for(var Me=0;Me<Ce[pe].length;Me++)if(Oi(Ce[pe][Me],ve))return pe===n?e:pe}else if(Oi(Ce[pe],ve))return pe===n?e:pe;return ve},XA={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},wf={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Nf={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[E,[d,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[E,[d,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[d,E],[/opios[\/ ]+([\w\.]+)/i],[E,[d,K+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[E,[d,K+" GX"]],[/\bopr\/([\w\.]+)/i],[E,[d,K]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[E,[d,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[d,E],[/\bddg\/([\w\.]+)/i],[E,[d,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[E,[d,"UC"+S]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[E,[d,"WeChat"]],[/konqueror\/([\w\.]+)/i],[E,[d,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[E,[d,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[E,[d,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[E,[d,"Smart Lenovo "+S]],[/(avast|avg)\/([\w\.]+)/i],[[d,/(.+)/,"$1 Secure "+S],E],[/\bfocus\/([\w\.]+)/i],[E,[d,N+" Focus"]],[/\bopt\/([\w\.]+)/i],[E,[d,K+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[E,[d,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[E,[d,"Dolphin"]],[/coast\/([\w\.]+)/i],[E,[d,K+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[E,[d,"MIUI "+S]],[/fxios\/([-\w\.]+)/i],[E,[d,N]],[/\bqihu|(qi?ho?o?|360)browser/i],[[d,"360 "+S]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[d,/(.+)/,"$1 "+S],E],[/samsungbrowser\/([\w\.]+)/i],[E,[d,W+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[d,/_/g," "],E],[/metasr[\/ ]?([\d\.]+)/i],[E,[d,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[d,"Sogou Mobile"],E],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[d,E],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[d],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[d,fe],E],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[d,E],[/\bgsa\/([\w\.]+) .*safari\//i],[E,[d,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[E,[d,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[E,[d,y+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[d,y+" WebView"],E],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[E,[d,"Android "+S]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[d,E],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[E,[d,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[E,d],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[d,[E,Le,XA]],[/(webkit|khtml)\/([\w\.]+)/i],[d,E],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[d,"Netscape"],E],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[E,[d,N+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[d,E],[/(cobalt)\/([\w\.]+)/i],[d,[E,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[v,"amd64"]],[/(ia32(?=;))/i],[[v,wt]],[/((?:i[346]|x)86)[;\)]/i],[[v,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[v,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[v,"armhf"]],[/windows (ce|mobile); ppc;/i],[[v,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[v,/ower/,r,wt]],[/(sun4\w)[;\)]/i],[[v,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[v,wt]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[m,W],[p,C]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[m,W],[p,k]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[m,te],[p,k]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[m,te],[p,C]],[/(macintosh);/i],[l,[m,te]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[m,J],[p,k]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[m,w],[p,C]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[m,w],[p,k]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,k]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,C]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[m,"OPPO"],[p,k]],[/\b(opd2\d{3}a?) bui/i],[l,[m,"OPPO"],[p,C]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[m,"Vivo"],[p,k]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[m,"Realme"],[p,k]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[m,U],[p,k]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[m,U],[p,C]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[m,O],[p,C]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[m,O],[p,k]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[m,"Lenovo"],[p,C]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[m,"Nokia"],[p,k]],[/(pixel c)\b/i],[l,[m,R],[p,C]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[m,R],[p,k]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[m,de],[p,k]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[m,de],[p,C]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[m,"OnePlus"],[p,k]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[m,$],[p,C]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[m,$],[p,k]],[/(playbook);[-\w\),; ]+(rim)/i],[l,m,[p,C]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[m,x],[p,k]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[m,A],[p,C]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[m,A],[p,k]],[/(nexus 9)/i],[l,[m,"HTC"],[p,C]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[m,[l,/_/g," "],[p,k]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[m,"Acer"],[p,C]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[m,"Meizu"],[p,k]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[m,"Ulefone"],[p,k]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[m,l,[p,k]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[m,l,[p,C]],[/(surface duo)/i],[l,[m,P],[p,C]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[m,"Fairphone"],[p,k]],[/(u304aa)/i],[l,[m,"AT&T"],[p,k]],[/\bsie-(\w*)/i],[l,[m,"Siemens"],[p,k]],[/\b(rct\w+) b/i],[l,[m,"RCA"],[p,C]],[/\b(venue[\d ]{2,7}) b/i],[l,[m,"Dell"],[p,C]],[/\b(q(?:mv|ta)\w+) b/i],[l,[m,"Verizon"],[p,C]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[m,"Barnes & Noble"],[p,C]],[/\b(tm\d{3}\w+) b/i],[l,[m,"NuVision"],[p,C]],[/\b(k88) b/i],[l,[m,"ZTE"],[p,C]],[/\b(nx\d{3}j) b/i],[l,[m,"ZTE"],[p,k]],[/\b(gen\d{3}) b.+49h/i],[l,[m,"Swiss"],[p,k]],[/\b(zur\d{3}) b/i],[l,[m,"Swiss"],[p,C]],[/\b((zeki)?tb.*\b) b/i],[l,[m,"Zeki"],[p,C]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[m,"Dragon Touch"],l,[p,C]],[/\b(ns-?\w{0,9}) b/i],[l,[m,"Insignia"],[p,C]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[m,"NextBook"],[p,C]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[m,"Voice"],l,[p,k]],[/\b(lvtel\-)?(v1[12]) b/i],[[m,"LvTel"],l,[p,k]],[/\b(ph-1) /i],[l,[m,"Essential"],[p,k]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[m,"Envizen"],[p,C]],[/\b(trio[-\w\. ]+) b/i],[l,[m,"MachSpeed"],[p,C]],[/\btu_(1491) b/i],[l,[m,"Rotor"],[p,C]],[/(shield[\w ]+) b/i],[l,[m,"Nvidia"],[p,C]],[/(sprint) (\w+)/i],[m,l,[p,k]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[m,P],[p,k]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[m,He],[p,C]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[m,He],[p,k]],[/smart-tv.+(samsung)/i],[m,[p,L]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[m,W],[p,L]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[m,O],[p,L]],[/(apple) ?tv/i],[m,[l,te+" TV"],[p,L]],[/crkey/i],[[l,y+"cast"],[m,R],[p,L]],[/droid.+aft(\w+)( bui|\))/i],[l,[m,$],[p,L]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[m,J],[p,L]],[/(bravia[\w ]+)( bui|\))/i],[l,[m,de],[p,L]],[/(mitv-\w{5}) bui/i],[l,[m,ke],[p,L]],[/Hbbtv.*(technisat) (.*);/i],[m,l,[p,L]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[m,Nt],[l,Nt],[p,L]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,L]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[m,l,[p,b]],[/droid.+; (shield) bui/i],[l,[m,"Nvidia"],[p,b]],[/(playstation [345portablevi]+)/i],[l,[m,de],[p,b]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[m,P],[p,b]],[/((pebble))app/i],[m,l,[p,B]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[m,te],[p,B]],[/droid.+; (glass) \d/i],[l,[m,R],[p,B]],[/droid.+; (wt63?0{2,3})\)/i],[l,[m,He],[p,B]],[/(quest( \d| pro)?)/i],[l,[m,fe],[p,B]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[m,[p,G]],[/(aeobc)\b/i],[l,[m,$],[p,G]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,k]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,C]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,C]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,k]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[m,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[E,[d,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[E,[d,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[d,E],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[E,d]],os:[[/microsoft (windows) (vista|xp)/i],[d,E],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[d,[E,Le,wf]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[E,Le,wf],[d,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[E,/_/g,"."],[d,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[d,at],[E,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[E,d],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[d,E],[/\(bb(10);/i],[E,[d,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[E,[d,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[E,[d,N+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[E,[d,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[E,[d,"watchOS"]],[/crkey\/([\d\.]+)/i],[E,[d,y+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[d,we],E],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[d,E],[/(sunos) ?([\w\.\d]*)/i],[[d,"Solaris"],E],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[d,E]]},er=function(ve,Ce){if(typeof ve===o&&(Ce=ve,ve=e),!(this instanceof er))return new er(ve,Ce).getResult();var pe=typeof t!==s&&t.navigator?t.navigator:e,Me=ve||(pe&&pe.userAgent?pe.userAgent:r),Xr=pe&&pe.userAgentData?pe.userAgentData:e,kr=Ce?Ri(Nf,Ce):Nf,Oe=pe&&pe.userAgent==Me;return this.getBrowser=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Me,kr.browser),ie[c]=Gn(ie[E]),Oe&&pe&&pe.brave&&typeof pe.brave.isBrave==i&&(ie[d]="Brave"),ie},this.getCPU=function(){var ie={};return ie[v]=e,Ye.call(ie,Me,kr.cpu),ie},this.getDevice=function(){var ie={};return ie[m]=e,ie[l]=e,ie[p]=e,Ye.call(ie,Me,kr.device),Oe&&!ie[p]&&Xr&&Xr.mobile&&(ie[p]=k),Oe&&ie[l]=="Macintosh"&&pe&&typeof pe.standalone!==s&&pe.maxTouchPoints&&pe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=C),ie},this.getEngine=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Me,kr.engine),ie},this.getOS=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Me,kr.os),Oe&&!ie[d]&&Xr&&Xr.platform&&Xr.platform!="Unknown"&&(ie[d]=Xr.platform.replace(/chrome os/i,we).replace(/macos/i,at)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return Me},this.setUA=function(ie){return Me=typeof ie===a&&ie.length>j?Nt(ie,j):ie,this},this.setUA(Me),this};er.BROWSER=gn([d,E,c]),er.CPU=gn([v]),er.DEVICE=gn([l,m,p,b,k,L,C,B,G]),er.ENGINE=er.OS=gn([d,E]),typeof sa!==s?(typeof bl!==s&&bl.exports&&(sa=bl.exports=er),sa.UAParser=er):typeof define===i&&define.amd?define(function(){return er}):typeof t!==s&&(t.UAParser=er);var ki=typeof t!==s&&(t.jQuery||t.Zepto);if(ki&&!ki.ua){var Fa=new er;ki.ua=Fa.getResult(),ki.ua.get=function(){return Fa.getUA()},ki.ua.set=function(ve){Fa.setUA(ve);var Ce=Fa.getResult();for(var pe in Ce)ki.ua[pe]=Ce[pe]}}})(typeof window=="object"?window:sa)});var rg=he((C7,tg)=>{"use strict";var Zy=ee("url"),eg=1800,rp=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=Zy.parse(r||""),i=this.parse(e),s;return i.domain?(s=i.domain.replace(/^\./,""),(n.hostname.length<s.length||("."+n.hostname).substr(-s.length+1)!=="."+s)&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||eg)||eg)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={};return(e||"").toString().split(";").forEach(n=>{let i=n.split("="),s=i.shift().trim().toLowerCase(),o=i.join("=").trim(),a;if(s)switch(s){case"expires":o=new Date(o),o.toString()!=="Invalid Date"&&(r.expires=o);break;case"path":r.path=o;break;case"domain":a=o.toLowerCase(),a.length&&a.charAt(0)!=="."&&(a="."+a),r.domain=a;break;case"max-age":r.expires=new Date(Date.now()+(Number(o)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break;default:r.name||(r.name=s,r.value=o)}}),r}match(e,r){let n=Zy.parse(r||"");return!(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain)||this.getPath(n.pathname).substr(0,e.path.length)!==e.path||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");return r.pop(),r=r.join("/").trim(),r.charAt(0)!=="/"&&(r="/"+r),r.substr(-1)!=="/"&&(r+="/"),r}};tg.exports=rp});var br=he((D7,oS)=>{oS.exports={name:"nodemailer",version:"8.0.10",description:"Easy as cake e-mail sending from your Node.js applications",main:"lib/nodemailer.js",scripts:{test:"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",format:'prettier --write "**/*.{js,json,md}"',"format:check":'prettier --check "**/*.{js,json,md}"',lint:"eslint .","lint:fix":"eslint . --fix",update:"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":'docker run --rm -v "$PWD:/app:ro" -w /app node:6-alpine node test/syntax-compat.js'},repository:{type:"git",url:"https://github.com/nodemailer/nodemailer.git"},keywords:["Nodemailer"],author:"Andris Reinman",license:"MIT-0",bugs:{url:"https://github.com/nodemailer/nodemailer/issues"},homepage:"https://nodemailer.com/",devDependencies:{"@aws-sdk/client-sesv2":"3.1037.0",bunyan:"1.8.15",c8:"11.0.0",eslint:"10.2.1","eslint-config-prettier":"10.1.8",globals:"17.5.0",libbase64:"1.3.0",libmime:"5.3.8",libqp:"2.1.1",prettier:"3.8.3",proxy:"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.18.4"},engines:{node:">=6.0.0"}}});var lr=he((P7,np)=>{"use strict";var ng={ECONNECTION:"Connection closed unexpectedly",ETIMEDOUT:"Connection or operation timed out",ESOCKET:"Socket-level error",EDNS:"DNS resolution failed",ETLS:"TLS handshake or STARTTLS failed",EREQUIRETLS:"REQUIRETLS not supported by server (RFC 8689)",EPROTOCOL:"Invalid SMTP server response",EENVELOPE:"Invalid mail envelope (sender or recipients)",EMESSAGE:"Message delivery error",ESTREAM:"Stream processing error",EAUTH:"Authentication failed",ENOAUTH:"Authentication credentials not provided",EOAUTH2:"OAuth2 token generation or refresh error",EMAXLIMIT:"Pool resource limit reached (max messages per connection)",ESENDMAIL:"Sendmail command error",ESES:"AWS SES transport error",ECONFIG:"Invalid configuration",EPROXY:"Proxy connection error",EFILEACCESS:"File access rejected (disableFileAccess is set)",EURLACCESS:"URL access rejected (disableUrlAccess is set)",EFETCH:"HTTP fetch error"};np.exports={ERROR_CODES:ng};for(let t of Object.keys(ng))np.exports[t]=t});var aa=he((U7,ip)=>{"use strict";var aS=ee("http"),cS=ee("https"),ig=ee("url"),lS=ee("zlib"),{PassThrough:uS}=ee("stream"),sg=rg(),dS=br(),pS=ee("net"),Wr=lr(),fS=5;ip.exports=function(t,e){return og(t,e)};ip.exports.Cookies=sg;function og(t,e){e=e||{},e.fetchRes=e.fetchRes||new uS,e.cookies=e.cookies||new sg,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?fS:e.maxRedirects,e.cookie&&([].concat(e.cookie||[]).forEach(m=>{e.cookies.set(m,t)}),e.cookie=!1);let r=e.fetchRes,n=ig.parse(t),i=(e.method||"").toString().trim().toUpperCase()||"GET",s=!1,o,a,c=n.protocol==="https:"?cS:aS,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+dS.version};if(Object.keys(e.headers||{}).forEach(m=>{l[m.toLowerCase().trim()]=e.headers[m]}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(o=e.cookies.get(t))&&(l.cookie=o),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(m=>{let E=e.body[m].toString().trim();return encodeURIComponent(m)+"="+encodeURIComponent(E)}).join("&"))}catch(m){if(s)return;s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let d,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!1,agent:!1};e.tls&&Object.assign(p,e.tls),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!pS.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{d=c.request(p)}catch(m){return s=!0,setImmediate(()=>{m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),r}return e.timeout&&d.setTimeout(e.timeout,()=>{if(s)return;s=!0,d.abort();let m=new Error("Request Timeout");m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),d.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))}),d.on("response",m=>{let E;if(!s){switch(m.headers["content-encoding"]){case"gzip":case"deflate":E=lS.createUnzip();break}if(m.headers["set-cookie"]&&[].concat(m.headers["set-cookie"]||[]).forEach(v=>{e.cookies.set(v,t)}),[301,302,303,307,308].includes(m.statusCode)&&m.headers.location){if(e.redirects++,e.redirects>e.maxRedirects){s=!0;let v=new Error("Maximum redirect count exceeded");v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}return e.method="GET",e.body=!1,og(ig.resolve(t,m.headers.location),e)}if(r.statusCode=m.statusCode,r.headers=m.headers,m.statusCode>=300&&!e.allowErrorResponse){s=!0;let v=new Error("Invalid status code "+m.statusCode);v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}m.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())}),E?(m.pipe(E).pipe(r),E.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())})):m.pipe(r)}}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(d);d.write(a)}catch(m){s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}d.end()}),r}});var Kt=he((L7,gt)=>{"use strict";var mS=ee("url"),hS=ee("util"),ES=ee("fs"),yS=aa(),ag=lr(),zr=ee("dns"),gS=ee("net"),vS=ee("os"),ca=300*1e3,AS=30*1e3,cg=1e3,wl=0;gt.exports._lastCacheCleanup=()=>wl;gt.exports._resetCacheCleanup=()=>{wl=0};var ug;try{ug=vS.networkInterfaces()}catch{}gt.exports.networkInterfaces=ug;var dg=(t,e)=>{let r=gt.exports.networkInterfaces;return r?Object.keys(r).map(n=>r[n]).reduce((n,i)=>n.concat(i),[]).filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},lg=(t,e,r,n)=>{if(r=r||{},!dg(t,r.allowInternalNetworkInterfaces))return n(null,[]);(zr.Resolver?new zr.Resolver(r):zr)["resolve"+t](e,(s,o)=>{if(s){switch(s.code){case zr.NODATA:case zr.NOTFOUND:case zr.NOTIMP:case zr.SERVFAIL:case zr.CONNREFUSED:case zr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(s)}return n(null,Array.isArray(o)?o:[].concat(o||[]))})},ur=gt.exports.dnsCache=new Map,Fn=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({servername:t.servername,host:n,_addresses:r},e||{})};gt.exports.resolveHostname=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||gS.isIP(t.host)){let a={addresses:[t.host],servername:t.servername||!1};return e(null,Fn(a,{cached:!1}))}let r;if(ur.has(t.host)){r=ur.get(t.host);let a=Date.now();if(a-wl>AS){wl=a;for(let[c,l]of ur.entries())l.expires&&l.expires<a&&ur.delete(c);if(ur.size>cg){let c=Math.floor(cg*.1);Array.from(ur.keys()).slice(0,c).forEach(d=>ur.delete(d))}}if(!r.expires||r.expires>=a)return e(null,Fn(r.value,{cached:!0}))}let n=[],i=[],s=null,o=null;lg(4,t.host,t,(a,c)=>{a?s=a:n=c||[],lg(6,t.host,t,(l,d)=>{l?o=l:i=d||[];let p=n.concat(i);if(p.length){let m={addresses:p,servername:t.servername||t.host};return ur.set(t.host,{value:m,expires:Date.now()+(t.dnsTtl||ca)}),e(null,Fn(m,{cached:!1}))}if(s&&o&&r)return ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||ca)}),e(null,Fn(r.value,{cached:!0,error:s}));try{zr.lookup(t.host,{all:!0},(m,E)=>{if(m)return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||ca)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(m);let v=E?E.filter(k=>dg(k.family)).map(k=>k.address):[];if(E&&E.length&&!v.length&&console.warn(`Failed to resolve IPv${E[0].family} addresses with current network`),!v.length&&r)return e(null,Fn(r.value,{cached:!0}));let b={addresses:v.length?v:[t.host],servername:t.servername||t.host};return ur.set(t.host,{value:b,expires:Date.now()+(t.dnsTtl||ca)}),e(null,Fn(b,{cached:!1}))})}catch(m){return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||ca)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(s||o||m)}})})};gt.exports.parseConnectionUrl=t=>{t=t||"";let e={},r=mS.parse(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}if(!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),r.auth){let n=r.auth.split(":");e.auth={user:n.shift(),pass:n.join(":")}}return Object.keys(r.query||{}).forEach(n=>{let i=e,s=n,o=r.query[n];switch(isNaN(o)||(o=Number(o)),o){case"true":o=!0;break;case"false":o=!1;break}if(n.indexOf("tls.")===0)s=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;s in i||(i[s]=o)}),e};gt.exports._logFunc=(t,e,r,n,i,...s)=>{let o=Object.assign({},r||{},n||{});delete o.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](o,i,...s)};gt.exports.getLogger=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(s=>{r[s]=()=>!1}),r;let i=t.logger===!0?TS(n):t.logger;return n.forEach(s=>{r[s]=(o,a,...c)=>{gt.exports._logFunc(i,s,e,o,a,...c)}}),r};gt.exports.callbackPromise=(t,e)=>function(){let r=Array.from(arguments),n=r.shift();n?e(n):t(...r)};gt.exports.parseDataURI=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,s=n.split(";");if(s.length>0){let l=s[s.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,s.pop())}let o=s.length>0?s.shift():"application/octet-stream",a={};for(let l=0;l<s.length;l++){let d=s[l],p=d.indexOf("=");if(p>0){let m=d.substring(0,p).trim(),E=d.substring(p+1).trim();m&&(a[m]=E)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:o||"application/octet-stream",params:a}};gt.exports.resolveContent=(t,e,r,n)=>{!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;n||(i=new Promise((a,c)=>{n=gt.exports.callbackPromise(a,c)}));let s=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!s)return n(null,s);if(typeof s=="object"){if(typeof s.pipe=="function")return sp(s,(a,c)=>{if(a)return n(a);t[e].content?t[e].content=c:t[e]=c,n(null,c)});if(/^https?:\/\//i.test(s.path||s.href))return r.disableUrlAccess?setImmediate(()=>{let a=new Error("Url access rejected for "+(s.path||s.href));a.code=ag.EURLACCESS,n(a)}):sp(yS(s.path||s.href),n);if(/^data:/i.test(s.path||s.href)){let a=gt.exports.parseDataURI(s.path||s.href);return!a||!a.data?n(null,Buffer.from(0)):n(null,a.data)}else if(s.path)return r.disableFileAccess?setImmediate(()=>{let a=new Error("File access rejected for "+s.path);a.code=ag.EFILEACCESS,n(a)}):sp(ES.createReadStream(s.path),n)}return typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(s=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,s)),i};gt.exports.assign=function(){let t=Array.from(arguments),e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=Object.assign(e[n]||{},r[n]):e[n]=r[n]})}),e};gt.exports.encodeXText=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let s=e[n];s<33||s>126||s===43||s===61?r+="+"+(s<16?"0":"")+s.toString(16).toUpperCase():r+=String.fromCharCode(s)}return r};function sp(t,e){let r=!1,n=[],i=0;t.on("error",s=>{r||(r=!0,e(s))}),t.on("readable",()=>{let s;for(;(s=t.read())!==null;)n.push(s),i+=s.length}),t.on("end",()=>{if(r)return;r=!0;let s;try{s=Buffer.concat(n,i)}catch(o){return e(o)}e(null,s)})}function TS(t){let e=t.reduce((s,o)=>Math.max(s,o.length),0),r=new Map;t.forEach(s=>{let o=s.toUpperCase();o.length<e&&(o+=" ".repeat(e-o.length)),r.set(s,o)});let n=(s,o,a,...c)=>{let l="";o&&(o.tnx==="server"?l="S: ":o.tnx==="client"&&(l="C: "),o.sid&&(l="["+o.sid+"] "+l),o.cid&&(l="[#"+o.cid+"] "+l)),a=hS.format(a,...c),a.split(/\r?\n/).forEach(d=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(s),l+d)})},i={};return t.forEach(s=>{i[s]=n.bind(null,s)}),i}});var op=he((M7,hg)=>{"use strict";var IS=ee("path"),pg="application/octet-stream",_S="bin",fg=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),mg=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);hg.exports={detectMimeType(t){if(!t)return pg;let e=IS.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=mg.has(r)?mg.get(r):pg;return Array.isArray(n)?n[0]:n},detectExtension(t){if(!t)return _S;let e=(t||"").toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(fg.has(r+"/"+n)){let i=fg.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}}});var lp=he((K7,Ig)=>{"use strict";var xS=/^xn--/,bS=/[^\0-\x7F]/,SS=/[\x2E\u3002\uFF0E\uFF61]/g,wS={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},ap=35,Jr=Math.floor,cp=String.fromCharCode;function Vn(t){throw new RangeError(wS[t])}function NS(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function yg(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(SS,".");let i=t.split("."),s=NS(i,e).join(".");return n+s}function gg(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let s=t.charCodeAt(r++);(s&64512)==56320?e.push(((i&1023)<<10)+(s&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var RS=t=>String.fromCodePoint(...t),OS=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Eg=function(t,e){return t+22+75*(t<26)-((e!=0)<<5)},vg=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>ap*26>>1;n+=36)t=Jr(t/ap);return Jr(n+(ap+1)*t/(t+38))},Ag=function(t){let e=[],r=t.length,n=0,i=128,s=72,o=t.lastIndexOf("-");o<0&&(o=0);for(let a=0;a<o;++a)t.charCodeAt(a)>=128&&Vn("not-basic"),e.push(t.charCodeAt(a));for(let a=o>0?o+1:0;a<r;){let c=n;for(let d=1,p=36;;p+=36){a>=r&&Vn("invalid-input");let m=OS(t.charCodeAt(a++));m>=36&&Vn("invalid-input"),m>Jr((2147483647-n)/d)&&Vn("overflow"),n+=m*d;let E=p<=s?1:p>=s+26?26:p-s;if(m<E)break;let v=36-E;d>Jr(2147483647/v)&&Vn("overflow"),d*=v}let l=e.length+1;s=vg(n-c,l,c==0),Jr(n/l)>2147483647-i&&Vn("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},Tg=function(t){let e=[];t=gg(t);let r=t.length,n=128,i=0,s=72;for(let c of t)c<128&&e.push(cp(c));let o=e.length,a=o;for(o&&e.push("-");a<r;){let c=2147483647;for(let d of t)d>=n&&d<c&&(c=d);let l=a+1;c-n>Jr((2147483647-i)/l)&&Vn("overflow"),i+=(c-n)*l,n=c;for(let d of t)if(d<n&&++i>2147483647&&Vn("overflow"),d===n){let p=i;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(p<E)break;let v=p-E,b=36-E;e.push(cp(Eg(E+v%b,0))),p=Jr(v/b)}e.push(cp(Eg(p,0))),s=vg(i,l,a===o),i=0,++a}++i,++n}return e.join("")},kS=function(t){return yg(t,function(e){return xS.test(e)?Ag(e.slice(4).toLowerCase()):e})},CS=function(t){return yg(t,function(e){return bS.test(e)?"xn--"+Tg(e):e})},DS={version:"2.3.1",ucs2:{decode:gg,encode:RS},decode:Ag,encode:Tg,toASCII:CS,toUnicode:kS};Ig.exports=DS});var fp=he((H7,_g)=>{"use strict";var{Transform:PS}=ee("stream");function up(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function dp(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=[],n=0,i=e*1024,s=new RegExp(".{"+e+"}","g");for(;n<t.length;){let o=t.substr(n,i).replace(s,`$&\r
4
+ -----END ${e}-----`},dm=async(t,e,r)=>{if(ti(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!hr(r))throw new TypeError(nr(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return um(Zs(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},pm=t=>dm("public","spki",t),fm=t=>dm("private","pkcs8",t),hu=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},yu=t=>({data:t,pos:0}),yr=t=>{let e=t.data[t.pos++];if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|t.data[t.pos++];return n}return e},Eu=(t,e=1)=>{if(e<=0)return;t.pos++;let r=yr(t);t.pos+=r,e>1&&Eu(t,e-1)},Mr=(t,e,r)=>{if(t.data[t.pos++]!==e)throw new Error(r)},mm=(t,e)=>{let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},OT=t=>{Mr(t,6,"Expected algorithm OID");let e=yr(t);return mm(t,e)};hm=t=>{let e=OT(t);if(hu(e,[43,101,110]))return"X25519";if(!hu(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mr(t,6,"Expected curve OID");let r=yr(t),n=mm(t,r);for(let{name:i,oid:s}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(hu(n,s))return i;throw new Error("Unsupported named curve")},Em=async(t,e,r,n)=>{let i,s,o=t==="spki",a=()=>o?["verify"]:["sign"],c=()=>o?["encrypt","wrapKey"]:["decrypt","unwrapKey"];switch(r){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:`SHA-${parseInt(r.slice(-3),10)||1}`},s=c();break;case"ES256":case"ES384":case"ES512":{i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[r]},s=a();break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{try{let l=n.getNamedCurve(e);i=l==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:l}}catch{throw new re("Invalid or unsupported key format")}s=o?[]:["deriveBits"];break}case"Ed25519":case"EdDSA":i={name:"Ed25519"},s=a();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:r},s=a();break;default:throw new re('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(t,e,i,n?.extractable??!!o,s)},gu=(t,e)=>za(t.replace(e,"")),ym=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return kT(o),hm(o)}),Em("pkcs8",n,e,i)},vu=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return CT(o),hm(o)}),Em("spki",n,e,i)};gm=(t,e,r)=>{let n;try{n=PT(t)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return vu(um(Zs(n),"PUBLIC KEY"),e,r)}});async function sc(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return vu(t,e,r)}async function vm(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return gm(t,e,r)}async function ao(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return ym(t,e,r)}async function it(t,e,r){if(!be(t))throw new TypeError("JWK must be an object");let n;switch(e??=t.alg,n??=r?.extractable??t.ext,t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return dt(t.k);case"RSA":if("oth"in t&&t.oth!==void 0)throw new re('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Fi({...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return Fi({...t,ext:n})}case"EC":case"OKP":return Fi({...t,alg:e,ext:n});default:throw new re('Unsupported "kty" (Key Type) Parameter value')}}var co=Q(()=>{pt();Au();mu();Te();Qe()});async function Am(t){if(ti(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!hr(t))throw new TypeError(nr(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await crypto.subtle.exportKey("jwk",t);return s.kty==="AKP"&&(s.alg=n),s}var Tm=Q(()=>{Qn();pt();In()});async function Im(t){return pm(t)}async function _m(t){return fm(t)}async function qi(t){return Am(t)}var oc=Q(()=>{Au();Tm()});async function xm(t,e,r,n){let i=t.slice(0,7),s=await Za(i,r,e,n,new Uint8Array);return{encryptedKey:s.ciphertext,iv:De(s.iv),tag:De(s.tag)}}async function bm(t,e,r,n,i){let s=t.slice(0,7);return ec(s,e,r,n,i,new Uint8Array)}var Sm=Q(()=>{ri();pt()});function lo(t){if(t===void 0)throw new q("JWE Encrypted Key missing")}async function wm(t,e,r,n,i){switch(t){case"dir":{if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!be(n.epk))throw new q('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(Hi(e),!fu(e))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await it(n.epk,t);Hi(s);let o,a;if(n.apu!==void 0){if(typeof n.apu!="string")throw new q('JOSE Header "apu" (Agreement PartyUInfo) invalid');o=Pt(n.apu,"apu",q)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new q('JOSE Header "apv" (Agreement PartyVInfo) invalid');a=Pt(n.apv,"apv",q)}let c=await pu(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?Qa(n.enc):parseInt(t.slice(-5,-2),10),o,a);return t==="ECDH-ES"?c:(lo(r),so(t.slice(-6),c,r))}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return lo(r),Hi(e),am(t,e,r);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(lo(r),typeof n.p2c!="number")throw new q('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new q('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new q('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let o;return o=Pt(n.p2s,"p2s",q),Zf(t,e,r,n.p2c,o)}case"A128KW":case"A192KW":case"A256KW":return lo(r),so(t,e,r);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(lo(r),typeof n.iv!="string")throw new q('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new q('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=Pt(n.iv,"iv",q);let o;return o=Pt(n.tag,"tag",q),bm(t,e,r,s,o)}default:throw new re(Nm)}}async function ac(t,e,r,n,i={}){let s,o,a;switch(t){case"dir":{a=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(Hi(r),!fu(r))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:c,apv:l}=i,d;i.epk?d=await ir(i.epk,t):d=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let{x:p,y:m,crv:E,kty:v}=await qi(d),b=await pu(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?Qa(e):parseInt(t.slice(-5,-2),10),c,l);if(o={epk:{x:p,crv:E,kty:v}},v==="EC"&&(o.epk.y=m),c&&(o.apu=De(c)),l&&(o.apv=De(l)),t==="ECDH-ES"){a=b;break}a=n||Ur(e);let k=t.slice(-6);s=await io(k,b,a);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{a=n||Ur(e),Hi(r),s=await om(t,r,a);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{a=n||Ur(e);let{p2c:c,p2s:l}=i;({encryptedKey:s,...o}=await Qf(t,r,a,c,l));break}case"A128KW":case"A192KW":case"A256KW":{a=n||Ur(e),s=await io(t,r,a);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{a=n||Ur(e);let{iv:c}=i;({encryptedKey:s,...o}=await xm(t,r,a,c));break}default:throw new re(Nm)}return{cek:a,encryptedKey:s,parameters:o}}var Nm,cc=Q(()=>{uu();Yf();em();cm();pt();ii();Te();Er();ri();co();oc();Qe();Sm();In();Nm='Invalid or unsupported "alg" (JWE Algorithm) header value'});function Kr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let o of n.crit){if(!s.has(o))throw new re(`Extension Header Parameter "${o}" is not recognized`);if(i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s.get(o)&&n[o]===void 0)throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)}var ji=Q(()=>{Te()});function uo(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}var Tu=Q(()=>{});function Hr(t,e,r){switch(t.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":UT(t,e,r);break;default:LT(t,e,r)}}var Gi,Iu,UT,LT,$i=Q(()=>{Qn();In();Qe();Gi=t=>t?.[Symbol.toStringTag],Iu=(t,e,r)=>{if(e.use!==void 0){let n;switch(r){case"sign":case"verify":n="sig";break;case"encrypt":case"decrypt":n="enc";break}if(e.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(e.alg!==void 0&&e.alg!==t)throw new TypeError(`Invalid key for this operation, its "alg" must be "${t}" when present`);if(Array.isArray(e.key_ops)){let n;switch(!0){case(r==="sign"||r==="verify"):case t==="dir":case t.includes("CBC-HS"):n=r;break;case t.startsWith("PBES2"):n="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(t):!t.includes("GCM")&&t.endsWith("KW")?n=r==="encrypt"?"wrapKey":"unwrapKey":n=r;break;case(r==="encrypt"&&t.startsWith("RSA")):n="wrapKey";break;case r==="decrypt":n=t.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&e.key_ops?.includes?.(n)===!1)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return!0},UT=(t,e,r)=>{if(!(e instanceof Uint8Array)){if(ni(e)){if($f(e)&&Iu(t,e,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(e.type!=="secret")throw new TypeError(`${Gi(e)} instances for symmetric algorithms must be of type "secret"`)}},LT=(t,e,r)=>{if(ni(e))switch(r){case"decrypt":case"sign":if(jf(e)&&Iu(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if(Gf(e)&&Iu(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key"));if(e.type==="secret")throw new TypeError(`${Gi(e)} instances for asymmetric algorithms must not be of type "secret"`);if(e.type==="public")switch(r){case"sign":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm decryption must be of type "private"`)}if(e.type==="private")switch(r){case"verify":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm encryption must be of type "public"`)}}});function Rm(t){if(typeof globalThis[t]>"u")throw new re(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Om(t){Rm("CompressionStream");let e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let n=[],i=e.readable.getReader();for(;;){let{value:s,done:o}=await i.read();if(o)break;n.push(s)}return rt(...n)}async function km(t,e){Rm("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});let i=[],s=0,o=r.readable.getReader();for(;;){let{value:a,done:c}=await o.read();if(c)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new q("Decompressed plaintext exceeded the configured limit")}return rt(...i)}var _u=Q(()=>{Te();Tt()});async function Wi(t,e,r){if(!be(t))throw new q("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new q("JOSE Header missing");if(t.iv!==void 0&&typeof t.iv!="string")throw new q("JWE Initialization Vector incorrect type");if(typeof t.ciphertext!="string")throw new q("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new q("JWE Authentication Tag incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new q("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new q("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new q("JWE AAD incorrect type");if(t.header!==void 0&&!be(t.header))throw new q("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!be(t.unprotected))throw new q("JWE Per-Recipient Unprotected Header incorrect type");let n;if(t.protected)try{let G=dt(t.protected);n=JSON.parse(ct.decode(G))}catch{throw new q("JWE Protected Header is invalid")}if(!Lr(n,t.header,t.unprotected))throw new q("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let i={...n,...t.header,...t.unprotected};if(Kr(q,new Map,r?.crit,n,i),i.zip!==void 0&&i.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(i.zip!==void 0&&!n?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:s,enc:o}=i;if(typeof s!="string"||!s)throw new q("missing JWE Algorithm (alg) in JWE Header");if(typeof o!="string"||!o)throw new q("missing JWE Encryption Algorithm (enc) in JWE Header");let a=r&&uo("keyManagementAlgorithms",r.keyManagementAlgorithms),c=r&&uo("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(a&&!a.has(s)||!a&&s.startsWith("PBES2"))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(c&&!c.has(o))throw new Tn('"enc" (Encryption Algorithm) Header Parameter value not allowed');let l;t.encrypted_key!==void 0&&(l=Pt(t.encrypted_key,"encrypted_key",q));let d=!1;typeof e=="function"&&(e=await e(n,t),d=!0),Hr(s==="dir"?o:s,e,"decrypt");let p=await ir(e,s),m;try{m=await wm(s,p,l,i,r)}catch(G){if(G instanceof TypeError||G instanceof q||G instanceof re)throw G;m=Ur(o)}let E,v;t.iv!==void 0&&(E=Pt(t.iv,"iv",q)),t.tag!==void 0&&(v=Pt(t.tag,"tag",q));let b=t.protected!==void 0?ze(t.protected):new Uint8Array,k;t.aad!==void 0?k=rt(b,ze("."),ze(t.aad)):k=b;let C=Pt(t.ciphertext,"ciphertext",q),L=await ec(o,m,C,E,v,k),B={plaintext:L};if(i.zip==="DEF"){let G=r?.maxDecompressedLength??25e4;if(G===0)throw new re('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(G!==1/0&&(!Number.isSafeInteger(G)||G<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");B.plaintext=await km(L,G).catch(j=>{throw j instanceof q?j:new q("Failed to decompress plaintext",{cause:j})})}return t.protected!==void 0&&(B.protectedHeader=n),t.aad!==void 0&&(B.additionalAuthenticatedData=Pt(t.aad,"aad",q)),t.unprotected!==void 0&&(B.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(B.unprotectedHeader=t.header),d?{...B,key:p}:B}var lc=Q(()=>{pt();ri();Er();Te();Qe();Qe();cc();Tt();ri();ji();Tu();ii();$i();_u()});async function uc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new q("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:o,4:a,length:c}=t.split(".");if(c!==5)throw new q("Invalid Compact JWE");let l=await Wi({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var xu=Q(()=>{lc();Te();Tt()});async function Cm(t,e,r){if(!be(t))throw new q("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(be))throw new q("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new q("JWE Recipients has no members");for(let n of t.recipients)try{return await Wi({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Zr}var Dm=Q(()=>{lc();Te();Qe()});var en,dc=Q(()=>{pt();Er();ri();cc();Te();Qe();Tt();ji();ii();$i();_u();en=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return Ge(this.#o,"setKeyManagementParameters"),this.#o=e,this}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return Ge(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return Ge(this.#s,"setUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}setContentEncryptionKey(e){return Ge(this.#i,"setContentEncryptionKey"),this.#i=e,this}setInitializationVector(e){return Ge(this.#a,"setInitializationVector"),this.#a=e,this}async encrypt(e,r){if(!this.#t&&!this.#s&&!this.#r)throw new q("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!Lr(this.#t,this.#s,this.#r))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this.#t,...this.#s,...this.#r};if(Kr(q,new Map,r?.crit,this.#t,n),n.zip!==void 0&&n.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(n.zip!==void 0&&!this.#t?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let o;if(this.#i&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);Hr(i==="dir"?s:i,e,"encrypt");let a;{let C,L=await ir(e,i);({cek:a,encryptedKey:o,parameters:C}=await ac(i,s,L,this.#i,this.#o)),C&&(r&&tc in r?this.#s?this.#s={...this.#s,...C}:this.setUnprotectedHeader(C):this.#t?this.#t={...this.#t,...C}:this.setProtectedHeader(C))}let c,l,d,p;if(this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array),this.#n){p=De(this.#n);let C=ze(p);c=rt(d,ze("."),C)}else c=d;let m=this.#e;n.zip==="DEF"&&(m=await Om(m).catch(C=>{throw new q("Failed to compress plaintext",{cause:C})}));let{ciphertext:E,tag:v,iv:b}=await Za(s,m,a,this.#a,c),k={ciphertext:De(E)};return b&&(k.iv=De(b)),v&&(k.tag=De(v)),o&&(k.encrypted_key=De(o)),p&&(k.aad=p),this.#t&&(k.protected=l),this.#r&&(k.unprotected=this.#r),this.#s&&(k.header=this.#s),k}}});var bu,pc,Pm=Q(()=>{dc();Er();Te();ri();Qe();cc();pt();ji();ii();$i();bu=class{#e;unprotectedHeader;keyManagementParameters;key;options;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}setKeyManagementParameters(e){return Ge(this.keyManagementParameters,"setKeyManagementParameters"),this.keyManagementParameters=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},pc=class{#e;#t=[];#r;#s;#n;constructor(e){this.#e=e}addRecipient(e,r){let n=new bu(this,e,{crit:r?.crit});return this.#t.push(n),n}setProtectedHeader(e){return Ge(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Ge(this.#s,"setSharedUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}async encrypt(){if(!this.#t.length)throw new q("at least one recipient must be added");if(this.#t.length===1){let[i]=this.#t,s=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(i.unprotectedHeader).encrypt(i.key,{...i.options}),o={ciphertext:s.ciphertext,iv:s.iv,recipients:[{}],tag:s.tag};return s.aad&&(o.aad=s.aad),s.protected&&(o.protected=s.protected),s.unprotected&&(o.unprotected=s.unprotected),s.encrypted_key&&(o.recipients[0].encrypted_key=s.encrypted_key),s.header&&(o.recipients[0].header=s.header),o}let e;for(let i=0;i<this.#t.length;i++){let s=this.#t[i];if(!Lr(this.#r,this.#s,s.unprotectedHeader))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let o={...this.#r,...this.#s,...s.unprotectedHeader},{alg:a}=o;if(typeof a!="string"||!a)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(a==="dir"||a==="ECDH-ES")throw new q('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof o.enc!="string"||!o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!e)e=o.enc;else if(e!==o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(Kr(q,new Map,s.options.crit,this.#r,o),o.zip!==void 0&&o.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(o.zip!==void 0&&!this.#r?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}let r=Ur(e),n={ciphertext:"",recipients:[]};for(let i=0;i<this.#t.length;i++){let s=this.#t[i],o={};if(n.recipients.push(o),i===0){let p=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setContentEncryptionKey(r).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(s.unprotectedHeader).setKeyManagementParameters(s.keyManagementParameters).encrypt(s.key,{...s.options,[tc]:!0});n.ciphertext=p.ciphertext,n.iv=p.iv,n.tag=p.tag,p.aad&&(n.aad=p.aad),p.protected&&(n.protected=p.protected),p.unprotected&&(n.unprotected=p.unprotected),o.encrypted_key=p.encrypted_key,p.header&&(o.header=p.header);continue}let a=s.unprotectedHeader?.alg||this.#r?.alg||this.#s?.alg;Hr(a==="dir"?e:a,s.key,"encrypt");let c=await ir(s.key,a),{encryptedKey:l,parameters:d}=await ac(a,e,c,r,s.keyManagementParameters);o.encrypted_key=De(l),(s.unprotectedHeader||d)&&(o.header={...s.unprotectedHeader,...d})}return n}}});async function zi(t,e,r){if(!be(t))throw new Ee("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new Ee('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new Ee("JWS Protected Header incorrect type");if(t.payload===void 0)throw new Ee("JWS Payload missing");if(typeof t.signature!="string")throw new Ee("JWS Signature missing or incorrect type");if(t.header!==void 0&&!be(t.header))throw new Ee("JWS Unprotected Header incorrect type");let n={};if(t.protected)try{let k=dt(t.protected);n=JSON.parse(ct.decode(k))}catch{throw new Ee("JWS Protected Header is invalid")}if(!Lr(n,t.header))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let i={...n,...t.header},s=Kr(Ee,new Map([["b64",!0]]),r?.crit,n,i),o=!0;if(s.has("b64")&&(o=n.b64,typeof o!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=i;if(typeof a!="string"||!a)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let c=r&&uo("algorithms",r.algorithms);if(c&&!c.has(a))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(o){if(typeof t.payload!="string")throw new Ee("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new Ee("JWS Payload must be a string or an Uint8Array instance");let l=!1;typeof e=="function"&&(e=await e(n,t),l=!0),Hr(a,e,"verify");let d=rt(t.protected!==void 0?ze(t.protected):new Uint8Array,ze("."),typeof t.payload=="string"?o?ze(t.payload):Yn.encode(t.payload):t.payload),p=Pt(t.signature,"signature",Ee),m=await ir(e,a);if(!await im(a,m,p,d))throw new ei;let v;o?v=Pt(t.payload,"payload",Ee):typeof t.payload=="string"?v=Yn.encode(t.payload):v=t.payload;let b={payload:v};return t.protected!==void 0&&(b.protectedHeader=n),t.header!==void 0&&(b.unprotectedHeader=t.header),l?{...b,key:m}:b}var fc=Q(()=>{pt();nc();Te();Tt();Er();Qe();Qe();$i();ji();Tu();ii()});async function mc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new Ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new Ee("Invalid Compact JWS");let a=await zi({payload:i,protected:n,signature:s},e,r),c={payload:a.payload,protectedHeader:a.protectedHeader};return typeof e=="function"?{...c,key:a.key}:c}var Su=Q(()=>{fc();Te();Tt()});async function Um(t,e,r){if(!be(t))throw new Ee("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(be))throw new Ee("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await zi({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new ei}var Lm=Q(()=>{fc();Te();Qe()});function po(t){let e=HT.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");let r=parseFloat(e[2]),n=e[3].toLowerCase(),i;switch(n){case"sec":case"secs":case"second":case"seconds":case"s":i=Math.round(r);break;case"minute":case"minutes":case"min":case"mins":case"m":i=Math.round(r*Km);break;case"hour":case"hours":case"hr":case"hrs":case"h":i=Math.round(r*Hm);break;case"day":case"days":case"d":i=Math.round(r*Nu);break;case"week":case"weeks":case"w":i=Math.round(r*MT);break;default:i=Math.round(r*KT);break}return e[1]==="-"||e[4]==="ago"?-i:i}function si(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function Ji(t,e,r={}){let n;try{n=JSON.parse(ct.decode(e))}catch{}if(!be(n))throw new Xe("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i&&(typeof t.typ!="string"||Mm(t.typ)!==Mm(i)))throw new ft('unexpected "typ" JWT header value',n,"typ","check_failed");let{requiredClaims:s=[],issuer:o,subject:a,audience:c,maxTokenAge:l}=r,d=[...s];l!==void 0&&d.push("iat"),c!==void 0&&d.push("aud"),a!==void 0&&d.push("sub"),o!==void 0&&d.push("iss");for(let v of new Set(d.reverse()))if(!(v in n))throw new ft(`missing required "${v}" claim`,n,v,"missing");if(o&&!(Array.isArray(o)?o:[o]).includes(n.iss))throw new ft('unexpected "iss" claim value',n,"iss","check_failed");if(a&&n.sub!==a)throw new ft('unexpected "sub" claim value',n,"sub","check_failed");if(c&&!FT(n.aud,typeof c=="string"?[c]:c))throw new ft('unexpected "aud" claim value',n,"aud","check_failed");let p;switch(typeof r.clockTolerance){case"string":p=po(r.clockTolerance);break;case"number":p=r.clockTolerance;break;case"undefined":p=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:m}=r,E=_n(m||new Date);if((n.iat!==void 0||l)&&typeof n.iat!="number")throw new ft('"iat" claim must be a number',n,"iat","invalid");if(n.nbf!==void 0){if(typeof n.nbf!="number")throw new ft('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>E+p)throw new ft('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(n.exp!==void 0){if(typeof n.exp!="number")throw new ft('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=E-p)throw new Mi('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){let v=E-n.iat,b=typeof l=="number"?l:po(l);if(v-p>b)throw new Mi('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(v<0-p)throw new ft('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var _n,Km,Hm,Nu,MT,KT,HT,Mm,FT,xn,Yi=Q(()=>{Te();Tt();Qe();_n=t=>Math.floor(t.getTime()/1e3),Km=60,Hm=Km*60,Nu=Hm*24,MT=Nu*7,KT=Nu*365.25,HT=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;Mm=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,FT=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1;xn=class{#e;constructor(e){if(!be(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return Yn.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){typeof e=="number"?this.#e.nbf=si("setNotBefore",e):e instanceof Date?this.#e.nbf=si("setNotBefore",_n(e)):this.#e.nbf=_n(new Date)+po(e)}set exp(e){typeof e=="number"?this.#e.exp=si("setExpirationTime",e):e instanceof Date?this.#e.exp=si("setExpirationTime",_n(e)):this.#e.exp=_n(new Date)+po(e)}set iat(e){e===void 0?this.#e.iat=_n(new Date):e instanceof Date?this.#e.iat=si("setIssuedAt",_n(e)):typeof e=="string"?this.#e.iat=si("setIssuedAt",_n(new Date)+po(e)):this.#e.iat=si("setIssuedAt",e)}}});async function bn(t,e,r){let n=await mc(t,e,r);if(n.protectedHeader.crit?.includes("b64")&&n.protectedHeader.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");let s={payload:Ji(n.protectedHeader,n.payload,r),protectedHeader:n.protectedHeader};return typeof e=="function"?{...s,key:n.key}:s}var Fm=Q(()=>{Su();Yi();Te()});async function Vm(t,e,r){let n=await uc(t,e,r),i=Ji(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ft('replicated "iss" claim header parameter mismatch',i,"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ft('replicated "sub" claim header parameter mismatch',i,"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ft('replicated "aud" claim header parameter mismatch',i,"aud","mismatch");let o={payload:i,protectedHeader:s};return typeof e=="function"?{...o,key:n.key}:o}var Bm=Q(()=>{xu();Yi();Te()});var Xi,wu=Q(()=>{dc();Xi=class{#e;constructor(e){this.#e=new en(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var Sn,hc=Q(()=>{pt();nc();Qe();Te();Tt();$i();ji();ii();Er();Sn=class{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return Ge(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){if(!this.#t&&!this.#r)throw new Ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Lr(this.#t,this.#r))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this.#t,...this.#r},i=Kr(Ee,new Map([["b64",!0]]),r?.crit,this.#t,n),s=!0;if(i.has("b64")&&(s=this.#t.b64,typeof s!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');Hr(o,e,"sign");let a,c;s?(a=De(this.#e),c=ze(a)):(c=this.#e,a="");let l,d;this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array);let p=rt(d,ze("."),c),m=await ir(e,o),E=await nm(o,m,p),v={signature:De(E),payload:a};return this.#r&&(v.header=this.#r),this.#t&&(v.protected=l),v}}});var Qi,Ru=Q(()=>{hc();Qi=class{#e;constructor(e){this.#e=new Sn(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}async sign(e,r){let n=await this.#e.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var Ou,Ec,qm=Q(()=>{hc();Te();Er();Ou=class{#e;protectedHeader;unprotectedHeader;options;key;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setProtectedHeader(e){return Ge(this.protectedHeader,"setProtectedHeader"),this.protectedHeader=e,this}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Ec=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new Ou(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new Ee("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this.#t.length;r++){let n=this.#t[r],i=new Sn(this.#e);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...o}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new Ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(o)}return e}}});var Zi,jm=Q(()=>{Ru();Te();Yi();Zi=class{#e;#t;constructor(e={}){this.#t=new xn(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){let n=new Qi(this.#t.data());if(n.setProtectedHeader(this.#e),Array.isArray(this.#e?.crit)&&this.#e.crit.includes("b64")&&this.#e.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}});var yc,Gm=Q(()=>{wu();Yi();Er();yc=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e={}){this.#o=new xn(e)}setIssuer(e){return this.#o.iss=e,this}setSubject(e){return this.#o.sub=e,this}setAudience(e){return this.#o.aud=e,this}setJti(e){return this.#o.jti=e,this}setNotBefore(e){return this.#o.nbf=e,this}setExpirationTime(e){return this.#o.exp=e,this}setIssuedAt(e){return this.#o.iat=e,this}setProtectedHeader(e){return Ge(this.#s,"setProtectedHeader"),this.#s=e,this}setKeyManagementParameters(e){return Ge(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return Ge(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Ge(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#n=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,r){let n=new Xi(this.#o.data());return this.#s&&(this.#n||this.#i||this.#a)&&(this.#s={...this.#s,iss:this.#n?this.#o.iss:void 0,sub:this.#i?this.#o.sub:void 0,aud:this.#a?this.#o.aud:void 0}),n.setProtectedHeader(this.#s),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}});async function ku(t,e){let r;if(ni(t))r=t;else if(no(t))r=await qi(t);else throw new TypeError(nr(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":Fr(r.alg,'"alg" (Algorithm) Parameter'),Fr(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":Fr(r.crv,'"crv" (Curve) Parameter'),Fr(r.x,'"x" (X Coordinate) Parameter'),Fr(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":Fr(r.crv,'"crv" (Subtype of Key Pair) Parameter'),Fr(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":Fr(r.e,'"e" (Exponent) Parameter'),Fr(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":Fr(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new re('"kty" (Key Type) Parameter missing or unsupported')}let i=ze(JSON.stringify(n));return De(await rc(e,i))}async function $m(t,e){e??="sha256";let r=await ku(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var Fr,Wm=Q(()=>{Er();pt();Te();Tt();In();Qe();oc();Qn();Fr=(t,e)=>{if(typeof t!="string"||!t)throw new eo(`${e} missing or invalid`)}});async function zm(t,e){let r={...t,...e?.header};if(!be(r.jwk))throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await it({...r.jwk,ext:!0},r.alg);if(n instanceof Uint8Array||n.type!=="public")throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var Jm=Q(()=>{co();Qe();Te()});function VT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new re('Unsupported "alg" value for a JSON Web Key Set')}}function BT(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(qT)}function qT(t){return be(t)}async function Ym(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await it({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Ki("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function fo(t){let e=new Cu(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperties(r,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),r}var Cu,Du=Q(()=>{co();Te();Qe();Cu=class{#e;#t=new WeakMap;constructor(e){if(!BT(e))throw new Ki("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=VT(n),o=this.#e.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&(typeof l.alg=="string"||s==="AKP")&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break;case"Ed25519":case"EdDSA":d=l.crv==="Ed25519";break}return d}),{0:a,length:c}=o;if(c===0)throw new Zn;if(c!==1){let l=new to,d=this.#t;throw l[Symbol.asyncIterator]=async function*(){for(let p of o)try{yield await Ym(d,p,n)}catch{}},l}return Ym(this.#t,a,n)}}});function jT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function GT(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new ro:s});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function $T(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>=e||!("jwks"in t)||!be(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,be))}function Xm(t,e){let r=new Uu(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>r.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>r.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>r.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>r.jwks(),enumerable:!0,configurable:!1,writable:!1}}),n}var Pu,Lu,mo,Uu,Qm=Q(()=>{Te();Du();Qe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(Pu="jose/v6.2.3");Lu=Symbol();mo=Symbol();Uu=class{#e;#t;#r;#s;#n;#i;#a;#o;#l;#c;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href),this.#t=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this.#r=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this.#s=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5,this.#a=new Headers(r?.headers),Pu&&!this.#a.has("User-Agent")&&this.#a.set("User-Agent",Pu),this.#a.has("accept")||(this.#a.set("accept","application/json"),this.#a.append("accept","application/jwk-set+json")),this.#o=r?.[Lu],r?.[mo]!==void 0&&(this.#c=r?.[mo],$T(r?.[mo],this.#s)&&(this.#n=this.#c.uat,this.#l=fo(this.#c.jwks)))}pendingFetch(){return!!this.#i}coolingDown(){return typeof this.#n=="number"?Date.now()<this.#n+this.#r:!1}fresh(){return typeof this.#n=="number"?Date.now()<this.#n+this.#s:!1}jwks(){return this.#l?.jwks()}async getKey(e,r){(!this.#l||!this.fresh())&&await this.reload();try{return await this.#l(e,r)}catch(n){if(n instanceof Zn&&this.coolingDown()===!1)return await this.reload(),this.#l(e,r);throw n}}async reload(){this.#i&&jT()&&(this.#i=void 0),this.#i||=GT(this.#e.href,this.#a,AbortSignal.timeout(this.#t),this.#o).then(e=>{this.#l=fo(e),this.#c&&(this.#c.uat=Date.now(),this.#c.jwks=e),this.#n=Date.now(),this.#i=void 0}).catch(e=>{throw this.#i=void 0,e}),await this.#i}}});var gc,Zm=Q(()=>{pt();Tt();Te();Yi();gc=class{#e;constructor(e={}){this.#e=new xn(e)}encode(){let e=De(JSON.stringify({alg:"none"})),r=De(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new Xe("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new Xe("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(ct.decode(dt(n))),a.alg!=="none")throw new Error}catch{throw new Xe("Invalid Unsecured JWT")}return{payload:Ji(a,dt(i),r),header:a}}}});function eh(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ct.decode(dt(e)));if(!be(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var th=Q(()=>{pt();Tt();Qe()});function rh(t){if(typeof t!="string")throw new Xe("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new Xe("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new Xe("Invalid JWT");if(!e)throw new Xe("JWTs must contain a payload");let n;try{n=dt(e)}catch{throw new Xe("Failed to base64url decode the payload")}let i;try{i=JSON.parse(ct.decode(n))}catch{throw new Xe("Failed to parse the decoded payload as JSON")}if(!be(i))throw new Xe("Invalid JWT Claims Set");return i}var nh=Q(()=>{pt();Tt();Qe();Te()});function Mu(t){let e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new re("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function ih(t,e){let r,n;switch(t){case"PS256":case"PS384":case"PS512":r={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RS256":case"RS384":case"RS512":r={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":r={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"},n=["sign","verify"];break;case"ES384":r={name:"ECDSA",namedCurve:"P-384"},n=["sign","verify"];break;case"ES512":r={name:"ECDSA",namedCurve:"P-521"},n=["sign","verify"];break;case"Ed25519":case"EdDSA":{n=["sign","verify"],r={name:"Ed25519"};break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{n=["sign","verify"],r={name:t};break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{n=["deriveBits"];let i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":{r={name:"ECDH",namedCurve:i};break}case"X25519":r={name:"X25519"};break;default:throw new re("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}break}default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(r,e?.extractable??!1,n)}var sh=Q(()=>{Te()});async function oh(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}var ah=Q(()=>{Te()});var ch={};Ba(ch,{CompactEncrypt:()=>Xi,CompactSign:()=>Qi,EmbeddedJWK:()=>zm,EncryptJWT:()=>yc,FlattenedEncrypt:()=>en,FlattenedSign:()=>Sn,GeneralEncrypt:()=>pc,GeneralSign:()=>Ec,SignJWT:()=>Zi,UnsecuredJWT:()=>gc,base64url:()=>Ja,calculateJwkThumbprint:()=>ku,calculateJwkThumbprintUri:()=>$m,compactDecrypt:()=>uc,compactVerify:()=>mc,createLocalJWKSet:()=>fo,createRemoteJWKSet:()=>Xm,cryptoRuntime:()=>WT,customFetch:()=>Lu,decodeJwt:()=>rh,decodeProtectedHeader:()=>eh,errors:()=>lu,exportJWK:()=>qi,exportPKCS8:()=>_m,exportSPKI:()=>Im,flattenedDecrypt:()=>Wi,flattenedVerify:()=>zi,generalDecrypt:()=>Cm,generalVerify:()=>Um,generateKeyPair:()=>ih,generateSecret:()=>oh,importJWK:()=>it,importPKCS8:()=>ao,importSPKI:()=>sc,importX509:()=>vm,jwksCache:()=>mo,jwtDecrypt:()=>Vm,jwtVerify:()=>bn});var WT,ho=Q(()=>{xu();lc();Dm();Pm();Su();fc();Lm();Fm();Bm();wu();dc();Ru();hc();qm();jm();Gm();Wm();Jm();Du();Qm();Zm();oc();co();th();nh();Te();sh();ah();pt();WT="WebCryptoAPI"});var eg=he((oa,wl)=>{(function(t,e){"use strict";var r="",n="?",i="function",s="undefined",o="object",a="string",c="major",l="model",d="name",p="type",m="vendor",E="version",v="architecture",b="console",k="mobile",C="tablet",L="smarttv",B="wearable",G="embedded",j=500,$="Amazon",te="Apple",A="ASUS",x="BlackBerry",S="Browser",y="Chrome",I="Edge",w="Firefox",R="Google",N="Huawei",O="LG",P="Microsoft",U="Motorola",K="Opera",W="Samsung",J="Sharp",de="Sony",ke="Xiaomi",He="Zebra",fe="Facebook",Ne="Chromium OS",at="Mac OS",Ri=function(ve,Ce){var pe={};for(var Ke in ve)Ce[Ke]&&Ce[Ke].length%2===0?pe[Ke]=Ce[Ke].concat(ve[Ke]):pe[Ke]=ve[Ke];return pe},gn=function(ve){for(var Ce={},pe=0;pe<ve.length;pe++)Ce[ve[pe].toUpperCase()]=ve[pe];return Ce},Oi=function(ve,Ce){return typeof ve===a?Nt(Ce).indexOf(Nt(ve))!==-1:!1},Nt=function(ve){return ve.toLowerCase()},Gn=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},wt=function(ve,Ce){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof Ce===s?ve:ve.substring(0,j)},Ye=function(ve,Ce){for(var pe=0,Ke,Xr,kr,Oe,ie,Cr;pe<Ce.length&&!ie;){var Ql=Ce[pe],Df=Ce[pe+1];for(Ke=Xr=0;Ke<Ql.length&&!ie&&Ql[Ke];)if(ie=Ql[Ke++].exec(ve),ie)for(kr=0;kr<Df.length;kr++)Cr=ie[++Xr],Oe=Df[kr],typeof Oe===o&&Oe.length>0?Oe.length===2?typeof Oe[1]==i?this[Oe[0]]=Oe[1].call(this,Cr):this[Oe[0]]=Oe[1]:Oe.length===3?typeof Oe[1]===i&&!(Oe[1].exec&&Oe[1].test)?this[Oe[0]]=Cr?Oe[1].call(this,Cr,Oe[2]):e:this[Oe[0]]=Cr?Cr.replace(Oe[1],Oe[2]):e:Oe.length===4&&(this[Oe[0]]=Cr?Oe[3].call(this,Cr.replace(Oe[1],Oe[2])):e):this[Oe]=Cr||e;pe+=2}},Me=function(ve,Ce){for(var pe in Ce)if(typeof Ce[pe]===o&&Ce[pe].length>0){for(var Ke=0;Ke<Ce[pe].length;Ke++)if(Oi(Ce[pe][Ke],ve))return pe===n?e:pe}else if(Oi(Ce[pe],ve))return pe===n?e:pe;return ve},tT={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},kf={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Cf={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[E,[d,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[E,[d,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[d,E],[/opios[\/ ]+([\w\.]+)/i],[E,[d,K+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[E,[d,K+" GX"]],[/\bopr\/([\w\.]+)/i],[E,[d,K]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[E,[d,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[d,E],[/\bddg\/([\w\.]+)/i],[E,[d,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[E,[d,"UC"+S]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[E,[d,"WeChat"]],[/konqueror\/([\w\.]+)/i],[E,[d,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[E,[d,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[E,[d,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[E,[d,"Smart Lenovo "+S]],[/(avast|avg)\/([\w\.]+)/i],[[d,/(.+)/,"$1 Secure "+S],E],[/\bfocus\/([\w\.]+)/i],[E,[d,w+" Focus"]],[/\bopt\/([\w\.]+)/i],[E,[d,K+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[E,[d,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[E,[d,"Dolphin"]],[/coast\/([\w\.]+)/i],[E,[d,K+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[E,[d,"MIUI "+S]],[/fxios\/([-\w\.]+)/i],[E,[d,w]],[/\bqihu|(qi?ho?o?|360)browser/i],[[d,"360 "+S]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[d,/(.+)/,"$1 "+S],E],[/samsungbrowser\/([\w\.]+)/i],[E,[d,W+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[d,/_/g," "],E],[/metasr[\/ ]?([\d\.]+)/i],[E,[d,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[d,"Sogou Mobile"],E],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[d,E],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[d],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[d,fe],E],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[d,E],[/\bgsa\/([\w\.]+) .*safari\//i],[E,[d,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[E,[d,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[E,[d,y+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[d,y+" WebView"],E],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[E,[d,"Android "+S]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[d,E],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[E,[d,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[E,d],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[d,[E,Me,tT]],[/(webkit|khtml)\/([\w\.]+)/i],[d,E],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[d,"Netscape"],E],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[E,[d,w+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[d,E],[/(cobalt)\/([\w\.]+)/i],[d,[E,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[v,"amd64"]],[/(ia32(?=;))/i],[[v,Nt]],[/((?:i[346]|x)86)[;\)]/i],[[v,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[v,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[v,"armhf"]],[/windows (ce|mobile); ppc;/i],[[v,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[v,/ower/,r,Nt]],[/(sun4\w)[;\)]/i],[[v,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[v,Nt]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[m,W],[p,C]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[m,W],[p,k]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[m,te],[p,k]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[m,te],[p,C]],[/(macintosh);/i],[l,[m,te]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[m,J],[p,k]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[m,N],[p,C]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[m,N],[p,k]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,k]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,C]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[m,"OPPO"],[p,k]],[/\b(opd2\d{3}a?) bui/i],[l,[m,"OPPO"],[p,C]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[m,"Vivo"],[p,k]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[m,"Realme"],[p,k]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[m,U],[p,k]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[m,U],[p,C]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[m,O],[p,C]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[m,O],[p,k]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[m,"Lenovo"],[p,C]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[m,"Nokia"],[p,k]],[/(pixel c)\b/i],[l,[m,R],[p,C]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[m,R],[p,k]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[m,de],[p,k]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[m,de],[p,C]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[m,"OnePlus"],[p,k]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[m,$],[p,C]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[m,$],[p,k]],[/(playbook);[-\w\),; ]+(rim)/i],[l,m,[p,C]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[m,x],[p,k]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[m,A],[p,C]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[m,A],[p,k]],[/(nexus 9)/i],[l,[m,"HTC"],[p,C]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[m,[l,/_/g," "],[p,k]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[m,"Acer"],[p,C]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[m,"Meizu"],[p,k]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[m,"Ulefone"],[p,k]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[m,l,[p,k]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[m,l,[p,C]],[/(surface duo)/i],[l,[m,P],[p,C]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[m,"Fairphone"],[p,k]],[/(u304aa)/i],[l,[m,"AT&T"],[p,k]],[/\bsie-(\w*)/i],[l,[m,"Siemens"],[p,k]],[/\b(rct\w+) b/i],[l,[m,"RCA"],[p,C]],[/\b(venue[\d ]{2,7}) b/i],[l,[m,"Dell"],[p,C]],[/\b(q(?:mv|ta)\w+) b/i],[l,[m,"Verizon"],[p,C]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[m,"Barnes & Noble"],[p,C]],[/\b(tm\d{3}\w+) b/i],[l,[m,"NuVision"],[p,C]],[/\b(k88) b/i],[l,[m,"ZTE"],[p,C]],[/\b(nx\d{3}j) b/i],[l,[m,"ZTE"],[p,k]],[/\b(gen\d{3}) b.+49h/i],[l,[m,"Swiss"],[p,k]],[/\b(zur\d{3}) b/i],[l,[m,"Swiss"],[p,C]],[/\b((zeki)?tb.*\b) b/i],[l,[m,"Zeki"],[p,C]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[m,"Dragon Touch"],l,[p,C]],[/\b(ns-?\w{0,9}) b/i],[l,[m,"Insignia"],[p,C]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[m,"NextBook"],[p,C]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[m,"Voice"],l,[p,k]],[/\b(lvtel\-)?(v1[12]) b/i],[[m,"LvTel"],l,[p,k]],[/\b(ph-1) /i],[l,[m,"Essential"],[p,k]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[m,"Envizen"],[p,C]],[/\b(trio[-\w\. ]+) b/i],[l,[m,"MachSpeed"],[p,C]],[/\btu_(1491) b/i],[l,[m,"Rotor"],[p,C]],[/(shield[\w ]+) b/i],[l,[m,"Nvidia"],[p,C]],[/(sprint) (\w+)/i],[m,l,[p,k]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[m,P],[p,k]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[m,He],[p,C]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[m,He],[p,k]],[/smart-tv.+(samsung)/i],[m,[p,L]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[m,W],[p,L]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[m,O],[p,L]],[/(apple) ?tv/i],[m,[l,te+" TV"],[p,L]],[/crkey/i],[[l,y+"cast"],[m,R],[p,L]],[/droid.+aft(\w+)( bui|\))/i],[l,[m,$],[p,L]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[m,J],[p,L]],[/(bravia[\w ]+)( bui|\))/i],[l,[m,de],[p,L]],[/(mitv-\w{5}) bui/i],[l,[m,ke],[p,L]],[/Hbbtv.*(technisat) (.*);/i],[m,l,[p,L]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[m,wt],[l,wt],[p,L]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,L]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[m,l,[p,b]],[/droid.+; (shield) bui/i],[l,[m,"Nvidia"],[p,b]],[/(playstation [345portablevi]+)/i],[l,[m,de],[p,b]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[m,P],[p,b]],[/((pebble))app/i],[m,l,[p,B]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[m,te],[p,B]],[/droid.+; (glass) \d/i],[l,[m,R],[p,B]],[/droid.+; (wt63?0{2,3})\)/i],[l,[m,He],[p,B]],[/(quest( \d| pro)?)/i],[l,[m,fe],[p,B]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[m,[p,G]],[/(aeobc)\b/i],[l,[m,$],[p,G]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,k]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,C]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,C]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,k]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[m,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[E,[d,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[E,[d,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[d,E],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[E,d]],os:[[/microsoft (windows) (vista|xp)/i],[d,E],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[d,[E,Me,kf]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[E,Me,kf],[d,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[E,/_/g,"."],[d,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[d,at],[E,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[E,d],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[d,E],[/\(bb(10);/i],[E,[d,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[E,[d,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[E,[d,w+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[E,[d,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[E,[d,"watchOS"]],[/crkey\/([\d\.]+)/i],[E,[d,y+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[d,Ne],E],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[d,E],[/(sunos) ?([\w\.\d]*)/i],[[d,"Solaris"],E],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[d,E]]},er=function(ve,Ce){if(typeof ve===o&&(Ce=ve,ve=e),!(this instanceof er))return new er(ve,Ce).getResult();var pe=typeof t!==s&&t.navigator?t.navigator:e,Ke=ve||(pe&&pe.userAgent?pe.userAgent:r),Xr=pe&&pe.userAgentData?pe.userAgentData:e,kr=Ce?Ri(Cf,Ce):Cf,Oe=pe&&pe.userAgent==Ke;return this.getBrowser=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.browser),ie[c]=Gn(ie[E]),Oe&&pe&&pe.brave&&typeof pe.brave.isBrave==i&&(ie[d]="Brave"),ie},this.getCPU=function(){var ie={};return ie[v]=e,Ye.call(ie,Ke,kr.cpu),ie},this.getDevice=function(){var ie={};return ie[m]=e,ie[l]=e,ie[p]=e,Ye.call(ie,Ke,kr.device),Oe&&!ie[p]&&Xr&&Xr.mobile&&(ie[p]=k),Oe&&ie[l]=="Macintosh"&&pe&&typeof pe.standalone!==s&&pe.maxTouchPoints&&pe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=C),ie},this.getEngine=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.engine),ie},this.getOS=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.os),Oe&&!ie[d]&&Xr&&Xr.platform&&Xr.platform!="Unknown"&&(ie[d]=Xr.platform.replace(/chrome os/i,Ne).replace(/macos/i,at)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return Ke},this.setUA=function(ie){return Ke=typeof ie===a&&ie.length>j?wt(ie,j):ie,this},this.setUA(Ke),this};er.BROWSER=gn([d,E,c]),er.CPU=gn([v]),er.DEVICE=gn([l,m,p,b,k,L,C,B,G]),er.ENGINE=er.OS=gn([d,E]),typeof oa!==s?(typeof wl!==s&&wl.exports&&(oa=wl.exports=er),oa.UAParser=er):typeof define===i&&define.amd?define(function(){return er}):typeof t!==s&&(t.UAParser=er);var ki=typeof t!==s&&(t.jQuery||t.Zepto);if(ki&&!ki.ua){var Va=new er;ki.ua=Va.getResult(),ki.ua.get=function(){return Va.getUA()},ki.ua.set=function(ve){Va.setUA(ve);var Ce=Va.getResult();for(var pe in Ce)ki.ua[pe]=Ce[pe]}}})(typeof window=="object"?window:oa)});var og=he((H7,sg)=>{"use strict";var ng=ee("url"),ig=1800,op=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=ng.parse(r||""),i=this.parse(e),s;return i.domain?(s=i.domain.replace(/^\./,""),(n.hostname.length<s.length||("."+n.hostname).substr(-s.length+1)!=="."+s)&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||ig)||ig)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={};return(e||"").toString().split(";").forEach(n=>{let i=n.split("="),s=i.shift().trim().toLowerCase(),o=i.join("=").trim(),a;if(s)switch(s){case"expires":o=new Date(o),o.toString()!=="Invalid Date"&&(r.expires=o);break;case"path":r.path=o;break;case"domain":a=o.toLowerCase(),a.length&&a.charAt(0)!=="."&&(a="."+a),r.domain=a;break;case"max-age":r.expires=new Date(Date.now()+(Number(o)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break;default:r.name||(r.name=s,r.value=o)}}),r}match(e,r){let n=ng.parse(r||"");return!(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain)||this.getPath(n.pathname).substr(0,e.path.length)!==e.path||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");return r.pop(),r=r.join("/").trim(),r.charAt(0)!=="/"&&(r="/"+r),r.substr(-1)!=="/"&&(r+="/"),r}};sg.exports=op});var br=he((F7,fS)=>{fS.exports={name:"nodemailer",version:"8.0.10",description:"Easy as cake e-mail sending from your Node.js applications",main:"lib/nodemailer.js",scripts:{test:"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",format:'prettier --write "**/*.{js,json,md}"',"format:check":'prettier --check "**/*.{js,json,md}"',lint:"eslint .","lint:fix":"eslint . --fix",update:"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":'docker run --rm -v "$PWD:/app:ro" -w /app node:6-alpine node test/syntax-compat.js'},repository:{type:"git",url:"https://github.com/nodemailer/nodemailer.git"},keywords:["Nodemailer"],author:"Andris Reinman",license:"MIT-0",bugs:{url:"https://github.com/nodemailer/nodemailer/issues"},homepage:"https://nodemailer.com/",devDependencies:{"@aws-sdk/client-sesv2":"3.1037.0",bunyan:"1.8.15",c8:"11.0.0",eslint:"10.2.1","eslint-config-prettier":"10.1.8",globals:"17.5.0",libbase64:"1.3.0",libmime:"5.3.8",libqp:"2.1.1",prettier:"3.8.3",proxy:"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.18.4"},engines:{node:">=6.0.0"}}});var lr=he((V7,ap)=>{"use strict";var ag={ECONNECTION:"Connection closed unexpectedly",ETIMEDOUT:"Connection or operation timed out",ESOCKET:"Socket-level error",EDNS:"DNS resolution failed",ETLS:"TLS handshake or STARTTLS failed",EREQUIRETLS:"REQUIRETLS not supported by server (RFC 8689)",EPROTOCOL:"Invalid SMTP server response",EENVELOPE:"Invalid mail envelope (sender or recipients)",EMESSAGE:"Message delivery error",ESTREAM:"Stream processing error",EAUTH:"Authentication failed",ENOAUTH:"Authentication credentials not provided",EOAUTH2:"OAuth2 token generation or refresh error",EMAXLIMIT:"Pool resource limit reached (max messages per connection)",ESENDMAIL:"Sendmail command error",ESES:"AWS SES transport error",ECONFIG:"Invalid configuration",EPROXY:"Proxy connection error",EFILEACCESS:"File access rejected (disableFileAccess is set)",EURLACCESS:"URL access rejected (disableUrlAccess is set)",EFETCH:"HTTP fetch error"};ap.exports={ERROR_CODES:ag};for(let t of Object.keys(ag))ap.exports[t]=t});var ca=he((B7,cp)=>{"use strict";var mS=ee("http"),hS=ee("https"),cg=ee("url"),ES=ee("zlib"),{PassThrough:yS}=ee("stream"),lg=og(),gS=br(),vS=ee("net"),Wr=lr(),AS=5;cp.exports=function(t,e){return ug(t,e)};cp.exports.Cookies=lg;function ug(t,e){e=e||{},e.fetchRes=e.fetchRes||new yS,e.cookies=e.cookies||new lg,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?AS:e.maxRedirects,e.cookie&&([].concat(e.cookie||[]).forEach(m=>{e.cookies.set(m,t)}),e.cookie=!1);let r=e.fetchRes,n=cg.parse(t),i=(e.method||"").toString().trim().toUpperCase()||"GET",s=!1,o,a,c=n.protocol==="https:"?hS:mS,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+gS.version};if(Object.keys(e.headers||{}).forEach(m=>{l[m.toLowerCase().trim()]=e.headers[m]}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(o=e.cookies.get(t))&&(l.cookie=o),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(m=>{let E=e.body[m].toString().trim();return encodeURIComponent(m)+"="+encodeURIComponent(E)}).join("&"))}catch(m){if(s)return;s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let d,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!1,agent:!1};e.tls&&Object.assign(p,e.tls),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!vS.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{d=c.request(p)}catch(m){return s=!0,setImmediate(()=>{m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),r}return e.timeout&&d.setTimeout(e.timeout,()=>{if(s)return;s=!0,d.abort();let m=new Error("Request Timeout");m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),d.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))}),d.on("response",m=>{let E;if(!s){switch(m.headers["content-encoding"]){case"gzip":case"deflate":E=ES.createUnzip();break}if(m.headers["set-cookie"]&&[].concat(m.headers["set-cookie"]||[]).forEach(v=>{e.cookies.set(v,t)}),[301,302,303,307,308].includes(m.statusCode)&&m.headers.location){if(e.redirects++,e.redirects>e.maxRedirects){s=!0;let v=new Error("Maximum redirect count exceeded");v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}return e.method="GET",e.body=!1,ug(cg.resolve(t,m.headers.location),e)}if(r.statusCode=m.statusCode,r.headers=m.headers,m.statusCode>=300&&!e.allowErrorResponse){s=!0;let v=new Error("Invalid status code "+m.statusCode);v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}m.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())}),E?(m.pipe(E).pipe(r),E.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())})):m.pipe(r)}}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(d);d.write(a)}catch(m){s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}d.end()}),r}});var Kt=he((q7,gt)=>{"use strict";var TS=ee("url"),IS=ee("util"),_S=ee("fs"),xS=ca(),dg=lr(),zr=ee("dns"),bS=ee("net"),SS=ee("os"),la=300*1e3,NS=30*1e3,pg=1e3,Ol=0;gt.exports._lastCacheCleanup=()=>Ol;gt.exports._resetCacheCleanup=()=>{Ol=0};var mg;try{mg=SS.networkInterfaces()}catch{}gt.exports.networkInterfaces=mg;var hg=(t,e)=>{let r=gt.exports.networkInterfaces;return r?Object.keys(r).map(n=>r[n]).reduce((n,i)=>n.concat(i),[]).filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},fg=(t,e,r,n)=>{if(r=r||{},!hg(t,r.allowInternalNetworkInterfaces))return n(null,[]);(zr.Resolver?new zr.Resolver(r):zr)["resolve"+t](e,(s,o)=>{if(s){switch(s.code){case zr.NODATA:case zr.NOTFOUND:case zr.NOTIMP:case zr.SERVFAIL:case zr.CONNREFUSED:case zr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(s)}return n(null,Array.isArray(o)?o:[].concat(o||[]))})},ur=gt.exports.dnsCache=new Map,Fn=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({servername:t.servername,host:n,_addresses:r},e||{})};gt.exports.resolveHostname=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||bS.isIP(t.host)){let a={addresses:[t.host],servername:t.servername||!1};return e(null,Fn(a,{cached:!1}))}let r;if(ur.has(t.host)){r=ur.get(t.host);let a=Date.now();if(a-Ol>NS){Ol=a;for(let[c,l]of ur.entries())l.expires&&l.expires<a&&ur.delete(c);if(ur.size>pg){let c=Math.floor(pg*.1);Array.from(ur.keys()).slice(0,c).forEach(d=>ur.delete(d))}}if(!r.expires||r.expires>=a)return e(null,Fn(r.value,{cached:!0}))}let n=[],i=[],s=null,o=null;fg(4,t.host,t,(a,c)=>{a?s=a:n=c||[],fg(6,t.host,t,(l,d)=>{l?o=l:i=d||[];let p=n.concat(i);if(p.length){let m={addresses:p,servername:t.servername||t.host};return ur.set(t.host,{value:m,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(m,{cached:!1}))}if(s&&o&&r)return ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:s}));try{zr.lookup(t.host,{all:!0},(m,E)=>{if(m)return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(m);let v=E?E.filter(k=>hg(k.family)).map(k=>k.address):[];if(E&&E.length&&!v.length&&console.warn(`Failed to resolve IPv${E[0].family} addresses with current network`),!v.length&&r)return e(null,Fn(r.value,{cached:!0}));let b={addresses:v.length?v:[t.host],servername:t.servername||t.host};return ur.set(t.host,{value:b,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(b,{cached:!1}))})}catch(m){return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(s||o||m)}})})};gt.exports.parseConnectionUrl=t=>{t=t||"";let e={},r=TS.parse(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}if(!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),r.auth){let n=r.auth.split(":");e.auth={user:n.shift(),pass:n.join(":")}}return Object.keys(r.query||{}).forEach(n=>{let i=e,s=n,o=r.query[n];switch(isNaN(o)||(o=Number(o)),o){case"true":o=!0;break;case"false":o=!1;break}if(n.indexOf("tls.")===0)s=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;s in i||(i[s]=o)}),e};gt.exports._logFunc=(t,e,r,n,i,...s)=>{let o=Object.assign({},r||{},n||{});delete o.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](o,i,...s)};gt.exports.getLogger=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(s=>{r[s]=()=>!1}),r;let i=t.logger===!0?wS(n):t.logger;return n.forEach(s=>{r[s]=(o,a,...c)=>{gt.exports._logFunc(i,s,e,o,a,...c)}}),r};gt.exports.callbackPromise=(t,e)=>function(){let r=Array.from(arguments),n=r.shift();n?e(n):t(...r)};gt.exports.parseDataURI=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,s=n.split(";");if(s.length>0){let l=s[s.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,s.pop())}let o=s.length>0?s.shift():"application/octet-stream",a={};for(let l=0;l<s.length;l++){let d=s[l],p=d.indexOf("=");if(p>0){let m=d.substring(0,p).trim(),E=d.substring(p+1).trim();m&&(a[m]=E)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:o||"application/octet-stream",params:a}};gt.exports.resolveContent=(t,e,r,n)=>{!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;n||(i=new Promise((a,c)=>{n=gt.exports.callbackPromise(a,c)}));let s=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!s)return n(null,s);if(typeof s=="object"){if(typeof s.pipe=="function")return lp(s,(a,c)=>{if(a)return n(a);t[e].content?t[e].content=c:t[e]=c,n(null,c)});if(/^https?:\/\//i.test(s.path||s.href))return r.disableUrlAccess?setImmediate(()=>{let a=new Error("Url access rejected for "+(s.path||s.href));a.code=dg.EURLACCESS,n(a)}):lp(xS(s.path||s.href),n);if(/^data:/i.test(s.path||s.href)){let a=gt.exports.parseDataURI(s.path||s.href);return!a||!a.data?n(null,Buffer.from(0)):n(null,a.data)}else if(s.path)return r.disableFileAccess?setImmediate(()=>{let a=new Error("File access rejected for "+s.path);a.code=dg.EFILEACCESS,n(a)}):lp(_S.createReadStream(s.path),n)}return typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(s=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,s)),i};gt.exports.assign=function(){let t=Array.from(arguments),e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=Object.assign(e[n]||{},r[n]):e[n]=r[n]})}),e};gt.exports.encodeXText=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let s=e[n];s<33||s>126||s===43||s===61?r+="+"+(s<16?"0":"")+s.toString(16).toUpperCase():r+=String.fromCharCode(s)}return r};function lp(t,e){let r=!1,n=[],i=0;t.on("error",s=>{r||(r=!0,e(s))}),t.on("readable",()=>{let s;for(;(s=t.read())!==null;)n.push(s),i+=s.length}),t.on("end",()=>{if(r)return;r=!0;let s;try{s=Buffer.concat(n,i)}catch(o){return e(o)}e(null,s)})}function wS(t){let e=t.reduce((s,o)=>Math.max(s,o.length),0),r=new Map;t.forEach(s=>{let o=s.toUpperCase();o.length<e&&(o+=" ".repeat(e-o.length)),r.set(s,o)});let n=(s,o,a,...c)=>{let l="";o&&(o.tnx==="server"?l="S: ":o.tnx==="client"&&(l="C: "),o.sid&&(l="["+o.sid+"] "+l),o.cid&&(l="[#"+o.cid+"] "+l)),a=IS.format(a,...c),a.split(/\r?\n/).forEach(d=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(s),l+d)})},i={};return t.forEach(s=>{i[s]=n.bind(null,s)}),i}});var up=he((j7,vg)=>{"use strict";var RS=ee("path"),Eg="application/octet-stream",OS="bin",yg=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),gg=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);vg.exports={detectMimeType(t){if(!t)return Eg;let e=RS.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=gg.has(r)?gg.get(r):Eg;return Array.isArray(n)?n[0]:n},detectExtension(t){if(!t)return OS;let e=(t||"").toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(yg.has(r+"/"+n)){let i=yg.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}}});var fp=he((G7,Sg)=>{"use strict";var kS=/^xn--/,CS=/[^\0-\x7F]/,DS=/[\x2E\u3002\uFF0E\uFF61]/g,PS={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},dp=35,Jr=Math.floor,pp=String.fromCharCode;function Vn(t){throw new RangeError(PS[t])}function US(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function Tg(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(DS,".");let i=t.split("."),s=US(i,e).join(".");return n+s}function Ig(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let s=t.charCodeAt(r++);(s&64512)==56320?e.push(((i&1023)<<10)+(s&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var LS=t=>String.fromCodePoint(...t),MS=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Ag=function(t,e){return t+22+75*(t<26)-((e!=0)<<5)},_g=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>dp*26>>1;n+=36)t=Jr(t/dp);return Jr(n+(dp+1)*t/(t+38))},xg=function(t){let e=[],r=t.length,n=0,i=128,s=72,o=t.lastIndexOf("-");o<0&&(o=0);for(let a=0;a<o;++a)t.charCodeAt(a)>=128&&Vn("not-basic"),e.push(t.charCodeAt(a));for(let a=o>0?o+1:0;a<r;){let c=n;for(let d=1,p=36;;p+=36){a>=r&&Vn("invalid-input");let m=MS(t.charCodeAt(a++));m>=36&&Vn("invalid-input"),m>Jr((2147483647-n)/d)&&Vn("overflow"),n+=m*d;let E=p<=s?1:p>=s+26?26:p-s;if(m<E)break;let v=36-E;d>Jr(2147483647/v)&&Vn("overflow"),d*=v}let l=e.length+1;s=_g(n-c,l,c==0),Jr(n/l)>2147483647-i&&Vn("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},bg=function(t){let e=[];t=Ig(t);let r=t.length,n=128,i=0,s=72;for(let c of t)c<128&&e.push(pp(c));let o=e.length,a=o;for(o&&e.push("-");a<r;){let c=2147483647;for(let d of t)d>=n&&d<c&&(c=d);let l=a+1;c-n>Jr((2147483647-i)/l)&&Vn("overflow"),i+=(c-n)*l,n=c;for(let d of t)if(d<n&&++i>2147483647&&Vn("overflow"),d===n){let p=i;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(p<E)break;let v=p-E,b=36-E;e.push(pp(Ag(E+v%b,0))),p=Jr(v/b)}e.push(pp(Ag(p,0))),s=_g(i,l,a===o),i=0,++a}++i,++n}return e.join("")},KS=function(t){return Tg(t,function(e){return kS.test(e)?xg(e.slice(4).toLowerCase()):e})},HS=function(t){return Tg(t,function(e){return CS.test(e)?"xn--"+bg(e):e})},FS={version:"2.3.1",ucs2:{decode:Ig,encode:LS},decode:xg,encode:bg,toASCII:HS,toUnicode:KS};Sg.exports=FS});var yp=he(($7,Ng)=>{"use strict";var{Transform:VS}=ee("stream");function mp(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function hp(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=[],n=0,i=e*1024,s=new RegExp(".{"+e+"}","g");for(;n<t.length;){let o=t.substr(n,i).replace(s,`$&\r
5
5
  `).trim();r.push(o),n+=i}return r.join(`\r
6
- `).trim()}var pp=class extends PS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return setImmediate(n);this.inputBytes+=e.length,this._remainingBytes&&this._remainingBytes.length&&(e=Buffer.concat([this._remainingBytes,e],this._remainingBytes.length+e.length),this._remainingBytes=!1),e.length%3?(this._remainingBytes=e.slice(e.length-e.length%3),e=e.slice(0,e.length-e.length%3)):this._remainingBytes=!1;let i=this._curLine+up(e);if(this.options.lineLength){i=dp(i,this.options.lineLength);let s=i.lastIndexOf(`
7
- `);s<0?(this._curLine=i,i=""):s===i.length-1?this._curLine="":(this._curLine=i.substring(s+1),i=i.substring(0,s+1))}i&&(this.outputBytes+=i.length,this.push(Buffer.from(i,"ascii"))),setImmediate(n)}_flush(e){this._remainingBytes&&this._remainingBytes.length&&(this._curLine+=up(this._remainingBytes)),this._curLine&&(this._curLine=dp(this._curLine,this.options.lineLength),this.outputBytes+=this._curLine.length,this.push(Buffer.from(this._curLine,"ascii")),this._curLine=""),e()}};_g.exports={encode:up,wrap:dp,Encoder:pp}});var Ep=he((F7,bg)=>{"use strict";var{Transform:US}=ee("stream"),LS=[[9],[10],[13],[32,60],[62,126]];function mp(t){typeof t=="string"&&(t=Buffer.from(t,"utf-8"));let e="",r;for(let n=0,i=t.length;n<i;n++){if(r=t[n],MS(r,LS)&&!((r===32||r===9)&&(n===i-1||t[n+1]===10||t[n+1]===13))){e+=String.fromCharCode(r);continue}e+="="+(r<16?"0":"")+r.toString(16).toUpperCase()}return e}function xg(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=0,n=t.length,i,s,o,a=Math.floor(e/3),c="";for(;r<n;){if(o=t.substr(r,e),i=o.match(/\r\n/)){o=o.substr(0,i.index+i[0].length),c+=o,r+=o.length;continue}if(o.substr(-1)===`
6
+ `).trim()}var Ep=class extends VS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return setImmediate(n);this.inputBytes+=e.length,this._remainingBytes&&this._remainingBytes.length&&(e=Buffer.concat([this._remainingBytes,e],this._remainingBytes.length+e.length),this._remainingBytes=!1),e.length%3?(this._remainingBytes=e.slice(e.length-e.length%3),e=e.slice(0,e.length-e.length%3)):this._remainingBytes=!1;let i=this._curLine+mp(e);if(this.options.lineLength){i=hp(i,this.options.lineLength);let s=i.lastIndexOf(`
7
+ `);s<0?(this._curLine=i,i=""):s===i.length-1?this._curLine="":(this._curLine=i.substring(s+1),i=i.substring(0,s+1))}i&&(this.outputBytes+=i.length,this.push(Buffer.from(i,"ascii"))),setImmediate(n)}_flush(e){this._remainingBytes&&this._remainingBytes.length&&(this._curLine+=mp(this._remainingBytes)),this._curLine&&(this._curLine=hp(this._curLine,this.options.lineLength),this.outputBytes+=this._curLine.length,this.push(Buffer.from(this._curLine,"ascii")),this._curLine=""),e()}};Ng.exports={encode:mp,wrap:hp,Encoder:Ep}});var Ap=he((W7,Rg)=>{"use strict";var{Transform:BS}=ee("stream"),qS=[[9],[10],[13],[32,60],[62,126]];function gp(t){typeof t=="string"&&(t=Buffer.from(t,"utf-8"));let e="",r;for(let n=0,i=t.length;n<i;n++){if(r=t[n],jS(r,qS)&&!((r===32||r===9)&&(n===i-1||t[n+1]===10||t[n+1]===13))){e+=String.fromCharCode(r);continue}e+="="+(r<16?"0":"")+r.toString(16).toUpperCase()}return e}function wg(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=0,n=t.length,i,s,o,a=Math.floor(e/3),c="";for(;r<n;){if(o=t.substr(r,e),i=o.match(/\r\n/)){o=o.substr(0,i.index+i[0].length),c+=o,r+=o.length;continue}if(o.substr(-1)===`
8
8
  `){c+=o,r+=o.length;continue}if(i=o.substr(-a).match(/\n.*?$/)){o=o.substr(0,o.length-(i[0].length-1)),c+=o,r+=o.length;continue}if(o.length>e-a&&(i=o.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))o=o.substr(0,o.length-(i[0].length-1));else if(o.match(/[=][\da-f]{0,2}$/i))for((i=o.match(/[=][\da-f]{0,1}$/i))&&(o=o.substr(0,o.length-i[0].length));o.length>3&&o.length<n-r&&!o.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=o.match(/[=][\da-f]{2}$/gi))&&(s=parseInt(i[0].substr(1,2),16),!(s<128||(o=o.substr(0,o.length-3),s>=192))););r+o.length<n&&o.substr(-1)!==`
9
9
  `?(o.length===e&&o.match(/[=][\da-f]{2}$/i)?o=o.substr(0,o.length-3):o.length===e&&(o=o.substr(0,o.length-1)),r+=o.length,o+=`=\r
10
- `):r+=o.length,c+=o}return c}function MS(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var hp=class extends US{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i;if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return n();this.inputBytes+=e.length,this.options.lineLength?(i=this._curLine+mp(e),i=xg(i,this.options.lineLength),i=i.replace(/(^|\n)([^\n]*)$/,(s,o,a)=>(this._curLine=a,o)),i&&(this.outputBytes+=i.length,this.push(i))):(i=mp(e),this.outputBytes+=i.length,this.push(i,"ascii")),n()}_flush(e){this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii")),e()}};bg.exports={encode:mp,wrap:xg,Encoder:hp}});var ua=he((V7,wg)=>{"use strict";var la=fp(),KS=Ep(),Sg=op();wg.exports={isPlainText(t,e){return typeof t=="string"&&!(e?/[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)},hasLongerLines(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)},encodeWord(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=KS.encode(t).replace(/[^a-z0-9!*+\-/=]/gi,s=>{let o=s.charCodeAt(0).toString(16).toUpperCase();return s===" "?"_":"="+(o.length===1?"0"+o:o)}):e==="B"&&(n=typeof t=="string"?t:la.encode(t),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:la.encode(t)).length>r)if(e==="Q")n=this.splitMimeEncodedString(n,r).join("?= =?"+i+"?"+e+"?");else{let s=[],o="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud83c\ud83d\ud83e]/.test(l)&&a<c-1&&(l+=n.charAt(++a)),Buffer.byteLength(o+l)<=r||a===0?o+=l:(s.push(la.encode(o)),o=l)}o&&s.push(la.encode(o)),s.length>1?n=s.join("?= =?"+i+"?"+e+"?"):n=s.join("")}else e==="B"&&(n=la.encode(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")},encodeWords(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return this.encodeWord(t,e,r);let s=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!s)return t;let o=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=s.index+(s[1]||"").length;return(o?t.substr(0,o):"")+this.encodeWord(t.substring(o,a),e||"Q",r)+(a<t.length?t.substr(a):"")},buildHeaderValue(t){let e=[];return Object.keys(t.params||{}).forEach(r=>{let n=t.params[r];!this.isPlainText(n,!0)||n.length>=75?this.buildHeaderParam(r,n,50).forEach(i=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(i.value)||i.key.substr(-1)==="*"?e.push(i.key+"="+i.value):e.push(i.key+"="+JSON.stringify(i.value))}):/[\s'"\\;:/=(),<>@[\]?]|^-/.test(n)?e.push(r+"="+JSON.stringify(n)):e.push(r+"="+n)}),t.value+(e.length?"; "+e.join("; "):"")},buildHeaderParam(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),s,o,a,c=0,l,d;if(r=r||50,this.isPlainText(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),p=>(n.push({line:p}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let m=[];for(l=0,d=i.length;l<d;l++)s=i.charAt(l),o=s.charCodeAt(0),o>=55296&&o<=56319&&l<d-1?(s+=i.charAt(l+1),m.push(s),l++):m.push(s);i=m}a="utf-8''";let p=!0;for(c=0,l=0,d=i.length;l<d;l++){if(s=i[l],p)s=this.safeEncodeURIComponent(s);else if(s=s===" "?s:this.safeEncodeURIComponent(s),s!==i[l])if((this.safeEncodeURIComponent(a)+s).length>=r)n.push({line:a,encoded:p}),a="",c=l-1;else{p=!0,l=c,a="";continue}(a+s).length>=r?(n.push({line:a,encoded:p}),a=s=i[l]===" "?" ":this.safeEncodeURIComponent(i[l]),s===i[l]?(p=!1,c=l-1):p=!0):a+=s}a&&n.push({line:a,encoded:p})}return n.map((p,m)=>({key:t+"*"+m+(p.encoded?"*":""),value:p.line}))},parseHeaderValue(t){let e={value:!1,params:{}},r=!1,n="",i="value",s=!1,o=!1,a;for(let c=0,l=t.length;c<l;c++)if(a=t.charAt(c),i==="key"){if(a==="="){r=n.trim().toLowerCase(),i="value",n="";continue}n+=a}else{if(o)n+=a;else if(a==="\\"){o=!0;continue}else s&&a===s?s=!1:!s&&a==='"'?s=a:!s&&a===";"?(r===!1?e.value=n.trim():e.params[r]=n.trim(),i="key",n=""):n+=a;o=!1}return i==="value"?r===!1?e.value=n.trim():e.params[r]=n.trim():n.trim()&&(e.params[n.trim().toLowerCase()]=""),Object.keys(e.params).forEach(c=>{let l,d,p,m;(p=c.match(/(\*(\d+)|\*(\d+)\*|\*)$/))&&(l=c.substr(0,p.index),d=Number(p[2]||p[3])||0,(!e.params[l]||typeof e.params[l]!="object")&&(e.params[l]={charset:!1,values:[]}),m=e.params[c],d===0&&p[0].substr(-1)==="*"&&(p=m.match(/^([^']*)'[^']*'(.*)$/))&&(e.params[l].charset=p[1]||"iso-8859-1",m=p[2]),e.params[l].values[d]=m,delete e.params[c])}),Object.keys(e.params).forEach(c=>{let l;e.params[c]&&Array.isArray(e.params[c].values)&&(l=e.params[c].values.map(d=>d||"").join(""),e.params[c].charset?e.params[c]="=?"+e.params[c].charset+"?Q?"+l.replace(/[=?_\s]/g,d=>{let p=d.charCodeAt(0).toString(16);return d===" "?"_":"%"+(p.length<2?"0":"")+p}).replace(/%/g,"=")+"?=":e.params[c]=l)}),e},detectExtension:t=>Sg.detectExtension(t),detectMimeType:t=>Sg.detectMimeType(t),foldLines(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,s="",o,a;for(;n<i;){if(o=t.substr(n,e),o.length<e){s+=o;break}if(a=o.match(/^[^\n\r]*(\r?\n|\r)/)){o=a[0],s+=o,n+=o.length;continue}else(a=o.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<o.length?o=o.substr(0,o.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+o.length).match(/^[^\s]+(\s*)/))&&(o=o+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));s+=o,n+=o.length,n<i&&(s+=`\r
11
- `)}return s},splitMimeEncodedString:(t,e)=>{let r=[],n,i,s,o;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(i=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,i.index)),o=!1;!o;)o=!0,(i=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(i[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),o=!1));n.length&&r.push(n),t=t.substr(n.length)}return r},encodeURICharComponent:t=>{let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e},safeEncodeURIComponent(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{return t.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g,"")}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>this.encodeURICharComponent(e))}}});var Og=he((B7,Rg)=>{"use strict";function HS(t,e){let r=!1,n="text",i=[],s={address:[],comment:[],group:[],text:[],textWasQuoted:[]},o=!1;for(let a=0,c=t.length;a<c;a++){let l=t[a],d=a?t[a-1]:null;if(l.type==="operator")switch(l.value){case"<":n="address",o=!1;break;case"(":n="comment",o=!1;break;case":":n="group",r=!0,o=!1;break;case'"':o=!o,n="text";break;default:n="text",o=!1;break}else l.value&&(n==="address"&&(l.value=l.value.replace(/^[^<]*<\s*/,"")),d&&d.noBreak&&s[n].length?(s[n][s[n].length-1]+=l.value,n==="text"&&o&&(s.textWasQuoted[s.textWasQuoted.length-1]=!0)):(s[n].push(l.value),n==="text"&&s.textWasQuoted.push(o)))}if(!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),r){s.text=s.text.join(" ");let a=[];s.group.length&&Ng(s.group.join(","),{_depth:e+1}).forEach(l=>{l.group?a=a.concat(l.group):a.push(l)}),i.push({name:s.text||"",group:a})}else{if(!s.address.length&&s.text.length){for(let c=s.text.length-1;c>=0;c--)if(!s.textWasQuoted[c]&&/^[^@\s]+@[^@\s]+$/.test(s.text[c])){s.address=s.text.splice(c,1),s.textWasQuoted.splice(c,1);break}if(!s.address.length){let c=!1;for(let l=s.text.length-1;l>=0&&!(!s.textWasQuoted[l]&&(s.text[l]=s.text[l].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/,d=>c?d:(s.address=[d.trim()],c=!0," ")).trim(),c));l--);}}!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),s.address.length>1&&(s.text=s.text.concat(s.address.splice(1))),s.text=s.text.join(" "),s.address=s.address.join(" ");let a={address:s.address||s.text||"",name:s.text||s.address||""};a.address===a.name&&(/@/.test(a.address||"")?a.name="":a.address=""),i.push(a)}return i}var yp=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),s=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,s)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" "," ","\r",`
10
+ `):r+=o.length,c+=o}return c}function jS(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var vp=class extends BS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i;if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return n();this.inputBytes+=e.length,this.options.lineLength?(i=this._curLine+gp(e),i=wg(i,this.options.lineLength),i=i.replace(/(^|\n)([^\n]*)$/,(s,o,a)=>(this._curLine=a,o)),i&&(this.outputBytes+=i.length,this.push(i))):(i=gp(e),this.outputBytes+=i.length,this.push(i,"ascii")),n()}_flush(e){this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii")),e()}};Rg.exports={encode:gp,wrap:wg,Encoder:vp}});var da=he((z7,kg)=>{"use strict";var ua=yp(),GS=Ap(),Og=up();kg.exports={isPlainText(t,e){return typeof t=="string"&&!(e?/[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)},hasLongerLines(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)},encodeWord(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=GS.encode(t).replace(/[^a-z0-9!*+\-/=]/gi,s=>{let o=s.charCodeAt(0).toString(16).toUpperCase();return s===" "?"_":"="+(o.length===1?"0"+o:o)}):e==="B"&&(n=typeof t=="string"?t:ua.encode(t),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:ua.encode(t)).length>r)if(e==="Q")n=this.splitMimeEncodedString(n,r).join("?= =?"+i+"?"+e+"?");else{let s=[],o="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud83c\ud83d\ud83e]/.test(l)&&a<c-1&&(l+=n.charAt(++a)),Buffer.byteLength(o+l)<=r||a===0?o+=l:(s.push(ua.encode(o)),o=l)}o&&s.push(ua.encode(o)),s.length>1?n=s.join("?= =?"+i+"?"+e+"?"):n=s.join("")}else e==="B"&&(n=ua.encode(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")},encodeWords(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return this.encodeWord(t,e,r);let s=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!s)return t;let o=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=s.index+(s[1]||"").length;return(o?t.substr(0,o):"")+this.encodeWord(t.substring(o,a),e||"Q",r)+(a<t.length?t.substr(a):"")},buildHeaderValue(t){let e=[];return Object.keys(t.params||{}).forEach(r=>{let n=t.params[r];!this.isPlainText(n,!0)||n.length>=75?this.buildHeaderParam(r,n,50).forEach(i=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(i.value)||i.key.substr(-1)==="*"?e.push(i.key+"="+i.value):e.push(i.key+"="+JSON.stringify(i.value))}):/[\s'"\\;:/=(),<>@[\]?]|^-/.test(n)?e.push(r+"="+JSON.stringify(n)):e.push(r+"="+n)}),t.value+(e.length?"; "+e.join("; "):"")},buildHeaderParam(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),s,o,a,c=0,l,d;if(r=r||50,this.isPlainText(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),p=>(n.push({line:p}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let m=[];for(l=0,d=i.length;l<d;l++)s=i.charAt(l),o=s.charCodeAt(0),o>=55296&&o<=56319&&l<d-1?(s+=i.charAt(l+1),m.push(s),l++):m.push(s);i=m}a="utf-8''";let p=!0;for(c=0,l=0,d=i.length;l<d;l++){if(s=i[l],p)s=this.safeEncodeURIComponent(s);else if(s=s===" "?s:this.safeEncodeURIComponent(s),s!==i[l])if((this.safeEncodeURIComponent(a)+s).length>=r)n.push({line:a,encoded:p}),a="",c=l-1;else{p=!0,l=c,a="";continue}(a+s).length>=r?(n.push({line:a,encoded:p}),a=s=i[l]===" "?" ":this.safeEncodeURIComponent(i[l]),s===i[l]?(p=!1,c=l-1):p=!0):a+=s}a&&n.push({line:a,encoded:p})}return n.map((p,m)=>({key:t+"*"+m+(p.encoded?"*":""),value:p.line}))},parseHeaderValue(t){let e={value:!1,params:{}},r=!1,n="",i="value",s=!1,o=!1,a;for(let c=0,l=t.length;c<l;c++)if(a=t.charAt(c),i==="key"){if(a==="="){r=n.trim().toLowerCase(),i="value",n="";continue}n+=a}else{if(o)n+=a;else if(a==="\\"){o=!0;continue}else s&&a===s?s=!1:!s&&a==='"'?s=a:!s&&a===";"?(r===!1?e.value=n.trim():e.params[r]=n.trim(),i="key",n=""):n+=a;o=!1}return i==="value"?r===!1?e.value=n.trim():e.params[r]=n.trim():n.trim()&&(e.params[n.trim().toLowerCase()]=""),Object.keys(e.params).forEach(c=>{let l,d,p,m;(p=c.match(/(\*(\d+)|\*(\d+)\*|\*)$/))&&(l=c.substr(0,p.index),d=Number(p[2]||p[3])||0,(!e.params[l]||typeof e.params[l]!="object")&&(e.params[l]={charset:!1,values:[]}),m=e.params[c],d===0&&p[0].substr(-1)==="*"&&(p=m.match(/^([^']*)'[^']*'(.*)$/))&&(e.params[l].charset=p[1]||"iso-8859-1",m=p[2]),e.params[l].values[d]=m,delete e.params[c])}),Object.keys(e.params).forEach(c=>{let l;e.params[c]&&Array.isArray(e.params[c].values)&&(l=e.params[c].values.map(d=>d||"").join(""),e.params[c].charset?e.params[c]="=?"+e.params[c].charset+"?Q?"+l.replace(/[=?_\s]/g,d=>{let p=d.charCodeAt(0).toString(16);return d===" "?"_":"%"+(p.length<2?"0":"")+p}).replace(/%/g,"=")+"?=":e.params[c]=l)}),e},detectExtension:t=>Og.detectExtension(t),detectMimeType:t=>Og.detectMimeType(t),foldLines(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,s="",o,a;for(;n<i;){if(o=t.substr(n,e),o.length<e){s+=o;break}if(a=o.match(/^[^\n\r]*(\r?\n|\r)/)){o=a[0],s+=o,n+=o.length;continue}else(a=o.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<o.length?o=o.substr(0,o.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+o.length).match(/^[^\s]+(\s*)/))&&(o=o+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));s+=o,n+=o.length,n<i&&(s+=`\r
11
+ `)}return s},splitMimeEncodedString:(t,e)=>{let r=[],n,i,s,o;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(i=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,i.index)),o=!1;!o;)o=!0,(i=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(i[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),o=!1));n.length&&r.push(n),t=t.substr(n.length)}return r},encodeURICharComponent:t=>{let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e},safeEncodeURIComponent(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{return t.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g,"")}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>this.encodeURICharComponent(e))}}});var Pg=he((J7,Dg)=>{"use strict";function $S(t,e){let r=!1,n="text",i=[],s={address:[],comment:[],group:[],text:[],textWasQuoted:[]},o=!1;for(let a=0,c=t.length;a<c;a++){let l=t[a],d=a?t[a-1]:null;if(l.type==="operator")switch(l.value){case"<":n="address",o=!1;break;case"(":n="comment",o=!1;break;case":":n="group",r=!0,o=!1;break;case'"':o=!o,n="text";break;default:n="text",o=!1;break}else l.value&&(n==="address"&&(l.value=l.value.replace(/^[^<]*<\s*/,"")),d&&d.noBreak&&s[n].length?(s[n][s[n].length-1]+=l.value,n==="text"&&o&&(s.textWasQuoted[s.textWasQuoted.length-1]=!0)):(s[n].push(l.value),n==="text"&&s.textWasQuoted.push(o)))}if(!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),r){s.text=s.text.join(" ");let a=[];s.group.length&&Cg(s.group.join(","),{_depth:e+1}).forEach(l=>{l.group?a=a.concat(l.group):a.push(l)}),i.push({name:s.text||"",group:a})}else{if(!s.address.length&&s.text.length){for(let c=s.text.length-1;c>=0;c--)if(!s.textWasQuoted[c]&&/^[^@\s]+@[^@\s]+$/.test(s.text[c])){s.address=s.text.splice(c,1),s.textWasQuoted.splice(c,1);break}if(!s.address.length){let c=!1;for(let l=s.text.length-1;l>=0&&!(!s.textWasQuoted[l]&&(s.text[l]=s.text[l].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/,d=>c?d:(s.address=[d.trim()],c=!0," ")).trim(),c));l--);}}!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),s.address.length>1&&(s.text=s.text.concat(s.address.splice(1))),s.text=s.text.join(" "),s.address=s.address.join(" ");let a={address:s.address||s.text||"",name:s.text||s.address||""};a.address===a.name&&(/@/.test(a.address||"")?a.name="":a.address=""),i.push(a)}return i}var Tp=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),s=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,s)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" "," ","\r",`
12
12
  `,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
13
- `&&(e=" "),(e.charCodeAt(0)>=33||[" "," "].includes(e))&&(this.node.value+=e),this.escaped=!1}},FS=50;function Ng(t,e){e=e||{};let r=e._depth||0;if(r>FS)return[];let i=new yp(t).tokenize(),s=[],o=[],a=[];i.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&s.push(o),o=[]):o.push(c)}),o.length&&s.push(o),s.forEach(c=>{let l=HS(c,r);l.length&&(a=a.concat(l))});for(let c=a.length-2;c>=0;c--){let l=a[c],d=a[c+1];l.address===""&&l.name&&!l.group&&d.address&&d.name&&(d.name=l.name+", "+d.name,a.splice(c,1))}if(e.flatten){let c=[],l=d=>{d.forEach(p=>{if(p.group)return l(p.group);c.push(p)})};return l(a),c}return a}Rg.exports=Ng});var Cg=he((q7,kg)=>{"use strict";var{Transform:VS}=ee("stream"),gp=class extends VS{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
13
+ `&&(e=" "),(e.charCodeAt(0)>=33||[" "," "].includes(e))&&(this.node.value+=e),this.escaped=!1}},WS=50;function Cg(t,e){e=e||{};let r=e._depth||0;if(r>WS)return[];let i=new Tp(t).tokenize(),s=[],o=[],a=[];i.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&s.push(o),o=[]):o.push(c)}),o.length&&s.push(o),s.forEach(c=>{let l=$S(c,r);l.length&&(a=a.concat(l))});for(let c=a.length-2;c>=0;c--){let l=a[c],d=a[c+1];l.address===""&&l.name&&!l.group&&d.address&&d.name&&(d.name=l.name+", "+d.name,a.splice(c,1))}if(e.flatten){let c=[],l=d=>{d.forEach(p=>{if(p.group)return l(p.group);c.push(p)})};return l(a),c}return a}Dg.exports=Cg});var Lg=he((Y7,Ug)=>{"use strict";var{Transform:zS}=ee("stream"),Ip=class extends zS{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
14
14
  `)),e()):(this.push(Buffer.from(`\r
15
- `)),e())}};kg.exports=gp});var Ap=he((j7,Dg)=>{"use strict";var{Transform:BS}=ee("stream"),vp=class extends BS{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>s&&(i=e.slice(s,o),this.push(i)),this.push(Buffer.from(`\r
16
- `)),s=o+1);s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),this.lastByte=e[e.length-1],n()}};Dg.exports=vp});var Ug=he((G7,Pg)=>{"use strict";var{Transform:qS}=ee("stream"),Tp=class extends qS{constructor(e){super(e)}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===13&&(i=e.slice(s,o),s=o+1,this.push(i));s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),n()}};Pg.exports=Tp});var Nl=he(($7,Kg)=>{"use strict";var Ip=ee("crypto"),jS=ee("fs"),Lg=lp(),{PassThrough:da}=ee("stream"),GS=Kt(),Sr=ua(),$S=Ep(),WS=fp(),zS=Og(),JS=aa(),Mg=lr(),YS=Cg(),XS=Ap(),QS=Ug(),ZS=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],_p=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=r.baseBoundary||Ip.randomBytes(8).toString("hex"),this.boundaryPrefix=r.boundaryPrefix||"--_NmP",this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Sr.detectMimeType(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(s=>{this.setHeader(s.key,s.value)}):Object.keys(e).forEach(s=>{this.setHeader(s,e[s])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let s=0,o=this._headers.length;s<o;s++)this._headers[s].key===e&&(n?(this._headers.splice(s,1),s--,o--):(this._headers[s]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?(this._contentErrorHandler=r=>{this.content.removeListener("error",this._contentErrorHandler),this.content=r},this.content.once("error",this._contentErrorHandler)):typeof this.content=="string"&&(this._isPlainText=Sr.isPlainText(this.content),this._isPlainText&&Sr.hasLongerLines(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((a,c)=>{e=GS.callbackPromise(a,c)}));let n=this.createReadStream(),i=[],s=0,o=!1;return n.on("readable",()=>{let a;for(;(a=n.read())!==null;)i.push(a),s+=a.length}),n.once("error",a=>{if(!o)return o=!0,e(a)}),n.once("end",a=>{if(!o)return o=!0,a&&a.length&&(i.push(a),s+=a.length),e(null,Buffer.concat(i,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,s=n.value,o,a,c={};if(!(s&&typeof s=="object"&&!ZS.includes(i)&&(Object.keys(s).forEach(d=>{d!=="value"&&(c[d]=s[d])}),s=(s.value||"").toString(),!s.trim()))){if(c.prepared){c.foldLines?r.push(Sr.foldLines(i+": "+s)):r.push(i+": "+s);return}switch(n.key){case"Content-Disposition":o=Sr.parseHeaderValue(s),this.filename&&(o.params.filename=this.filename),s=Sr.buildHeaderValue(o);break;case"Content-Type":o=Sr.parseHeaderValue(s),this._handleContentType(o),o.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(o.params.charset="utf-8"),s=Sr.buildHeaderValue(o),this.filename&&(a=this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a='"'+a+'"'),s+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(s=this._encodeHeaderValue(i,s),!!(s||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let d=this.normalizeHeaderKey(i,s);d&&typeof d=="string"&&d.length&&(i=d)}r.push(Sr.foldLines(i+": "+s,76))}}}),r.join(`\r
17
- `)}createReadStream(e){e=e||{};let r=new da(e),n=r,i;this.stream(r,e,s=>{if(s){n.emit("error",s);return}r.end()});for(let s=0,o=this._transforms.length;s<o;s++)i=typeof this._transforms[s]=="function"?this._transforms[s]():this._transforms[s],n.once("error",a=>{i.emit("error",a)}),n=n.pipe(i);i=new YS,n.once("error",s=>{i.emit("error",s)}),n=n.pipe(i);for(let s=0,o=this._processFuncs.length;s<o;s++)i=this._processFuncs[s],n=i(n);if(this.newline){let o=["win","windows","dos",`\r
18
- `].includes(this.newline.toString().toLowerCase())?new XS:new QS,a=n.pipe(o);return n.on("error",c=>a.emit("error",c)),a}return n}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),s,o,a=!1,c=p=>{a||(a=!0,n(p))},l=()=>{let p=0,m=()=>{if(p>=this.childNodes.length)return e.write(`\r
15
+ `)),e())}};Ug.exports=Ip});var xp=he((X7,Mg)=>{"use strict";var{Transform:JS}=ee("stream"),_p=class extends JS{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>s&&(i=e.slice(s,o),this.push(i)),this.push(Buffer.from(`\r
16
+ `)),s=o+1);s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),this.lastByte=e[e.length-1],n()}};Mg.exports=_p});var Hg=he((Q7,Kg)=>{"use strict";var{Transform:YS}=ee("stream"),bp=class extends YS{constructor(e){super(e)}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===13&&(i=e.slice(s,o),s=o+1,this.push(i));s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),n()}};Kg.exports=bp});var kl=he((Z7,Bg)=>{"use strict";var Sp=ee("crypto"),XS=ee("fs"),Fg=fp(),{PassThrough:pa}=ee("stream"),QS=Kt(),Sr=da(),ZS=Ap(),eN=yp(),tN=Pg(),rN=ca(),Vg=lr(),nN=Lg(),iN=xp(),sN=Hg(),oN=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],Np=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=r.baseBoundary||Sp.randomBytes(8).toString("hex"),this.boundaryPrefix=r.boundaryPrefix||"--_NmP",this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Sr.detectMimeType(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(s=>{this.setHeader(s.key,s.value)}):Object.keys(e).forEach(s=>{this.setHeader(s,e[s])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let s=0,o=this._headers.length;s<o;s++)this._headers[s].key===e&&(n?(this._headers.splice(s,1),s--,o--):(this._headers[s]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?(this._contentErrorHandler=r=>{this.content.removeListener("error",this._contentErrorHandler),this.content=r},this.content.once("error",this._contentErrorHandler)):typeof this.content=="string"&&(this._isPlainText=Sr.isPlainText(this.content),this._isPlainText&&Sr.hasLongerLines(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((a,c)=>{e=QS.callbackPromise(a,c)}));let n=this.createReadStream(),i=[],s=0,o=!1;return n.on("readable",()=>{let a;for(;(a=n.read())!==null;)i.push(a),s+=a.length}),n.once("error",a=>{if(!o)return o=!0,e(a)}),n.once("end",a=>{if(!o)return o=!0,a&&a.length&&(i.push(a),s+=a.length),e(null,Buffer.concat(i,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,s=n.value,o,a,c={};if(!(s&&typeof s=="object"&&!oN.includes(i)&&(Object.keys(s).forEach(d=>{d!=="value"&&(c[d]=s[d])}),s=(s.value||"").toString(),!s.trim()))){if(c.prepared){c.foldLines?r.push(Sr.foldLines(i+": "+s)):r.push(i+": "+s);return}switch(n.key){case"Content-Disposition":o=Sr.parseHeaderValue(s),this.filename&&(o.params.filename=this.filename),s=Sr.buildHeaderValue(o);break;case"Content-Type":o=Sr.parseHeaderValue(s),this._handleContentType(o),o.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(o.params.charset="utf-8"),s=Sr.buildHeaderValue(o),this.filename&&(a=this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a='"'+a+'"'),s+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(s=this._encodeHeaderValue(i,s),!!(s||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let d=this.normalizeHeaderKey(i,s);d&&typeof d=="string"&&d.length&&(i=d)}r.push(Sr.foldLines(i+": "+s,76))}}}),r.join(`\r
17
+ `)}createReadStream(e){e=e||{};let r=new pa(e),n=r,i;this.stream(r,e,s=>{if(s){n.emit("error",s);return}r.end()});for(let s=0,o=this._transforms.length;s<o;s++)i=typeof this._transforms[s]=="function"?this._transforms[s]():this._transforms[s],n.once("error",a=>{i.emit("error",a)}),n=n.pipe(i);i=new nN,n.once("error",s=>{i.emit("error",s)}),n=n.pipe(i);for(let s=0,o=this._processFuncs.length;s<o;s++)i=this._processFuncs[s],n=i(n);if(this.newline){let o=["win","windows","dos",`\r
18
+ `].includes(this.newline.toString().toLowerCase())?new iN:new sN,a=n.pipe(o);return n.on("error",c=>a.emit("error",c)),a}return n}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),s,o,a=!1,c=p=>{a||(a=!0,n(p))},l=()=>{let p=0,m=()=>{if(p>=this.childNodes.length)return e.write(`\r
19
19
  --`+this.boundary+`--\r
20
20
  `),c();let E=this.childNodes[p++];e.write((p>1?`\r
21
21
  `:"")+"--"+this.boundary+`\r
22
- `),E.stream(e,r,v=>{if(v)return c(v);setImmediate(m)})};if(this.multipart)setImmediate(m);else return c()},d=()=>{if(this.content){if(Object.prototype.toString.call(this.content)==="[object Error]")return c(this.content);typeof this.content.pipe=="function"&&(this.content.removeListener("error",this._contentErrorHandler),this._contentErrorHandler=m=>c(m),this.content.once("error",this._contentErrorHandler));let p=()=>{["quoted-printable","base64"].includes(i)?(s=new(i==="base64"?WS:$S).Encoder(r),s.pipe(e,{end:!1}),s.once("end",l),s.once("error",m=>c(m)),o=this._getStream(this.content),o.pipe(s)):(o=this._getStream(this.content),o.pipe(e,{end:!1}),o.once("end",l)),o.once("error",m=>c(m))};if(this.content._resolve){let m=[],E=0,v=!1,b=this._getStream(this.content);b.on("error",k=>{v||(v=!0,c(k))}),b.on("readable",()=>{let k;for(;(k=b.read())!==null;)m.push(k),E+=k.length}),b.on("end",()=>{v||(v=!0,this.content._resolve=!1,this.content._resolvedValue=Buffer.concat(m,E),setImmediate(p))})}else setImmediate(p);return}return setImmediate(l)};this._raw?setImmediate(()=>{if(Object.prototype.toString.call(this._raw)==="[object Error]")return c(this._raw);typeof this._raw.pipe=="function"&&this._raw.removeListener("error",this._contentErrorHandler);let p=this._getStream(this._raw);p.pipe(e,{end:!1}),p.on("error",m=>e.emit("error",m)),p.on("end",l)}):(e.write(this.buildHeaders()+`\r
22
+ `),E.stream(e,r,v=>{if(v)return c(v);setImmediate(m)})};if(this.multipart)setImmediate(m);else return c()},d=()=>{if(this.content){if(Object.prototype.toString.call(this.content)==="[object Error]")return c(this.content);typeof this.content.pipe=="function"&&(this.content.removeListener("error",this._contentErrorHandler),this._contentErrorHandler=m=>c(m),this.content.once("error",this._contentErrorHandler));let p=()=>{["quoted-printable","base64"].includes(i)?(s=new(i==="base64"?eN:ZS).Encoder(r),s.pipe(e,{end:!1}),s.once("end",l),s.once("error",m=>c(m)),o=this._getStream(this.content),o.pipe(s)):(o=this._getStream(this.content),o.pipe(e,{end:!1}),o.once("end",l)),o.once("error",m=>c(m))};if(this.content._resolve){let m=[],E=0,v=!1,b=this._getStream(this.content);b.on("error",k=>{v||(v=!0,c(k))}),b.on("readable",()=>{let k;for(;(k=b.read())!==null;)m.push(k),E+=k.length}),b.on("end",()=>{v||(v=!0,this.content._resolve=!1,this.content._resolvedValue=Buffer.concat(m,E),setImmediate(p))})}else setImmediate(p);return}return setImmediate(l)};this._raw?setImmediate(()=>{if(Object.prototype.toString.call(this._raw)==="[object Error]")return c(this._raw);typeof this._raw.pipe=="function"&&this._raw.removeListener("error",this._contentErrorHandler);let p=this._getStream(this._raw);p.pipe(e,{end:!1}),p.on("error",m=>e.emit("error",m)),p.on("end",l)}):(e.write(this.buildHeaders()+`\r
23
23
  \r
24
- `),setImmediate(d))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseAddresses(e.from),r),r=r.filter(i=>i&&i.address),r.length&&r[0]&&(this._envelope.from=r[0].address)),["to","cc","bcc"].forEach(i=>{e[i]&&this._convertAddresses(this._parseAddresses(e[i]),this._envelope.to)}),this._envelope.to=this._envelope.to.map(i=>i.address).filter(i=>i);let n=["to","cc","bcc","from"];return Object.keys(e).forEach(i=>{n.includes(i)||(this._envelope[i]=e[i])}),this}getAddresses(){let e={};return this._headers.forEach(r=>{let n=r.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(n)&&(Array.isArray(e[n])||(e[n]=[]),this._convertAddresses(this._parseAddresses(r.value),e[n]))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]};return this._headers.forEach(r=>{let n=[];r.key==="From"||!e.from&&["Reply-To","Sender"].includes(r.key)?(this._convertAddresses(this._parseAddresses(r.value),n),n.length&&n[0]&&(e.from=n[0].address)):["To","Cc","Bcc"].includes(r.key)&&this._convertAddresses(this._parseAddresses(r.value),e.to)}),e.to=e.to.map(r=>r.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&(this._contentErrorHandler=r=>{this._raw.removeListener("error",this._contentErrorHandler),this._raw=r},this._raw.once("error",this._contentErrorHandler)),this}_getStream(e){let r;return e._resolvedValue?(r=new da,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this.disableFileAccess?(r=new da,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Mg.EFILEACCESS,r.emit("error",n)}),r):jS.createReadStream(e.path):e&&typeof e.href=="string"?this.disableUrlAccess?(r=new da,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=Mg.EURLACCESS,r.emit("error",n)}),r):JS(e.href,{headers:e.httpHeaders}):(r=new da,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){return[].concat.apply([],[].concat(e).map(r=>r&&r.address?(r.address=this._normalizeAddress(r.address),r.name=r.name||"",[r]):zS(r)))}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart?this.boundary=e.params.boundary=e.params.boundary||this.boundary||this._generateBoundary():this.boundary=!1}_generateBoundary(){return this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," "),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r)}}_convertAddresses(e,r){let n=[];return r=r||[],[].concat(e||[]).forEach(i=>{if(i.address)i.address=this._normalizeAddress(i.address),i.name?n.push(`${this._encodeAddressName(i.name)} <${i.address}>`):n.push(i.address.indexOf(" ")>=0?`<${i.address}>`:`${i.address}`),r.some(s=>s.address===i.address)||r.push(i);else if(i.group){let s=(i.group.length?this._convertAddresses(i.group,r):"").trim();n.push(`${this._encodeAddressName(i.name)}:${s};`)}}),n.join(", ")}_normalizeAddress(e){e=(e||"").toString().replace(/[\x00-\x1F<>]+/g," ").trim();let r=e.lastIndexOf("@");if(r<0)return e;let n=e.substr(0,r),i=e.substr(r+1),s=i;try{/[\x80-\uFFFF]/.test(n)?s=Lg.toUnicode(i.toLowerCase()):s=Lg.toASCII(i.toLowerCase())}catch{}return n.indexOf(" ")>=0&&(n.charAt(0)!=='"'&&(n='"'+n),n.substr(-1)!=='"'&&(n=n+'"')),`${n}@${s}`}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?'"'+e.replace(/([\\"])/g,"\\$1")+'"':Sr.encodeWord(e,this._getTextEncoding(e),52)}_encodeWords(e){return Sr.encodeWords(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,s=e.length;i<s;i++){let o=e.charCodeAt(i);o>=0&&o<=8||o===11||o===12||o>=14&&o<=31||o>=128?r++:(o>=65&&o<=90||o>=97&&o<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+Ip.randomBytes(r).toString("hex"),Ip.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}};Kg.exports=_p});var Fg=he((W7,Hg)=>{"use strict";var pa=Nl(),xp=ua(),{parseDataURI:ew}=Kt(),bp=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new pa("message/rfc822",{newline:this.mail.newline}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n,i=[].concat(this.mail.attachments||[]).map((s,o)=>{/^data:/i.test(s.path||s.href)&&(s=this._processDataUrl(s));let a=s.contentType||xp.detectMimeType(s.filename||s.path||s.href||"bin"),c=/^image\//i.test(a),l=/^message\//i.test(a),d=s.contentDisposition||(l||c&&s.cid?"inline":"attachment"),p;"contentTransferEncoding"in s?p=s.contentTransferEncoding:l?p="8bit":p="base64";let m={contentType:a,contentDisposition:d,contentTransferEncoding:p};return s.filename?m.filename=s.filename:!l&&s.filename!==!1&&(m.filename=(s.path||s.href||"").split("/").pop().split("?").shift()||"attachment-"+(o+1),m.filename.indexOf(".")<0&&(m.filename+="."+xp.detectExtension(m.contentType))),/^https?:\/\//i.test(s.path)&&(s.href=s.path,s.path=void 0),s.cid&&(m.cid=s.cid),s.raw?m.raw=s.raw:s.path?m.content={path:s.path}:s.href?m.content={href:s.href,httpHeaders:s.httpHeaders}:m.content=s.content||"",s.encoding&&(m.encoding=s.encoding),s.headers&&(m.headers=s.headers),m});return this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?r=this.mail.icalEvent:r={content:this.mail.icalEvent},n=Object.assign({},r),n.contentType="application/ics",n.headers||(n.headers={}),n.filename=n.filename||"invite.ics",n.headers["Content-Disposition"]="attachment",n.headers["Content-Transfer-Encoding"]="base64"),e?{attached:i.filter(s=>!s.cid).concat(n||[]),related:i.filter(s=>!!s.cid)}:{attached:i.concat(n||[]),related:[]}}getAlternatives(){let e=[],r,n,i,s,o,a;return this.mail.text&&(typeof this.mail.text=="object"&&(this.mail.text.content||this.mail.text.path||this.mail.text.href||this.mail.text.raw)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(typeof this.mail.watchHtml=="object"&&(this.mail.watchHtml.content||this.mail.watchHtml.path||this.mail.watchHtml.href||this.mail.watchHtml.raw)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(typeof this.mail.amp=="object"&&(this.mail.amp.content||this.mail.amp.path||this.mail.amp.href||this.mail.amp.raw)?s=this.mail.amp:s={content:this.mail.amp},s.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?o=this.mail.icalEvent:o={content:this.mail.icalEvent},a=Object.assign({},o),a.content&&typeof a.content=="object"&&(a.content._resolve=!0),a.filename=!1,a.contentType="text/calendar; charset=utf-8; method="+(a.method||"PUBLISH").toString().trim().toUpperCase(),a.headers||(a.headers={})),this.mail.html&&(typeof this.mail.html=="object"&&(this.mail.html.content||this.mail.html.path||this.mail.html.href||this.mail.html.raw)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(s||[]).concat(n||[]).concat(a||[]).concat(this.mail.alternatives||[]).forEach(c=>{/^data:/i.test(c.path||c.href)&&(c=this._processDataUrl(c));let l={contentType:c.contentType||xp.detectMimeType(c.filename||c.path||c.href||"txt"),contentTransferEncoding:c.contentTransferEncoding};c.filename&&(l.filename=c.filename),/^https?:\/\//i.test(c.path)&&(c.href=c.path,c.path=void 0),c.raw?l.raw=c.raw:c.path?l.content={path:c.path}:c.href?l.content={href:c.href}:l.content=c.content||"",c.encoding&&(l.encoding=c.encoding),c.headers&&(l.headers=c.headers),e.push(l)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new pa("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new pa("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new pa('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new pa(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",s=r.indexOf(",");if(s>0&&s<200){let a=r.substring(5,s).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign({},e,{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=ew(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}};Hg.exports=bp});var Bg=he((z7,Vg)=>{"use strict";var{Transform:tw}=ee("stream"),Sp=class extends tw{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,s=r-n;i<s;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,s=this.lastBytes.length+e.length;i<s;i++){let o;if(i<r?o=this.lastBytes[i]:o=e[i-r],o===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length-1>n){let i=e.slice(n);this.bodySize+=i.length,setImmediate(()=>this.push(i))}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(s){return n(s)}i&&(this.bodySize+=e.length,this.push(e)),setImmediate(n)}_flush(e){if(this.headerChunks){let r=Buffer.concat(this.headerChunks,this.headerBytes);this.bodySize+=r.length,this.push(r),this.headerChunks=null}e()}parseHeaders(){let e=(this.rawHeaders||"").toString().split(/\r?\n/);for(let r=e.length-1;r>0;r--)/^\s/.test(e[r])&&(e[r-1]+=`
25
- `+e[r],e.splice(r,1));return e.filter(r=>r.trim()).map(r=>({key:r.substr(0,r.indexOf(":")).trim().toLowerCase(),line:r}))}};Vg.exports=Sp});var jg=he((J7,qg)=>{"use strict";var{Transform:rw}=ee("stream"),nw=ee("crypto"),wp=class extends rw{constructor(e){super(),e=e||{},this.chunkBuffer=[],this.chunkBufferLen=0,this.bodyHash=nw.createHash(e.hashAlgo||"sha1"),this.remainder="",this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1}updateHash(e){let r,n="",i="file";for(let o=e.length-1;o>=0;o--){let a=e[o];if(!(i==="file"&&(a===10||a===13))){if(i==="file"&&(a===9||a===32))i="line";else if(!(i==="line"&&(a===9||a===32))){if((i==="file"||i==="line")&&(i="body",o===e.length-1))break}}if(o===0){if(i==="file"&&(!this.remainder||/[\r\n]$/.test(this.remainder))||i==="line"&&(!this.remainder||/[ \t]$/.test(this.remainder))){this.remainder+=e.toString("binary");return}else if(i==="line"||i==="file"){n=e.toString("binary"),e=!1;break}}if(i==="body"){n=e.slice(o+1).toString("binary"),e=e.slice(0,o+1);break}}let s=!!this.remainder;if(e&&!s){for(let o=0,a=e.length;o<a;o++)if(o&&e[o]===10&&e[o-1]!==13){s=!0;break}else if(o&&e[o]===13&&e[o-1]===32){s=!0;break}else if(o&&e[o]===32&&e[o-1]===32){s=!0;break}else if(e[o]===9){s=!0;break}}s?(r=this.remainder+(e?e.toString("binary"):""),this.remainder=n,r=r.replace(/\r?\n/g,`
24
+ `),setImmediate(d))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseAddresses(e.from),r),r=r.filter(i=>i&&i.address),r.length&&r[0]&&(this._envelope.from=r[0].address)),["to","cc","bcc"].forEach(i=>{e[i]&&this._convertAddresses(this._parseAddresses(e[i]),this._envelope.to)}),this._envelope.to=this._envelope.to.map(i=>i.address).filter(i=>i);let n=["to","cc","bcc","from"];return Object.keys(e).forEach(i=>{n.includes(i)||(this._envelope[i]=e[i])}),this}getAddresses(){let e={};return this._headers.forEach(r=>{let n=r.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(n)&&(Array.isArray(e[n])||(e[n]=[]),this._convertAddresses(this._parseAddresses(r.value),e[n]))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]};return this._headers.forEach(r=>{let n=[];r.key==="From"||!e.from&&["Reply-To","Sender"].includes(r.key)?(this._convertAddresses(this._parseAddresses(r.value),n),n.length&&n[0]&&(e.from=n[0].address)):["To","Cc","Bcc"].includes(r.key)&&this._convertAddresses(this._parseAddresses(r.value),e.to)}),e.to=e.to.map(r=>r.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&(this._contentErrorHandler=r=>{this._raw.removeListener("error",this._contentErrorHandler),this._raw=r},this._raw.once("error",this._contentErrorHandler)),this}_getStream(e){let r;return e._resolvedValue?(r=new pa,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this.disableFileAccess?(r=new pa,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Vg.EFILEACCESS,r.emit("error",n)}),r):XS.createReadStream(e.path):e&&typeof e.href=="string"?this.disableUrlAccess?(r=new pa,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=Vg.EURLACCESS,r.emit("error",n)}),r):rN(e.href,{headers:e.httpHeaders}):(r=new pa,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){return[].concat.apply([],[].concat(e).map(r=>r&&r.address?(r.address=this._normalizeAddress(r.address),r.name=r.name||"",[r]):tN(r)))}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart?this.boundary=e.params.boundary=e.params.boundary||this.boundary||this._generateBoundary():this.boundary=!1}_generateBoundary(){return this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," "),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r)}}_convertAddresses(e,r){let n=[];return r=r||[],[].concat(e||[]).forEach(i=>{if(i.address)i.address=this._normalizeAddress(i.address),i.name?n.push(`${this._encodeAddressName(i.name)} <${i.address}>`):n.push(i.address.indexOf(" ")>=0?`<${i.address}>`:`${i.address}`),r.some(s=>s.address===i.address)||r.push(i);else if(i.group){let s=(i.group.length?this._convertAddresses(i.group,r):"").trim();n.push(`${this._encodeAddressName(i.name)}:${s};`)}}),n.join(", ")}_normalizeAddress(e){e=(e||"").toString().replace(/[\x00-\x1F<>]+/g," ").trim();let r=e.lastIndexOf("@");if(r<0)return e;let n=e.substr(0,r),i=e.substr(r+1),s=i;try{/[\x80-\uFFFF]/.test(n)?s=Fg.toUnicode(i.toLowerCase()):s=Fg.toASCII(i.toLowerCase())}catch{}return n.indexOf(" ")>=0&&(n.charAt(0)!=='"'&&(n='"'+n),n.substr(-1)!=='"'&&(n=n+'"')),`${n}@${s}`}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?'"'+e.replace(/([\\"])/g,"\\$1")+'"':Sr.encodeWord(e,this._getTextEncoding(e),52)}_encodeWords(e){return Sr.encodeWords(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,s=e.length;i<s;i++){let o=e.charCodeAt(i);o>=0&&o<=8||o===11||o===12||o>=14&&o<=31||o>=128?r++:(o>=65&&o<=90||o>=97&&o<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+Sp.randomBytes(r).toString("hex"),Sp.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}};Bg.exports=Np});var jg=he((eX,qg)=>{"use strict";var fa=kl(),wp=da(),{parseDataURI:aN}=Kt(),Rp=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new fa("message/rfc822",{newline:this.mail.newline}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n,i=[].concat(this.mail.attachments||[]).map((s,o)=>{/^data:/i.test(s.path||s.href)&&(s=this._processDataUrl(s));let a=s.contentType||wp.detectMimeType(s.filename||s.path||s.href||"bin"),c=/^image\//i.test(a),l=/^message\//i.test(a),d=s.contentDisposition||(l||c&&s.cid?"inline":"attachment"),p;"contentTransferEncoding"in s?p=s.contentTransferEncoding:l?p="8bit":p="base64";let m={contentType:a,contentDisposition:d,contentTransferEncoding:p};return s.filename?m.filename=s.filename:!l&&s.filename!==!1&&(m.filename=(s.path||s.href||"").split("/").pop().split("?").shift()||"attachment-"+(o+1),m.filename.indexOf(".")<0&&(m.filename+="."+wp.detectExtension(m.contentType))),/^https?:\/\//i.test(s.path)&&(s.href=s.path,s.path=void 0),s.cid&&(m.cid=s.cid),s.raw?m.raw=s.raw:s.path?m.content={path:s.path}:s.href?m.content={href:s.href,httpHeaders:s.httpHeaders}:m.content=s.content||"",s.encoding&&(m.encoding=s.encoding),s.headers&&(m.headers=s.headers),m});return this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?r=this.mail.icalEvent:r={content:this.mail.icalEvent},n=Object.assign({},r),n.contentType="application/ics",n.headers||(n.headers={}),n.filename=n.filename||"invite.ics",n.headers["Content-Disposition"]="attachment",n.headers["Content-Transfer-Encoding"]="base64"),e?{attached:i.filter(s=>!s.cid).concat(n||[]),related:i.filter(s=>!!s.cid)}:{attached:i.concat(n||[]),related:[]}}getAlternatives(){let e=[],r,n,i,s,o,a;return this.mail.text&&(typeof this.mail.text=="object"&&(this.mail.text.content||this.mail.text.path||this.mail.text.href||this.mail.text.raw)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(typeof this.mail.watchHtml=="object"&&(this.mail.watchHtml.content||this.mail.watchHtml.path||this.mail.watchHtml.href||this.mail.watchHtml.raw)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(typeof this.mail.amp=="object"&&(this.mail.amp.content||this.mail.amp.path||this.mail.amp.href||this.mail.amp.raw)?s=this.mail.amp:s={content:this.mail.amp},s.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?o=this.mail.icalEvent:o={content:this.mail.icalEvent},a=Object.assign({},o),a.content&&typeof a.content=="object"&&(a.content._resolve=!0),a.filename=!1,a.contentType="text/calendar; charset=utf-8; method="+(a.method||"PUBLISH").toString().trim().toUpperCase(),a.headers||(a.headers={})),this.mail.html&&(typeof this.mail.html=="object"&&(this.mail.html.content||this.mail.html.path||this.mail.html.href||this.mail.html.raw)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(s||[]).concat(n||[]).concat(a||[]).concat(this.mail.alternatives||[]).forEach(c=>{/^data:/i.test(c.path||c.href)&&(c=this._processDataUrl(c));let l={contentType:c.contentType||wp.detectMimeType(c.filename||c.path||c.href||"txt"),contentTransferEncoding:c.contentTransferEncoding};c.filename&&(l.filename=c.filename),/^https?:\/\//i.test(c.path)&&(c.href=c.path,c.path=void 0),c.raw?l.raw=c.raw:c.path?l.content={path:c.path}:c.href?l.content={href:c.href}:l.content=c.content||"",c.encoding&&(l.encoding=c.encoding),c.headers&&(l.headers=c.headers),e.push(l)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",s=r.indexOf(",");if(s>0&&s<200){let a=r.substring(5,s).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign({},e,{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=aN(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}};qg.exports=Rp});var $g=he((tX,Gg)=>{"use strict";var{Transform:cN}=ee("stream"),Op=class extends cN{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,s=r-n;i<s;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,s=this.lastBytes.length+e.length;i<s;i++){let o;if(i<r?o=this.lastBytes[i]:o=e[i-r],o===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length-1>n){let i=e.slice(n);this.bodySize+=i.length,setImmediate(()=>this.push(i))}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(s){return n(s)}i&&(this.bodySize+=e.length,this.push(e)),setImmediate(n)}_flush(e){if(this.headerChunks){let r=Buffer.concat(this.headerChunks,this.headerBytes);this.bodySize+=r.length,this.push(r),this.headerChunks=null}e()}parseHeaders(){let e=(this.rawHeaders||"").toString().split(/\r?\n/);for(let r=e.length-1;r>0;r--)/^\s/.test(e[r])&&(e[r-1]+=`
25
+ `+e[r],e.splice(r,1));return e.filter(r=>r.trim()).map(r=>({key:r.substr(0,r.indexOf(":")).trim().toLowerCase(),line:r}))}};Gg.exports=Op});var zg=he((rX,Wg)=>{"use strict";var{Transform:lN}=ee("stream"),uN=ee("crypto"),kp=class extends lN{constructor(e){super(),e=e||{},this.chunkBuffer=[],this.chunkBufferLen=0,this.bodyHash=uN.createHash(e.hashAlgo||"sha1"),this.remainder="",this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1}updateHash(e){let r,n="",i="file";for(let o=e.length-1;o>=0;o--){let a=e[o];if(!(i==="file"&&(a===10||a===13))){if(i==="file"&&(a===9||a===32))i="line";else if(!(i==="line"&&(a===9||a===32))){if((i==="file"||i==="line")&&(i="body",o===e.length-1))break}}if(o===0){if(i==="file"&&(!this.remainder||/[\r\n]$/.test(this.remainder))||i==="line"&&(!this.remainder||/[ \t]$/.test(this.remainder))){this.remainder+=e.toString("binary");return}else if(i==="line"||i==="file"){n=e.toString("binary"),e=!1;break}}if(i==="body"){n=e.slice(o+1).toString("binary"),e=e.slice(0,o+1);break}}let s=!!this.remainder;if(e&&!s){for(let o=0,a=e.length;o<a;o++)if(o&&e[o]===10&&e[o-1]!==13){s=!0;break}else if(o&&e[o]===13&&e[o-1]===32){s=!0;break}else if(o&&e[o]===32&&e[o-1]===32){s=!0;break}else if(e[o]===9){s=!0;break}}s?(r=this.remainder+(e?e.toString("binary"):""),this.remainder=n,r=r.replace(/\r?\n/g,`
26
26
  `).replace(/[ \t]*$/gm,"").replace(/[ \t]+/gm," ").replace(/\n/g,`\r
27
27
  `),e=Buffer.from(r,"binary")):n&&(this.remainder=n),this.debug&&this._debugBody.push(e),this.bodyHash.update(e)}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){/[\r\n]$/.test(this.remainder)&&this.byteLength>2&&this.bodyHash.update(Buffer.from(`\r
28
28
  `)),this.byteLength||this.push(Buffer.from(`\r
29
- `)),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}};qg.exports=wp});var Wg=he((Y7,Np)=>{"use strict";var iw=lp(),sw=ua(),ow=ee("crypto");Np.exports=(t,e,r,n)=>{n=n||{};let s=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",o=Gg(t,s,n.skipFields),a=aw(n.domainName,n.keySelector,o.fieldNames,e,r);o.headers+="dkim-signature:"+$g(a);let c=ow.createSign(("rsa-"+e).toUpperCase());c.update(o.headers);let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
30
- `).trim()};Np.exports.relaxedHeaders=Gg;function aw(t,e,r,n,i){let s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+iw.toASCII(t),"q=dns/txt","s="+e,"bh="+i,"h="+r].join("; ");return sw.foldLines("DKIM-Signature: "+s,76)+`;\r
31
- b=`}function Gg(t,e,r){let n=new Set,i=new Set,s=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!s.has(l.key)&&s.set(l.key,$g(l.line))}let o=[],a=[];return n.forEach(c=>{s.has(c)&&(a.push(c),o.push(c+":"+s.get(c)))}),{headers:o.join(`\r
29
+ `)),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}};Wg.exports=kp});var Xg=he((nX,Cp)=>{"use strict";var dN=fp(),pN=da(),fN=ee("crypto");Cp.exports=(t,e,r,n)=>{n=n||{};let s=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",o=Jg(t,s,n.skipFields),a=mN(n.domainName,n.keySelector,o.fieldNames,e,r);o.headers+="dkim-signature:"+Yg(a);let c=fN.createSign(("rsa-"+e).toUpperCase());c.update(o.headers);let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
30
+ `).trim()};Cp.exports.relaxedHeaders=Jg;function mN(t,e,r,n,i){let s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+dN.toASCII(t),"q=dns/txt","s="+e,"bh="+i,"h="+r].join("; ");return pN.foldLines("DKIM-Signature: "+s,76)+`;\r
31
+ b=`}function Jg(t,e,r){let n=new Set,i=new Set,s=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!s.has(l.key)&&s.set(l.key,Yg(l.line))}let o=[],a=[];return n.forEach(c=>{s.has(c)&&(a.push(c),o.push(c+":"+s.get(c)))}),{headers:o.join(`\r
32
32
  `)+`\r
33
- `,fieldNames:a.join(":")}}function $g(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/\s+/g," ").trim()}});var Jg=he((X7,zg)=>{"use strict";var cw=Bg(),lw=jg(),uw=Wg(),{PassThrough:Rp}=ee("stream"),Op=ee("fs"),dw=ee("path"),pw=ee("crypto"),fw="sha256",mw=2*1024*1024,kp=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||mw,this.hashAlgo=this.options.hashAlgo||fw,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?dw.join(this.cacheDir,"message."+Date.now()+"-"+pw.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",s=>{this.hasErrored=!0,this.cleanup(),i.emit("error",s)})}cleanup(){!this.cache||!this.cachePath||Op.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=Op.createReadStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.output.emit("error",e)}),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){if(this.hasErrored)return;if(this.readPos>=this.chunks.length)return this.cache?this.createReadCache():this.output.end();let e=this.chunks[this.readPos++];if(this.output.write(e)===!1)return this.output.once("drain",()=>{this.sendNextChunk()});setImmediate(()=>this.sendNextChunk())}sendSignedOutput(){let e=0,r=()=>{if(e>=this.keys.length)return this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());let n=this.keys[e++],i=uw(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields});return i&&this.output.write(Buffer.from(i+`\r
34
- `)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=Op.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.hasErrored=!0,this.output.emit("error",e)}),this.cache.once("close",()=>{this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new cw,this.relaxedBody=new lw({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Cp=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new Rp,i=e,s=!1;Buffer.isBuffer(e)?(s=e,i=new Rp):typeof e=="string"&&(s=Buffer.from(e),i=new Rp);let o=this.options;r&&Object.keys(r).length&&(o=Object.assign({},r,this.options));let a=new kp(o,this.keys,i,n);return setImmediate(()=>{a.signStream(),s&&setImmediate(()=>{i.end(s)})}),n}};zg.exports=Cp});var ev=he((Q7,Zg)=>{"use strict";var Yg=ee("net"),Xg=ee("tls"),hw=ee("url"),Ew=lr();function Qg(t,e,r,n){let i=hw.parse(t),s={host:i.hostname,port:Number(i.port)?Number(i.port):i.protocol==="https:"?443:80},o;i.protocol==="https:"?(s.rejectUnauthorized=!1,o=Xg.connect.bind(Xg)):o=Yg.connect.bind(Yg);let a,c=!1,l=p=>{if(!c){c=!0;try{a.destroy()}catch{}n(p)}},d=()=>{let p=new Error("Proxy socket timed out");p.code="ETIMEDOUT",l(p)};a=o(s,()=>{if(c)return;let p={Host:r+":"+e,Connection:"close"};i.auth&&(p["Proxy-Authorization"]="Basic "+Buffer.from(i.auth).toString("base64")),a.write("CONNECT "+r+":"+e+` HTTP/1.1\r
33
+ `,fieldNames:a.join(":")}}function Yg(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/\s+/g," ").trim()}});var Zg=he((iX,Qg)=>{"use strict";var hN=$g(),EN=zg(),yN=Xg(),{PassThrough:Dp}=ee("stream"),Pp=ee("fs"),gN=ee("path"),vN=ee("crypto"),AN="sha256",TN=2*1024*1024,Up=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||TN,this.hashAlgo=this.options.hashAlgo||AN,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?gN.join(this.cacheDir,"message."+Date.now()+"-"+vN.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",s=>{this.hasErrored=!0,this.cleanup(),i.emit("error",s)})}cleanup(){!this.cache||!this.cachePath||Pp.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=Pp.createReadStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.output.emit("error",e)}),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){if(this.hasErrored)return;if(this.readPos>=this.chunks.length)return this.cache?this.createReadCache():this.output.end();let e=this.chunks[this.readPos++];if(this.output.write(e)===!1)return this.output.once("drain",()=>{this.sendNextChunk()});setImmediate(()=>this.sendNextChunk())}sendSignedOutput(){let e=0,r=()=>{if(e>=this.keys.length)return this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());let n=this.keys[e++],i=yN(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields});return i&&this.output.write(Buffer.from(i+`\r
34
+ `)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=Pp.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.hasErrored=!0,this.output.emit("error",e)}),this.cache.once("close",()=>{this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new hN,this.relaxedBody=new EN({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Lp=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new Dp,i=e,s=!1;Buffer.isBuffer(e)?(s=e,i=new Dp):typeof e=="string"&&(s=Buffer.from(e),i=new Dp);let o=this.options;r&&Object.keys(r).length&&(o=Object.assign({},r,this.options));let a=new Up(o,this.keys,i,n);return setImmediate(()=>{a.signStream(),s&&setImmediate(()=>{i.end(s)})}),n}};Qg.exports=Lp});var iv=he((sX,nv)=>{"use strict";var ev=ee("net"),tv=ee("tls"),IN=ee("url"),_N=lr();function rv(t,e,r,n){let i=IN.parse(t),s={host:i.hostname,port:Number(i.port)?Number(i.port):i.protocol==="https:"?443:80},o;i.protocol==="https:"?(s.rejectUnauthorized=!1,o=tv.connect.bind(tv)):o=ev.connect.bind(ev);let a,c=!1,l=p=>{if(!c){c=!0;try{a.destroy()}catch{}n(p)}},d=()=>{let p=new Error("Proxy socket timed out");p.code="ETIMEDOUT",l(p)};a=o(s,()=>{if(c)return;let p={Host:r+":"+e,Connection:"close"};i.auth&&(p["Proxy-Authorization"]="Basic "+Buffer.from(i.auth).toString("base64")),a.write("CONNECT "+r+":"+e+` HTTP/1.1\r
35
35
  `+Object.keys(p).map(v=>v+": "+p[v]).join(`\r
36
36
  `)+`\r
37
37
  \r
38
- `);let m="",E=v=>{let b,k;if(!c&&(m+=v.toString("binary"),b=m.match(/\r\n\r\n/))){if(a.removeListener("data",E),k=m.substr(b.index+b[0].length),m=m.substr(0,b.index),k&&a.unshift(Buffer.from(k,"binary")),c=!0,b=m.match(/^HTTP\/\d+\.\d+ (\d+)/i),!b||(b[1]||"").charAt(0)!=="2"){try{a.destroy()}catch{}let C=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return C.code=Ew.EPROXY,n(C)}return a.removeListener("error",l),a.removeListener("timeout",d),a.setTimeout(0),n(null,a)}};a.on("data",E)}),a.setTimeout(Qg.timeout||30*1e3),a.on("timeout",d),a.once("error",l)}Zg.exports=Qg});var nv=he((Z7,rv)=>{"use strict";var tv=Kt(),yw=Nl(),Vs=ua(),Dp=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};Object.assign(this.data,r),this.data.headers=this.data.headers||{},Object.keys(i).forEach(s=>{s in this.data?s==="headers"&&Object.keys(i.headers).forEach(o=>{o in this.data.headers||(this.data.headers[o]=i.headers[o])}):this.data[s]=i[s]}),["disableFileAccess","disableUrlAccess","normalizeHeaderKey"].forEach(s=>{s in n&&(this.data[s]=n[s])})}resolveContent(...e){return tv.resolveContent(...e)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split("/").pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Vs.detectExtension(c.contentType))),c.contentType||(c.contentType=Vs.detectMimeType(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new yw;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let o=0,a=()=>{if(o>=r.length)return e(null,this.data);let c=r[o++];if(!c[0]||!c[0][c[1]])return a();tv.resolveContent(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,d)=>{if(l)return e(l);let p={content:d};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&Object.keys(c[0][c[1]]).forEach(m=>{!(m in p)&&!["content","path","href","raw"].includes(m)&&(p[m]=c[0][c[1]][m])}),c[0][c[1]]=p,a()})};setImmediate(()=>a())}normalize(e){let r=this.data.envelope||this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,s)=>i?e(i):(s.envelope=r,s.messageId=n,["html","text","watchHtml","amp"].forEach(o=>{s[o]&&s[o].content&&(typeof s[o].content=="string"?s[o]=s[o].content:Buffer.isBuffer(s[o].content)&&(s[o]=s[o].content.toString()))}),s.icalEvent&&Buffer.isBuffer(s.icalEvent.content)&&(s.icalEvent.content=s.icalEvent.content.toString("base64"),s.icalEvent.encoding="base64"),s.alternatives&&s.alternatives.length&&s.alternatives.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.attachments&&s.attachments.length&&s.attachments.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.normalizedHeaders={},Object.keys(s.headers||{}).forEach(o=>{let a=[].concat(s.headers[o]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(o)&&(a=this.message._encodeHeaderValue(o,a)),s.normalizedHeaders[o]=a)}),s.list&&typeof s.list=="object"&&this._getListHeaders(s.list).forEach(a=>{s.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),s.references&&(s.normalizedHeaders.references=this.message._encodeHeaderValue("references",s.references)),s.inReplyTo&&(s.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",s.inReplyTo)),e(null,s)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){if(r.toLowerCase().trim()==="id"){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(o)?o='"'+o+'"':o=Vs.encodeWord(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+\/{,2}/,"")}let s=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(s)||(s=Vs.encodeWord(s)),this._formatListUrl(i.url)+(i.comment?" ("+s+")":"")}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};rv.exports=Dp});var cv=he((eX,av)=>{"use strict";var gw=ee("events"),iv=Kt(),vw=op(),Aw=Fg(),sv=Jg(),Tw=ev(),ov=lr(),Iw=ee("util"),_w=ee("url"),Pp=br(),xw=nv(),bw=ee("net"),Sw=ee("dns"),ww=ee("crypto"),Up=class extends gw{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new sv(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=iv.getLogger(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...s)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...s)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((s,o)=>{r=iv.callbackPromise(s,o)})),typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let i=new xw(this,e);return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",i,s=>{if(s)return this.logger.error({err:s,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",s.message),r(s);i.message=new Aw(i.data).compile(),i.setMailerHeader(),i.setPriorityHeaders(),i.setListHeaders(),this._processPlugins("stream",i,o=>{if(o)return this.logger.error({err:o,tnx:"plugin",action:"stream"},"PluginStream Error: %s",o.message),r(o);(i.data.dkim||this.dkim)&&i.message.processFunc(a=>{let c=i.data.dkim?new sv(i.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:i.message.messageId(),dkimDomains:c.keys.map(l=>l.keySelector+"."+l.domainName).join(", ")},"Signing outgoing message with %s keys",c.keys.length),c.sign(a,i.data._dkim)}),this.transporter.send(i,(...a)=>{a[0]&&this.logger.error({err:a[0],tnx:"transport",action:"send"},"Send Error: %s",a[0].message),r(...a)})})}),n}getVersionString(){return Iw.format("%s (%s; +%s; %s/%s)",Pp.name,Pp.version,Pp.homepage,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],s=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+s.length===0)return n();let o=0,a="default",c=()=>{let l=a==="default"?s:i;if(o>=l.length)if(a==="default"&&i.length)a="user",o=0,l=i;else return n();let d=l[o++];d(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=_w.parse(e);this.getSocket=(n,i)=>{let s=r.protocol.replace(/:$/,"").toLowerCase();if(this.meta.has("proxy_handler_"+s))return this.meta.get("proxy_handler_"+s)(r,n,i);switch(s){case"http":case"https":Tw(r.href,n.port,n.host,(a,c)=>a?i(a):i(null,{connection:c}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let c=new Error("Socks module not loaded");return c.code=ov.EPROXY,i(c)}let a=c=>{let l=!!this.meta.get("proxy_socks_module").SocksClient,d=l?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),p=Number(r.protocol.replace(/\D/g,""))||5,m={proxy:{ipaddress:c,port:Number(r.port),type:p},[l?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(r.auth){let E=decodeURIComponent(r.auth.split(":").shift()),v=decodeURIComponent(r.auth.split(":").pop());l?(m.proxy.userId=E,m.proxy.password=v):p===4?m.userid=E:m.authentication={username:E,password:v}}d.createConnection(m,(E,v)=>E?i(E):i(null,{connection:v.socket||v}))};return bw.isIP(r.hostname)?a(r.hostname):Sw.resolve(r.hostname,(c,l)=>{if(c)return i(c);a(Array.isArray(l)?l[0]:l)})}}let o=new Error("Unknown proxy configuration");o.code=ov.EPROXY,i(o)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let s=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(o,a,c,l)=>{let d=ww.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:d,filename:"image-"+ ++s+"."+vw.detectExtension(l)}),a+"cid:"+d}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}};av.exports=Up});var uv=he((tX,lv)=>{"use strict";var{Transform:Nw}=ee("stream"),Lp=class extends Nw{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],s=0,o,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,o=0,a=e.length;o<a;o++)e[o]===46?(o&&e[o-1]===10||!o&&(!this.lastByte||this.lastByte===10))&&(l=e.slice(c,o+1),i.push(l),i.push(Buffer.from(".")),s+=l.length+1,c=o+1):e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>c?(l=e.slice(c,o),i.push(l),s+=l.length+2):s+=2,i.push(Buffer.from(`\r
38
+ `);let m="",E=v=>{let b,k;if(!c&&(m+=v.toString("binary"),b=m.match(/\r\n\r\n/))){if(a.removeListener("data",E),k=m.substr(b.index+b[0].length),m=m.substr(0,b.index),k&&a.unshift(Buffer.from(k,"binary")),c=!0,b=m.match(/^HTTP\/\d+\.\d+ (\d+)/i),!b||(b[1]||"").charAt(0)!=="2"){try{a.destroy()}catch{}let C=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return C.code=_N.EPROXY,n(C)}return a.removeListener("error",l),a.removeListener("timeout",d),a.setTimeout(0),n(null,a)}};a.on("data",E)}),a.setTimeout(rv.timeout||30*1e3),a.on("timeout",d),a.once("error",l)}nv.exports=rv});var av=he((oX,ov)=>{"use strict";var sv=Kt(),xN=kl(),Vs=da(),Mp=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};Object.assign(this.data,r),this.data.headers=this.data.headers||{},Object.keys(i).forEach(s=>{s in this.data?s==="headers"&&Object.keys(i.headers).forEach(o=>{o in this.data.headers||(this.data.headers[o]=i.headers[o])}):this.data[s]=i[s]}),["disableFileAccess","disableUrlAccess","normalizeHeaderKey"].forEach(s=>{s in n&&(this.data[s]=n[s])})}resolveContent(...e){return sv.resolveContent(...e)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split("/").pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Vs.detectExtension(c.contentType))),c.contentType||(c.contentType=Vs.detectMimeType(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new xN;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let o=0,a=()=>{if(o>=r.length)return e(null,this.data);let c=r[o++];if(!c[0]||!c[0][c[1]])return a();sv.resolveContent(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,d)=>{if(l)return e(l);let p={content:d};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&Object.keys(c[0][c[1]]).forEach(m=>{!(m in p)&&!["content","path","href","raw"].includes(m)&&(p[m]=c[0][c[1]][m])}),c[0][c[1]]=p,a()})};setImmediate(()=>a())}normalize(e){let r=this.data.envelope||this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,s)=>i?e(i):(s.envelope=r,s.messageId=n,["html","text","watchHtml","amp"].forEach(o=>{s[o]&&s[o].content&&(typeof s[o].content=="string"?s[o]=s[o].content:Buffer.isBuffer(s[o].content)&&(s[o]=s[o].content.toString()))}),s.icalEvent&&Buffer.isBuffer(s.icalEvent.content)&&(s.icalEvent.content=s.icalEvent.content.toString("base64"),s.icalEvent.encoding="base64"),s.alternatives&&s.alternatives.length&&s.alternatives.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.attachments&&s.attachments.length&&s.attachments.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.normalizedHeaders={},Object.keys(s.headers||{}).forEach(o=>{let a=[].concat(s.headers[o]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(o)&&(a=this.message._encodeHeaderValue(o,a)),s.normalizedHeaders[o]=a)}),s.list&&typeof s.list=="object"&&this._getListHeaders(s.list).forEach(a=>{s.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),s.references&&(s.normalizedHeaders.references=this.message._encodeHeaderValue("references",s.references)),s.inReplyTo&&(s.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",s.inReplyTo)),e(null,s)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){if(r.toLowerCase().trim()==="id"){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(o)?o='"'+o+'"':o=Vs.encodeWord(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+\/{,2}/,"")}let s=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(s)||(s=Vs.encodeWord(s)),this._formatListUrl(i.url)+(i.comment?" ("+s+")":"")}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};ov.exports=Mp});var pv=he((aX,dv)=>{"use strict";var bN=ee("events"),cv=Kt(),SN=up(),NN=jg(),lv=Zg(),wN=iv(),uv=lr(),RN=ee("util"),ON=ee("url"),Kp=br(),kN=av(),CN=ee("net"),DN=ee("dns"),PN=ee("crypto"),Hp=class extends bN{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new lv(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=cv.getLogger(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...s)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...s)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((s,o)=>{r=cv.callbackPromise(s,o)})),typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let i=new kN(this,e);return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",i,s=>{if(s)return this.logger.error({err:s,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",s.message),r(s);i.message=new NN(i.data).compile(),i.setMailerHeader(),i.setPriorityHeaders(),i.setListHeaders(),this._processPlugins("stream",i,o=>{if(o)return this.logger.error({err:o,tnx:"plugin",action:"stream"},"PluginStream Error: %s",o.message),r(o);(i.data.dkim||this.dkim)&&i.message.processFunc(a=>{let c=i.data.dkim?new lv(i.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:i.message.messageId(),dkimDomains:c.keys.map(l=>l.keySelector+"."+l.domainName).join(", ")},"Signing outgoing message with %s keys",c.keys.length),c.sign(a,i.data._dkim)}),this.transporter.send(i,(...a)=>{a[0]&&this.logger.error({err:a[0],tnx:"transport",action:"send"},"Send Error: %s",a[0].message),r(...a)})})}),n}getVersionString(){return RN.format("%s (%s; +%s; %s/%s)",Kp.name,Kp.version,Kp.homepage,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],s=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+s.length===0)return n();let o=0,a="default",c=()=>{let l=a==="default"?s:i;if(o>=l.length)if(a==="default"&&i.length)a="user",o=0,l=i;else return n();let d=l[o++];d(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=ON.parse(e);this.getSocket=(n,i)=>{let s=r.protocol.replace(/:$/,"").toLowerCase();if(this.meta.has("proxy_handler_"+s))return this.meta.get("proxy_handler_"+s)(r,n,i);switch(s){case"http":case"https":wN(r.href,n.port,n.host,(a,c)=>a?i(a):i(null,{connection:c}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let c=new Error("Socks module not loaded");return c.code=uv.EPROXY,i(c)}let a=c=>{let l=!!this.meta.get("proxy_socks_module").SocksClient,d=l?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),p=Number(r.protocol.replace(/\D/g,""))||5,m={proxy:{ipaddress:c,port:Number(r.port),type:p},[l?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(r.auth){let E=decodeURIComponent(r.auth.split(":").shift()),v=decodeURIComponent(r.auth.split(":").pop());l?(m.proxy.userId=E,m.proxy.password=v):p===4?m.userid=E:m.authentication={username:E,password:v}}d.createConnection(m,(E,v)=>E?i(E):i(null,{connection:v.socket||v}))};return CN.isIP(r.hostname)?a(r.hostname):DN.resolve(r.hostname,(c,l)=>{if(c)return i(c);a(Array.isArray(l)?l[0]:l)})}}let o=new Error("Unknown proxy configuration");o.code=uv.EPROXY,i(o)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let s=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(o,a,c,l)=>{let d=PN.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:d,filename:"image-"+ ++s+"."+SN.detectExtension(l)}),a+"cid:"+d}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}};dv.exports=Hp});var mv=he((cX,fv)=>{"use strict";var{Transform:UN}=ee("stream"),Fp=class extends UN{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],s=0,o,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,o=0,a=e.length;o<a;o++)e[o]===46?(o&&e[o-1]===10||!o&&(!this.lastByte||this.lastByte===10))&&(l=e.slice(c,o+1),i.push(l),i.push(Buffer.from(".")),s+=l.length+1,c=o+1):e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>c?(l=e.slice(c,o),i.push(l),s+=l.length+2):s+=2,i.push(Buffer.from(`\r
39
39
  `)),c=o+1);s?(c<e.length&&(l=e.slice(c),i.push(l),s+=l.length),this.outByteCount+=s,this.push(Buffer.concat(i,s))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
40
40
  `):this.lastByte===13?r=Buffer.from(`
41
41
  .\r
42
42
  `):r=Buffer.from(`\r
43
43
  .\r
44
- `),this.outByteCount+=r.length,this.push(r),e()}};lv.exports=Lp});var Rl=he((rX,yv)=>{"use strict";var Rw=br(),{EventEmitter:Ow}=ee("events"),dv=ee("net"),pv=ee("tls"),kw=ee("os"),fv=ee("crypto"),Cw=uv(),{PassThrough:mv}=ee("stream"),_i=Kt(),Dw=120*1e3,hv=600*1e3,Pw=30*1e3,Uw=30*1e3,Lw=()=>{};function Ev(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}var Mp=class extends Ow{constructor(e){super(e),this.id=fv.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:dv.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=_i.getLogger(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=Rw.version,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._greetingTimeout=!1,this._connectionTimeout=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onConnectionError(r,"ESOCKET"),this._connectionAttemptId=0}connect(e){if(typeof e=="function"){this.once("connect",()=>{this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let n=this._isDestroyedMessage("connect");if(n)return e(this._formatError(n,"ECONNECTION",!1,"CONN"))}let r={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:this.options.dnsTimeout||Uw};if(this.options.localAddress&&(r.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(n=>{if(n){this._onError(new Error("Error initiating TLS - "+(n.message||n)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(r,n=>{try{this._socket.connect(this.port,this.host,()=>{this._socket.setKeepAlive(!0),this._onConnect()}),this._setupConnectionHandlers()}catch(i){return setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"))}})):(this.secureConnection&&(Object.assign(r,this.options.tls||{}),this.servername&&!r.servername&&(r.servername=this.servername)),this._resolveAndConnect(r,n=>{this._fallbackAddresses=(n._addresses||[]).filter(i=>i!==r.host),this._connectOpts=Object.assign({},r),this._connectToHost(r,this.secureConnection)}))}_resolveAndConnect(e,r){return _i.resolveHostname(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let s of Object.keys(i))s.charAt(0)!=="_"&&i[s]&&(e[s]=i[s]);r(i)})}_connectToHost(e,r){this._connectionAttemptId++;let n=this._connectionAttemptId,i=r?pv.connect:dv.connect;try{this._socket=i(e,()=>{this._connectionAttemptId===n&&(this._socket.setKeepAlive(!0),this._onConnect())}),this._setupConnectionHandlers()}catch(s){return setImmediate(()=>this._onError(s,"ECONNECTION",!1,"CONN"))}}_setupConnectionHandlers(){this._connectionTimeout=setTimeout(()=>{this._onConnectionError("Connection timeout","ETIMEDOUT")},this.options.connectionTimeout||Dw),this._socket.on("error",this._onConnectionSocketError)}_onConnectionError(e,r){if(clearTimeout(this._connectionTimeout),!(this._fallbackAddresses&&this._fallbackAddresses.length&&this.stage==="init"&&!this._destroyed)){this._onError(e,r,!1,"CONN");return}let i=this._fallbackAddresses.shift();if(this.logger.info({tnx:"network",failedHost:this._connectOpts.host,nextHost:i,error:e.message||e},"Connection to %s failed, trying %s",this._connectOpts.host,i),this._socket){try{this._socket.removeListener("error",this._onConnectionSocketError),this._socket.destroy()}catch{}this._socket=null}this._connectOpts.host=i,this._connectToHost(this._connectOpts,this.secureConnection)}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(r&&!r.destroyed)try{r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",Lw),r[e]()}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));if(this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1,!this._authMethod&&this._auth.oauth2&&!this._auth.credentials?this._authMethod="XOAUTH2":(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2)&&(this._authMethod=(this._supportedAuth[0]||"PLAIN").toUpperCase().trim()),this._authMethod!=="XOAUTH2"&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let i=this.customAuth.get(this._authMethod),s,o=!1,a=()=>{o||(o=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},c=d=>{o||(o=!0,r(this._formatError(d,"EAUTH",s,"AUTH "+this._authMethod)))},l=i({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:(d,p)=>{let m;return p||(m=new Promise((E,v)=>{p=_i.callbackPromise(E,v)})),this._responseActions.push(E=>{s=E;let v=E.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),b={command:d,response:E};v?(b.status=Number(v[1])||0,v[2]&&(b.code=v[2]),b.text=E.substr(v[0].length)):(b.text=E,b.status=0),p(null,b)}),setImmediate(()=>this._sendCommand(d)),m},resolve:a,reject:c});l&&typeof l.catch=="function"&&l.then(a).catch(c);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(i=>{this._actionAUTH_LOGIN_USER(i,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(i=>{this._actionAUTHComplete(i,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(i=>{this._actionAUTH_CRAM_MD5(i,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){if(!r)return n(this._formatError("Empty message","EMESSAGE",!1,"API"));let i=this._isDestroyedMessage("send message");if(i)return n(this._formatError(i,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize)return setImmediate(()=>{n(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});let s=!1,o=function(){s||(s=!0,n(...arguments))};typeof r.on=="function"&&r.on("error",c=>o(this._formatError(c,"ESTREAM",!1,"API")));let a=Date.now();this._setEnvelope(e,(c,l)=>{if(c){let m=new mv;return typeof r.pipe=="function"?r.pipe(m):(m.write(r),m.end()),o(c)}let d=Date.now(),p=this._createSendStream((m,E)=>m?o(m):(l.envelopeTime=d-a,l.messageTime=Date.now()-d,l.messageSize=p.outByteCount,l.response=E,o(null,l)));typeof r.pipe=="function"?r.pipe(p):(p.write(r),p.end())})}reset(e){this._sendCommand("RSET"),this._responseActions.push(r=>r.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+r,"EPROTOCOL",r,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){if(clearTimeout(this._connectionTimeout),this.logger.info({tnx:"network",localAddress:this._socket.localAddress,localPort:this._socket.localPort,remoteAddress:this._socket.remoteAddress,remotePort:this._socket.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",this._socket.remoteAddress,this._socket.remotePort),this._destroyed){this.close();return}this.stage="connected",this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout),this._socket.removeListener("close",this._onSocketClose),this._socket.removeListener("end",this._onSocketEnd),this._socket.removeListener("error",this._onConnectionSocketError),this._socket.on("error",this._onSocketError),this._socket.on("data",this._onSocketData),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||hv),this._socket.on("timeout",this._onSocketTimeout),this._greetingTimeout=setTimeout(()=>{this._socket&&!this._destroyed&&this._responseActions[0]===this._actionGreeting&&this._onError("Greeting never received","ETIMEDOUT",!1,"CONN")},this.options.greetingTimeout||Pw),this._responseActions.push(this._actionGreeting),this._socket.resume()}_onData(e){if(this._destroyed||!e||!e.length)return;let r=(e||"").toString("binary"),n=(this._remainder+r).split(/\r?\n/),i;this._remainder=n.pop();for(let s=0,o=n.length;s<o;s++){if(this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
44
+ `),this.outByteCount+=r.length,this.push(r),e()}};fv.exports=Fp});var Cl=he((lX,Tv)=>{"use strict";var LN=br(),{EventEmitter:MN}=ee("events"),hv=ee("net"),Ev=ee("tls"),KN=ee("os"),yv=ee("crypto"),HN=mv(),{PassThrough:gv}=ee("stream"),_i=Kt(),FN=120*1e3,vv=600*1e3,VN=30*1e3,BN=30*1e3,qN=()=>{};function Av(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}var Vp=class extends MN{constructor(e){super(e),this.id=yv.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:hv.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=_i.getLogger(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=LN.version,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._greetingTimeout=!1,this._connectionTimeout=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onConnectionError(r,"ESOCKET"),this._connectionAttemptId=0}connect(e){if(typeof e=="function"){this.once("connect",()=>{this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let n=this._isDestroyedMessage("connect");if(n)return e(this._formatError(n,"ECONNECTION",!1,"CONN"))}let r={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:this.options.dnsTimeout||BN};if(this.options.localAddress&&(r.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(n=>{if(n){this._onError(new Error("Error initiating TLS - "+(n.message||n)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(r,n=>{try{this._socket.connect(this.port,this.host,()=>{this._socket.setKeepAlive(!0),this._onConnect()}),this._setupConnectionHandlers()}catch(i){return setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"))}})):(this.secureConnection&&(Object.assign(r,this.options.tls||{}),this.servername&&!r.servername&&(r.servername=this.servername)),this._resolveAndConnect(r,n=>{this._fallbackAddresses=(n._addresses||[]).filter(i=>i!==r.host),this._connectOpts=Object.assign({},r),this._connectToHost(r,this.secureConnection)}))}_resolveAndConnect(e,r){return _i.resolveHostname(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let s of Object.keys(i))s.charAt(0)!=="_"&&i[s]&&(e[s]=i[s]);r(i)})}_connectToHost(e,r){this._connectionAttemptId++;let n=this._connectionAttemptId,i=r?Ev.connect:hv.connect;try{this._socket=i(e,()=>{this._connectionAttemptId===n&&(this._socket.setKeepAlive(!0),this._onConnect())}),this._setupConnectionHandlers()}catch(s){return setImmediate(()=>this._onError(s,"ECONNECTION",!1,"CONN"))}}_setupConnectionHandlers(){this._connectionTimeout=setTimeout(()=>{this._onConnectionError("Connection timeout","ETIMEDOUT")},this.options.connectionTimeout||FN),this._socket.on("error",this._onConnectionSocketError)}_onConnectionError(e,r){if(clearTimeout(this._connectionTimeout),!(this._fallbackAddresses&&this._fallbackAddresses.length&&this.stage==="init"&&!this._destroyed)){this._onError(e,r,!1,"CONN");return}let i=this._fallbackAddresses.shift();if(this.logger.info({tnx:"network",failedHost:this._connectOpts.host,nextHost:i,error:e.message||e},"Connection to %s failed, trying %s",this._connectOpts.host,i),this._socket){try{this._socket.removeListener("error",this._onConnectionSocketError),this._socket.destroy()}catch{}this._socket=null}this._connectOpts.host=i,this._connectToHost(this._connectOpts,this.secureConnection)}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(r&&!r.destroyed)try{r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",qN),r[e]()}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));if(this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1,!this._authMethod&&this._auth.oauth2&&!this._auth.credentials?this._authMethod="XOAUTH2":(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2)&&(this._authMethod=(this._supportedAuth[0]||"PLAIN").toUpperCase().trim()),this._authMethod!=="XOAUTH2"&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let i=this.customAuth.get(this._authMethod),s,o=!1,a=()=>{o||(o=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},c=d=>{o||(o=!0,r(this._formatError(d,"EAUTH",s,"AUTH "+this._authMethod)))},l=i({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:(d,p)=>{let m;return p||(m=new Promise((E,v)=>{p=_i.callbackPromise(E,v)})),this._responseActions.push(E=>{s=E;let v=E.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),b={command:d,response:E};v?(b.status=Number(v[1])||0,v[2]&&(b.code=v[2]),b.text=E.substr(v[0].length)):(b.text=E,b.status=0),p(null,b)}),setImmediate(()=>this._sendCommand(d)),m},resolve:a,reject:c});l&&typeof l.catch=="function"&&l.then(a).catch(c);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(i=>{this._actionAUTH_LOGIN_USER(i,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(i=>{this._actionAUTHComplete(i,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(i=>{this._actionAUTH_CRAM_MD5(i,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){if(!r)return n(this._formatError("Empty message","EMESSAGE",!1,"API"));let i=this._isDestroyedMessage("send message");if(i)return n(this._formatError(i,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize)return setImmediate(()=>{n(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});let s=!1,o=function(){s||(s=!0,n(...arguments))};typeof r.on=="function"&&r.on("error",c=>o(this._formatError(c,"ESTREAM",!1,"API")));let a=Date.now();this._setEnvelope(e,(c,l)=>{if(c){let m=new gv;return typeof r.pipe=="function"?r.pipe(m):(m.write(r),m.end()),o(c)}let d=Date.now(),p=this._createSendStream((m,E)=>m?o(m):(l.envelopeTime=d-a,l.messageTime=Date.now()-d,l.messageSize=p.outByteCount,l.response=E,o(null,l)));typeof r.pipe=="function"?r.pipe(p):(p.write(r),p.end())})}reset(e){this._sendCommand("RSET"),this._responseActions.push(r=>r.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+r,"EPROTOCOL",r,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){if(clearTimeout(this._connectionTimeout),this.logger.info({tnx:"network",localAddress:this._socket.localAddress,localPort:this._socket.localPort,remoteAddress:this._socket.remoteAddress,remotePort:this._socket.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",this._socket.remoteAddress,this._socket.remotePort),this._destroyed){this.close();return}this.stage="connected",this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout),this._socket.removeListener("close",this._onSocketClose),this._socket.removeListener("end",this._onSocketEnd),this._socket.removeListener("error",this._onConnectionSocketError),this._socket.on("error",this._onSocketError),this._socket.on("data",this._onSocketData),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),this._greetingTimeout=setTimeout(()=>{this._socket&&!this._destroyed&&this._responseActions[0]===this._actionGreeting&&this._onError("Greeting never received","ETIMEDOUT",!1,"CONN")},this.options.greetingTimeout||VN),this._responseActions.push(this._actionGreeting),this._socket.resume()}_onData(e){if(this._destroyed||!e||!e.length)return;let r=(e||"").toString("binary"),n=(this._remainder+r).split(/\r?\n/),i;this._remainder=n.pop();for(let s=0,o=n.length;s<o;s++){if(this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
45
45
  `).pop()))){this._responseQueue[this._responseQueue.length-1]+=`
46
46
  `+n[s];continue}this._responseQueue.push(n[s])}this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
47
- `).pop()))||this._processResponse()}_onError(e,r,n,i){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._destroyed)return;e=this._formatError(e,r,n,i),["ETIMEDOUT","ESOCKET","ECONNECTION"].includes(e.code)?this.logger.warn(n,e.message):this.logger.error(n,e.message),this.emit("error",e),this.close()}_formatError(e,r,n,i){let s;/Error\]$/i.test(Object.prototype.toString.call(e))?s=e:s=new Error(e),r&&r!=="Error"&&(s.code=r),n&&(s.response=n,s.message+=": "+n);let o=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return o&&(s.responseCode=o),i&&(s.command=i),s}_onClose(){let e=!1;if(this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=Ev(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed"),this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",e,"CONN");if(![this._actionGreeting,this.close].includes(this._responseActions[0])&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");if(/^[45]\d{2}\b/.test(e))return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(new Error("Timeout"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.emit("end"))}_upgradeConnection(e){this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout);let r=this._socket,n=Object.assign({socket:this._socket,host:this.host},this.options.tls||{});this.servername&&!n.servername&&(n.servername=this.servername);let i=()=>{r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError)};this.upgrading=!0;try{this._socket=pv.connect(n,()=>(this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),i(),e(null,!0)))}catch(s){return i(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||hv),this._socket.on("timeout",this._onSocketTimeout),r.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=this.lastServerResponse=Ev((this._responseQueue.shift()||"").toString());if(/^\d+-/.test(e.split(`
47
+ `).pop()))||this._processResponse()}_onError(e,r,n,i){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._destroyed)return;e=this._formatError(e,r,n,i),["ETIMEDOUT","ESOCKET","ECONNECTION"].includes(e.code)?this.logger.warn(n,e.message):this.logger.error(n,e.message),this.emit("error",e),this.close()}_formatError(e,r,n,i){let s;/Error\]$/i.test(Object.prototype.toString.call(e))?s=e:s=new Error(e),r&&r!=="Error"&&(s.code=r),n&&(s.response=n,s.message+=": "+n);let o=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return o&&(s.responseCode=o),i&&(s.command=i),s}_onClose(){let e=!1;if(this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=Av(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed"),this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",e,"CONN");if(![this._actionGreeting,this.close].includes(this._responseActions[0])&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");if(/^[45]\d{2}\b/.test(e))return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(new Error("Timeout"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.emit("end"))}_upgradeConnection(e){this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout);let r=this._socket,n=Object.assign({socket:this._socket,host:this.host},this.options.tls||{});this.servername&&!n.servername&&(n.servername=this.servername);let i=()=>{r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError)};this.upgrading=!0;try{this._socket=Ev.connect(n,()=>(this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),i(),e(null,!0)))}catch(s){return i(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),r.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=this.lastServerResponse=Av((this._responseQueue.shift()||"").toString());if(/^\d+-/.test(e.split(`
48
48
  `).pop()))return;(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e.replace(/\r?\n$/,"")),e.trim()||setImmediate(()=>this._processResponse());let r=this._responseActions.shift();if(typeof r=="function")r.call(this,e),setImmediate(()=>this._processResponse());else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",e,"CONN")}_sendCommand(e,r){if(!this._destroyed){if(this._socket.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),this._socket.write(Buffer.from(e+`\r
49
- `,"utf-8"))}}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(s=>(s&&s.address||s||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let s=0,o=this._envelope.to.length;s<o;s++){if(!this._envelope.to[s]||/[\r\n<>]/.test(this._envelope.to[s]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[s]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[s])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(s){return r(this._formatError("Invalid DSN "+s.message,"EENVELOPE",!1,"API"))}if(this._responseActions.push(s=>{this._actionMAIL(s,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let s=Number(this._envelope.size)||0;s>0&&n.push("SIZE="+s)}if(this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+_i.encodeXText(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+_i.encodeXText(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));n.push("REQUIRETLS")}this._sendCommand("MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):""))}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let o=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!o.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let s=(e.recipient||e.orcpt||"").toString()||null;return s&&s.indexOf(";")<0&&(s="rfc822;"+s),{ret:r,envid:n,notify:i,orcpt:s}}_getDsnRcptToArgs(){let e=[];return this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.notify&&e.push("NOTIFY="+_i.encodeXText(this._envelope.dsn.notify)),this._envelope.dsn.orcpt&&e.push("ORCPT="+_i.encodeXText(this._envelope.dsn.orcpt))),e.length?" "+e.join(" "):""}_createSendStream(e){let r=new Cw;if(this.options.lmtp?this._envelope.accepted.forEach((n,i)=>{let s=i===this._envelope.accepted.length-1;this._responseActions.push(o=>{this._actionLMTPStream(n,s,o,e)})}):this._responseActions.push(n=>{this._actionSMTPStream(n,e)}),this._currentDataStream=r,r.pipe(this._socket,{end:!1}),this.options.debug){let n=new mv;n.on("readable",()=>{let i;for(;i=n.read();)this.logger.debug({tnx:"message"},i.toString("binary").replace(/\r?\n$/,""))}),r.pipe(n)}return r.once("end",()=>{this._currentDataStream===r&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:r.inByteCount,outByteCount:r.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",r.outByteCount,r.inByteCount)}),r}_actionGreeting(e){if(clearTimeout(this._greetingTimeout),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){let r;if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(this._ehloLines=e.split(/\r?\n/).map(n=>n.replace(/^\d+[ -]/,"").trim()).filter(n=>n).slice(1),!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(e)&&this._supportedAuth.push("PLAIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(e)&&this._supportedAuth.push("LOGIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(e)&&this._supportedAuth.push("CRAM-MD5"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(e)&&this._supportedAuth.push("XOAUTH2"),(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0),this.emit("connect")}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS)return this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this.emit("connect");this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),s=fv.createHmac("md5",this._auth.credentials.pass);s.update(i);let o=this._auth.credentials.user+" "+s.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(o).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(this._envelope.from)?"Internationalized mailbox name not allowed":"Mail command failed";return r(this._formatError(i,"EENVELOPE",e,"MAIL FROM"))}if(!this._envelope.rcptQueue.length)return r(this._formatError("Can't send mail - no recipients defined","EENVELOPE",!1,"API"));this._recipientQueue=[];let n=this._supportedExtensions.includes("PIPELINING");do{let i=this._envelope.rcptQueue.shift();this._recipientQueue.push(i),this._responseActions.push(s=>{this._actionRCPT(s,r)}),this._sendCommand("RCPT TO:<"+i+">"+this._getDsnRcptToArgs())}while(n&&this._envelope.rcptQueue.length)}_actionRCPT(e,r){let n,i=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(i)?"Internationalized mailbox name not allowed":"Recipient command failed";this._envelope.rejected.push(i),n=this._formatError(s,"EENVELOPE",e,"RCPT TO"),n.recipient=i,this._envelope.rejectedErrors.push(n)}else this._envelope.accepted.push(i);if(!this._envelope.rcptQueue.length&&!this._recipientQueue.length)if(this._envelope.rejected.length<this._envelope.to.length)this._responseActions.push(s=>{this._actionDATA(s,r)}),this._sendCommand("DATA");else return n=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",e,"RCPT TO"),n.rejected=this._envelope.rejected,n.rejectedErrors=this._envelope.rejectedErrors,r(n);else if(this._envelope.rcptQueue.length){let s=this._envelope.rcptQueue.shift();this._recipientQueue.push(s),this._responseActions.push(o=>{this._actionRCPT(o,r)}),this._sendCommand("RCPT TO:<"+s+">"+this._getDsnRcptToArgs())}}_actionDATA(e,r){if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let n={accepted:this._envelope.accepted,rejected:this._envelope.rejected};this._ehloLines&&this._ehloLines.length&&(n.ehlo=this._ehloLines),this._envelope.rejectedErrors.length&&(n.rejectedErrors=this._envelope.rejectedErrors),r(null,n)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,this._envelope.rejected.push(e),this._envelope.rejectedErrors.push(s);for(let o=0,a=this._envelope.accepted.length;o<a;o++)this._envelope.accepted[o]===e&&this._envelope.accepted.splice(o,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(s=>{this._actionAUTHComplete(s,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=kw.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}};yv.exports=Mp});var Hp=he((nX,gv)=>{"use strict";var{Stream:Mw}=ee("stream"),Kw=aa(),Hw=ee("crypto"),Fw=Kt(),xi=lr(),Kp=class extends Mw{constructor(e,r){if(super(),this.options=e||{},e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=xi.EOAUTH2,setImmediate(()=>this.emit("error",i));return}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=Fw.getLogger({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,r(i)}if(this.renewing)return this.renewalQueue.push({renew:e,callback:r});this.renewing=!0;let n=(i,s)=>{this.renewalQueue.forEach(o=>o.callback(i,s)),this.renewalQueue=[],this.renewing=!1,i?this.logger.error({err:i,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),r(i,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(i,s,o)=>{!i&&s&&(this.accessToken=s,this.expires=o||0),n(i,s)}):this.generateToken(n)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r,n;if(this.options.serviceClient){let i=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:i,exp:i+this.options.serviceRequestTimeout},o;try{o=this.jwtSignRS256(s)}catch{let c=new Error("Can't generate token. Check your auth options");return c.code=xi.EOAUTH2,e(c)}r={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:o},n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,e(i)}r={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},n={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(r,this.options.customParams),Object.assign(n,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(n)),this.postRequest(this.options.accessUrl,r,this.options,(i,s)=>{let o;if(i)return e(i);try{o=JSON.parse(s.toString())}catch(l){return e(l)}if(!o||typeof o!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let l=new Error("Invalid authentication response");return l.code=xi.EOAUTH2,e(l)}let a=Object.assign({},o);if(a.access_token&&(a.access_token=(a.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(a)),o.error){let l=o.error;o.error_description&&(l+=": "+o.error_description),o.error_uri&&(l+=" ("+o.error_uri+")");let d=new Error(l);return d.code=xi.EOAUTH2,e(d)}if(o.access_token)return this.updateToken(o.access_token,o.expires_in),e(null,this.accessToken);let c=new Error("No access token");return c.code=xi.EOAUTH2,e(c)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join(""),"utf-8").toString("base64")}postRequest(e,r,n,i){let s=!1,o=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=Kw(e,c);l.on("readable",()=>{let d;for(;(d=l.read())!==null;)o.push(d),a+=d.length}),l.once("error",d=>{if(!s)return s=!0,i(d)}),l.once("end",()=>{if(!s)return s=!0,i(null,Buffer.concat(o,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){e=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(n=>this.toBase64URL(n)).join(".");let r=Hw.createSign("RSA-SHA256").update(e).sign(this.options.privateKey);return e+"."+this.toBase64URL(r)}};gv.exports=Kp});var Tv=he((iX,Av)=>{"use strict";var Vw=Rl(),Bw=Kt().assign,qw=Hp(),vv=lr(),jw=ee("events"),Fp=class extends jw{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new qw(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this.emit("error",n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0}connect(e){this.pool.getSocket(this.options,(r,n)=>{if(r)return e(r);let i=!1,s=this.options;n&&n.connection&&(this.logger.info({tnx:"proxy",remoteAddress:n.connection.remoteAddress,remotePort:n.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",n.connection.remoteAddress,n.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Bw(!1,s),n)),this.connection=new Vw(s),this.connection.once("error",o=>{if(this.emit("error",o),!i)return i=!0,e(o)}),this.connection.once("end",()=>{if(this.close(),i)return;i=!0;let o=setTimeout(()=>{if(i)return;let a=new Error("Unexpected socket close");this.connection&&this.connection._socket&&this.connection._socket.upgrading&&(a.code=vv.ETLS),e(a)},1e3);try{o.unref()}catch{}}),this.connection.connect(()=>{if(!i)if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,o=>{if(!i){if(i=!0,o)return this.connection.close(),this.emit("error",o),e(o);this._connected=!0,e(null,!0)}});else return i=!0,this._connected=!0,e(null,!0)})})}send(e,r){if(!this._connected)return this.connect(o=>o?r(o):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,s.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.connection.send(n,e.message.createReadStream(),(o,a)=>{if(this.messages++,o)return this.connection.close(),this.emit("error",o),r(o);a.envelope={from:n.from,to:n.to},a.messageId=i,setImmediate(()=>{if(this.messages>=this.options.maxMessages){let c=new Error("Resource exhausted");c.code=vv.EMAXLIMIT,this.connection.close(),this.emit("error",c)}else this.pool._checkRateLimit(()=>{this.available=!0,this.emit("available")})}),r(null,a)})}close(){this._connected=!1,this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};Av.exports=Fp});var Iv=he((sX,Gw)=>{Gw.exports={"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},"126":{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},"163":{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}}});var Vp=he((oX,xv)=>{"use strict";var _v=Iv(),Ol={};Object.keys(_v).forEach(t=>{let e=_v[t],r=$w(e);Ol[kl(t)]=r,[].concat(e.aliases||[]).forEach(n=>{Ol[kl(n)]=r}),[].concat(e.domains||[]).forEach(n=>{Ol[kl(n)]=r})});function kl(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function $w(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}xv.exports=function(t){return t=kl(t.split("@").pop()),Ol[t]||!1}});var Rv=he((aX,Nv)=>{"use strict";var Ww=ee("events"),bv=Tv(),zw=Rl(),Jw=Vp(),fa=Kt(),Sv=lr(),wv=br(),Bp=class extends Ww{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=fa.parseConnectionUrl(e.url),n=n||r.service),this.options=fa.assign(!1,e,r,n&&Jw(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.logger=fa.getLogger(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=wv.version+"[client:"+wv.version+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){return setImmediate(()=>r(null,!1))}send(e,r){return this._closed?!1:(this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0)}close(){let e,r=this._connections.length;if(this._closed=!0,clearTimeout(this._rateLimit.timeout),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}e.queueEntry=!1}})}_createConnection(){let e=new bv(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Sv.EMAXLIMIT?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues===void 0||this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{e.queueEntry.callback(new Error("Reached maximum number of retries after connection was closed"))}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((i,s)=>{e=fa.callbackPromise(i,s)}));let n=new bv(this).auth;return this.getSocket(this.options,(i,s)=>{if(i)return e(i);let o=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,o.host||"",o.port||""),o=Object.assign(fa.assign(!1,o),s));let a=new zw(o),c=!1;a.once("error",d=>{if(!c)return c=!0,a.close(),e(d)}),a.once("end",()=>{if(!c)return c=!0,e(new Error("Connection closed"))});let l=()=>{if(!c)return c=!0,a.quit(),e(null,!0)};a.connect(()=>{if(!c)if(n&&(a.allowsAuth||o.forceAuth))a.login(n,d=>{if(!c){if(d)return c=!0,a.close(),e(d);l()}});else if(!n&&a.allowsAuth&&o.forceAuth){let d=new Error("Authentication info was not provided");return d.code=Sv.ENOAUTH,c=!0,a.close(),e(d)}else l()})}),r}};Nv.exports=Bp});var Pv=he((cX,Dv)=>{"use strict";var Yw=ee("events"),Ov=Rl(),Xw=Vp(),Bs=Kt(),Qw=Hp(),kv=lr(),Cv=br(),qp=class extends Yw{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=Bs.parseConnectionUrl(e.url),n=n||r.service),this.options=Bs.assign(!1,e,r,n&&Xw(n)),this.logger=Bs.getLogger(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Cv.version+"[client:"+Cv.version+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){return setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},e&&typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new Qw(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){this.getSocket(this.options,(n,i)=>{if(n)return r(n);let s=!1,o=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,o.host||"",o.port||""),o=Object.assign(Bs.assign(!1,o),i));let a=new Ov(o),c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};a.once("error",p=>{if(!s)return s=!0,l(),a.close(),r(p)}),a.once("end",()=>{if(s)return;let p=setTimeout(()=>{if(s)return;s=!0,l();let m=new Error("Unexpected socket close");a&&a._socket&&a._socket.upgrading&&(m.code=kv.ETLS),r(m)},1e3);try{p.unref()}catch{}});let d=()=>{let p=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(p.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(p.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(p.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),a.send(p,e.message.createReadStream(),(v,b)=>{if(s=!0,l(),a.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);b.envelope={from:p.from,to:p.to},b.messageId=m;try{return r(null,b)}catch(k){this.logger.error({err:k,tnx:"callback"},"Callback error for %s: %s",m,k.message)}})};a.connect(()=>{s||(c=this.getAuth(e.data.auth),c&&(a.allowsAuth||o.forceAuth)?a.login(c,p=>{if(l(),!s){if(p)return s=!0,a.close(),r(p);d()}}):d())})})}verify(e){let r;return e||(r=new Promise((n,i)=>{e=Bs.callbackPromise(n,i)})),this.getSocket(this.options,(n,i)=>{if(n)return e(n);let s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Bs.assign(!1,s),i));let o=new Ov(s),a=!1,c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};o.once("error",p=>{if(!a)return a=!0,l(),o.close(),e(p)}),o.once("end",()=>{if(!a)return a=!0,l(),e(new Error("Connection closed"))});let d=()=>{if(!a)return a=!0,l(),o.quit(),e(null,!0)};o.connect(()=>{if(!a)if(c=this.getAuth({}),c&&(o.allowsAuth||s.forceAuth))o.login(c,p=>{if(l(),!a){if(p)return a=!0,o.close(),e(p);d()}});else if(!c&&o.allowsAuth&&s.forceAuth){let p=new Error("Authentication info was not provided");return p.code=kv.ENOAUTH,a=!0,l(),o.close(),e(p)}else d()})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}};Dv.exports=qp});var Lv=he((lX,Uv)=>{"use strict";var{spawn:Zw}=ee("child_process"),eN=br(),tN=Kt(),jp=lr(),Gp=class{constructor(e){e=e||{},this._spawn=Zw,this.options=e,this.name="Sendmail",this.version=eN.version,this.path="sendmail",this.args=!1,this.logger=tN.getLogger(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args))}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s;if([].concat(n.from||[]).concat(n.to||[]).some(d=>/^-/.test(d))){let d=new Error("Can not send mail. Invalid envelope addresses.");return d.code=jp.ESENDMAIL,r(d)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=d=>{if(!s&&(s=!0,typeof r=="function"))return d?r(d):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(d){return this.logger.error({err:d,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",d.message),c(d)}if(l){l.on("error",m=>{this.logger.error({err:m,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,m.message),c(m)}),l.once("exit",m=>{if(!m)return c();let E=new Error(m===127?"Sendmail command not found, process exited with code "+m:"Sendmail exited with code "+m);E.code=jp.ESENDMAIL,this.logger.error({err:E,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,E.message),c(E)}),l.once("close",c),l.stdin.on("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,m.message),c(m)});let d=[].concat(n.to||[]);d.length>3&&d.push("...and "+d.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,d.join(", "));let p=e.message.createReadStream();p.once("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,m.message),l.kill("SIGINT"),c(m)}),p.pipe(l.stdin)}else{let d=new Error("sendmail was not found");return d.code=jp.ESENDMAIL,c(d)}}};Uv.exports=Gp});var Kv=he((uX,Mv)=>{"use strict";var rN=br(),nN=Kt(),$p=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=rN.version,this.logger=nN.getLogger(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
50
- `].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,s.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let o;try{o=e.message.createReadStream()}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return o.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:o});let a=[],c=0;o.on("readable",()=>{let l;for(;(l=o.read())!==null;)a.push(l),c+=l.length}),o.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),o.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}};Mv.exports=$p});var Fv=he((dX,Hv)=>{"use strict";var iN=br(),sN=Kt(),Wp=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=iN.version,this.logger=sN.getLogger(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,s.join(", ")),setImmediate(()=>{e.normalize((o,a)=>o?(this.logger.error({err:o,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,o.message),r(o)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}};Hv.exports=Wp});var qv=he((pX,Bv)=>{"use strict";var oN=ee("events"),aN=br(),Vv=Kt(),cN=Ap(),lN=Nl(),zp=class extends oN{constructor(e){super(),e=e||{},this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=aN.version,this.logger=Vv.getLogger(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){return this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"?this.ses.sesClient.config.region().then(r=>e(null,r)).catch(r=>e(r)):e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new lN("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.data.envelope||e.message.getEnvelope(),s=e.message.messageId(),o=[].concat(i.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:s},"Sending message %s to <%s>",s,o.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),d=l.pipe(new cN),p=[],m=0;d.on("readable",()=>{let E;for(;(E=d.read())!==null;)p.push(E),m+=E.length}),l.once("error",E=>d.emit("error",E)),d.once("error",E=>c(E)),d.once("end",()=>c(null,Buffer.concat(p,m)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:s},"Failed creating message for %s. %s",s,c.message),r(c);let d=Object.assign({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses||{});this.getRegion((p,m)=>{(p||!m)&&(m="us-east-1");let E=new this.ses.SendEmailCommand(d);this.ses.sesClient.send(E).then(b=>{m==="us-east-1"&&(m="email"),r(null,{envelope:{from:i.from,to:i.to},messageId:"<"+b.MessageId+(/@/.test(b.MessageId)?"":"@"+m+".amazonses.com")+">",response:b.MessageId,raw:l})}).catch(b=>{this.logger.error({err:b,tnx:"send"},"Send error for %s: %s",s,b.message),r(b)})})}))}verify(e){let r;e||(r=new Promise((s,o)=>{e=Vv.callbackPromise(s,o)}));let n=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?e(s):e(null,!0),i={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
49
+ `,"utf-8"))}}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(s=>(s&&s.address||s||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let s=0,o=this._envelope.to.length;s<o;s++){if(!this._envelope.to[s]||/[\r\n<>]/.test(this._envelope.to[s]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[s]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[s])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(s){return r(this._formatError("Invalid DSN "+s.message,"EENVELOPE",!1,"API"))}if(this._responseActions.push(s=>{this._actionMAIL(s,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let s=Number(this._envelope.size)||0;s>0&&n.push("SIZE="+s)}if(this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+_i.encodeXText(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+_i.encodeXText(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));n.push("REQUIRETLS")}this._sendCommand("MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):""))}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let o=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!o.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let s=(e.recipient||e.orcpt||"").toString()||null;return s&&s.indexOf(";")<0&&(s="rfc822;"+s),{ret:r,envid:n,notify:i,orcpt:s}}_getDsnRcptToArgs(){let e=[];return this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.notify&&e.push("NOTIFY="+_i.encodeXText(this._envelope.dsn.notify)),this._envelope.dsn.orcpt&&e.push("ORCPT="+_i.encodeXText(this._envelope.dsn.orcpt))),e.length?" "+e.join(" "):""}_createSendStream(e){let r=new HN;if(this.options.lmtp?this._envelope.accepted.forEach((n,i)=>{let s=i===this._envelope.accepted.length-1;this._responseActions.push(o=>{this._actionLMTPStream(n,s,o,e)})}):this._responseActions.push(n=>{this._actionSMTPStream(n,e)}),this._currentDataStream=r,r.pipe(this._socket,{end:!1}),this.options.debug){let n=new gv;n.on("readable",()=>{let i;for(;i=n.read();)this.logger.debug({tnx:"message"},i.toString("binary").replace(/\r?\n$/,""))}),r.pipe(n)}return r.once("end",()=>{this._currentDataStream===r&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:r.inByteCount,outByteCount:r.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",r.outByteCount,r.inByteCount)}),r}_actionGreeting(e){if(clearTimeout(this._greetingTimeout),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){let r;if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(this._ehloLines=e.split(/\r?\n/).map(n=>n.replace(/^\d+[ -]/,"").trim()).filter(n=>n).slice(1),!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(e)&&this._supportedAuth.push("PLAIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(e)&&this._supportedAuth.push("LOGIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(e)&&this._supportedAuth.push("CRAM-MD5"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(e)&&this._supportedAuth.push("XOAUTH2"),(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0),this.emit("connect")}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS)return this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this.emit("connect");this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),s=yv.createHmac("md5",this._auth.credentials.pass);s.update(i);let o=this._auth.credentials.user+" "+s.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(o).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(this._envelope.from)?"Internationalized mailbox name not allowed":"Mail command failed";return r(this._formatError(i,"EENVELOPE",e,"MAIL FROM"))}if(!this._envelope.rcptQueue.length)return r(this._formatError("Can't send mail - no recipients defined","EENVELOPE",!1,"API"));this._recipientQueue=[];let n=this._supportedExtensions.includes("PIPELINING");do{let i=this._envelope.rcptQueue.shift();this._recipientQueue.push(i),this._responseActions.push(s=>{this._actionRCPT(s,r)}),this._sendCommand("RCPT TO:<"+i+">"+this._getDsnRcptToArgs())}while(n&&this._envelope.rcptQueue.length)}_actionRCPT(e,r){let n,i=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(i)?"Internationalized mailbox name not allowed":"Recipient command failed";this._envelope.rejected.push(i),n=this._formatError(s,"EENVELOPE",e,"RCPT TO"),n.recipient=i,this._envelope.rejectedErrors.push(n)}else this._envelope.accepted.push(i);if(!this._envelope.rcptQueue.length&&!this._recipientQueue.length)if(this._envelope.rejected.length<this._envelope.to.length)this._responseActions.push(s=>{this._actionDATA(s,r)}),this._sendCommand("DATA");else return n=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",e,"RCPT TO"),n.rejected=this._envelope.rejected,n.rejectedErrors=this._envelope.rejectedErrors,r(n);else if(this._envelope.rcptQueue.length){let s=this._envelope.rcptQueue.shift();this._recipientQueue.push(s),this._responseActions.push(o=>{this._actionRCPT(o,r)}),this._sendCommand("RCPT TO:<"+s+">"+this._getDsnRcptToArgs())}}_actionDATA(e,r){if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let n={accepted:this._envelope.accepted,rejected:this._envelope.rejected};this._ehloLines&&this._ehloLines.length&&(n.ehlo=this._ehloLines),this._envelope.rejectedErrors.length&&(n.rejectedErrors=this._envelope.rejectedErrors),r(null,n)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,this._envelope.rejected.push(e),this._envelope.rejectedErrors.push(s);for(let o=0,a=this._envelope.accepted.length;o<a;o++)this._envelope.accepted[o]===e&&this._envelope.accepted.splice(o,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(s=>{this._actionAUTHComplete(s,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KN.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}};Tv.exports=Vp});var qp=he((uX,Iv)=>{"use strict";var{Stream:jN}=ee("stream"),GN=ca(),$N=ee("crypto"),WN=Kt(),xi=lr(),Bp=class extends jN{constructor(e,r){if(super(),this.options=e||{},e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=xi.EOAUTH2,setImmediate(()=>this.emit("error",i));return}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=WN.getLogger({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,r(i)}if(this.renewing)return this.renewalQueue.push({renew:e,callback:r});this.renewing=!0;let n=(i,s)=>{this.renewalQueue.forEach(o=>o.callback(i,s)),this.renewalQueue=[],this.renewing=!1,i?this.logger.error({err:i,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),r(i,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(i,s,o)=>{!i&&s&&(this.accessToken=s,this.expires=o||0),n(i,s)}):this.generateToken(n)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r,n;if(this.options.serviceClient){let i=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:i,exp:i+this.options.serviceRequestTimeout},o;try{o=this.jwtSignRS256(s)}catch{let c=new Error("Can't generate token. Check your auth options");return c.code=xi.EOAUTH2,e(c)}r={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:o},n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,e(i)}r={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},n={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(r,this.options.customParams),Object.assign(n,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(n)),this.postRequest(this.options.accessUrl,r,this.options,(i,s)=>{let o;if(i)return e(i);try{o=JSON.parse(s.toString())}catch(l){return e(l)}if(!o||typeof o!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let l=new Error("Invalid authentication response");return l.code=xi.EOAUTH2,e(l)}let a=Object.assign({},o);if(a.access_token&&(a.access_token=(a.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(a)),o.error){let l=o.error;o.error_description&&(l+=": "+o.error_description),o.error_uri&&(l+=" ("+o.error_uri+")");let d=new Error(l);return d.code=xi.EOAUTH2,e(d)}if(o.access_token)return this.updateToken(o.access_token,o.expires_in),e(null,this.accessToken);let c=new Error("No access token");return c.code=xi.EOAUTH2,e(c)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join(""),"utf-8").toString("base64")}postRequest(e,r,n,i){let s=!1,o=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=GN(e,c);l.on("readable",()=>{let d;for(;(d=l.read())!==null;)o.push(d),a+=d.length}),l.once("error",d=>{if(!s)return s=!0,i(d)}),l.once("end",()=>{if(!s)return s=!0,i(null,Buffer.concat(o,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){e=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(n=>this.toBase64URL(n)).join(".");let r=$N.createSign("RSA-SHA256").update(e).sign(this.options.privateKey);return e+"."+this.toBase64URL(r)}};Iv.exports=Bp});var bv=he((dX,xv)=>{"use strict";var zN=Cl(),JN=Kt().assign,YN=qp(),_v=lr(),XN=ee("events"),jp=class extends XN{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new YN(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this.emit("error",n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0}connect(e){this.pool.getSocket(this.options,(r,n)=>{if(r)return e(r);let i=!1,s=this.options;n&&n.connection&&(this.logger.info({tnx:"proxy",remoteAddress:n.connection.remoteAddress,remotePort:n.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",n.connection.remoteAddress,n.connection.remotePort,s.host||"",s.port||""),s=Object.assign(JN(!1,s),n)),this.connection=new zN(s),this.connection.once("error",o=>{if(this.emit("error",o),!i)return i=!0,e(o)}),this.connection.once("end",()=>{if(this.close(),i)return;i=!0;let o=setTimeout(()=>{if(i)return;let a=new Error("Unexpected socket close");this.connection&&this.connection._socket&&this.connection._socket.upgrading&&(a.code=_v.ETLS),e(a)},1e3);try{o.unref()}catch{}}),this.connection.connect(()=>{if(!i)if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,o=>{if(!i){if(i=!0,o)return this.connection.close(),this.emit("error",o),e(o);this._connected=!0,e(null,!0)}});else return i=!0,this._connected=!0,e(null,!0)})})}send(e,r){if(!this._connected)return this.connect(o=>o?r(o):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,s.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.connection.send(n,e.message.createReadStream(),(o,a)=>{if(this.messages++,o)return this.connection.close(),this.emit("error",o),r(o);a.envelope={from:n.from,to:n.to},a.messageId=i,setImmediate(()=>{if(this.messages>=this.options.maxMessages){let c=new Error("Resource exhausted");c.code=_v.EMAXLIMIT,this.connection.close(),this.emit("error",c)}else this.pool._checkRateLimit(()=>{this.available=!0,this.emit("available")})}),r(null,a)})}close(){this._connected=!1,this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};xv.exports=jp});var Sv=he((pX,QN)=>{QN.exports={"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},"126":{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},"163":{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}}});var Gp=he((fX,wv)=>{"use strict";var Nv=Sv(),Dl={};Object.keys(Nv).forEach(t=>{let e=Nv[t],r=ZN(e);Dl[Pl(t)]=r,[].concat(e.aliases||[]).forEach(n=>{Dl[Pl(n)]=r}),[].concat(e.domains||[]).forEach(n=>{Dl[Pl(n)]=r})});function Pl(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function ZN(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}wv.exports=function(t){return t=Pl(t.split("@").pop()),Dl[t]||!1}});var Dv=he((mX,Cv)=>{"use strict";var ew=ee("events"),Rv=bv(),tw=Cl(),rw=Gp(),ma=Kt(),Ov=lr(),kv=br(),$p=class extends ew{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=ma.parseConnectionUrl(e.url),n=n||r.service),this.options=ma.assign(!1,e,r,n&&rw(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.logger=ma.getLogger(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=kv.version+"[client:"+kv.version+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){return setImmediate(()=>r(null,!1))}send(e,r){return this._closed?!1:(this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0)}close(){let e,r=this._connections.length;if(this._closed=!0,clearTimeout(this._rateLimit.timeout),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}e.queueEntry=!1}})}_createConnection(){let e=new Rv(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Ov.EMAXLIMIT?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues===void 0||this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{e.queueEntry.callback(new Error("Reached maximum number of retries after connection was closed"))}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((i,s)=>{e=ma.callbackPromise(i,s)}));let n=new Rv(this).auth;return this.getSocket(this.options,(i,s)=>{if(i)return e(i);let o=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,o.host||"",o.port||""),o=Object.assign(ma.assign(!1,o),s));let a=new tw(o),c=!1;a.once("error",d=>{if(!c)return c=!0,a.close(),e(d)}),a.once("end",()=>{if(!c)return c=!0,e(new Error("Connection closed"))});let l=()=>{if(!c)return c=!0,a.quit(),e(null,!0)};a.connect(()=>{if(!c)if(n&&(a.allowsAuth||o.forceAuth))a.login(n,d=>{if(!c){if(d)return c=!0,a.close(),e(d);l()}});else if(!n&&a.allowsAuth&&o.forceAuth){let d=new Error("Authentication info was not provided");return d.code=Ov.ENOAUTH,c=!0,a.close(),e(d)}else l()})}),r}};Cv.exports=$p});var Kv=he((hX,Mv)=>{"use strict";var nw=ee("events"),Pv=Cl(),iw=Gp(),Bs=Kt(),sw=qp(),Uv=lr(),Lv=br(),Wp=class extends nw{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=Bs.parseConnectionUrl(e.url),n=n||r.service),this.options=Bs.assign(!1,e,r,n&&iw(n)),this.logger=Bs.getLogger(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Lv.version+"[client:"+Lv.version+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){return setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},e&&typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new sw(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){this.getSocket(this.options,(n,i)=>{if(n)return r(n);let s=!1,o=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,o.host||"",o.port||""),o=Object.assign(Bs.assign(!1,o),i));let a=new Pv(o),c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};a.once("error",p=>{if(!s)return s=!0,l(),a.close(),r(p)}),a.once("end",()=>{if(s)return;let p=setTimeout(()=>{if(s)return;s=!0,l();let m=new Error("Unexpected socket close");a&&a._socket&&a._socket.upgrading&&(m.code=Uv.ETLS),r(m)},1e3);try{p.unref()}catch{}});let d=()=>{let p=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(p.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(p.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(p.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),a.send(p,e.message.createReadStream(),(v,b)=>{if(s=!0,l(),a.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);b.envelope={from:p.from,to:p.to},b.messageId=m;try{return r(null,b)}catch(k){this.logger.error({err:k,tnx:"callback"},"Callback error for %s: %s",m,k.message)}})};a.connect(()=>{s||(c=this.getAuth(e.data.auth),c&&(a.allowsAuth||o.forceAuth)?a.login(c,p=>{if(l(),!s){if(p)return s=!0,a.close(),r(p);d()}}):d())})})}verify(e){let r;return e||(r=new Promise((n,i)=>{e=Bs.callbackPromise(n,i)})),this.getSocket(this.options,(n,i)=>{if(n)return e(n);let s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Bs.assign(!1,s),i));let o=new Pv(s),a=!1,c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};o.once("error",p=>{if(!a)return a=!0,l(),o.close(),e(p)}),o.once("end",()=>{if(!a)return a=!0,l(),e(new Error("Connection closed"))});let d=()=>{if(!a)return a=!0,l(),o.quit(),e(null,!0)};o.connect(()=>{if(!a)if(c=this.getAuth({}),c&&(o.allowsAuth||s.forceAuth))o.login(c,p=>{if(l(),!a){if(p)return a=!0,o.close(),e(p);d()}});else if(!c&&o.allowsAuth&&s.forceAuth){let p=new Error("Authentication info was not provided");return p.code=Uv.ENOAUTH,a=!0,l(),o.close(),e(p)}else d()})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}};Mv.exports=Wp});var Fv=he((EX,Hv)=>{"use strict";var{spawn:ow}=ee("child_process"),aw=br(),cw=Kt(),zp=lr(),Jp=class{constructor(e){e=e||{},this._spawn=ow,this.options=e,this.name="Sendmail",this.version=aw.version,this.path="sendmail",this.args=!1,this.logger=cw.getLogger(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args))}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s;if([].concat(n.from||[]).concat(n.to||[]).some(d=>/^-/.test(d))){let d=new Error("Can not send mail. Invalid envelope addresses.");return d.code=zp.ESENDMAIL,r(d)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=d=>{if(!s&&(s=!0,typeof r=="function"))return d?r(d):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(d){return this.logger.error({err:d,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",d.message),c(d)}if(l){l.on("error",m=>{this.logger.error({err:m,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,m.message),c(m)}),l.once("exit",m=>{if(!m)return c();let E=new Error(m===127?"Sendmail command not found, process exited with code "+m:"Sendmail exited with code "+m);E.code=zp.ESENDMAIL,this.logger.error({err:E,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,E.message),c(E)}),l.once("close",c),l.stdin.on("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,m.message),c(m)});let d=[].concat(n.to||[]);d.length>3&&d.push("...and "+d.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,d.join(", "));let p=e.message.createReadStream();p.once("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,m.message),l.kill("SIGINT"),c(m)}),p.pipe(l.stdin)}else{let d=new Error("sendmail was not found");return d.code=zp.ESENDMAIL,c(d)}}};Hv.exports=Jp});var Bv=he((yX,Vv)=>{"use strict";var lw=br(),uw=Kt(),Yp=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=lw.version,this.logger=uw.getLogger(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
50
+ `].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,s.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let o;try{o=e.message.createReadStream()}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return o.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:o});let a=[],c=0;o.on("readable",()=>{let l;for(;(l=o.read())!==null;)a.push(l),c+=l.length}),o.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),o.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}};Vv.exports=Yp});var jv=he((gX,qv)=>{"use strict";var dw=br(),pw=Kt(),Xp=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=dw.version,this.logger=pw.getLogger(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,s.join(", ")),setImmediate(()=>{e.normalize((o,a)=>o?(this.logger.error({err:o,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,o.message),r(o)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}};qv.exports=Xp});var Wv=he((vX,$v)=>{"use strict";var fw=ee("events"),mw=br(),Gv=Kt(),hw=xp(),Ew=kl(),Qp=class extends fw{constructor(e){super(),e=e||{},this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=mw.version,this.logger=Gv.getLogger(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){return this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"?this.ses.sesClient.config.region().then(r=>e(null,r)).catch(r=>e(r)):e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Ew("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.data.envelope||e.message.getEnvelope(),s=e.message.messageId(),o=[].concat(i.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:s},"Sending message %s to <%s>",s,o.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),d=l.pipe(new hw),p=[],m=0;d.on("readable",()=>{let E;for(;(E=d.read())!==null;)p.push(E),m+=E.length}),l.once("error",E=>d.emit("error",E)),d.once("error",E=>c(E)),d.once("end",()=>c(null,Buffer.concat(p,m)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:s},"Failed creating message for %s. %s",s,c.message),r(c);let d=Object.assign({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses||{});this.getRegion((p,m)=>{(p||!m)&&(m="us-east-1");let E=new this.ses.SendEmailCommand(d);this.ses.sesClient.send(E).then(b=>{m==="us-east-1"&&(m="email"),r(null,{envelope:{from:i.from,to:i.to},messageId:"<"+b.MessageId+(/@/.test(b.MessageId)?"":"@"+m+".amazonses.com")+">",response:b.MessageId,raw:l})}).catch(b=>{this.logger.error({err:b,tnx:"send"},"Send error for %s: %s",s,b.message),r(b)})})}))}verify(e){let r;e||(r=new Promise((s,o)=>{e=Gv.callbackPromise(s,o)}));let n=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?e(s):e(null,!0),i={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
51
51
  To: <invalid@invalid>\r
52
52
  Subject: Invalid\r
53
53
  \r
54
- Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion((s,o)=>{(s||!o)&&(o="us-east-1");let a=new this.ses.SendEmailCommand(i);this.ses.sesClient.send(a).then(l=>n(null,l)).catch(l=>n(l))}),r}};Bv.exports=zp});var Wv=he((fX,Cl)=>{"use strict";var uN=cv(),$v=Kt(),dN=Rv(),pN=Pv(),fN=Lv(),mN=Kv(),hN=Fv(),EN=qv(),yN=lr(),gN=aa(),jv=br(),vN=(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),AN=(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),Gv=(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,TN=["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),ma=!1;Cl.exports.createTransport=function(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n?r=$v.parseConnectionUrl(n):r=t,r.pool)t=new dN(r);else if(r.sendmail)t=new fN(r);else if(r.streamTransport)t=new mN(r);else if(r.jsonTransport)t=new hN(r);else if(r.SES){if(r.SES.ses&&r.SES.aws){let i=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw i.code=yN.ECONFIG,i}t=new EN(r)}else t=new pN(r)}return new uN(t,r,e)};Cl.exports.createTestAccount=function(t,e){let r;if(!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((l,d)=>{e=$v.callbackPromise(l,d)})),TN&&ma)return setImmediate(()=>e(null,ma)),r;t=t||vN;let n=[],i=0,s={},o={requestor:jv.name,version:jv.version};Gv&&(s.Authorization="Bearer "+Gv);let a={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(o))};/^https:/i.test(t)&&(a.tls={rejectUnauthorized:!0});let c=gN(t+"/user",a);return c.on("readable",()=>{let l;for(;(l=c.read())!==null;)n.push(l),i+=l.length}),c.once("error",l=>e(l)),c.once("end",()=>{let l=Buffer.concat(n,i),d;try{d=JSON.parse(l.toString())}catch(p){return e(p)}if(d.status!=="success"||d.error)return e(new Error(d.error||"Request failed"));delete d.status,ma=d,e(null,ma)}),r};Cl.exports.getTestMessageUrl=function(t){if(!t||!t.response)return!1;let e=new Map;return t.response.replace(/\[([^\]]+)\]$/,(r,n)=>{n.replace(/\b([A-Z0-9]+)=([^\s]+)/g,(i,s,o)=>{e.set(s,o)})}),e.has("STATUS")&&e.has("MSGID")?(ma.web||AN)+"/message/"+e.get("MSGID"):!1}});var $A={};Va($A,{RequestError:()=>jn,createAdaptorServer:()=>GA,getRequestListener:()=>jA,serve:()=>w0});import{createServer as u0}from"http";import{Http2ServerRequest as d0}from"http2";import{Http2ServerRequest as Tf}from"http2";import{Readable as LA}from"stream";import _0 from"crypto";async function A0(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function FA(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(o,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function s(){t.read().then(o,i)}function o({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",s);else return t.read().then(o,i)}catch(l){i(l)}}}function T0(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:FA(t.getReader(),e)}var jn,p0,f0,Ka,m0,KA,h0,zs,E0,$l,Wl,y0,Ws,g0,zl,v0,MA,$s,wi,xf,Ha,If,I0,bf,x0,VA,_f,BA,qA,b0,S0,jA,GA,w0,WA=Q(()=>{jn=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},p0=t=>t instanceof jn?t:new jn(t.message,{cause:t}),f0=global.Request,Ka=class extends f0{constructor(t,e){typeof t=="object"&&zs in t&&(t=t[zs]()),typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},m0=t=>{let e=[],r=t.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:i,[n+1]:s}=r;i.charCodeAt(0)!==58&&e.push([i,s])}return new Headers(e)},KA=Symbol("wrapBodyStream"),h0=(t,e,r,n,i)=>{let s={method:t,headers:r,signal:i.signal};if(t==="TRACE"){s.method="GET";let o=new Ka(e,s);return Object.defineProperty(o,"method",{get(){return"TRACE"}}),o}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(o){o.enqueue(n.rawBody),o.close()}});else if(n[KA]){let o;s.body=new ReadableStream({async pull(a){try{o||=LA.toWeb(n).getReader();let{done:c,value:l}=await o.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=LA.toWeb(n);return new Ka(e,s)},zs=Symbol("getRequestCache"),E0=Symbol("requestCache"),$l=Symbol("incomingKey"),Wl=Symbol("urlKey"),y0=Symbol("headersKey"),Ws=Symbol("abortControllerKey"),g0=Symbol("getAbortController"),zl={get method(){return this[$l].method||"GET"},get url(){return this[Wl]},get headers(){return this[y0]||=m0(this[$l])},[g0](){return this[zs](),this[Ws]},[zs](){return this[Ws]||=new AbortController,this[E0]||=h0(this.method,this[Wl],this.headers,this[$l],this[Ws])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(t=>{Object.defineProperty(zl,t,{get(){return this[zs]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(zl,t,{value:function(){return this[zs]()[t]()}})});Object.setPrototypeOf(zl,Ka.prototype);v0=(t,e)=>{let r=Object.create(zl);r[$l]=t;let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof Tf)throw new jn("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[Wl]=a.href}catch(a){throw new jn("Invalid absolute URL",{cause:a})}return r}let i=(t instanceof Tf?t.authority:t.headers.host)||e;if(!i)throw new jn("Missing host header");let s;if(t instanceof Tf){if(s=t.scheme,!(s==="http"||s==="https"))throw new jn("Unsupported scheme")}else s=t.socket&&t.socket.encrypted?"https":"http";let o=new URL(`${s}://${i}${n}`);if(o.hostname.length!==i.length&&o.hostname!==i.replace(/:\d+$/,""))throw new jn("Invalid host header");return r[Wl]=o.href,r},MA=Symbol("responseCache"),$s=Symbol("getResponseCache"),wi=Symbol("cache"),xf=global.Response,Ha=class HA{#e;#t;[$s](){return delete this[wi],this[MA]||=new xf(this.#e,this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof HA){let i=r[MA];if(i){this.#t=i,this[$s]();return}else this.#t=r.#t,n=new Headers(r.#t.headers)}else this.#t=r;(typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[wi]=[r?.status||200,e,n||r?.headers])}get headers(){let e=this[wi];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||{"content-type":"text/plain; charset=UTF-8"})),e[2]):this[$s]().headers}get status(){return this[wi]?.[0]??this[$s]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(Ha.prototype,t,{get(){return this[$s]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Ha.prototype,t,{value:function(){return this[$s]()[t]()}})});Object.setPrototypeOf(Ha,xf);Object.setPrototypeOf(Ha.prototype,xf.prototype);If=t=>{let e={};t instanceof Headers||(t=new Headers(t??void 0));let r=[];for(let[n,i]of t)n==="set-cookie"?r.push(i):e[n]=i;return r.length>0&&(e["set-cookie"]=r),e["content-type"]??="text/plain; charset=UTF-8",e},I0="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=_0);bf=Symbol("outgoingEnded"),x0=()=>new Response(null,{status:400}),VA=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),_f=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||e.writeHead(500,{"Content-Type":"text/plain"}),e.end(`Error: ${r.message}`),e.destroy(r))},BA=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},qA=async(t,e)=>{let[r,n,i]=t[wi],s=!1;if(!i)i={"content-type":"text/plain; charset=UTF-8"};else if(i instanceof Headers)s=i.has("content-length"),i=If(i);else if(Array.isArray(i)){let o=new Headers(i);s=o.has("content-length"),i=If(o)}else for(let o in i)if(o.length===14&&o.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?i["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?i["Content-Length"]=n.byteLength:n instanceof Blob&&(i["Content-Length"]=n.size)),e.writeHead(r,i),typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(BA(e),await T0(n,e)?.catch(o=>_f(o,e))),e[bf]?.()},b0=t=>typeof t.then=="function",S0=async(t,e,r={})=>{if(b0(t))if(r.errorHandler)try{t=await t}catch(i){let s=await r.errorHandler(i);if(!s)return;t=s}else t=await t.catch(VA);if(wi in t)return qA(t,e);let n=If(t.headers);if(t.body){let i=t.body.getReader(),s=[],o=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let d=await A0(a).catch(p=>{console.error(p),o=!0});if(!d){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,d.value&&s.push(d.value),d.done){o=!0;break}}o&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,d)=>l+d.length,0))}e.writeHead(t.status,n),s.forEach(c=>{e.write(c)}),o?e.end():(s.length===0&&BA(e),await FA(i,e,a))}else n[I0]||(e.writeHead(t.status,n),e.end());e[bf]?.()},jA=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ka&&(Object.defineProperty(global,"Request",{value:Ka}),Object.defineProperty(global,"Response",{value:Ha})),async(n,i)=>{let s,o;try{o=v0(n,e.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[KA]=!0,n.on("end",()=>{a=!0}),n instanceof d0&&(i[bf]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{n.destroy(),i.destroy()})})})),i.on("close",()=>{o[Ws]&&(n.errored?o[Ws].abort(n.errored.toString()):i.writableFinished||o[Ws].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{n.destroy()})})}),s=t(o,{incoming:n,outgoing:i}),wi in s)return qA(s,i)}catch(a){if(s)return _f(a,i);if(e.errorHandler){if(s=await e.errorHandler(o?a:p0(a)),!s)return}else o?s=VA(a):s=x0()}try{return await S0(s,i,e)}catch(a){return _f(a,i)}}},GA=t=>{let e=t.fetch,r=jA(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming});return(t.createServer||u0)(t.serverOptions||{},r)},w0=(t,e)=>{let r=GA(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var Ci=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),iT=Ci.READ|Ci.WRITE|Ci.DELETE|Ci.APPROVE|Ci.EXECUTE,tt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},tr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var sT=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function Di(t){return sT?Object.freeze(t):t}function g(t,e){if(arguments.length===0)return Di({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),Di(r)}function u(t,e){let n={ok:!1,errors:Di(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),Di(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:o!=null,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c};return g(t,{...r,pagination:l})}function T(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function X(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let s in r){if(s==="message"||s==="field")continue;let o=r[s];(typeof o=="string"||typeof o=="number")&&(n=n.replace(new RegExp(`\\{${s}\\}`,"g"),String(o)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function Pi(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=T("AUTH_NOT_AUTHENTICATED","Not authenticated"),rr=T("AUTH_MISSING_CREDENTIALS","Missing credentials"),Wt=T("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Dr=T("AUTH_TOKEN_EXPIRED","Token expired"),Qr=T("AUTH_TOKEN_MALFORMED","Token malformed"),zt=T("PERM_DENIED","Permission denied"),Xl=X("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),$n=T("VALIDATION_ERROR","Validation failed"),Ui=X("INVALID_INPUT","Invalid input: {reason}"),Js=T("FORBIDDEN","Access forbidden"),Ql=T("NOT_FOUND","Resource not found"),Zl=X("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),Ys=X("ALREADY_EXISTS","{resource} already exists"),Xs=T("CONFLICT","Resource conflict"),Wn=T("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),Li=T("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:rr,InvalidCredentials:Wt,TokenExpired:Dr,TokenMalformed:Qr,PermissionDenied:zt,BoundaryViolation:Xl,Forbidden:Js,ValidationError:$n,InvalidInput:Ui,NotFound:Ql,ResourceNotFound:Zl,AlreadyExists:Ys,Conflict:Xs,RateLimitExceeded:Wn,InternalError:Li};var Ct={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var Ba=class{getMask(e,r){return kf(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return u(zt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return g();let i=this.getMask(e,r.resource),s=this.checkCapability(i,r.action);return s.ok?this.checkBoundary(e,r.boundary,n):s}checkCapability(e,r){return(e&r)!==r?u(zt()):g()}checkBoundary(e,r,n){if(r===tt.GLOBAL)return g();if(!n)return u(zt({message:"Resource context required for boundary check"}));let i=n;switch(r){case tt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return u(zt({message:"Tenant boundary violation"}));break;case tt.OWNER:case tt.SELF:if(i.ownerId!==e.id)return u(zt({message:"Owner boundary violation"}));break;default:return u(zt({message:`Unknown boundary type: ${r}`}))}return g()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(s=>(i&s)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(s=>(i&s)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let E=r.requireAllRoles?"ALL":"ANY",v=e.roles??[],b=r.requireAllRoles?r.roles.every(k=>v.includes(k)):r.roles.some(k=>v.includes(k));if(i.push(`Roles (${E}): ${r.roles.join(", ")} \u2014 user has: [${v.join(", ")}]`),!b)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
54
+ Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion((s,o)=>{(s||!o)&&(o="us-east-1");let a=new this.ses.SendEmailCommand(i);this.ses.sesClient.send(a).then(l=>n(null,l)).catch(l=>n(l))}),r}};$v.exports=Qp});var Xv=he((AX,Ul)=>{"use strict";var yw=pv(),Yv=Kt(),gw=Dv(),vw=Kv(),Aw=Fv(),Tw=Bv(),Iw=jv(),_w=Wv(),xw=lr(),bw=ca(),zv=br(),Sw=(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),Nw=(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),Jv=(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,ww=["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),ha=!1;Ul.exports.createTransport=function(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n?r=Yv.parseConnectionUrl(n):r=t,r.pool)t=new gw(r);else if(r.sendmail)t=new Aw(r);else if(r.streamTransport)t=new Tw(r);else if(r.jsonTransport)t=new Iw(r);else if(r.SES){if(r.SES.ses&&r.SES.aws){let i=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw i.code=xw.ECONFIG,i}t=new _w(r)}else t=new vw(r)}return new yw(t,r,e)};Ul.exports.createTestAccount=function(t,e){let r;if(!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((l,d)=>{e=Yv.callbackPromise(l,d)})),ww&&ha)return setImmediate(()=>e(null,ha)),r;t=t||Sw;let n=[],i=0,s={},o={requestor:zv.name,version:zv.version};Jv&&(s.Authorization="Bearer "+Jv);let a={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(o))};/^https:/i.test(t)&&(a.tls={rejectUnauthorized:!0});let c=bw(t+"/user",a);return c.on("readable",()=>{let l;for(;(l=c.read())!==null;)n.push(l),i+=l.length}),c.once("error",l=>e(l)),c.once("end",()=>{let l=Buffer.concat(n,i),d;try{d=JSON.parse(l.toString())}catch(p){return e(p)}if(d.status!=="success"||d.error)return e(new Error(d.error||"Request failed"));delete d.status,ha=d,e(null,ha)}),r};Ul.exports.getTestMessageUrl=function(t){if(!t||!t.response)return!1;let e=new Map;return t.response.replace(/\[([^\]]+)\]$/,(r,n)=>{n.replace(/\b([A-Z0-9]+)=([^\s]+)/g,(i,s,o)=>{e.set(s,o)})}),e.has("STATUS")&&e.has("MSGID")?(ha.web||Nw)+"/message/"+e.get("MSGID"):!1}});var YA={};Ba(YA,{RequestError:()=>jn,createAdaptorServer:()=>JA,getRequestListener:()=>zA,serve:()=>P0});import{createServer as y0}from"http";import{Http2ServerRequest as g0}from"http2";import{Http2ServerRequest as bf}from"http2";import{Readable as FA}from"stream";import O0 from"crypto";async function N0(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function jA(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(o,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function s(){t.read().then(o,i)}function o({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",s);else return t.read().then(o,i)}catch(l){i(l)}}}function w0(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:jA(t.getReader(),e)}var jn,v0,A0,Ha,T0,BA,I0,zs,_0,Jl,Yl,x0,Ws,b0,Xl,S0,VA,$s,Ni,wf,Fa,Sf,R0,Rf,k0,GA,Nf,$A,WA,C0,D0,zA,JA,P0,XA=Q(()=>{jn=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},v0=t=>t instanceof jn?t:new jn(t.message,{cause:t}),A0=global.Request,Ha=class extends A0{constructor(t,e){typeof t=="object"&&zs in t&&(t=t[zs]()),typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},T0=t=>{let e=[],r=t.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:i,[n+1]:s}=r;i.charCodeAt(0)!==58&&e.push([i,s])}return new Headers(e)},BA=Symbol("wrapBodyStream"),I0=(t,e,r,n,i)=>{let s={method:t,headers:r,signal:i.signal};if(t==="TRACE"){s.method="GET";let o=new Ha(e,s);return Object.defineProperty(o,"method",{get(){return"TRACE"}}),o}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(o){o.enqueue(n.rawBody),o.close()}});else if(n[BA]){let o;s.body=new ReadableStream({async pull(a){try{o||=FA.toWeb(n).getReader();let{done:c,value:l}=await o.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=FA.toWeb(n);return new Ha(e,s)},zs=Symbol("getRequestCache"),_0=Symbol("requestCache"),Jl=Symbol("incomingKey"),Yl=Symbol("urlKey"),x0=Symbol("headersKey"),Ws=Symbol("abortControllerKey"),b0=Symbol("getAbortController"),Xl={get method(){return this[Jl].method||"GET"},get url(){return this[Yl]},get headers(){return this[x0]||=T0(this[Jl])},[b0](){return this[zs](),this[Ws]},[zs](){return this[Ws]||=new AbortController,this[_0]||=I0(this.method,this[Yl],this.headers,this[Jl],this[Ws])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(t=>{Object.defineProperty(Xl,t,{get(){return this[zs]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Xl,t,{value:function(){return this[zs]()[t]()}})});Object.setPrototypeOf(Xl,Ha.prototype);S0=(t,e)=>{let r=Object.create(Xl);r[Jl]=t;let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof bf)throw new jn("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[Yl]=a.href}catch(a){throw new jn("Invalid absolute URL",{cause:a})}return r}let i=(t instanceof bf?t.authority:t.headers.host)||e;if(!i)throw new jn("Missing host header");let s;if(t instanceof bf){if(s=t.scheme,!(s==="http"||s==="https"))throw new jn("Unsupported scheme")}else s=t.socket&&t.socket.encrypted?"https":"http";let o=new URL(`${s}://${i}${n}`);if(o.hostname.length!==i.length&&o.hostname!==i.replace(/:\d+$/,""))throw new jn("Invalid host header");return r[Yl]=o.href,r},VA=Symbol("responseCache"),$s=Symbol("getResponseCache"),Ni=Symbol("cache"),wf=global.Response,Fa=class qA{#e;#t;[$s](){return delete this[Ni],this[VA]||=new wf(this.#e,this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof qA){let i=r[VA];if(i){this.#t=i,this[$s]();return}else this.#t=r.#t,n=new Headers(r.#t.headers)}else this.#t=r;(typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[Ni]=[r?.status||200,e,n||r?.headers])}get headers(){let e=this[Ni];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||{"content-type":"text/plain; charset=UTF-8"})),e[2]):this[$s]().headers}get status(){return this[Ni]?.[0]??this[$s]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{get(){return this[$s]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{value:function(){return this[$s]()[t]()}})});Object.setPrototypeOf(Fa,wf);Object.setPrototypeOf(Fa.prototype,wf.prototype);Sf=t=>{let e={};t instanceof Headers||(t=new Headers(t??void 0));let r=[];for(let[n,i]of t)n==="set-cookie"?r.push(i):e[n]=i;return r.length>0&&(e["set-cookie"]=r),e["content-type"]??="text/plain; charset=UTF-8",e},R0="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=O0);Rf=Symbol("outgoingEnded"),k0=()=>new Response(null,{status:400}),GA=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),Nf=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||e.writeHead(500,{"Content-Type":"text/plain"}),e.end(`Error: ${r.message}`),e.destroy(r))},$A=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},WA=async(t,e)=>{let[r,n,i]=t[Ni],s=!1;if(!i)i={"content-type":"text/plain; charset=UTF-8"};else if(i instanceof Headers)s=i.has("content-length"),i=Sf(i);else if(Array.isArray(i)){let o=new Headers(i);s=o.has("content-length"),i=Sf(o)}else for(let o in i)if(o.length===14&&o.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?i["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?i["Content-Length"]=n.byteLength:n instanceof Blob&&(i["Content-Length"]=n.size)),e.writeHead(r,i),typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):($A(e),await w0(n,e)?.catch(o=>Nf(o,e))),e[Rf]?.()},C0=t=>typeof t.then=="function",D0=async(t,e,r={})=>{if(C0(t))if(r.errorHandler)try{t=await t}catch(i){let s=await r.errorHandler(i);if(!s)return;t=s}else t=await t.catch(GA);if(Ni in t)return WA(t,e);let n=Sf(t.headers);if(t.body){let i=t.body.getReader(),s=[],o=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let d=await N0(a).catch(p=>{console.error(p),o=!0});if(!d){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,d.value&&s.push(d.value),d.done){o=!0;break}}o&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,d)=>l+d.length,0))}e.writeHead(t.status,n),s.forEach(c=>{e.write(c)}),o?e.end():(s.length===0&&$A(e),await jA(i,e,a))}else n[R0]||(e.writeHead(t.status,n),e.end());e[Rf]?.()},zA=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ha&&(Object.defineProperty(global,"Request",{value:Ha}),Object.defineProperty(global,"Response",{value:Fa})),async(n,i)=>{let s,o;try{o=S0(n,e.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[BA]=!0,n.on("end",()=>{a=!0}),n instanceof g0&&(i[Rf]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{n.destroy(),i.destroy()})})})),i.on("close",()=>{o[Ws]&&(n.errored?o[Ws].abort(n.errored.toString()):i.writableFinished||o[Ws].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{n.destroy()})})}),s=t(o,{incoming:n,outgoing:i}),Ni in s)return WA(s,i)}catch(a){if(s)return Nf(a,i);if(e.errorHandler){if(s=await e.errorHandler(o?a:v0(a)),!s)return}else o?s=GA(a):s=k0()}try{return await D0(s,i,e)}catch(a){return Nf(a,i)}}},JA=t=>{let e=t.fetch,r=zA(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming});return(t.createServer||y0)(t.serverOptions||{},r)},P0=(t,e)=>{let r=JA(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var Ci=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),cT=Ci.READ|Ci.WRITE|Ci.DELETE|Ci.APPROVE|Ci.EXECUTE,tt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},tr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var lT=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function Di(t){return lT?Object.freeze(t):t}function g(t,e){if(arguments.length===0)return Di({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),Di(r)}function u(t,e){let n={ok:!1,errors:Di(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),Di(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:o!=null,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c};return g(t,{...r,pagination:l})}function T(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function X(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let s in r){if(s==="message"||s==="field")continue;let o=r[s];(typeof o=="string"||typeof o=="number")&&(n=n.replace(new RegExp(`\\{${s}\\}`,"g"),String(o)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function Pi(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=T("AUTH_NOT_AUTHENTICATED","Not authenticated"),rr=T("AUTH_MISSING_CREDENTIALS","Missing credentials"),Wt=T("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Dr=T("AUTH_TOKEN_EXPIRED","Token expired"),Qr=T("AUTH_TOKEN_MALFORMED","Token malformed"),zt=T("PERM_DENIED","Permission denied"),eu=X("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),$n=T("VALIDATION_ERROR","Validation failed"),Ui=X("INVALID_INPUT","Invalid input: {reason}"),Js=T("FORBIDDEN","Access forbidden"),tu=T("NOT_FOUND","Resource not found"),ru=X("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),Ys=X("ALREADY_EXISTS","{resource} already exists"),Xs=T("CONFLICT","Resource conflict"),Wn=T("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),Li=T("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:rr,InvalidCredentials:Wt,TokenExpired:Dr,TokenMalformed:Qr,PermissionDenied:zt,BoundaryViolation:eu,Forbidden:Js,ValidationError:$n,InvalidInput:Ui,NotFound:tu,ResourceNotFound:ru,AlreadyExists:Ys,Conflict:Xs,RateLimitExceeded:Wn,InternalError:Li};var Ct={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var qa=class{getMask(e,r){return Uf(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return u(zt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return g();let i=this.getMask(e,r.resource),s=this.checkCapability(i,r.action);return s.ok?this.checkBoundary(e,r.boundary,n):s}checkCapability(e,r){return(e&r)!==r?u(zt()):g()}checkBoundary(e,r,n){if(r===tt.GLOBAL)return g();if(!n)return u(zt({message:"Resource context required for boundary check"}));let i=n;switch(r){case tt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return u(zt({message:"Tenant boundary violation"}));break;case tt.OWNER:case tt.SELF:if(i.ownerId!==e.id)return u(zt({message:"Owner boundary violation"}));break;default:return u(zt({message:`Unknown boundary type: ${r}`}))}return g()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(s=>(i&s)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(s=>(i&s)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let E=r.requireAllRoles?"ALL":"ANY",v=e.roles??[],b=r.requireAllRoles?r.roles.every(k=>v.includes(k)):r.roles.some(k=>v.includes(k));if(i.push(`Roles (${E}): ${r.roles.join(", ")} \u2014 user has: [${v.join(", ")}]`),!b)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
55
55
  `);i.push("Roles: \u2713 OK")}if(r.allowOwner){let E=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),E)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
56
56
  `);i.push("Owner bypass: not owner, continuing to perm check")}let s=this.describeBits(r.action);i.push(`Required: ${s} (${r.action})`);let o=e.perms,a=o?.[r.resource],c=o?.["*"],l=a??c??0,d=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${d})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
57
57
  `);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
58
58
  `);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(` User tenantId: ${e.tenantId||"undefined"}`),i.push(` Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(` User id: ${e.id}`),i.push(` Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
59
59
  `);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
60
- `)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function zn(){return new Ba}function kf(t,e){return t?.[e]??t?.["*"]??0}var oT="AUTH_INVALID_CREDENTIALS",qa=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[tr.JWT,tr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return u($t({message:"No auth methods configured"}));for(let i of n){let s=this.methods.get(i);if(!s)continue;let o=await s.authenticate(r);if(o.ok)return g({user:o.data,method:i});if(!o.errors||o.errors.length===0)continue;let a=o.errors[0];if(a?.code===oT)return u(a)}return u($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Jn(t,e={}){return new qa(t,e)}var Qs={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function vn(t,e){return{name:tr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return u(rr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return u(Qr({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return u(rr({message:"Bearer token is empty"}));let s=await e(i,t);if(!s.ok){let a=s.errors[0];return a?.code===Qs.TOKEN_EXPIRED?u(Dr()):a?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let o=s.data;return o.exp&&o.exp<Date.now()/1e3?u(Dr()):g({id:o.sub,perms:o.perms,tenantId:o.tid,tenantType:o.tty,roles:o.roles??[]})}}}function ja(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function An(t){return{name:tr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return u(rr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?g({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):u(Wt({message:"Invalid API key"}))}}}ho();function gc(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var jT="x-gateway-auth";function es(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??jT;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let s=gc(e);n=it({kty:"OKP",crv:"Ed25519",x:s},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:tr.GATEWAY_JWT,async authenticate(s){if(e!==void 0){let l=s.headers[r];if(!l)return u(rr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return u(Wt({message:`${r} must use Bearer scheme`}));let d=l.slice(7);if(!d)return u(rr({message:"Gateway JWT is empty"}));let p;try{let m=await i(),{payload:E}=await bn(d,m,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=E}catch(m){return m.code==="ERR_JWT_EXPIRED"?u(Dr({message:"Gateway JWT expired"})):u(Wt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let m=typeof p.jti=="string"?p.jti:void 0;if(!m)return u(Wt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(m))return u(Wt({message:"Gateway JWT jti already used (replay)"}))}}let o=ja(s.headers);if(o===null)return s.headers.authorization??s.headers.Authorization?u(Qr({message:"Authorization header must use Bearer scheme"})):u(rr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(o,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Qs.TOKEN_EXPIRED?u(Dr()):l?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?u(Dr()):g({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var LU=globalThis.performance;ho();var aI="TOKEN_EXPIRED",ah="TOKEN_MALFORMED";function cI(t){return"secret"in t}function lI(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function uI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=gc(t);return it({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function ch(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function dI(t){try{let e=atob(t);return ch(e)}catch{return null}}async function pI(t){if(cI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=ch(e);if(n)return it(n,r);let i=dI(e);return i?it(i,r):r==="EdDSA"&&lI(e)?uI(e):ic(e,r)}function fI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function gr(t){let e=null;return async(r,n)=>{try{e||(e=pI(t));let i=await e,{payload:s}=await bn(r,i,fI(t));return g(s)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?u({code:aI,message:"Token has expired"}):u({code:ah,message:i.message}):u({code:ah,message:"JWT verification failed"})}}}function Mu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as mI}from"crypto";async function Ku(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??mI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function tn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:Pi(t)}:{status:e?.error??400,body:Pi(t)}}var ts=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function rs(t,e){let r=e?.name;return function(i){if(i.ok)return tn(i);let s=i.errors[0]?.code;if(!s||!(s in t))throw new ts(s,i,r);let o=t[s];return tn(i,{error:o})}}function ns(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof ts)return tn(n.result,{error:e});throw n}}}var hI={...Ct},eM=ns(rs(hI),400);var AM=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var Hu=(t,e,r)=>(n,i)=>{let s=-1;return o(0);async function o(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,d;if(t[a]?(d=t[a][0][0],n.req.routeIndex=a):d=a===t.length&&i||void 0,d)try{c=await d(n,()=>o(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var ph=Symbol();var fh=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,s=(t instanceof Ic?t.raw.headers:t.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?II(t,{all:r,dot:n}):{}};async function II(t,e){let r=await t.formData();return r?_I(r,e):{}}function _I(t,e){let r=Object.create(null);return t.forEach((n,i)=>{e.all||i.endsWith("[]")?xI(r,i,n):r[i]=n}),e.dot&&Object.entries(r).forEach(([n,i])=>{n.includes(".")&&(bI(r,n,i),delete r[n])}),r}var xI=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},bI=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,i=e.split(".");i.forEach((s,o)=>{o===i.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var Vu=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},mh=t=>{let{groups:e,path:r}=SI(t),n=Vu(r);return wI(n,e)},SI=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},wI=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},_c={},hh=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return _c[n]||(r[2]?_c[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:_c[n]=[t,r[1],!0]),_c[n]}return null},ss=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},NI=t=>ss(t,decodeURI),Bu=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let s=e.indexOf("?",n),o=e.indexOf("#",n),a=s===-1?o===-1?void 0:o:o===-1?s:Math.min(s,o),c=e.slice(r,a);return NI(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var Eh=t=>{let e=Bu(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},wn=(t,e,...r)=>(r.length&&(e=wn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),xc=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(/\?/.test(i)){r.length===0&&n===""?r.push("/"):r.push(n);let s=i.replace("?","");n+="/"+s,r.push(n)}else n+="/"+i}),r.filter((i,s,o)=>o.indexOf(i)===s)},Fu=t=>/[%+]/.test(t)?(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),t.indexOf("%")!==-1?ss(t,yo):t):t,yh=(t,e,r)=>{let n;if(!r&&e&&!/[%+]/.test(e)){let o=t.indexOf("?",8);if(o===-1)return;for(t.startsWith(e,o+1)||(o=t.indexOf(`&${e}`,o+1));o!==-1;){let a=t.charCodeAt(o+e.length+1);if(a===61){let c=o+e.length+2,l=t.indexOf("&",c);return Fu(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";o=t.indexOf(`&${e}`,o+1)}if(n=/[%+]/.test(t),!n)return}let i={};n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let o=t.indexOf("&",s+1),a=t.indexOf("=",s);a>o&&o!==-1&&(a=-1);let c=t.slice(s+1,a===-1?o===-1?void 0:o:a);if(n&&(c=Fu(c)),s=o,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,o===-1?void 0:o),n&&(l=Fu(l))),r?(i[c]&&Array.isArray(i[c])||(i[c]=[]),i[c].push(l)):i[c]??=l}return e?i[e]:i},gh=yh,vh=(t,e)=>yh(t,e,!0),yo=decodeURIComponent;var Ah=t=>ss(t,yo),Ic=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r,this.#e={}}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#t[0][this.routeIndex][1][t],r=this.#n(e);return r&&/\%/.test(r)?Ah(r):r}#s(){let t={},e=Object.keys(this.#t[0][this.routeIndex][1]);for(let r of e){let n=this.#n(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=/\%/.test(n)?Ah(n):n)}return t}#n(t){return this.#t[1]?this.#t[1][t]:t}query(t){return gh(this.url,t)}queries(t){return vh(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e={};return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return fh(this,t)}#i=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;let i=Object.keys(e)[0];return i?e[i].then(s=>(i==="json"&&(s=JSON.stringify(s)),new Response(s)[t]())):e[t]=r[t]()};json(){return this.#i("text").then(t=>JSON.parse(t))}text(){return this.#i("text")}arrayBuffer(){return this.#i("arrayBuffer")}bytes(){return this.#i("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#i("blob")}formData(){return this.#i("formData")}addValidatedData(t,e){this.#e[t]=e}valid(t){return this.#e[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[ph](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var Th={Stringify:1,BeforeStream:2,Stream:3},RI=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var qu=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let o=Promise.all(s.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>qu(c,e,!1,n,i))).then(()=>i[0]));return r?RI(await o,s):o};var OI="text/plain; charset=UTF-8",ju=(t,e)=>({"Content-Type":t,...e}),go=(t,e)=>new Response(t,e),Gu=class{#e;#t;env={};#r;finalized=!1;error;#s;#n;#i;#a;#o;#l;#c;#d;#p;constructor(t,e){this.#e=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new Ic(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#i||=go(null,{headers:this.#c??=new Headers})}set res(t){if(this.#i&&t){t=go(t.body,t);for(let[e,r]of this.#i.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#i.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#i=t,this.finalized=!0}render=(...t)=>(this.#o??=e=>this.html(e),this.#o(...t));setLayout=t=>this.#a=t;getLayout=()=>this.#a;setRenderer=t=>{this.#o=t};header=(t,e,r)=>{this.finalized&&(this.#i=go(this.#i.body,this.#i));let n=this.#i?this.#i.headers:this.#c??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#u(t,e,r){let n=this.#i?new Headers(this.#i.headers):this.#c??new Headers;if(typeof e=="object"&&"headers"in e){let s=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[o,a]of s)o.toLowerCase()==="set-cookie"?n.append(o,a):n.set(o,a)}if(r)for(let[s,o]of Object.entries(r))if(typeof o=="string")n.set(s,o);else{n.delete(s);for(let a of o)n.append(s,a)}let i=typeof e=="number"?e:e?.status??this.#s;return go(t,{status:i,headers:n})}newResponse=(...t)=>this.#u(...t);body=(t,e,r)=>this.#u(t,e,r);text=(t,e,r)=>!this.#c&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#u(t,e,ju(OI,r));json=(t,e,r)=>this.#u(JSON.stringify(t),e,ju("application/json",r));html=(t,e,r)=>{let n=i=>this.#u(i,e,ju("text/html; charset=UTF-8",r));return typeof t=="object"?qu(t,Th.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>go(),this.#l(this))};var Be="ALL",Ih="all",_h=["get","post","put","delete","options","patch"],bc="Can not add a route since the matcher is already built.",Sc=class extends Error{};var xh="__COMPOSED_HANDLER";var kI=t=>t.text("404 Not Found",404),bh=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},Sh=class wh{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[..._h,Ih].forEach(s=>{this[s]=(o,...a)=>(typeof o=="string"?this.#e=o:this.#s(s,this.#e,o),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,o,...a)=>{for(let c of[o].flat()){this.#e=c;for(let l of[s].flat())a.map(d=>{this.#s(l.toUpperCase(),this.#e,d)})}return this},this.use=(s,...o)=>(typeof s=="string"?this.#e=s:(this.#e="*",o.unshift(s)),o.forEach(a=>{this.#s(Be,this.#e,a)}),this);let{strict:n,...i}=e;Object.assign(this,i),this.getPath=n??!0?e.getPath??Bu:Eh}#t(){let e=new wh({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=kI;errorHandler=bh;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let s;r.errorHandler===bh?s=i.handler:(s=async(o,a)=>(await Hu([],r.errorHandler)(o,()=>i.handler(o,a))).res,s[xh]=i.handler),n.#s(i.method,i.path,s,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=wn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let o=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=wn(this._basePath,e),l=c==="/"?0:c.length;return d=>{let p=new URL(d.url);return p.pathname=this.getPath(d).slice(l)||"/",new Request(p,d)}})();let a=async(c,l)=>{let d=await r(i(c.req.raw),...o(c));if(d)return d;await l()};return this.#s(Be,wn(e,"*"),a),this}#s(e,r,n,i){e=e.toUpperCase(),r=wn(this._basePath,r);let s={basePath:i!==void 0?wn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#i(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#i(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),o=this.router.match(i,s),a=new Gu(e,{path:s,matchResult:o,env:n,executionCtx:r,notFoundHandler:this.#r});if(o[0].length===1){let l;try{l=o[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(d){return this.#n(d,a)}return l instanceof Promise?l.then(d=>d||(a.finalized?a.res:this.#r(a))).catch(d=>this.#n(d,a)):l??this.#r(a)}let c=Hu(o[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,a)}})()}fetch=(e,...r)=>this.#i(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${wn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#i(e.request,e,void 0,e.request.method))})}};var wc=[];function $u(t,e){let r=this.buildAllMatchers(),n=((i,s)=>{let o=r[i]||r[Be],a=o[2][s];if(a)return a;let c=s.match(o[0]);if(!c)return[[],wc];let l=c.indexOf("",1);return[o[1][l],c]});return this.match=n,n(t,e)}var Nc="[^/]+",vo=".*",Ao="(?:|/.*)",oi=Symbol(),CI=new Set(".\\+*[^]$()");function DI(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1||t===vo||t===Ao?1:e===vo||e===Ao?-1:t===Nc?1:e===Nc?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var Nh=class Wu{#e;#t;#r=Object.create(null);insert(e,r,n,i,s){if(e.length===0){if(this.#e!==void 0)throw oi;if(s)return;this.#e=r;return}let[o,...a]=e,c=o==="*"?a.length===0?["","",vo]:["","",Nc]:o==="/*"?["","",Ao]:o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let d=c[1],p=c[2]||Nc;if(d&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw oi;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(m=>m!==vo&&m!==Ao))throw oi;if(s)return;l=this.#r[p]=new Wu,d!==""&&(l.#t=i.varIndex++)}!s&&d!==""&&n.push([d,l.#t])}else if(l=this.#r[o],!l){if(Object.keys(this.#r).some(d=>d.length>1&&d!==vo&&d!==Ao))throw oi;if(s)return;l=this.#r[o]=new Wu}l.insert(a,r,n,i,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(DI).map(n=>{let i=this.#r[n];return(typeof i.#t=="number"?`(${n})@${i.#t}`:CI.has(n)?`\\${n}`:n)+i.buildRegExpStr()});return typeof this.#e=="number"&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Rh=class{#e={varIndex:0};#t=new Nh;insert(t,e,r){let n=[],i=[];for(let o=0;;){let a=!1;if(t=t.replace(/\{[^}]+\}/g,c=>{let l=`@\\${o}`;return i[o]=[l,c],o++,a=!0,l}),!a)break}let s=t.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let o=i.length-1;o>=0;o--){let[a]=i[o];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,i[o][1]);break}}return this.#t.insert(s,e,n,this.#e,r),n}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,s,o)=>s!==void 0?(r[++e]=Number(s),"$()"):(o!==void 0&&(n[Number(o)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var PI=[/^$/,[],Object.create(null)],Oh=Object.create(null);function kh(t){return Oh[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function UI(){Oh=Object.create(null)}function LI(t){let e=new Rh,r=[];if(t.length===0)return PI;let n=t.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,d],[p,m])=>l?1:p?-1:d.length-m.length),i=Object.create(null);for(let l=0,d=-1,p=n.length;l<p;l++){let[m,E,v]=n[l];m?i[E]=[v.map(([k])=>[k,Object.create(null)]),wc]:d++;let b;try{b=e.insert(E,d,m)}catch(k){throw k===oi?new Sc(E):k}m||(r[d]=v.map(([k,C])=>{let L=Object.create(null);for(C-=1;C>=0;C--){let[B,G]=b[C];L[B]=G}return[k,L]}))}let[s,o,a]=e.buildRegExp();for(let l=0,d=r.length;l<d;l++)for(let p=0,m=r[l].length;p<m;p++){let E=r[l][p]?.[1];if(!E)continue;let v=Object.keys(E);for(let b=0,k=v.length;b<k;b++)E[v[b]]=a[E[v[b]]]}let c=[];for(let l in o)c[l]=r[o[l]];return[s,c,i]}function os(t,e){if(t){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(kh(r).test(e))return[...t[r]]}}var Rc=class{name="RegExpRouter";#e;#t;constructor(){this.#e={[Be]:Object.create(null)},this.#t={[Be]:Object.create(null)}}add(t,e,r){let n=this.#e,i=this.#t;if(!n||!i)throw new Error(bc);n[t]||[n,i].forEach(a=>{a[t]=Object.create(null),Object.keys(a[Be]).forEach(c=>{a[t][c]=[...a[Be][c]]})}),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=kh(e);t===Be?Object.keys(n).forEach(c=>{n[c][e]||=os(n[c],e)||os(n[Be],e)||[]}):n[t][e]||=os(n[t],e)||os(n[Be],e)||[],Object.keys(n).forEach(c=>{(t===Be||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(i).forEach(c=>{(t===Be||t===c)&&Object.keys(i[c]).forEach(l=>a.test(l)&&i[c][l].push([r,s]))});return}let o=xc(e)||[e];for(let a=0,c=o.length;a<c;a++){let l=o[a];Object.keys(i).forEach(d=>{(t===Be||t===d)&&(i[d][l]||=[...os(n[d],l)||os(n[Be],l)||[]],i[d][l].push([r,s-c+a+1]))})}}match=$u;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach(e=>{t[e]||=this.#r(e)}),this.#e=this.#t=void 0,UI(),t}#r(t){let e=[],r=t===Be;return[this.#e,this.#t].forEach(n=>{let i=n[t]?Object.keys(n[t]).map(s=>[s,n[t][s]]):[];i.length!==0?(r||=!0,e.push(...i)):t!==Be&&e.push(...Object.keys(n[Be]).map(s=>[s,n[Be][s]]))}),r?LI(e):null}};var zu=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(bc);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,s=0,o;for(;s<i;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);o=a.match(t,e)}catch(c){if(c instanceof Sc)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,o}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var To=Object.create(null),MI=t=>{for(let e in t)return!0;return!1},Ch=class Dh{#e;#t;#r;#s=0;#n=To;constructor(e,r,n){if(this.#t=n||Object.create(null),this.#e=[],e&&r){let i=Object.create(null);i[e]={handler:r,possibleKeys:[],score:0},this.#e=[i]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let i=this,s=mh(r),o=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],d=s[a+1],p=hh(l,d),m=Array.isArray(p)?p[0]:l;if(m in i.#t){i=i.#t[m],p&&o.push(p[1]);continue}i.#t[m]=new Dh,p&&(i.#r.push(p),o.push(p[1])),i=i.#t[m]}return i.#e.push({[e]:{handler:n,possibleKeys:o.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),i}#i(e,r,n,i,s){for(let o=0,a=r.#e.length;o<a;o++){let c=r.#e[o],l=c[n]||c[Be],d={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),i!==To||s&&s!==To))for(let p=0,m=l.possibleKeys.length;p<m;p++){let E=l.possibleKeys[p],v=d[l.score];l.params[E]=s?.[E]&&!v?s[E]:i[E]??s?.[E],d[l.score]=!0}}}search(e,r){let n=[];this.#n=To;let s=[this],o=Vu(r),a=[],c=o.length,l=null;for(let d=0;d<c;d++){let p=o[d],m=d===c-1,E=[];for(let b=0,k=s.length;b<k;b++){let C=s[b],L=C.#t[p];L&&(L.#n=C.#n,m?(L.#t["*"]&&this.#i(n,L.#t["*"],e,C.#n),this.#i(n,L,e,C.#n)):E.push(L));for(let B=0,G=C.#r.length;B<G;B++){let j=C.#r[B],$=C.#n===To?{}:{...C.#n};if(j==="*"){let y=C.#t["*"];y&&(this.#i(n,y,e,C.#n),y.#n=$,E.push(y));continue}let[te,A,x]=j;if(!p&&!(x instanceof RegExp))continue;let S=C.#t[te];if(x instanceof RegExp){if(l===null){l=new Array(c);let N=r[0]==="/"?1:0;for(let R=0;R<c;R++)l[R]=N,N+=o[R].length+1}let y=r.substring(l[d]),I=x.exec(y);if(I){if($[A]=I[0],this.#i(n,S,e,C.#n,$),MI(S.#t)){S.#n=$;let N=I[0].match(/\//)?.length??0;(a[N]||=[]).push(S)}continue}}(x===!0||x.test(p))&&($[A]=p,m?(this.#i(n,S,e,$,C.#n),S.#t["*"]&&this.#i(n,S.#t["*"],e,$,C.#n)):(S.#n=$,E.push(S)))}}let v=a.shift();s=v?E.concat(v):E}return n.length>1&&n.sort((d,p)=>d.score-p.score),[n.map(({handler:d,params:p})=>[d,p])]}};var Ju=class{name="TrieRouter";#e;constructor(){this.#e=new Ch}add(t,e,r){let n=xc(e);if(n){for(let i=0,s=n.length;i<s;i++)this.#e.insert(t,n[i],r);return}this.#e.insert(t,e,r)}match(t,e){return this.#e.search(t,e)}};var Vr=class extends Sh{constructor(t={}){super(t),this.router=t.router??new zu({routers:[new Rc,new Ju]})}};function Yu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}function sr(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var Xu={...Ct},Ph=ns(rs(Xu),400);function Qu(t){Xu={...Ct,...t},Ph=ns(rs(Xu),400)}function Uh(){return Ph}function qe(t,e,r){let{traceId:n,successStatus:i,adapter:s=Uh()}=r??{},o=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:o}},l=s(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let d=e.ok?g(e.data,a):{...e,meta:a},p=Pi(d);return t.json(p,l)}async function KI(t){let e={};t.req.raw.headers.forEach((o,a)=>{e[a]=o});let r={},n=t.req.query();for(let[o,a]of Object.entries(n))r[o]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function Io(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,s)=>{let o=sr(i);try{let a=await KI(i),c=await e.resolve(n,a);if(!c.ok){if(r){await s();return}return qe(i,u($t()),{traceId:o})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await s()}catch{if(r){await s();return}return qe(i,u($t()),{traceId:o})}}}function Zu(t){return async(e,r)=>{let n=sr(e),i=e.get("authResult");if(!i)return qe(e,u($t()),{traceId:n});let{user:s}=i,o;if(t.loadResource){let l=e.req.param(),d=await t.loadResource(l,s);if(d===null)return qe(e,u(zt({message:"Resource not found for boundary check"})),{traceId:n});o=d}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(s,a,o);if(!c.ok)return qe(e,c,{traceId:n});await r()}}function _o(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?u(r.issues.map(n=>{let i=n.path?.map(s=>typeof s=="object"?s.key:s).join(".")??"";return $n({message:i?`${i}: ${n.message}`:n.message})})):g(r.value)}function xo(t){return async(e,r)=>{let n=sr(e);try{let i={};if(t.body){let s;try{s=await e.req.json()}catch{return qe(e,u(Ui({reason:"Request body is not valid JSON"})),{traceId:n})}let o=_o(t.body,s);if(!o.ok)return qe(e,o,{traceId:n});i.body=o.data}if(t.params){let s=_o(t.params,e.req.param());if(!s.ok)return qe(e,s,{traceId:n});i.params=s.data}if(t.query){let s=_o(t.query,e.req.query());if(!s.ok)return qe(e,s,{traceId:n});i.query=s.data}if(t.headers){let s={};e.req.raw.headers.forEach((a,c)=>{s[c]=a});let o=_o(t.headers,s);if(!o.ok)return qe(e,o,{traceId:n});i.headers=o.data}e.set("validatedData",i),await r()}catch(i){let s={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return qe(e,u($n(),s),{traceId:n})}}}function bo(t){return t.get("validatedData")?.body}function So(t){return t.get("validatedData")?.params}function wo(t){return t.get("validatedData")?.query}var nH=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function HI(t,e){let r=[...t,e];return async(n,i)=>{let s,o=async a=>{if(s||a>=r.length){!s&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await o(a+1)});l instanceof Response&&(s=l)};return await o(0),s}}function Y(t,e){let r=[];if(e.auth!==!1){let s=Array.isArray(e.auth)?e.auth:void 0;r.push(Io({engine:t.auth,methods:s}))}e.permission&&r.push(Zu({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(s,o)=>{let a={body:void 0,query:void 0,params:s,user:o};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(xo({body:e.input.body,query:e.input.query,params:e.input.params}));let i=HI(r,async s=>{let o=sr(s);try{let a=s.get("authResult"),c={body:bo(s),query:wo(s),params:So(s),user:a?.user,tenantContext:s.get("tenantContext"),traceId:o},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},d=await e.handler(l),p=e.successStatus??200;return qe(s,d,{traceId:o,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:o,route:`${e.method} ${e.path}`,error:{message:c}})),qe(s,u(Li()),{traceId:o})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function ed(t,e){let r=new Vr;for(let n of e){let{method:i,path:s}=n.routeMeta,o=s==="/"?t:`${t}${s}`;switch(i){case"GET":r.get(o,n);break;case"POST":r.post(o,n);break;case"PUT":r.put(o,n);break;case"PATCH":r.patch(o,n);break;case"DELETE":r.delete(o,n);break}}return r}var Lh={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var Oc,FI={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function VI(t){return!t&&!Oc?FI:{lang:t?.lang??Oc?.lang,message:t?.message,abortEarly:t?.abortEarly??Oc?.abortEarly,abortPipeEarly:t?.abortPipeEarly??Oc?.abortPipeEarly}}var BI;function qI(t){return BI?.get(t)}var jI;function GI(t){return jI?.get(t)}var $I;function WI(t,e){return $I?.get(t)?.get(e)}function ai(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function mt(t,e,r,n,i){let s=i&&"input"in i?i.input:r.value,o=i?.expected??t.expects??null,a=i?.received??ai(s),c={kind:t.kind,type:t.type,input:s,expected:o,received:a,message:`Invalid ${e}: ${o?`Expected ${o} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",d=i?.message??t.message??WI(t.reference,c.lang)??(l?GI(c.lang):null)??n.message??qI(c.lang);d!==void 0&&(c.message=typeof d=="function"?d(c):d),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}var Mh=new WeakMap;function Yt(t){let e=Mh.get(t);return e||(e={version:1,vendor:"valibot",validate(r){return t["~run"]({value:r},VI())}},Mh.set(t,e)),e}function zI(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function Hh(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}var JI=/^[\w+-]+(?:\.[\w+-]+)*@[\da-z]+(?:[.-][\da-z]+)*\.[a-z]{2,}$/iu;function kc(t,e){return{kind:"validation",type:"check",reference:kc,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&mt(this,"input",r,n),r}}}function rn(t){return{kind:"validation",type:"email",reference:rn,expects:null,async:!1,requirement:JI,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&mt(this,"email",e,r),e}}}function Nn(t){return{kind:"validation",type:"integer",reference:Nn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&mt(this,"integer",e,r),e}}}function ht(t,e){return{kind:"validation",type:"max_length",reference:ht,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function as(t,e){return{kind:"validation",type:"max_value",reference:as,async:!1,expects:`<=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function td(t,e){return{kind:"validation",type:"min_length",reference:td,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function cs(t,e){return{kind:"validation",type:"min_value",reference:cs,async:!1,expects:`>=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function ls(t){return{kind:"transformation",type:"transform",reference:ls,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function YI(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function rd(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return{kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let s=0;s<i.length;s++){let o=i[s],a=this.item["~run"]({value:o},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:s,value:o};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else mt(this,"type",r,n);return r}}}function It(t){return{kind:"schema",type:"boolean",reference:It,expects:"boolean",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:mt(this,"type",e,r),e}}}function us(t,e){return{kind:"schema",type:"literal",reference:us,expects:ai(t),async:!1,literal:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===this.literal?r.typed=!0:mt(this,"type",r,n),r}}}function ci(t,e){return{kind:"schema",type:"nullable",reference:ci,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=rd(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function $e(t){return{kind:"schema",type:"number",reference:$e,expects:"number",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:mt(this,"type",e,r),e}}}function H(t,e){return{kind:"schema",type:"object",reference:H,expects:"Object",async:!1,entries:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let s in this.entries){let o=this.entries[s];if(s in i||(o.type==="exact_optional"||o.type==="optional"||o.type==="nullish")&&o.default!==void 0){let a=s in i?i[s]:rd(o),c=o["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:s,value:a};for(let d of c.issues)d.path?d.path.unshift(l):d.path=[l],r.issues?.push(d);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[s]=c.value}else if(o.fallback!==void 0)r.value[s]=YI(o);else if(o.type!=="exact_optional"&&o.type!=="optional"&&o.type!=="nullish"&&(mt(this,"key",r,n,{input:void 0,expected:`"${s}"`,path:[{type:"object",origin:"key",input:i,key:s,value:i[s]}]}),n.abortEarly))break}}else mt(this,"type",r,n);return r}}}function _(t,e){return{kind:"schema",type:"optional",reference:_,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=rd(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function Xt(t,e){return{kind:"schema",type:"picklist",reference:Xt,expects:Hh(t.map(ai),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:mt(this,"type",r,n),r}}}function me(t,e,r){return{kind:"schema",type:"record",reference:me,expects:"Object",async:!1,key:t,value:e,message:r,get"~standard"(){return Yt(this)},"~run"(n,i){let s=n.value;if(s&&typeof s=="object"){n.typed=!0,n.value={};for(let o in s)if(zI(s,o)){let a=s[o],c=this.key["~run"]({value:o},i);if(c.issues){let d={type:"object",origin:"key",input:s,key:o,value:a};for(let p of c.issues)p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let d={type:"object",origin:"value",input:s,key:o,value:a};for(let p of l.issues)p.path?p.path.unshift(d):p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else mt(this,"type",n,i);return n}}}function h(t){return{kind:"schema",type:"string",reference:h,expects:"string",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="string"?e.typed=!0:mt(this,"type",e,r),e}}}function Kh(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function No(t,e){return{kind:"schema",type:"union",reference:No,expects:Hh(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i,s,o;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)s?s.push(c):s=[c];else{i=c;break}else o?o.push(c):o=[c]}if(i)return i;if(s){if(s.length===1)return s[0];mt(this,"type",r,n,{issues:Kh(s)}),r.typed=!0}else{if(o?.length===1)return o[0];mt(this,"type",r,n,{issues:Kh(o)})}return r}}}function ge(){return{kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,get"~standard"(){return Yt(this)},"~run"(t){return t.typed=!0,t}}}function Ne(...t){return{...t[0],pipe:t,get"~standard"(){return Yt(this)},"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}}}var Vt=(t=100)=>Ne(h(),ht(t)),Cc=Ne(h(),ht(320)),Rn=Ne(h(),ht(4096)),Ro=(t=256)=>Ne(h(),ht(t)),nd=(t=8192)=>Ne(h(),ht(t)),Oo=Ne(ge(),ls(Number),$e(),Nn(),cs(1),as(100));var Ut=H({message:_(h())}),Fh=H({accessToken:h(),refreshToken:_(h()),expiresAt:$e()}),Vh=H({requiresChallenge:us(!0),challenge:H({type:_(h()),phase:_(h()),expiresAt:_(No([h(),$e()])),data:me(h(),ge())})}),Bh=H({requiresMfa:us(!0),mfa:H({phase:_(h()),challengeId:h(),methods:Z(h()),method:_(h()),expiresAt:No([h(),$e()]),userId:h()})}),qh=H({requiresVerification:us(!0),verification:H({channel:us("email"),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h(),userId:h()})}),li=No([Vh,Bh,qh,Fh]),ko=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),username:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),metadata:_(me(h(),ge())),createdAt:h(),updatedAt:h()}),Co=H({challengeId:h(),expiresAt:h()});var id=H({maskedRecipient:_(h()),expiresAt:h()}),sd=H({userId:h(),verification:_(H({channel:h(),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h()}))});var od=H({userId:h(),identityType:h(),identityValue:h(),verifiedAt:h()});var jh=H({id:h(),tokenId:h(),tenantId:_(h()),deviceLabel:_(h()),country:_(h()),city:_(h()),createdAt:h(),expiresAt:h(),lastUsedAt:h(),revokedAt:_(ci(h())),metadata:_(me(h(),ge())),isCurrent:_(It())}),ad=Z(jh);var cd=H({method:h(),data:me(h(),ge())}),ld=H({method:h(),verified:It(),data:me(h(),ge())}),Gh=H({method:h(),verifiedAt:ci(h()),createdAt:h(),id:_(h()),label:_(h()),lastUsedAt:_(h())}),ud=H({authenticators:Z(Gh),total:$e()});var dd=H({state:h()}),$h=H({provider:h(),providerId:_(h()),email:_(h()),linkedAt:_(h())}),pd=Z($h);var Wh=H({id:h(),tenantId:h(),inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),status:h(),roles:_(Z(h())),authPerms:Z(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h()),invitedBy:_(ge()),createdAt:h(),updatedAt:h(),expiresAt:h()}),fd=Z(Wh),md=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),zh=H({userId:h(),tenantId:h(),status:h(),roles:_(Z(h())),authPerms:Z(h()),isOwner:It(),createdAt:h(),updatedAt:h()}),hd=H({members:Z(zh)}),Dc=H({userId:h(),tenantId:h(),status:h(),roles:_(Z(h())),authPerms:Z(h()),isOwner:It(),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),jobTitle:_(h()),contactEmail:_(h()),contactPhone:_(h()),bio:_(h()),locale:_(h()),metadata:_(me(h(),ge())),createdAt:_(h()),memberUpdatedAt:_(h()),profileUpdatedAt:_(h())}),Ed=H({tenantId:h(),roles:_(Z(h())),authPerms:Z(h())});var QI={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:H({identityType:Vt(),identityValue:Cc,credentialType:Vt(),credentialValue:_(Rn),metadata:_(me(Vt(),ge())),country:_(Vt()),city:_(Vt())}),response:li},ZI={method:"POST",path:"/auth/register",kind:"data",public:!0,body:H({identityType:Vt(),identityValue:Cc,credentialType:Vt(),credentialValue:Rn,displayName:_(Ro()),givenName:_(Ro()),familyName:_(Ro()),avatarUrl:_(nd(2048)),locale:_(Vt()),metadata:_(me(Vt(),ge()))}),response:sd},e_={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:H({challengeId:h(),code:h()}),response:li},t_={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:H({challengeId:h(),method:h(),code:h()}),response:li},r_={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:H({challengeId:h(),method:h(),userId:h()}),response:id},n_={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},i_={method:"POST",path:"/auth/logout",kind:"logout",public:!0},s_={method:"GET",path:"/auth/me",kind:"data",response:ko},o_={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:H({tenantId:h()})},Lt={authenticate:QI,register:ZI,completeChallenge:e_,completeMfaChallenge:t_,issueMfaChallenge:r_,refresh:n_,logout:i_,me:s_,selectTenant:o_};var a_={method:"PATCH",path:"/password/change",kind:"data",body:H({currentPassword:Rn,newPassword:Rn}),response:Ut},c_={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:H({email:Ne(h(),ht(320),rn())}),response:Co},l_={method:"POST",path:"/password/reset",kind:"data",public:!0,body:H({challengeId:Vt(),code:Vt(),newPassword:Rn}),response:Ut},sn={changePassword:a_,forgotPassword:c_,resetPassword:l_};var u_={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:H({challengeId:h(),code:h()}),response:od},d_={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:H({channel:Xt(["sms","email"]),identityValue:h(),previousChallengeId:_(h())}),response:Co},ui={verifyCode:u_,resendVerification:d_};var p_={method:"GET",path:"/sessions",kind:"data",query:H({includeRevoked:_(Xt(["true","false"])),limit:_(Oo),cursor:_(h())}),response:ad},f_={method:"DELETE",path:"/sessions",kind:"data",body:H({sessionId:h()}),response:Ut},m_={method:"POST",path:"/sessions/revoke",kind:"data",body:H({refreshToken:h()}),response:Ut},on={listSessions:p_,deleteSession:f_,revokeToken:m_};var h_={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:H({method:h(),data:_(me(h(),ge()))}),response:cd},E_={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:H({method:h(),data:_(me(h(),ge())),authenticatorId:_(h())}),response:ld},y_={method:"GET",path:"/mfa/authenticators",kind:"data",query:H({method:_(h()),verifiedOnly:_(It())}),response:ud},g_={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:H({method:h(),authenticatorId:_(h()),password:_(h())}),response:H({message:_(h())})},v_={method:"PATCH",path:"/mfa/settings",kind:"data",body:H({mfaRequired:_(It()),mfaMethods:_(Z(h())),password:_(h())}),response:H({mfaRequired:_(It()),mfaMethods:_(Z(h()))})},vr={setupAuthenticator:h_,verifyAuthenticator:E_,listAuthenticators:y_,removeAuthenticator:g_,updateMfaSettings:v_};var A_={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:dd},T_={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:H({provider:Ne(h(),ht(100)),code:_(Ne(h(),ht(8192))),credential:_(Ne(h(),ht(8192))),state:_(Ne(h(),ht(1024))),tenantId:_(Ne(h(),ht(100)))}),response:li},I_={method:"POST",path:"/oauth/link",kind:"data",body:H({provider:h(),code:_(h())}),response:Ut},__={method:"POST",path:"/oauth/unlink",kind:"data",body:H({provider:h()}),response:Ut},x_={method:"GET",path:"/oauth/providers",kind:"data",response:pd},an={oauthState:A_,oauthCallback:T_,linkProvider:I_,unlinkProvider:__,getProviders:x_};var b_={method:"PATCH",path:"/users/profile",kind:"data",body:H({email:_(Ne(h(),rn())),phone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),metadata:_(me(h(),ge()))}),response:ko},Do={updateProfile:b_};var S_={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Dc},w_={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:H({contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))}),response:Dc},N_={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:H({inviteeEmail:_(Ne(h(),rn())),inviteeUserId:_(h()),inviteePhone:_(h()),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),response:md},R_={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:H({status:_(h()),limit:_(Oo),cursor:_(h())}),response:fd},O_={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:H({inviteId:_(h()),inviteToken:_(h())}),response:Ed},k_={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:H({inviteId:_(h()),inviteToken:_(h())}),response:Ut},C_={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:H({inviteId:h()}),response:Ut},D_={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:H({limit:_(Oo),cursor:_(h())}),response:hd},P_={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h(),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h()))}),response:Ut},U_={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h()}),response:Ut},yd={getTenantProfile:S_,updateTenantProfile:w_,createInvite:N_,listInvites:R_,acceptInvite:O_,declineInvite:k_,revokeInvite:C_,listMembers:D_,updateMember:P_,removeMember:U_};var X2={...Lt,...sn,...ui,...on,...vr,...an,...Do,...yd};var V={VALIDATION_ERROR:T("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:T("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:T("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:T("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:T("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:T("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:T("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:T("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:T("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:T("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:T("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:T("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:T("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:T("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:T("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function ds(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function On(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:s,device:o}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=o?.deviceLabel,d={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...o?.country&&{country:o.country},...o?.city&&{city:o.city},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}},p=await e.plugins.database.sessions.create(d);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u(V.DATABASE_ERROR());let m=p.data,E=ds(n,e.security),v=await e.plugins.token.signAccessToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}}),b=await e.plugins.token.signRefreshToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i}});return g({accessToken:v.token,refreshToken:b.token,expiresAt:v.expiresAt,...n&&{tenantId:n}})}var Po={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};function Jh(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function Uo(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?u(Po.USER_NOT_FOUND()):g(Jh(r.data))}var gd={SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:V.DATABASE_ERROR};async function Pc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return g();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(gd.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?g():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(gd.DATABASE_ERROR()):g():g()}var kn={INVALID_TOKEN:T("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:T("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_SUSPENDED:V.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var cn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(cn||(cn={}));async function Uc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return u(kn.INVALID_TOKEN());if(r.typ!==cn.Refresh)return u(kn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(V.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return u(kn.INVALID_TOKEN());let s=Date.now(),o=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&s-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!o&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(V.DATABASE_ERROR()):u(kn.INVALID_TOKEN());if(a&&!o){let v=ds(i.tenantId,e.security),b=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),k=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),g({accessToken:b.token,refreshToken:k.token,expiresAt:b.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:s,expiresAt:new Date(s+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return u(V.DATABASE_ERROR());let d=ds(i.tenantId,e.security);if(l.data===!1){let v=await e.plugins.database.sessions.get(i.id);if(v.ok===!1)return u(V.DATABASE_ERROR());let b=v.data;if(!b||b.revokedAt)return u(kn.INVALID_TOKEN());let k=await e.plugins.token.signAccessToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType},...b.perms!==void 0&&{perms:b.perms},...b.roles&&{roles:b.roles}}),C=await e.plugins.token.signRefreshToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),m=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),E={accessToken:p.token,refreshToken:m.token,expiresAt:p.expiresAt};return g(E)}var Rt={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:T("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:X("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:X("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:X("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:T("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:X("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var Fe={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},Ar={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},_e={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var or={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function vd(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Lc(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let o=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(o)}async function Yh(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:s,codeHash:o,challengeId:a,expiresAt:c,...l}=t.nextStepData,d={id:r,userId:t.userId,purpose:_e.LOGIN,status:Fe.PENDING,phase:Ar.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(d.tenantId=t.tenantId),t.deviceLabel!==void 0&&(d.deviceLabel=t.deviceLabel),t.country!==void 0&&(d.country=t.country),t.city!==void 0&&(d.city=t.city),i!==void 0&&(d.codeHash=i),(await e.plugins.database.challenges.create(d)).ok===!1?u([V.DATABASE_ERROR()]):g({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:d.phase})}async function Mc(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,s=t.userHasMethods.length===1&&t.deliveryMethods.length===0,o=i?t.deliveryMethods[0]:s?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:_e.LOGIN,status:Fe.PENDING,phase:o?Ar.VERIFY_MFA:Ar.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),o!==void 0&&(a.method=o),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return u(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...o!==void 0&&{selectedMethod:o}};return g(l)}var lt={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var Ad={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},Kc={ACCOUNT_DELETED:V.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:T(Ad.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:T(Ad.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T(Ad.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function Br(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return u(Kc.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return u(Kc.ACCOUNT_SUSPENDED());let s,o,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return u(Kc.NO_ACCESS_TO_TENANT());let d=l.data;if(d.status!==lt.ACTIVE)return u(Kc.SUSPENDED_IN_TENANT());if(o=d.roles,s=d.isOwner?{"*":-1}:d.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return s!==void 0&&(c.perms=s),o!==void 0&&(c.roles=o),a!==void 0&&(c.tenantType=a),g(c)}var Ze={SMS:"sms",EMAIL:"email"},di={PHONE:"phone",EMAIL:"email"},pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Cn={type:Ze.EMAIL,purpose:_e.EMAIL_VERIFICATION,identityType:di.EMAIL,template:pi.EMAIL_CODE};var Dn={type:Ze.SMS,purpose:_e.PHONE_VERIFICATION,identityType:di.PHONE,template:pi.SMS_CODE};var Re={CHANNEL_NOT_CONFIGURED:T("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:T("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:T("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:T("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:T("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:T("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:T("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function Ie(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function ln(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function qr(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return L_(n)}async function ps(t,e){let r=await qr(t);return r.length!==e.length?!1:M_(r,e)}function L_(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function M_(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function K_(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function fs(t,e){let r=K_(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,s=await e.plugins.database.identities.get(r.identityType,i);if(!s.ok||!s.data)return u(Re.IDENTITY_NOT_FOUND());let o=s.data;if(o.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let a=o.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,d=t.previousChallengeId===void 0&&l===c;if(!l)return u(Re.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return u(p.errors,p.meta);let m=p.data;if(m&&(m.status!==Fe.PENDING||m.userId!==o.userId||m.purpose!==r.purpose||m.method!==r.type||m.identityType!==r.identityType||m.identityValue!==i))return u(Re.CHALLENGE_NOT_FOUND());if(!m&&!d)return u(Re.CHALLENGE_NOT_FOUND());let E=e.security.verificationResendCooldownSeconds*1e3,v=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(m?.createdAt.getTime()??0)+E;if(E>0&&Date.now()<v)return u(Re.RESEND_COOLDOWN_ACTIVE());let b=ln(6),k=await qr(b),C=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),L=e.plugins.database.challenges.generateChallengeId(),B=await e.plugins.database.challenges.create({id:L,userId:o.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:k,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:C});if(B.ok===!1)return u(B.errors,B.meta);let G=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,j=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:L,purpose:r.purpose,channel:r.type,expiresAt:C,resendAvailableAt:G}});return j.ok===!1?(await e.plugins.database.challenges.remove(L),u(j.errors,j.meta)):(await H_(t.channel,i,b,r.template,L,C,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(L),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),u(Re.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),Ie(e,{event:`verification_code_resent_${t.channel}`,userId:o.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:L,previousChallengeId:l}})]),g({challengeId:L,expiresAt:C}))}async function H_(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}function F_(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function ms(t,e){let r=F_(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return u(Re.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let s=i.guards.email_verification;if(s?.lockedUntil&&new Date(s.lockedUntil)>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let o=i.pendingVerification,a=o&&o.purpose===r.purpose&&o.channel===r.type&&o.expiresAt>new Date?o.challengeId:null;if(o?.resendAvailableAt&&o.purpose===r.purpose&&o.channel===r.type&&o.resendAvailableAt>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let c=ln(6),l=await qr(c),d=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),m=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:d});if(m.ok===!1)return u(m.errors,m.meta);let E=Math.max(0,e.security.verificationResendCooldownSeconds),v=E>0?new Date(Date.now()+E*1e3):null,b=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:d,resendAvailableAt:v}});return b.ok===!1?(await e.plugins.database.challenges.remove(p),u(b.errors,b.meta)):(await V_(t.channel,t.identityValue,c,r.template,p,d,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:o??null}),u(Re.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),Ie(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),g({challengeId:p,expiresAt:d}))}async function V_(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}var B_=[_e.PHONE_VERIFICATION,_e.EMAIL_VERIFICATION];async function hs(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(Re.CHALLENGE_NOT_FOUND());let n=r.data;if(!B_.includes(n.purpose))return u(Re.CHALLENGE_NOT_FOUND());if(n.status!==Fe.PENDING)return u(Re.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return u(Re.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?u(Re.TOO_MANY_ATTEMPTS()):u(i.errors,i.meta);if(!n.codeHash)return u(Re.INVALID_CODE());if(!await ps(t.code,n.codeHash))return u(Re.INVALID_CODE());let o=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:o,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await Ie(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),g({userId:n.userId,identityType:a,identityValue:c,verifiedAt:o})}function Lo(t,e){return e[t]??null}function Xh(t,e){return e[t]??null}async function Qh(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function Zh(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,s=r.security.maxFailedAttempts||5,o=i>=s,a=null;if(o){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>s){let d=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*d**(i-s),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function eE(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Mo(t,e){let r=t.tid,n=Lo(t.identityType,e.plugins.identity);if(!n)return u(Rt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return u(Rt.INVALID_IDENTITY_FORMAT());let s=n.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,s);if(o.ok===!1||!o.data)return u(Rt.INVALID_CREDENTIALS());let a=o.data;if(!a.loginEnabled)return u(Rt.LOGIN_DISABLED());let c=vd(a,t.credentialType);if(c.locked)return u(Rt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=Xh(t.credentialType,e.plugins.credential);if(!l)return u(Rt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let d=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=d.ok?d.data:null,m=await l.verify({userId:a.userId,identityValue:s,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(m.ok===!1)return await Zh(a,t.credentialType,e),u(Rt.INVALID_CREDENTIALS());let{userId:E,nextStep:v,intents:b}=m.data;b&&b.length>0&&await Qh(b,e);let k;if(t.userAgent&&e.plugins.deviceParser){let N=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),R=N.browser||"Unknown Browser",w=N.os||"Unknown OS";k=`${R} - ${w}`}if(v){let N={userId:E,credentialType:t.credentialType,identityType:t.identityType,identityValue:s,nextStepData:v.data,nextStepType:v.type};t.tid!==void 0&&(N.tenantId=t.tid),k!==void 0&&(N.deviceLabel=k),t.country!==void 0&&(N.country=t.country),t.city!==void 0&&(N.city=t.city);let R=await Yh(N,e);if(R.ok===!1)return u(R.errors,R.meta);if(!R.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:w,expiresAt:O,displayData:P,challengeType:U,phase:K}=R.data;return g({requiresChallenge:!0,challenge:{type:U,phase:K,expiresAt:O,data:{challengeId:w,expiresAt:O,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return u(Rt.IDENTITY_NOT_VERIFIED());let N=a.pendingVerification;if(!!N&&N.purpose===_e.EMAIL_VERIFICATION&&N.channel==="email"&&N.expiresAt>new Date&&N)return g({requiresVerification:!0,verification:{channel:"email",challengeId:N.challengeId,expiresAt:N.expiresAt,identityType:t.identityType,identityValue:s,userId:E}});let w=await ms({channel:"email",identityValue:s,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!w.ok){let O=await e.plugins.database.identities.get(t.identityType,s),P=O.ok&&O.data?O.data.pendingVerification:null;return P&&P.purpose===_e.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?g({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:s,userId:E}}):u(Rt.IDENTITY_NOT_VERIFIED())}return g({requiresVerification:!0,verification:{channel:"email",challengeId:w.data.challengeId,expiresAt:w.data.expiresAt,identityType:t.identityType,identityValue:s,userId:E}})}let C=await e.plugins.database.userAuths.get(E);if(C.ok===!1||!C.data)return u(Rt.USER_AUTH_NOT_FOUND());let L=C.data,B={userStatus:L.userStatus,userId:E,...r&&{tenantId:r}},G=await Br(B,e);if(G.ok===!1)return u(G.errors,G.meta);if(!G.ok)return u(V.DATABASE_ERROR());let{perms:j,roles:$,tenantType:te}=G.data;if(L.mfaRequired){let N=L.mfaMethods;if(!(!N||N.length===0)){let R=N.filter(w=>e.plugins.mfa?.[w]);if(R.length!==0){let w=R.filter(fe=>e.plugins.mfa?.[fe]?.requiresServerDelivery),O=R.filter(fe=>!e.plugins.mfa?.[fe]?.requiresServerDelivery),P={};k!==void 0&&(P.deviceLabel=k),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let U={userId:E,availableMethods:R,deliveryMethods:w,userHasMethods:O,device:P};t.tid!==void 0&&(U.tenantId=t.tid);let K=await Mc(U,e);if(K.ok===!1)return u(K.errors,K.meta);if(!K.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:W,expiresAt:J,phase:de,selectedMethod:ke,availableMethods:He}=K.data;return g({requiresMfa:!0,mfa:{phase:de,challengeId:W,methods:He,...ke&&{method:ke},expiresAt:J,userId:E}})}}}let A={userId:E,...r&&{tenantId:r},...te&&{tenantType:te},...j!==void 0||$?{permissions:{...$&&{roles:$},...j!==void 0&&{perms:j}}}:{},...k||t.country||t.city?{device:{...k&&{deviceLabel:k},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await On(A,e);if(x.ok===!1)return u(x.errors,x.meta);if(!x.ok)return u(V.DATABASE_ERROR());let{accessToken:S,refreshToken:y,expiresAt:I}=x.data;return await Lc(E,e),await eE(a,t.credentialType,e),g({accessToken:S,refreshToken:y,expiresAt:I})}var _t={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:T("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};var q_={CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function iE(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:s,device:o}=t;if(!r)return g({requiresMfa:!1});if(!n||n.length===0)return g({requiresMfa:!1});let a=n.filter(C=>e.plugins.mfa?.[C]);if(a.length===0)return g({requiresMfa:!1});let c=a.filter(C=>e.plugins.mfa?.[C]?.requiresServerDelivery),l=a.filter(C=>!e.plugins.mfa?.[C]?.requiresServerDelivery),d={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};s!==void 0&&(d.tenantId=s),o!==void 0&&(d.device=o);let p=await Mc(d,e);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u([q_.CHALLENGE_CREATE_FAILED()]);let{challengeId:m,expiresAt:E,phase:v,selectedMethod:b,availableMethods:k}=p.data;return g({requiresMfa:!0,mfa:{phase:v,challengeId:m,methods:k,...b&&{method:b},expiresAt:E,userId:i}})}async function Ko(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return u(_t.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Fe.PENDING)return u(_t.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_CREDENTIAL)return u(_t.INVALID_CHALLENGE_STATE());if(n.purpose!==_e.LOGIN)return u(_t.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(_t.CHALLENGE_EXPIRED());let s=n.method;if(!s)return u(_t.INTERNAL_ERROR());let o=e.plugins.credential[s];if(!o)return u(_t.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Fe.EXPIRED}),u(_t.MAX_ATTEMPTS_EXCEEDED())):u(a.errors,a.meta);if((await o.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return u(_t.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return u(_t.USER_AUTH_NOT_FOUND());let d=l.data,p={userStatus:d.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let m=await Br(p,e);if(m.ok===!1)return u(m.errors,m.meta);if(!m.ok)return u(_t.INTERNAL_ERROR());let{perms:E,roles:v,tenantType:b}=m.data,k=n.deviceLabel,C=n.country,L=n.city,B={};k!==void 0&&(B.deviceLabel=k),C!==void 0&&(B.country=C),L!==void 0&&(B.city=L);let G={mfaRequired:d.mfaRequired,...d.mfaMethods&&{mfaMethods:d.mfaMethods},userId:n.userId,device:B},j=await iE(G,e);if(j.ok===!1)return u(j.errors,j.meta);if(!j.ok)return u(_t.INTERNAL_ERROR());if(j.data.requiresMfa){let I={requiresMfa:!0,mfa:j.data.mfa};return g(I)}let $={};E!==void 0&&($.perms=E),v!==void 0&&($.roles=v);let te={userId:n.userId,permissions:$,device:B};i!==void 0&&(te.tenantId=i),b!==void 0&&(te.tenantType=b);let A=await On(te,e);if(A.ok===!1)return u(A.errors,A.meta);if(!A.ok)return u(_t.INTERNAL_ERROR());let{accessToken:x,refreshToken:S,expiresAt:y}=A.data;return g({accessToken:x,refreshToken:S,expiresAt:y})}var ot={MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function Ho(t,e){if(!e.plugins.mfa)return u(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,s=n.deviceLabel,o=n.country,a=n.city;if(n.status!==Fe.PENDING)return u(ot.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_MFA)return u(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==_e.LOGIN)return u(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return u(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return u(ot.MFA_METHOD_NOT_SUPPORTED());let d=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(d.ok===!1)return d.errors.some(te=>te.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(ot.TOO_MANY_ATTEMPTS())):u(d.errors,d.meta);if(l.requiresServerDelivery){if(!n.codeHash)return u(ot.INVALID_CHALLENGE_STATE());if(!await ps(t.code,n.codeHash))return u(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return u(ot.MFA_METHOD_NOT_SUPPORTED());let te=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if(te.ok===!1||!te.data)return u(ot.INVALID_MFA_CODE());let A=te.data;if(!A.verifiedAt)return u(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return u(ot.INVALID_MFA_CODE());let S=x.data.data?.usedBackupCodeHash;if(S){let I=(A.data.backupCodeHashes??[]).filter(N=>N!==S);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return u(ot.USER_AUTH_NOT_FOUND());let E={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},v=await Br(E,e);if(v.ok===!1)return u(v.errors,v.meta);if(!v.ok)return u(V.DATABASE_ERROR());let{perms:b,roles:k,tenantType:C}=v.data,L={userId:n.userId,...i&&{tenantId:i},...C&&{tenantType:C},...b!==void 0||k?{permissions:{...k&&{roles:k},...b!==void 0&&{perms:b}}}:{},...s||o||a?{device:{...s&&{deviceLabel:s},...o&&{country:o},...a&&{city:a}}}:{}},B=await On(L,e);if(B.ok===!1)return u(B.errors,B.meta);if(!B.ok)return u(V.DATABASE_ERROR());let{accessToken:G,refreshToken:j,expiresAt:$}=B.data;return g({accessToken:G,refreshToken:j,expiresAt:$})}var xt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:X("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:X("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:X("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:X("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:T("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:T("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:T("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function Fo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(xt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Fe.PENDING)return u(xt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return u(xt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return u(xt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return u(xt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return u(xt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let s=await e.plugins.database.userAuths.get(t.userId);if(!s.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let o=s.data;if(!o)return u(xt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(m=>m.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(xt.TOO_MANY_ISSUES())):u(a.errors,a.meta);if(!i.sendCode)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:o},e);if(!c.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,d=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:Ar.VERIFY_MFA,codeHash:l})).ok===!1?u(xt.CHALLENGE_UPDATE_FAILED()):g({maskedRecipient:d,expiresAt:n.expiresAt})}var je={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:X("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:X("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:T("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:T("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:T("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:T("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:T("INTERNAL_ERROR","Internal error occurred during registration")};function j_(t,e){return e[t]}function G_(t,e){return e[t]}async function Vo(t,e){let r=j_(t.identityType,e.plugins.identity);if(!r)return u(je.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return u(je.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,i);if(s.ok===!1)return u(je.DATABASE_ERROR());if(s.data)return u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let o=G_(t.credentialType,e.plugins.credential);if(!o)return u(je.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await o.create({value:t.credentialValue});if(a.ok===!1)return u(je.INVALID_CREDENTIAL());if(!a.ok)return u(je.INTERNAL_ERROR());let{value:c,data:l}=a.data,d=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let m={id:d,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===or.EMAIL&&{contactEmail:t.identityValue},...t.identityType===or.PHONE&&{contactPhone:t.identityValue},...t.identityType===or.USERNAME&&{username:t.identityValue}},E={userId:d,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},v={type:t.identityType,value:i,userId:d,loginEnabled:!0,verifiedAt:null,guards:{}},b={userId:d,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===or.EMAIL&&e.plugins.database.registration){let j=await $_({profileData:{...m,id:d},userAuthData:E,identityData:v,credentialRepoData:b,identityValue:i},e);return j.ok===!1?j.errors.some($=>$.code==="UNIQUE_CONSTRAINT_VIOLATION")?u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):u(j.errors,j.meta):j.ok?g({userId:d,verification:{channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}):u(je.INTERNAL_ERROR())}let k=await e.plugins.database.users.create(m);if(k.ok===!1||!k.data)return u(je.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(E)).ok===!1)return await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(v)).ok===!1)return await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let B=await e.plugins.database.credentials.create(b);if(B.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let G;if(t.identityType===or.EMAIL){let j=await J_({userId:d,identityType:t.identityType,identityValue:i},e);if(j.ok===!1)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(j.errors,j.meta);if(!j.ok)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.INTERNAL_ERROR());G={channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}return g({userId:d,...G&&{verification:G}})}async function $_(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await W_(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?u(je.USER_CREATION_FAILED()):((await z_({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),g({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function W_(t,e,r){let n=ln(6),i=await qr(n),s=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),o=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:o,userId:t,purpose:_e.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:or.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:s},pendingVerification:{challengeId:o,purpose:_e.EMAIL_VERIFICATION,channel:"email",expiresAt:s,resendAvailableAt:a}}}async function z_(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:_e.EMAIL_VERIFICATION}})).ok===!1?u(je.VERIFICATION_EMAIL_SEND_FAILED()):g(void 0):u(je.EMAIL_SYSTEM_NOT_AVAILABLE())}async function J_(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=ln(6),n=await qr(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),s=e.plugins.database.challenges.generateChallengeId(),o=await e.plugins.database.challenges.create({id:s,userId:t.userId,purpose:_e.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(o.ok===!1)return u(o.errors,o.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:s,purpose:_e.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(s),u(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:s,expiresAt:i.toISOString(),purpose:_e.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(s),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),u(je.VERIFICATION_EMAIL_SEND_FAILED())):g({challengeId:s,expiresAt:i})}var Pn={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Bo(t,e){let{sessionId:r,userId:n,tenantId:i}=t,s=await e.plugins.database.sessions.get(r);if(s.ok===!1)return u(s.errors,s.meta);if(!s.data)return u(Pn.SESSION_NOT_FOUND());let o=s.data;if(o.revokedAt)return u(Pn.SESSION_REVOKED());if(o.userId!==n)return u(Pn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return u(a.errors,a.meta);if(!a.data)return u(Pn.USER_NOT_FOUND());let c=a.data,l=await Br({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return u(l.errors,l.meta);if(!l.ok)return u(V.DATABASE_ERROR());let{perms:d,roles:p,tenantType:m}=l.data,E=e.plugins.database.sessions.generateTokenId(),v=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:E,...d!==void 0&&{perms:d},...p&&{roles:p},...m&&{tenantType:m}});if(v.ok===!1)return u(v.errors,v.meta);let b=ds(i,e.security),k=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m},...d!==void 0&&{perms:d},...p&&{roles:p}}),C=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt,tenantId:i})}var oE=/^[\w!#$%&'*.^`|~+-]+$/,Y_=/^[ !#-:<-[\]-~]*$/,sE=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},Td=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let s=i.indexOf("=");if(s===-1)continue;let o=sE(i.substring(0,s));if(e&&e!==o||!oE.test(o)||o in n)continue;let a=sE(i.substring(s+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),Y_.test(a)&&(n[o]=a.indexOf("%")!==-1?ss(a,yo):a,e))break}return n};var X_=(t,e,r={})=>{if(!oE.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Hc=(t,e,r)=>(e=encodeURIComponent(e),X_(t,e,r));var Id=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let s=e;return r==="secure"?s="__Secure-"+e:r==="host"&&(s="__Host-"+e),Td(n,s)[s]}return n?Td(n):{}};var Q_=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Hc("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Hc("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Hc(t,e,{path:"/",...r}),n},qo=(t,e,r,n)=>{let i=Q_(e,r,n);t.header("Set-Cookie",i,{append:!0})};var jo=(t,e,r)=>{let n=Id(t,e,r?.prefix);return qo(t,e,"",{...r,maxAge:0}),n};function _d(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Z_(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function aE(t,e,r,n,i){let s=r.tokenStrategy,o=r.refreshTokenCookie??{},a=e.refreshToken;if(typeof a!="string"||!a)return e;if(s==="cookie"||s==="both"){let c=i??Z_(r,n),l=_d(r,c);ex(t,a,{...o,name:l})}if(s==="cookie"){let{refreshToken:c,...l}=e;return l}return e}function cE(t,e,r){let n=e.tokenStrategy;if(n!=="cookie"&&n!=="both")return;let i=e.refreshTokenCookie??{},s={path:i.path??"/",...i.domain?{domain:i.domain}:{}},o=e.audienceCookieNames?.cookieNames;if(o&&!r){let c=i.name??"refresh_token",l=new Set([o.customer??c,o.tenant??c,o.system??c]);for(let d of l)jo(t,d,s);return}let a=_d(e,r);jo(t,a,s)}function Fc(t,e,r){let n=e.tokenStrategy;if(n!=="cookie"&&n!=="both"||!t)return;let i=_d(e,r);return tx(t,i)}function ex(t,e,r){qo(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function tx(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var lE=new Set(["customer","tenant","system"]);function Ke(t,e){let r=[];if(e.auth!==!1&&r.push(Io({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(xo(a))}let n=async a=>{let c=sr(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let d=a.get("authResult"),p={body:bo(a),query:wo(a),params:So(a),user:d?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},m=await e.handler(p),E=e.successStatus;if(m.ok&&m.data!==void 0&&e.tokenMode==="auth"){let v=m.data,b=typeof v.tenantId=="string"?v.tenantId:void 0,k=p.authContextHeader,C=b!==void 0?void 0:typeof k=="string"&&lE.has(k)?k:void 0,L=aE(a,v,t,b,C),B={...m,data:L};return qe(a,B,{traceId:c,...E!==void 0?{successStatus:E}:{}})}if(m.ok&&e.tokenMode==="logout"){let v=p.authContextHeader,b=typeof v=="string"&&lE.has(v)?v:void 0;cE(a,t,b)}return qe(a,m,{traceId:c,...E!==void 0?{successStatus:E}:{}})}catch(l){let d=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:d}})),qe(a,u(oe.InternalError()),{traceId:c})}},i=[...r,n],o=async(a,c)=>{let l,d=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let m=i[p],E=await m(a,async()=>{await d(p+1)});E instanceof Response&&(l=E)};return await d(0),l};return o.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},o}function jr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function uE(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function dE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function pE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function fE(t){return{plugins:{database:t.plugins.database}}}var ij=Ne(h(),ht(320)),sj=Ne(h(),ht(4096));function mE(t){return Ke(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Lt.authenticate.body},handler:async e=>{let r=jr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Mo(n,r)}})}function hE(t){return Ke(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeChallenge.body},handler:async e=>{let r=jr(t.auth);return Ko({challengeId:e.body.challengeId,code:e.body.code},r)}})}function EE(t){return Ke(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Ho({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function yE(t){return Ke(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Lt.issueMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Fo({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function Vc(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var rx=new Set(["customer","tenant","system"]);function gE(t){return Ke(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&rx.has(r)?r:void 0,i=Fc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!Vc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=dE(t.auth);return Pc({refreshToken:a},c)}})}function nx(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function Un(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=nx(e);return typeof r?.sid=="string"?r.sid:void 0}function vE(t){return Ke(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return u(oe.NotAuthenticated())}let n=fE(t.auth);return Uo({userId:e.user.id},n)}})}var ix=new Set(["customer","tenant","system"]);function AE(t){return Ke(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&ix.has(r)?r:void 0,i=Fc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!Vc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=pE(t.auth);return Uc({refreshToken:a},c)}})}function TE(t){return Ke(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Lt.register.body},handler:async e=>{let r=uE(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Vo(n,r)}})}function IE(t){return Ke(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Lt.selectTenant.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(!r)return u(oe.NotAuthenticated());let n=jr(t.auth);return Bo({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Go={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Bc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Go.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return u(Go.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return u(i.errors,i.meta);let s=i.data??[];t.verifiedOnly&&(s=s.filter(a=>a.verifiedAt!==null));let o=s.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return g({authenticators:o,total:o.length})}var un={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:X("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:X("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:X("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:X("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:X("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var dn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function qc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(un.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(un.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(un.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok||!i.data)return u(un.AUTHENTICATOR_NOT_FOUND());let s=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(s.ok===!1)return u(s.errors,s.meta);let o=s.data??[],a=o.filter(b=>b.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return u(un.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let b=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(b.ok===!1)return u(b.errors,b.meta);let k=b.data;if(k&&k.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:k.value,data:k.data??{}},credentialValue:t.password})).ok===!1)return u(un.INVALID_PASSWORD())}let d=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(d.ok===!1)return u(d.errors,d.meta);let m=o.filter(b=>b.method===t.method&&(b.id!==t.authenticatorId||b.method!==t.method)).length,E=a.length>1||a.length===1&&!l;await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:E,remainingCount:m}});let v={method:t.method,mfaStillEnabled:E,remainingCount:m};return t.authenticatorId!==void 0&&(v.authenticatorId=t.authenticatorId),g(v)}var pn={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function jc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(pn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(pn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(pn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return u(pn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return u(pn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let s=await i.setup({userId:t.userId,data:t.data||{}},e);if(s.ok===!1)return u(s.errors,s.meta);if(!s.ok)return u(pn.INTERNAL_ERROR());let o=s.data;if(o.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:o.credentialData});if(l.ok===!1)return u(l.errors,l.meta)}await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=o;return g({method:t.method,data:c})}var Et={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:T("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:T("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:T("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:T("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:X("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:X("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:T("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:V.INTERNAL_ERROR};var _E=["totp","webauthn","passkey","hardware"],xE=["email","sms","phone"],sx=new Set([..._E,...xE]);async function Gc(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return u(Et.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!sx.has(i))return u(Et.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return u(Et.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Et.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Et.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Et.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return u(Et.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return u(Et.MFA_NOT_ENABLED());if(!t.password)return u(Et.PASSWORD_REQUIRED());let i=await ox(t.userId,t.password,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await ax(t.userId,t.mfaMethods,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return u(i.errors,i.meta)}return await Ie({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),g()}async function ox(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let s=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return s.ok===!1?u(s.errors,s.meta):g()}async function ax(t,e,r){let n=e.filter(s=>_E.includes(s)),i=e.filter(s=>xE.includes(s));if(n.length>0){let s=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let s=await r.plugins.database.identities.getByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}return g()}var Tr={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:T("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:T("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function $c(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Tr.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Tr.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Tr.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok)return u(Tr.INTERNAL_ERROR());let s=i.data;if(!s)return u(Tr.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return u(Tr.MFA_NOT_AVAILABLE());let o=e.plugins.mfa[t.method];if(!o?.verifyWithCredentials)return u(Tr.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await o.verifyWithCredentials({credentialData:s.data,data:t.data||{}});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Tr.INTERNAL_ERROR());let c=a.data;if(!c.verified)return g({method:t.method,verified:!1,data:c.data||{}});if(!s.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return u(l.errors,l.meta);let d=n.mfaMethods||[];if(!d.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...d,t.method]);if(p.ok===!1)return u(p.errors,p.meta)}}return await Ie(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),g({method:t.method,verified:!0,data:c.data||{}})}function $o(t){return{system:{systemId:t.system.system.systemId}}}function bE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function SE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function wE(t){return{plugins:{database:t.plugins.database},system:$o(t)}}function NE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function RE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function OE(t){return Y(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=wE(t.auth);return Bc({userId:e.user.id},r)}})}function kE(t){return Y(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:vr.removeAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=NE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),qc(n,r)}})}function CE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:vr.setupAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=bE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),jc(n,r)}})}function DE(t){return Y(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:vr.updateMfaSettings.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=RE(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),Gc(n,r)}})}function PE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:vr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=SE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),$c(n,r)}})}var Wc={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function zc(t,e){if(!await e.plugins.database.users.getById(t.userId))return u(Wc.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(!i)return g([]);let s=i.map(o=>{let a={provider:o.provider,externalId:o.externalId,linkedAt:o.createdAt};return o.externalEmail&&(a.externalEmail=o.externalEmail),o.externalName&&(a.externalName=o.externalName),a});return g(s)}var bt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:T("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:T("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:T("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function cx(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return u(V.DATABASE_ERROR());let d=l.data;if(d.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(d.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let m=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(m.ok===!1)return u(m.errors,m.meta)}return g(c)}let s=null;if(t.email){let c=Lo(or.EMAIL,e.plugins.identity);if(!c)return u(V.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),d=await e.plugins.database.identities.get(or.EMAIL,l);if(d.ok===!1)return u(V.DATABASE_ERROR());if(d.data){if(t.emailVerified!==!0)return u(bt.EMAIL_NOT_VERIFIED_BY_PROVIDER());s=d.data.userId;let p=await e.plugins.database.userAuths.get(s);if(!p.ok||!p.data)return u(V.DATABASE_ERROR());let m=p.data;if(m.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(m.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED())}}if(!s){if(!t.email)return u(bt.EMAIL_REQUIRED());s=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let k=t.name.trim().split(/\s+/);c=k[0]||"",l=k.slice(1).join(" ")||""}let d={id:s,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(d)).ok)return u(V.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:s,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(s),u(V.DATABASE_ERROR());let E=Lo(or.EMAIL,e.plugins.identity);if(!E)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(V.PLUGIN_NOT_FOUND());let v=E.normalize(t.email),b=await e.plugins.database.identities.create({type:or.EMAIL,value:v,userId:s,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(b.ok===!1)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(b.errors,b.meta)}let o={userId:s,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(o.externalEmail=t.email),t.name!==void 0&&(o.externalName=t.name),t.avatarUrl!==void 0&&(o.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(o);return a.ok===!1?u(a.errors,a.meta):g(s)}async function Jc(t,e){if(!t.provider)return u(bt.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return u(bt.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return u(bt.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return u(bt.PROVIDER_NOT_FOUND());let b=await r.verifyCredential(t.credential);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}else if(t.code){let b=await r.exchangeCodeForToken(t.code);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());let k=b.data;if(!k)return u(bt.CODE_EXCHANGE_FAILED());i=k.accessToken}if(!n){if(!i)return u(bt.INVALID_ACCESS_TOKEN());let b=await r.getUserProfile(i);if(b.ok===!1)return u(bt.PROFILE_FETCH_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}let s=await cx(n,e,t);if(!s.ok)return u(s.errors,s.meta);let o=s.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(o);if(!c.ok||!c.data)return u(V.DATABASE_ERROR());let l=await Br({userStatus:c.data.userStatus,userId:o,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return u(l.errors,l.meta);let{perms:d,roles:p,tenantType:m}=l.data,E={userId:o,...t.tenantId&&{tenantId:t.tenantId},...m&&{tenantType:m},...d!==void 0||p?{permissions:{...p&&{roles:p},...d!==void 0&&{perms:d}}}:{}},v=await On(E,a);return v.ok===!1?u(v.errors,v.meta):(await Ie(e,{event:"oauth_login_success",userId:o,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Lc(o,e),g({accessToken:v.data.accessToken,refreshToken:v.data.refreshToken,expiresAt:v.data.expiresAt}))}catch(n){return await Ie(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),u(bt.PROFILE_FETCH_FAILED())}}var Mt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:T("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:T("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function Yc(t,e){if(!t.code)return u(Mt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return u(Mt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return u(Mt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let m=await n.exchangeCodeForToken(t.code);if(m.ok===!1)return u(Mt.CODE_EXCHANGE_FAILED());let E=m.data;if(!E)return u(Mt.CODE_EXCHANGE_FAILED());i=E.accessToken}if(!i)return u(Mt.INVALID_ACCESS_TOKEN());let s=await n.getUserProfile(i);if(s.ok===!1)return u(Mt.PROFILE_FETCH_FAILED());let o=s.data;if(!o)return u(Mt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,o.id);if(a.ok===!1)return u(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?u(Mt.PROVIDER_ALREADY_LINKED()):u(Mt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:o.id,createdAt:new Date};o.email!==void 0&&(l.externalEmail=o.email),o.name!==void 0&&(l.externalName=o.name),o.avatarUrl!==void 0&&(l.externalAvatarUrl=o.avatarUrl);let d=await e.plugins.database.userProviders.create(l);if(d.ok===!1)return u(d.errors,d.meta);let p=d.data;return p?(await Ie(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:o.id}}),g(p)):u(Mt.PROFILE_FETCH_FAILED())}catch(i){return await Ie(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),u(Mt.PROFILE_FETCH_FAILED())}}var Es={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:T("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:T("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function Xc(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return u(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return u(Es.PROVIDER_NOT_LINKED());let i=n.find(o=>o.provider===t.provider);if(!i)return u(Es.PROVIDER_NOT_LINKED());if(n.length<=1){let o=await e.plugins.database.identities.getByUserId(t.userId);if(!(o.ok&&o.data&&o.data.length>0))return u(Es.CANNOT_UNLINK_LAST_PROVIDER())}let s=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return s.ok===!1?u(s.errors,s.meta):(await Ie(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),g())}function UE(t){return Y(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return zc({userId:e.user.id},r)}})}function LE(t){return Y(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:an.linkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),Yc(n,r)}})}function ME(t){return Ke(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:an.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),Jc(n,r)}})}function KE(t){return Y(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:an.unlinkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Xc({userId:e.user.id,provider:e.body.provider},r)}})}var Ot={PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:T("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:T("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:T("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:T("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},Ir={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:Ot.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:Ot.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:Ot.SAME_PASSWORD},fi={EMAIL_SYSTEM_NOT_AVAILABLE:Ot.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:Ot.SEND_EMAIL_ERROR},Bt={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:Ot.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:Ot.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:Ot.CHALLENGE_ALREADY_USED,INVALID_CODE:Ot.INVALID_CODE,TOO_MANY_ATTEMPTS:Ot.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:Ot.AUTH_SCOPE_MISMATCH};async function ys(t,e){if(!e.plugins.credential?.password)return u(Ir.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Ir.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Ir.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return u(Ir.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return u(Ir.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Ir.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return u(l.errors,l.meta);let d=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return d.ok===!1&&console.error("Failed to revoke sessions after password change:",d.errors),await Ie(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),g()}async function gs(t,e){if(!e.plugins.emailSystem)return u(fi.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=ln(6),s=await qr(i),o=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return g({challengeId:`fake_challenge_${Date.now()}`,expiresAt:o});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===_e.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return g({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),d=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:_e.PASSWORD_RESET,status:Fe.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:s,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:o});if(d.ok===!1)return u(d.errors,d.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:o.toISOString(),purpose:_e.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),u(fi.SEND_EMAIL_ERROR());let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=!c||c.purpose===_e.PASSWORD_RESET;return await Promise.all([v?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:_e.PASSWORD_RESET,channel:"email",expiresAt:o,resendAvailableAt:E}}):Promise.resolve(),Ie(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),g({challengeId:l,expiresAt:o})}async function vs(t,e){if(!e.plugins.credential?.password)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Bt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==_e.PASSWORD_RESET)return u(Bt.CHALLENGE_NOT_FOUND());if(i.status!==Fe.PENDING)return u(Bt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return u(Bt.CHALLENGE_EXPIRED());let s=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(s.ok===!1)return s.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?u(Bt.TOO_MANY_ATTEMPTS()):u(s.errors,s.meta);if(!i.codeHash)return u(Bt.INVALID_CODE());if(!await ps(t.code,i.codeHash))return u(Bt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,dn.PASSWORD);if(l.ok===!1)return u(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return u(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:dn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return u(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let d=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return d.ok===!1&&console.error("Failed to revoke sessions after password reset:",d.errors),await Ie(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),g()}var Qc={NO_CHANGES_PROVIDED:T("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function Zc(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return u(Qc.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return u(V.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return u(V.INTERNAL_ERROR());await Ie(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let o=await e.plugins.database.users.getById(t.userId);return!o.ok||o.data===null?u(V.NOT_FOUND()):g(o.data)}function As(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function HE(t){return Ke(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:sn.changePassword.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=As(t.auth),n=e.body,i=Un(e.authorizationHeader);return ys({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function FE(t){return Y(t.policy,{method:"POST",path:"/password/forgot",auth:!1,input:{body:sn.forgotPassword.body},handler:async e=>{let r=As(t.auth);return gs({email:e.body.email},r)}})}function VE(t){return Y(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:sn.resetPassword.body},handler:async e=>{let r=As(t.auth);return vs({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var Wo={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:T("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to delete session")};async function zo(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?u(Wo.DATABASE_ERROR()):(await Ie(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),g())}var Jo={DATABASE_ERROR:T("DATABASE_ERROR","Failed to retrieve sessions")};async function Yo(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return u(Jo.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return g(a,i.meta)}var Ts={INVALID_TOKEN:T("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to revoke token")};async function Xo(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?u(Ts.DATABASE_ERROR()):(await Ie(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),g()):u(Ts.INVALID_TOKEN())}function BE(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function qE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function jE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function GE(t){return Y(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:on.deleteSession.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=qE(t.auth);return zo({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function $E(t){return Ke(t,{method:"GET",path:"/sessions",auth:!0,input:{query:on.listSessions.query},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=BE(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Yo(n,r);if(!i.ok)return i;let s=Un(e.authorizationHeader);if(s&&i.data){let o=i.data.map(a=>a.id===s?{...a,isCurrent:!0}:a);return g(o,i.meta)}return i}})}function WE(t){return Y(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:on.revokeToken.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=jE(t.auth);return Xo({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},Qo=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Zo(t,e){return t===void 0?!1:(t&e)===e}var xd={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},zE=Object.fromEntries(Object.entries(xd).map(([t,e])=>[e,Number(t)]));function Qt(t){return t?Object.entries(xd).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function Ln(t){let e=0;for(let r of t){let n=zE[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Zt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var Gr={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:T("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),DATABASE_ERROR:V.DATABASE_ERROR};var lx={IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:T("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:T("IDENTITY_ALREADY_EXISTS","This identity is already registered")},ux={GUARD_LOCKED:T("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},dx={INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:T("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:T("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:T("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:T("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},px={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:T("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:T("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:T("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},fx={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:T("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:T("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},mx={MFA_NOT_CONFIGURED:T("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:T("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:T("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:T("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},hx={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:T("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:T("INVALID_SESSION","Invalid session")},Ex={TOKEN_NOT_FOUND:T("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:T("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:T("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:T("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:T("TOKEN_VERIFICATION_FAILED","Token verification failed")},kt={NOT_MEMBER_OF_TENANT:T("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:T("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:T("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:T("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:T("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},$$={...lx,...ux,...dx,...px,...fx,...mx,...hx,...Ex,...kt};async function Is(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Gr.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let k=await s.tenantInvites.getById(r);if(!k.ok)return u(k.errors,k.meta);o=k.data}else if(n){let k=await s.tenantInvites.getByToken(n);if(!k.ok)return u(k.errors,k.meta);o=k.data}if(!o)return u(Gr.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Gr.INVITE_NOT_PENDING());if(o.expiresAt<new Date)return u(Gr.INVITE_EXPIRED());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Gr.INVITE_USER_MISMATCH());if(!o.inviteeUserId&&(o.inviteeEmail||o.inviteePhone)){let k=await s.identities.getByUserId(i);if(!k.ok)return u(k.errors,k.meta);let C=k.data.filter(j=>j.verifiedAt!==null),L=(j,$)=>{let te=$.trim().toLowerCase();return C.some(A=>A.type===j&&A.value.trim().toLowerCase()===te)},B=o.inviteeEmail?L("email",o.inviteeEmail):!1,G=o.inviteePhone?L("phone",o.inviteePhone):!1;if(!B&&!G)return u(Gr.INVITE_IDENTITY_MISMATCH())}let a=await s.tenantMembers.get(o.tenantId,i);if(!a.ok)return u(a.errors,a.meta);if(a.data&&a.data.status!==lt.REMOVED)return u(Gr.ALREADY_MEMBER());let c=await s.tenants.get(o.tenantId);if(!c.ok)return u(c.errors,c.meta);if(o.authPerm!==void 0&&(o.authPerm&Qo)!==0){if(!c.data)return u(kt.TENANT_NOT_FOUND());if(c.data.type!==Zt.SYSTEM)return u(kt.ACCOUNT_PERMS_SYSTEM_ONLY())}let l={tenantId:o.tenantId,userId:i,status:lt.ACTIVE,isOwner:!1,tenantType:o.tenantType};c.data?.parentTenantId!==void 0&&(l.parentTenantId=c.data.parentTenantId),o.roles!==void 0&&(l.roles=o.roles),o.perms!==void 0&&(l.perms=o.perms),o.authPerm!==void 0&&(l.authPerm=o.authPerm);let d=await s.tenantMembers.create(l);if(!d.ok)return u(d.errors,d.meta);let p={tenantId:o.tenantId,userId:i},m=await s.users.getById(i);m.ok&&m.data&&(m.data.contactEmail&&(p.contactEmail=m.data.contactEmail),m.data.contactPhone&&(p.contactPhone=m.data.contactPhone),m.data.displayName&&(p.displayName=m.data.displayName),m.data.givenName&&(p.givenName=m.data.givenName),m.data.familyName&&(p.familyName=m.data.familyName),m.data.avatarUrl&&(p.avatarUrl=m.data.avatarUrl),m.data.locale&&(p.locale=m.data.locale)),o.displayName&&(p.displayName=o.displayName),o.givenName&&(p.givenName=o.givenName),o.familyName&&(p.familyName=o.familyName),o.jobTitle&&(p.jobTitle=o.jobTitle);let E=await s.userTenantProfiles.create(p);if(!E.ok)return u(E.errors,E.meta);let v=await s.tenantInvites.updateStatus(o.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!v.ok)return u(v.errors,v.meta);let b={tenantId:o.tenantId};return o.roles!==void 0&&(b.roles=o.roles),o.perms!==void 0&&(b.perms=o.perms),o.authPerm!==void 0&&(b.authPerm=o.authPerm),g(b)}var mi={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function hi(t,e,r){if(t===void 0||(t&Qo)===0)return g(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g(void 0):u(kt.TENANT_NOT_FOUND()):u(n.errors,n.meta)}var el={NOT_MEMBER:kt.NOT_MEMBER_OF_TENANT,SUSPENDED:kt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:kt.INSUFFICIENT_TENANT_PERMISSIONS};async function ut(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,s=await e.tenantMembers.get(r,n);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(el.NOT_MEMBER());let o=s.data;return o.status!==lt.ACTIVE?u(el.SUSPENDED()):o.isOwner?g(o):Zo(o.authPerm,i)?g(o):u(el.INSUFFICIENT_PERMISSIONS())}async function tl(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(t.authPerm!==void 0&&(t.authPerm&se.CHANGE_MEMBER_PERMISSION)!==0&&!o.data.isOwner)return u(mi.CANNOT_ESCALATE_PERMISSIONS());let a=await hi(t.authPerm,r,s.tenants);if(!a.ok)return u(a.errors,a.meta);let c=await s.users.getById(n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(mi.USER_NOT_FOUND());let l=c.data,d=await s.tenantMembers.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(d.data&&d.data.status!==lt.REMOVED)return u(mi.ALREADY_MEMBER());let p=await s.tenants.get(r);if(!p.ok)return u(p.errors,p.meta);if(!p.data)return u(mi.TENANT_NOT_FOUND());let m=p.data,E={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!1,tenantType:m.type};m.parentTenantId!==void 0&&(E.parentTenantId=m.parentTenantId),t.roles!==void 0&&(E.roles=t.roles),t.perms!==void 0&&(E.perms=t.perms),t.authPerm!==void 0&&(E.authPerm=t.authPerm);let v=await s.tenantMembers.create(E);if(!v.ok)return u(v.errors,v.meta);let b={tenantId:r,userId:n};l.contactEmail&&(b.contactEmail=l.contactEmail),l.contactPhone&&(b.contactPhone=l.contactPhone),l.displayName&&(b.displayName=l.displayName),l.givenName&&(b.givenName=l.givenName),l.familyName&&(b.familyName=l.familyName),l.avatarUrl&&(b.avatarUrl=l.avatarUrl),l.locale&&(b.locale=l.locale),t.contactEmail!==void 0&&(b.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(b.contactPhone=t.contactPhone),t.displayName!==void 0&&(b.displayName=t.displayName),t.givenName!==void 0&&(b.givenName=t.givenName),t.familyName!==void 0&&(b.familyName=t.familyName),t.avatarUrl!==void 0&&(b.avatarUrl=t.avatarUrl),t.locale!==void 0&&(b.locale=t.locale),t.jobTitle!==void 0&&(b.jobTitle=t.jobTitle),t.bio!==void 0&&(b.bio=t.bio),t.metadata!==void 0&&(b.metadata=t.metadata);let k=await s.userTenantProfiles.create(b);return k.ok?g({tenantId:r,userId:n}):u(k.errors,k.meta)}var _s={TENANT_ALREADY_HAS_OWNER:T("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:T("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:V.DATABASE_ERROR};async function rl(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:s,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k}=t,C=e.plugins.database,L=i??"org";if(L===Zt.SYSTEM)return u(_s.SYSTEM_TYPE_FORBIDDEN());let B=await C.users.getById(n);if(!B.ok)return u(B.errors,B.meta);if(!B.data)return u(_s.USER_NOT_FOUND());let G=await C.tenants.get(r);if(!G.ok)return u(G.errors,G.meta);if(!G.data){let S={id:r,type:L,ownerId:n};s!==void 0&&(S.parentTenantId=s);let y=await C.tenants.create(S);if(!y.ok)return u(y.errors,y.meta)}let j=await C.tenantMembers.hasOwner(r);if(!j.ok)return u(j.errors,j.meta);if(j.data)return u(_s.TENANT_ALREADY_HAS_OWNER());let $=G.data?.parentTenantId??s,te={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!0,tenantType:L};$!==void 0&&(te.parentTenantId=$);let A=await C.tenantMembers.create(te);if(!A.ok)return u(A.errors,A.meta);let x=await C.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k});return x.ok?g({tenantId:r,userId:n}):u(x.errors,x.meta)}async function nl(t,e){let{email:r,phone:n}=t,i=e.plugins.database,s=[],o=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}return g({pendingInvites:s})}var Ei={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),DATABASE_ERROR:V.DATABASE_ERROR};async function xs(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Ei.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let c=await s.tenantInvites.getById(r);if(!c.ok)return u(c.errors,c.meta);o=c.data}else if(n){let c=await s.tenantInvites.getByToken(n);if(!c.ok)return u(c.errors,c.meta);o=c.data}if(!o)return u(Ei.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Ei.INVITE_NOT_PENDING());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Ei.INVITE_USER_MISMATCH());let a=await s.tenantInvites.updateStatus(o.id,{status:ar.DECLINED,declinedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}async function yi(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[s,o]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(kt.NOT_MEMBER_OF_TENANT());if(!o.ok)return u(o.errors,o.meta);let a=s.data,c=o.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),g(l)}var qt={INVITEE_REQUIRED:T("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:X("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:T("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:X("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};function yx(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function bs(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:s,inviteePhone:o,roles:a,perms:c,authPerm:l,displayName:d,givenName:p,familyName:m,jobTitle:E}=t,v=e.plugins.database,b=await ut({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!b.ok)return u(b.errors,b.meta);if(l!==void 0&&(l&se.CHANGE_MEMBER_PERMISSION)!==0&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());if(a?.includes("owner")&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());let k=await hi(l,r,v.tenants);if(!k.ok)return u(k.errors,k.meta);if(!i&&!s&&!o)return u(qt.INVITEE_REQUIRED());if(i){let R=await v.users.getById(i);if(!R.ok)return u(R.errors,R.meta);if(!R.data)return u(qt.INVITEE_USER_NOT_FOUND({userId:i}));let w=await v.tenantMembers.get(r,i);if(!w.ok)return u(w.errors,w.meta);if(w.data&&w.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER());let O=await v.tenantInvites.findByTenantAndUserId(r,i);if(!O.ok)return u(O.errors,O.meta);if(O.data)return u(qt.INVITE_ALREADY_EXISTS())}if(s){let R=await v.identities.get("email",s);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let w=await v.tenantInvites.findByTenantAndEmail(r,s);if(!w.ok)return u(w.errors,w.meta);if(w.data)return u(qt.INVITE_ALREADY_EXISTS())}if(o){let R=await v.identities.get("phone",o);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let w=await v.tenantInvites.findByTenantAndPhone(r,o);if(!w.ok)return u(w.errors,w.meta);if(w.data)return u(qt.INVITE_ALREADY_EXISTS())}let C=await v.tenantInvites.countPendingByTenant(r);if(!C.ok)return u(C.errors,C.meta);if(C.data>=e.security.maxPendingInvitesPerTenant)return u(qt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let L,B,G,j=await v.users.getById(n);j.ok&&j.data&&(j.data.displayName!==void 0&&(L=j.data.displayName),j.data.contactEmail!==void 0&&(B=j.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(L=$.data.displayName),$.data.jobTitle!==void 0&&(G=$.data.jobTitle));let te=Zt.DEFAULT,A=await v.tenants.get(r);A.ok&&A.data&&(te=A.data.type);let x=v.tenantInvites.generateInviteId(),S=yx(),y=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),I={id:x,tenantId:r,tenantType:te,invitedById:n,status:ar.PENDING,inviteToken:S,expiresAt:y};L!==void 0&&(I.invitedByName=L),B!==void 0&&(I.invitedByEmail=B),G!==void 0&&(I.invitedByJobTitle=G),i!==void 0&&(I.inviteeUserId=i),s!==void 0&&(I.inviteeEmail=s),o!==void 0&&(I.inviteePhone=o),a!==void 0&&(I.roles=a),c!==void 0&&(I.perms=c),l!==void 0&&(I.authPerm=l),d!==void 0&&(I.displayName=d),p!==void 0&&(I.givenName=p),m!==void 0&&(I.familyName=m),E!==void 0&&(I.jobTitle=E);let N=await v.tenantInvites.create(I);return N.ok?g({inviteId:x,inviteToken:S,expiresAt:y}):u(N.errors,N.meta)}async function Ss(t,e){let{tenantId:r,actorUserId:n,status:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await s.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?g(c.data,c.meta):u(c.errors,c.meta)}async function ws(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,s=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return u(s.errors,s.meta);let o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(o).length>0?o:void 0);return a.ok?g(a.data,a.meta):u(a.errors,a.meta)}async function il(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let s=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return s.ok?g(s.data,s.meta):u(s.errors,s.meta)}var gi={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:T("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:T("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:V.DATABASE_ERROR};async function Ns(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(i===n)return u(gi.CANNOT_REMOVE_SELF());let a=await s.tenantMembers.get(r,n);if(!a.ok)return u(a.errors,a.meta);if(!a.data)return u(gi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!o.data.isOwner)return u(gi.CANNOT_MODIFY_OWNER());if(c.isOwner){let d=await s.tenantMembers.listByTenant(r);if(!d.ok)return u(d.errors,d.meta);if(d.data.filter(m=>m.isOwner&&m.status===lt.ACTIVE).length<=1)return u(gi.CANNOT_REMOVE_LAST_OWNER())}let l=await s.tenantMembers.remove(r,n);return l.ok?(await s.userTenantProfiles.remove(r,n),g(void 0)):u(l.errors,l.meta)}var ea={INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rs(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,s=await i.tenantInvites.getById(r);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(ea.INVITE_NOT_FOUND());let o=await ut({tenantId:s.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(s.data.status!==ar.PENDING)return u(ea.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}var Mn={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};async function Os(t,e){let{tenantId:r,userId:n,actorUserId:i,role:s,perms:o,authPerm:a}=t,c=t.roles??(s!==void 0?[s]:void 0),l=e.plugins.database,d=await ut({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!d.ok)return u(d.errors,d.meta);let p=d.data;if(i===n)return u(Mn.CANNOT_MODIFY_SELF());let m=await l.tenantMembers.get(r,n);if(!m.ok)return u(m.errors,m.meta);if(!m.data)return u(Mn.MEMBER_NOT_FOUND());if(m.data.isOwner)return u(Mn.CANNOT_MODIFY_OWNER());if(a!==void 0&&!p.isOwner&&(a&se.CHANGE_MEMBER_PERMISSION)!==0)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());if(c?.includes("owner")&&!p.isOwner)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());let E=await hi(a,r,l.tenants);if(!E.ok)return u(E.errors,E.meta);let v={};if(c!==void 0&&(v.roles=c),o!==void 0&&(v.perms=o),a!==void 0&&(v.authPerm=a),Object.keys(v).length>0){let b=await l.tenantMembers.updatePermissions(r,n,v);if(!b.ok)return u(b.errors,b.meta)}return g(void 0)}var ta={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:V.DATABASE_ERROR};async function bd(t,e){let{tenantId:r,userId:n,actorUserId:i,status:s}=t,o=e.plugins.database,a=await ut({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:o.tenantMembers});if(!a.ok)return u(a.errors,a.meta);if(i===n)return u(ta.CANNOT_MODIFY_SELF());let c=await o.tenantMembers.get(r,n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(ta.MEMBER_NOT_FOUND());if(c.data.isOwner)return u(ta.CANNOT_MODIFY_OWNER());let l=await o.tenantMembers.updateStatus(r,n,s);return l.ok?g(void 0):u(l.errors,l.meta)}var sl={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:T("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:V.DATABASE_ERROR};async function ks(t,e){let{tenantId:r,userId:n,...i}=t,s=e.plugins.database,o=await s.tenantMembers.get(r,n);if(!o.ok)return u(o.errors,o.meta);if(!o.data)return u(sl.MEMBER_NOT_FOUND());let a=o.data,c=a.isOwner||Zo(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let d=await s.userTenantProfiles.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(!d.data){let m=await s.userTenantProfiles.create({tenantId:r,userId:n,...l});return m.ok?g(void 0):u(m.errors,m.meta)}let p=await s.userTenantProfiles.update(r,n,l);return p.ok?g(void 0):u(p.errors,p.meta)}var gx=10080,vx=100;function Ax(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??gx,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??vx}}}var $r=H({tenantId:Ne(h(),td(1))}),Tx=H({limit:_(Ne(ge(),ls(Number),$e(),Nn(),cs(1),as(100))),cursor:_(h())}),Ix=Ne(H({inviteeEmail:_(Ne(h(),rn())),inviteeUserId:_(h()),inviteePhone:_(h()),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),kc(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),JE=Ne(H({inviteId:_(h()),inviteToken:_(h())}),kc(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),_x=H({inviteId:h()}),xx=H({status:_(h()),limit:_(Ne(ge(),ls(Number),$e(),Nn(),cs(1),as(100))),cursor:_(h())}),bx=H({userId:h(),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h()))}),Sx=H({userId:h()}),wx=H({contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))});function YE(t){let{auth:e,policy:r}=t,n=Y(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r},handler:async E=>{let v=await yi({tenantId:E.params.tenantId,userId:E.user.id},e);if(!v.ok)return v;let b=v.data;if(!b)return g({});let{authPerm:k,...C}=b;return g({...C,authPerms:Qt(k)})}}),i=Y(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:wx},handler:async E=>{let v=E.params.tenantId,b=E.user.id,k={tenantId:v,userId:b},C=E.body;C.contactEmail!==void 0&&(k.contactEmail=C.contactEmail),C.contactPhone!==void 0&&(k.contactPhone=C.contactPhone),C.displayName!==void 0&&(k.displayName=C.displayName),C.givenName!==void 0&&(k.givenName=C.givenName),C.familyName!==void 0&&(k.familyName=C.familyName),C.avatarUrl!==void 0&&(k.avatarUrl=C.avatarUrl),C.locale!==void 0&&(k.locale=C.locale),C.bio!==void 0&&(k.bio=C.bio),C.jobTitle!==void 0&&(k.jobTitle=C.jobTitle),C.metadata!==void 0&&(k.metadata=C.metadata);let L=await ks(k,e);if(!L.ok)return L;let B=await yi({tenantId:v,userId:b},e);if(!B.ok)return B;let G=B.data;if(!G)return g({});let{authPerm:j,...$}=G;return g({...$,authPerms:Qt(j)})}}),s=Y(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Ix},handler:async E=>{let{inviteeEmail:v,inviteeUserId:b,inviteePhone:k,role:C,roles:L,authPerms:B,displayName:G,givenName:j,familyName:$,jobTitle:te}=E.body,A={tenantId:E.params.tenantId,invitedBy:E.user.id};return v!==void 0&&(A.inviteeEmail=v),b!==void 0&&(A.inviteeUserId=b),k!==void 0&&(A.inviteePhone=k),C!==void 0&&(A.role=C),L!==void 0&&(A.roles=L),B!==void 0&&(A.authPerm=Ln(B)),G!==void 0&&(A.displayName=G),j!==void 0&&(A.givenName=j),$!==void 0&&(A.familyName=$),te!==void 0&&(A.jobTitle=te),bs(A,Ax(t))}}),o=Y(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:xx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.status!==void 0&&(v.status=E.query.status),E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ss(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g(k,b.meta)}}),a=Y(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:JE},handler:async E=>{let v={userId:E.user.id};E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken);let b=await Is(v,e);if(!b.ok)return b;let k=b.data;if(!k)return b;let{authPerm:C,...L}=k;return g({...L,authPerms:Qt(C)})}}),c=Y(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:JE},handler:async E=>{let v={userId:E.user.id};return E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken),xs(v,e)}}),l=Y(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:_x},handler:async E=>Rs({inviteId:E.body.inviteId,revokedBy:E.user.id},e)}),d=Y(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Tx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await ws(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g({members:k},b.meta)}}),p=Y(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:bx},handler:async E=>{let v={tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id};return E.body.role!==void 0&&(v.role=E.body.role),E.body.roles!==void 0&&(v.roles=E.body.roles),E.body.authPerms!==void 0&&(v.authPerm=Ln(E.body.authPerms)),Os(v,e)}}),m=Y(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Sx},handler:async E=>Ns({tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id},e)});return ed("/tenants",[n,i,s,o,a,c,l,d,p,m])}function XE(t){return Y(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Do.updateProfile.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Zc(n,r)}})}function ol(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function QE(t){return Ke(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:ui.resendVerification.body},handler:async e=>{let r=ol(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),fs(n,r)}})}function ZE(t){return Y(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:ui.verifyCode.body},handler:async e=>{let r=ol(t.auth);return hs({challengeId:e.body.challengeId,code:e.body.code},r)}})}var Sd="oauth_state",Nx=600;function ey(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function ty(t,e,r){qo(t,Sd,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:Nx})}function Rx(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function ry(t,e){let r=Id(t,Sd);return jo(t,Sd,{path:"/"}),!r||!e?!1:Rx(r,e)}function Ox(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function kx(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function ny(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:s=[]}=e;return async(o,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=Ox(o),d=await kx(o,s),p=[`${i}:ip:${l}`];d&&p.push(`${i}:id:${d}`);for(let m of p){let E=await c.consume(m,{limit:r,windowMs:n});if(!E.allowed){let v=Math.ceil(E.retryAfterMs/1e3);return o.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(v)})}}return a()}}function Ue(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function iy(t,e,r={}){let n=Object.keys(r).length===0,i=o=>n||r[o]!==!1;t.get("/health",o=>o.json({ok:!0},200));let s=(o,a)=>t.use(o,ny(e.auth,a));if(s("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),s("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),s("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),s("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),s("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),s("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),s("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),s("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),s("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Ue(t,mE(e)),Ue(t,TE(e)),Ue(t,gE(e)),Ue(t,AE(e)),Ue(t,vE(e)),Ue(t,IE(e)),Ue(t,hE(e)),Ue(t,EE(e)),Ue(t,yE(e))),i("password")&&(Ue(t,HE(e)),Ue(t,FE(e)),Ue(t,VE(e))),i("verification")&&(Ue(t,ZE(e)),Ue(t,QE(e))),i("sessions")&&(Ue(t,$E(e)),Ue(t,GE(e)),Ue(t,WE(e))),i("mfa")&&(Ue(t,CE(e)),Ue(t,PE(e)),Ue(t,OE(e)),Ue(t,kE(e)),Ue(t,DE(e))),i("oauth")){let o=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=ey();return ty(a,c,o),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let d=await a.req.raw.clone().json();typeof d.state=="string"&&(l=d.state)}catch{l=void 0}return l!==void 0&&!ry(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Ue(t,ME(e)),Ue(t,LE(e)),Ue(t,KE(e)),Ue(t,UE(e))}i("users")&&Ue(t,XE(e)),i("tenants")&&t.route("",YE(e))}function wd(t){Qu(Lh);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:s,features:o}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),s&&s.length>0&&(a.trustedOrigins=s);let c=e.security.tokenAudiences?.cookieNames;if(c){let d={cookieNames:c};e.security.systemTenantId&&(d.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=d}let l=new Vr;return iy(l,a,o),l}async function Kn(t,e,r,n){let i=await ut({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return u(i.errors,i.meta);let s=await n.tenants.get(e);return s.ok?s.data?s.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g({actor:i.data}):u(kt.TENANT_NOT_FOUND()):u(s.errors,s.meta)}var fn={CANNOT_REMOVE_ACTIVE_ACCOUNT:T("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:T("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:T("NO_CHANGES","At least one field must be provided")};var Cx=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function Nd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=t.status??"active",s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let o=await r.users.getByStatus(i,s);if(!o.ok)return u(o.errors,o.meta);let a=[];for(let c of o.data){let l=await r.users.getById(c);if(l.ok&&l.data){let d=l.data,p={id:d.id,status:d.status,createdAt:d.createdAt,updatedAt:d.updatedAt};d.contactEmail!==void 0&&(p.contactEmail=d.contactEmail),d.contactPhone!==void 0&&(p.contactPhone=d.contactPhone),d.displayName!==void 0&&(p.displayName=d.displayName),a.push(p)}}return g(a,o.meta)}async function Rd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return u(i.errors,i.meta);if(!i.data)return u(V.NOT_FOUND());let s=i.data,o=await r.userAuths.get(t.userId),a={id:s.id,status:s.status,createdAt:s.createdAt,updatedAt:s.updatedAt,mfaRequired:o.ok&&o.data?o.data.mfaRequired:!1,mfaMethods:o.ok&&o.data?o.data.mfaMethods:null};return s.contactEmail!==void 0&&(a.contactEmail=s.contactEmail),s.contactPhone!==void 0&&(a.contactPhone=s.contactPhone),s.displayName!==void 0&&(a.displayName=s.displayName),s.givenName!==void 0&&(a.givenName=s.givenName),s.familyName!==void 0&&(a.familyName=s.familyName),s.avatarUrl!==void 0&&(a.avatarUrl=s.avatarUrl),s.locale!==void 0&&(a.locale=s.locale),s.username!==void 0&&(a.username=s.username),s.metadata!==void 0&&(a.metadata=s.metadata),g(a)}async function Od(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return u(fn.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?g(void 0):u(c.errors,c.meta)}async function kd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);if(!Cx.has(t.status))return u(fn.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.userAuths.updateStatus(t.userId,t.status);if(!o.ok)return u(o.errors,o.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?g(void 0):u(a.errors,a.meta)}async function Cd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.credentials.getByUserId(t.userId);if(!o.ok)return u(o.errors,o.meta);for(let a of o.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return u(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return u(a.errors,a.meta)}return g(void 0)}async function Dd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(s.data.status===ye.ACTIVE)return u(fn.CANNOT_REMOVE_ACTIVE_ACCOUNT());let o=await r.credentials.getByUserId(t.userId);if(o.ok)for(let l of o.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?g(void 0):u(c.errors,c.meta)}var _r=H({message:_(h())}),sy=H({message:_(h()),tenantId:h(),userId:h()}),Pd={tenantId:h(),userId:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),displayNameSource:_(Xt(["user","admin","system"])),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))},oy=H({...Pd,status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),isOwner:It(),createdAt:h(),memberUpdatedAt:h(),profileUpdatedAt:_(h())}),Dx=H({...Pd,createdAt:h(),updatedAt:h()}),Px=H({tenantId:h(),userId:h(),status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),isOwner:It(),createdAt:h(),updatedAt:h(),tenantProfile:_(Dx)}),ay=Z(Px),cy=H({tenantId:h(),userId:h()}),Ux=H({...Pd,status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerm:_($e()),isOwner:It(),createdAt:h(),updatedAt:h()}),ly=Z(Ux),Lx=H({id:h(),name:_(h()),email:_(h()),jobTitle:_(h())}),uy=H({id:h(),tenantId:h(),invitedBy:Lx,inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h()),status:h(),expiresAt:h(),createdAt:h(),updatedAt:h()}),dy=Z(uy),py=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),fy=H({tenantId:h(),userId:h()}),my=H({invites:Z(uy)}),Mx=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),status:h(),createdAt:h(),updatedAt:h()}),hy=Z(Mx),Ey=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),status:h(),createdAt:h(),updatedAt:h(),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),username:_(h()),metadata:_(me(h(),ge())),mfaRequired:It(),mfaMethods:ci(Z(h()))});var al={limit:_(Ne($e(),Nn())),cursor:_(h())},Kx={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:H({tenantId:h(),userId:h(),tenantType:_(h()),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),displayNameSource:_(Xt(["user","admin","system"])),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))}),response:sy},Hx={method:"POST",path:"/tenant/profile",kind:"data",body:H({tenantId:h(),userId:h()}),response:oy},Fx={method:"POST",path:"/tenant/profile/update",kind:"data",body:H({tenantId:h(),userId:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))}),response:_r},Vx={method:"POST",path:"/tenant/members/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),...al}),response:ay},Bx={method:"POST",path:"/tenant/members/update-status",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),status:Xt(["invited","active","suspended","removed"])}),response:_r},qx={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h()))}),response:_r},jx={method:"POST",path:"/tenant/members/remove",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h()}),response:_r},Gx={method:"POST",path:"/tenant/members/add",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h())),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))}),response:cy},$x={method:"POST",path:"/tenant/invites/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),status:_(Xt(["pending","accepted","declined","revoked","expired"])),...al}),response:dy},Wx={method:"POST",path:"/tenant/invites/create",kind:"data",body:H({tenantId:h(),invitedBy:h(),inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),response:py},gy=H({userId:h(),inviteId:_(h()),inviteToken:_(h())}),zx={method:"POST",path:"/tenant/invites/accept",kind:"data",body:gy,response:fy},Jx={method:"POST",path:"/tenant/invites/decline",kind:"data",body:gy,response:_r},Yx={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:H({inviteId:h(),revokedBy:h()}),response:_r},Xx={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:H({email:_(h()),phone:_(h())}),response:my},Qx={method:"POST",path:"/user/tenants/list",kind:"data",body:H({userId:h(),tenantType:_(h()),parentTenantId:_(h()),...al}),response:ly},Cs={actorUserId:h(),systemTenantId:h()},Zx={method:"POST",path:"/accounts/list",kind:"data",body:H({...Cs,status:_(Xt(["active","inactive"])),...al}),response:hy},eb={method:"POST",path:"/accounts/get",kind:"data",body:H({...Cs,userId:h()}),response:Ey},tb={method:"POST",path:"/accounts/update-profile",kind:"data",body:H({...Cs,userId:h(),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),contactEmail:_(h()),contactPhone:_(h()),metadata:_(me(h(),ge()))}),response:_r},rb={method:"POST",path:"/accounts/update-status",kind:"data",body:H({...Cs,userId:h(),status:Xt(["active","suspended","deleted"])}),response:_r},nb={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:H({...Cs,userId:h(),credentialType:_(h())}),response:_r},ib={method:"POST",path:"/accounts/remove",kind:"data",body:H({...Cs,userId:h()}),response:_r},Je={bootstrapTenantOwner:Kx,getTenantProfile:Hx,updateTenantProfile:Fx,listTenantMembers:Vx,updateTenantMemberStatus:Bx,updateTenantMemberPermission:qx,removeTenantMember:jx,addMemberToTenant:Gx,listTenantInvites:$x,inviteToTenant:Wx,acceptInvite:zx,declineInvite:Jx,revokeInvite:Yx,checkPendingInvites:Xx,listUserTenants:Qx,listAccounts:Zx,getAccount:eb,updateAccountProfile:tb,updateAccountStatus:rb,resetAccountCredentials:nb,removeAccount:ib};var sb=3,ob=10080,ab=100;function cb(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??ob,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??ab}}}function Ds(t){return{plugins:{database:t.plugins.database}}}function lb(t){return Yu({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Ud(t){let{auth:e,internal:r}=t,n=lb(r),i=new Vr;i.use("/*",async(y,I)=>{let N=y.req.header("Authorization");if(!N){await I();return}let R=N.match(/^Bearer\s+(.+)$/i);if(!R){await I();return}let O=R[1].split(".");if(O.length!==3||!O[1]){await I();return}let P;try{let U=O[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(U))}catch{await I();return}if(P.typ!==sb)return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let U=P.roles,K=Array.isArray(U)?U:[];if(!r.requiredRoles.some(J=>K.includes(J)))return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let s=Y(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId};return y.body.tenantType!==void 0&&(I.tenantType=y.body.tenantType),y.body.contactEmail!==void 0&&(I.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(I.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.displayNameSource!==void 0&&(I.displayNameSource=y.body.displayNameSource),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(I.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(I.locale=y.body.locale),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(I.bio=y.body.bio),y.body.metadata!==void 0&&(I.metadata=y.body.metadata),rl(I,e)}}),o=Y(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async y=>{let I=await yi({tenantId:y.body.tenantId,userId:y.body.userId},e);if(!I.ok)return I;let N=I.data;if(!N)return I;let{authPerm:R,...w}=N;return g({...w,authPerms:Qt(R)})}}),a=Y(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async y=>{let{tenantId:I,userId:N,...R}=y.body,w={tenantId:I,userId:N};return R.contactEmail!==void 0&&(w.contactEmail=R.contactEmail),R.contactPhone!==void 0&&(w.contactPhone=R.contactPhone),R.displayName!==void 0&&(w.displayName=R.displayName),R.givenName!==void 0&&(w.givenName=R.givenName),R.familyName!==void 0&&(w.familyName=R.familyName),R.avatarUrl!==void 0&&(w.avatarUrl=R.avatarUrl),R.locale!==void 0&&(w.locale=R.locale),R.bio!==void 0&&(w.bio=R.bio),R.jobTitle!==void 0&&(w.jobTitle=R.jobTitle),R.metadata!==void 0&&(w.metadata=R.metadata),ks(w,e)}}),c=Y(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async y=>{let I={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let N=await ws(I,e);if(!N.ok)return N;let R=N.data.map(({authPerm:w,...O})=>({...O,authPerms:Qt(w)}));return g(R,N.meta)}}),l=Y(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async y=>bd({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId,status:y.body.status},e)}),d=Y(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),Os(I,e)}}),p=Y(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async y=>Ns({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId},e)}),m=Y(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),y.body.contactEmail!==void 0&&(I.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(I.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(I.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(I.locale=y.body.locale),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(I.bio=y.body.bio),y.body.metadata!==void 0&&(I.metadata=y.body.metadata),tl(I,e)}}),E=Y(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async y=>{let I={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.status!==void 0&&(I.status=y.body.status),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let N=await Ss(I,e);if(!N.ok)return N;let R=N.data.map(({authPerm:w,...O})=>({...O,authPerms:Qt(w)}));return g(R,N.meta)}}),v=Y(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async y=>{let I={tenantId:y.body.tenantId,invitedBy:y.body.invitedBy};return y.body.inviteeUserId!==void 0&&(I.inviteeUserId=y.body.inviteeUserId),y.body.inviteeEmail!==void 0&&(I.inviteeEmail=y.body.inviteeEmail),y.body.inviteePhone!==void 0&&(I.inviteePhone=y.body.inviteePhone),y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),bs(I,cb(e))}}),b=Y(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async y=>{let I={userId:y.body.userId};y.body.inviteId!==void 0&&(I.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(I.inviteToken=y.body.inviteToken);let N=await Is(I,e);if(!N.ok)return N;let R=N.data;if(!R)return N;let{authPerm:w,...O}=R;return g({...O,authPerms:Qt(w)})}}),k=Y(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async y=>{let I={userId:y.body.userId};return y.body.inviteId!==void 0&&(I.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(I.inviteToken=y.body.inviteToken),xs(I,e)}}),C=Y(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async y=>Rs({inviteId:y.body.inviteId,revokedBy:y.body.revokedBy},e)}),L=Y(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async y=>{let I={};return y.body.email!==void 0&&(I.email=y.body.email),y.body.phone!==void 0&&(I.phone=y.body.phone),nl(I,e)}}),B=Y(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async y=>{let I={userId:y.body.userId};y.body.tenantType!==void 0&&(I.tenantType=y.body.tenantType),y.body.parentTenantId!==void 0&&(I.parentTenantId=y.body.parentTenantId),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let N=await il(I,e);if(!N.ok)return N;let R=N.data.map(({authPerm:w,...O})=>({...O,authPerms:Qt(w)}));return g(R,N.meta)}}),G=Y(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async y=>{let I={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId};return y.body.status!==void 0&&(I.status=y.body.status),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor),Nd(I,Ds(e))}}),j=Y(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async y=>Rd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))}),$=Y(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async y=>{let{actorUserId:I,systemTenantId:N,userId:R,...w}=y.body,O={actorUserId:I,systemTenantId:N,userId:R};return w.displayName!==void 0&&(O.displayName=w.displayName),w.givenName!==void 0&&(O.givenName=w.givenName),w.familyName!==void 0&&(O.familyName=w.familyName),w.avatarUrl!==void 0&&(O.avatarUrl=w.avatarUrl),w.locale!==void 0&&(O.locale=w.locale),w.contactEmail!==void 0&&(O.contactEmail=w.contactEmail),w.contactPhone!==void 0&&(O.contactPhone=w.contactPhone),w.metadata!==void 0&&(O.metadata=w.metadata),Od(O,Ds(e))}}),te=Y(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async y=>kd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId,status:y.body.status},Ds(e))}),A=Y(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async y=>{let I={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId};return y.body.credentialType!==void 0&&(I.credentialType=y.body.credentialType),Cd(I,Ds(e))}}),x=Y(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async y=>Dd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))});function S(y){let{method:I,path:N}=y.routeMeta,R=I.toLowerCase();i[R](N,y)}return S(s),S(o),S(a),S(c),S(l),S(d),S(p),S(m),S(E),S(v),S(b),S(k),S(C),S(L),S(B),S(G),S(j),S($),S(te),S(A),S(x),i}var vy=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},Ay=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,s=e.length-1;i<=n;i++,s--)r[i]=e.charCodeAt(i),r[s]=e.charCodeAt(s);return r};function ra(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var ub=t=>t.requestContext;var Ld=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=vb(r),s,o;try{s=i.createRequest(r),o=ub(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(s,{event:r,requestContext:o,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},cl=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=this.getDomainName(t),n=this.getPath(t),i=`https://${r}${n}`,s=e?`${i}?${e}`:i,o=this.getHeaders(t),a=this.getMethod(t),c={headers:o,method:a};if(t.body){let l=t.isBase64Encoded?Ay(t.body):new TextEncoder().encode(t.body);c.body=l,o.set("content-length",l.length.toString())}return new Request(s,c)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??Ty,s=!!(n&&i(n));if(!s){let c=e.headers.get("content-encoding");s=_b(c)}let a={body:s?vy(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:s,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,a),a.multiValueHeaders?e.headers.forEach((c,l)=>{a.multiValueHeaders[l]=[c]}):e.headers.forEach((c,l)=>{a.headers[l]=c}),a}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},db=class extends cl{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},pb=new db,fb=class extends cl{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,ra(n));if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},mb=new fb,hb=class extends cl{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=ra(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,ra(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},Eb=new hb,yb=class extends cl{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers){for(let[r,n]of Object.entries(t.headers))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},gb=new yb,vb=t=>Ab(t)?Eb:Tb(t)?pb:Ib(t)?gb:mb,Ab=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,Tb=t=>Object.hasOwn(t,"rawPath"),Ib=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,Ty=t=>!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(t),_b=t=>t===null?!1:/^(gzip|deflate|compress|br)/.test(t);var Iy=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...t},r=(i=>typeof i=="string"?i==="*"?()=>i:s=>i===s?s:null:typeof i=="function"?i:s=>i.includes(s)?s:null)(e.origin),n=(i=>typeof i=="function"?i:Array.isArray(i)?()=>i:()=>[])(e.allowMethods);return async function(s,o){function a(l,d){s.res.headers.set(l,d)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),e.credentials&&a("Access-Control-Allow-Credentials","true"),e.exposeHeaders?.length&&a("Access-Control-Expose-Headers",e.exposeHeaders.join(",")),s.req.method==="OPTIONS"){e.origin!=="*"&&a("Vary","Origin"),e.maxAge!=null&&a("Access-Control-Max-Age",e.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let d=e.allowHeaders;if(!d?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(d=p.split(/\s*,\s*/))}return d?.length&&(a("Access-Control-Allow-Headers",d.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await o(),e.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};var xb={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function vi(t={}){let e={...xb,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var Md={LOW:vi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:vi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:vi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:vi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var _y={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function Kd(t,e={}){return{system:t,policy:{..._y.policy,...e.policy??{}},version:e.version??_y.version,...e.email&&{email:e.email}}}var xy=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],by=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],Hd=[...xy,...by];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function Sy(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function wy(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Ny={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function Ry(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",s=typeof r.parseUserAgent=="function";if(!i&&!s)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Ny[e];n&&wy(t,String(e),n)}function Fd(t,e){Sy(t,String(e)),Ry(t,e)}var Oy={debug:0,info:1,warn:2,error:3},ll=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=Oy[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&Oy[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),s=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${s} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function ky(t){return new ll(t)}var ul=new ll({enabled:!1});function Ps(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Ai(t,e){let r=Ps(t),n=Ps(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Cy(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Ai(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&Ai(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Ai(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Ai(t,e.slice(2))>=0:e.startsWith(">")?Ai(t,e.slice(1))>0:e.startsWith("<=")?Ai(t,e.slice(2))<=0:e.startsWith("<")?Ai(t,e.slice(1))<0:!1}function bb(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function Sb(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function Us(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())Vd(n,i);return t}let e=[];if(bb(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,s]=n;Vd(i,s),r.set(i,s)}return r}function Vd(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");Sb(t,e)}function Bd(t,e){Vd(t,e)}function dl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function pl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function qd(t,e={},r,n=ul,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let s=new Map;for(let v of t)s.set(v.name,v);let o=new Map,a=new Map;for(let v of s.keys())o.set(v,0),a.set(v,[]);for(let v of s.values()){let b=v.dependencies??[];for(let k of b){let C=typeof k=="string"?k:k.name,L=typeof k=="string"?void 0:k.version;if(!s.has(C))throw new Error(`Plugin '${String(v.name)}' depends on '${String(C)}' which is not defined`);if(L){let B=s.get(C);if(B.version&&!Cy(B.version,L))throw new Error(`Plugin '${String(v.name)}' requires '${String(C)}' ${L}, but version ${B.version} is provided`)}a.get(C).push(v.name),o.set(v.name,(o.get(v.name)??0)+1)}}let c=[];for(let[v,b]of o.entries())b===0&&c.push(v);let l=[];for(;c.length>0;){let v=c.shift();l.push(v);for(let b of a.get(v)??[]){let k=(o.get(b)??0)-1;o.set(b,k),k===0&&c.push(b)}}if(l.length!==s.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let d={},p={get(v){if(!d[v])throw new Error(`Plugin '${String(v)}' not found or not yet initialized`);return d[v]},has(v){return v in d},getRegistry(){return d}};for(let v of l){n.group(`Initializing plugin: ${String(v)}`),n.time(`Plugin: ${String(v)}`);let b=s.get(v),k=e[v],C=null;if(k!==void 0?(n.debug("Using override"),dl(k)?(n.debug("Creating from factory wrapper"),C=await k.create(p)):pl(k)?(n.debug("Lazy loading plugin"),C=await k.load()):(n.debug("Using direct instance"),C=k)):b.factory?(n.debug("Creating from descriptor factory"),C=await b.factory(p)):b.instance&&(n.debug("Using descriptor instance"),C=b.instance),!C&&b.required)throw new Error(`Required plugin '${String(v)}' is missing`);if(C){if(v==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Fd(C,v),n.debug("Validation passed")}catch(G){throw n.error("Validation failed:",G),new Error(`Plugin '${String(v)}' validation failed: ${G instanceof Error?G.message:String(G)}`)}}d[v]=C;let B=C;B.initialize&&(n.debug("Calling plugin initialize()"),await B.initialize()),n.info(`Plugin '${String(v)}' initialized successfully`)}else n.warn(`Plugin '${String(v)}' is null/undefined`);n.timeEnd(`Plugin: ${String(v)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),d.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),d.credential=e.credential),i.extraEntries&&Object.assign(d,i.extraEntries),!wb(d))throw new Error("Plugin registry is incomplete - missing required plugins");let m=d,E=Us(m.oauthProviders);if(!E){let v=e.oauthProviders;v!==void 0&&!dl(v)&&!pl(v)?E=Us(v)??new Map:E=new Map}return m.oauthProviders=E,await r?.afterInit?.(m),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),m}function wb(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function jd(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function na(t){let e=t.debug?ky({enabled:!0,prefix:"[auth-core SDK]"}):ul;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=Us(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await qd(Hd,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let s=vi(t.security??{});e.debug("Security level:",s.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let o=Kd({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",o.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:s,system:o,async healthCheck(){let a=[];for(let[l,d]of Object.entries(i)){if(!d||typeof d!="object")continue;let p=d,m={name:String(l),healthy:!0};if(p.health)try{let E=await p.health();m.healthy=E,E||(m.error=`Plugin '${l}' health check failed`)}catch(E){m.healthy=!1,m.error=E instanceof Error?E.message:"Health check threw error"}a.push(m)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await jd(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Bd(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var fl=[];function ia(t){let e=process.env[t];return e||(fl.push(t),"")}function Gd(t,e){return e?ia(t):process.env[t]??""}function Dy(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function kb(t){let e=Dy(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var Cb=process.env.SMTP_MODE==="smtp"?"smtp":"console",Ti=process.env.EMAIL_MODE;if(Ti&&Ti!=="queue"&&Ti!=="smtp"&&Ti!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Ti}`);var Ls=Ti||Cb,Db=Ls==="console"?"console":"smtp",$d=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",ml=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(Ls==="queue"&&$d!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${$d}`);if(ml!=="generic"&&ml!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${ml}`);var F={dynamodbTableName:ia("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:ia("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:ia("JWT_PRIVATE_KEY"),jwtPublicKey:ia("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:Gd("SMTP_USER",Ls==="smtp"),pass:Gd("SMTP_PASS",Ls==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Db},email:{mode:Ls,queue:{provider:$d,url:Gd("EMAIL_QUEUE_URL",Ls==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:ml,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:kb("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Dy("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:process.env.REFRESH_TOKEN_STRATEGY||"cookie",...process.env.REFRESH_TOKEN_STRATEGY==="cookie"||process.env.REFRESH_TOKEN_STRATEGY==="both"||!process.env.REFRESH_TOKEN_STRATEGY?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__"},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function Py(){if(fl.length>0){let t=fl.map(e=>` - ${e}`).join(`
61
- `);throw new Error(`Missing required environment variables (${fl.length}):
62
- ${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Wd(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Pb(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function hl(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Pb(r)}async function zd(t,e){let r=await hl(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Ub="otp",Uy={INVALID_CODE:T("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:T("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Lb(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Ly(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Ub,challengeType:"verification-code",async create(){return g({value:"",data:null})},async update(){return g({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let o=Wd(e),a=await hl(o),c=new Date(Date.now()+r*60*1e3);return g({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:o,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Lb(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await zd(n.credentialValue,i)?g({userId:n.userId,intents:[]}):u(Uy.INVALID_CODE()):u(Uy.MISSING_CHALLENGE_CONTEXT())}}}function Mb(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}function yt(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(`${r}expected number, got ${typeof t}`)}if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new RangeError(`${r}expected integer >= 0, got ${t}`)}}function mn(t,e,r=""){let n=Mb(t),i=t?.length,s=e!==void 0;if(!n||s&&i!==e){let o=r&&`"${r}" `,a=s?` of length ${e}`:"",c=n?`length=${i}`:`type=${typeof t}`,l=o+"expected Uint8Array"+a+", got "+c;throw n?new RangeError(l):new TypeError(l)}return t}function El(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("Hash must wrapped by utils.createHasher");if(yt(t.outputLen),yt(t.blockLen),t.outputLen<1)throw new Error('"outputLen" must be >= 1');if(t.blockLen<1)throw new Error('"blockLen" must be >= 1')}function hn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Ms(t,e){mn(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new RangeError('"digestInto() output" expected to be of length >='+r)}function Ks(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function jt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Hs(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function xr(t,e){return t<<32-e|t>>>e}function xe(t,e){return t<<e|t>>>32-e>>>0}var Kb=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function Hb(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Fb(t){for(let e=0;e<t.length;e++)t[e]=Hb(t[e]);return t}var Fs=Kb?t=>t:Fb;function Vb(t){if(typeof t!="string")throw new TypeError("string expected");return new Uint8Array(new TextEncoder().encode(t))}function Jd(t,e=""){return typeof t=="string"?Vb(t):mn(t,void 0,e)}function yl(t,e){if(e!==void 0&&{}.toString.call(e)!=="[object Object]")throw new TypeError("options must be object or undefined");return Object.assign(t,e)}function gl(t,e={}){let r=(i,s)=>t(s).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function Yd(t=32){yt(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var vl=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var Al=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(El(e),mn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<i.length;s++)i[s]^=54;this.iHash.update(i),this.oHash=e.create();for(let s=0;s<i.length;s++)i[s]^=106;this.oHash.update(i),jt(i)}update(e){return hn(this),this.iHash.update(e),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:s,blockLen:o,outputLen:a}=this;return e=e,e.finished=i,e.destroyed=s,e.blockLen=o,e.outputLen=a,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},My=(()=>{let t=((e,r,n)=>new Al(e,r).update(n).digest());return t.create=(e,r)=>new Al(e,r),t})();function qb(t,e,r,n){El(t);let i=yl({dkLen:32,asyncTick:10},n),{c:s,dkLen:o,asyncTick:a}=i;if(yt(s,"c"),yt(o,"dkLen"),yt(a,"asyncTick"),s<1)throw new Error("iterations (c) must be >= 1");if(o<1)throw new Error('"dkLen" must be >= 1');if(o>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Jd(e,"password"),l=Jd(r,"salt"),d=new Uint8Array(o),p=My.create(t,c),m=p._cloneInto().update(l);return{c:s,dkLen:o,asyncTick:a,DK:d,PRF:p,PRFSalt:m}}function jb(t,e,r,n,i){return t.destroy(),e.destroy(),n&&n.destroy(),jt(i),r}function Xd(t,e,r,n){let{c:i,dkLen:s,DK:o,PRF:a,PRFSalt:c}=qb(t,e,r,n),l,d=new Uint8Array(4),p=Hs(d),m=new Uint8Array(a.outputLen);for(let E=1,v=0;v<s;E++,v+=a.outputLen){let b=o.subarray(v,v+a.outputLen);p.setInt32(0,E,!1),(l=c._cloneInto(l)).update(d).digestInto(m),b.set(m.subarray(0,b.length));for(let k=1;k<i;k++){a._cloneInto(l).update(m).digestInto(m);for(let C=0;C<b.length;C++)b[C]^=m[C]}}return jb(a,c,o,l,m)}function Ky(t,e,r){return t&e^~t&r}function Hy(t,e,r){return t&e^t&r^e&r}var Tl=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=Hs(this.buffer)}update(e){hn(this),mn(e);let{view:r,buffer:n,blockLen:i}=this,s=e.length;for(let o=0;o<s;){let a=Math.min(i-this.pos,s-o);if(a===i){let c=Hs(e);for(;i<=s-o;o+=i)this.process(c,o);continue}n.set(e.subarray(o,o+a),this.pos),this.pos+=a,o+=a,this.pos===i&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:s}=this,{pos:o}=this;r[o++]=128,jt(this.buffer.subarray(o)),this.padOffset>i-o&&(this.process(n,0),o=0);for(let p=o;p<i;p++)r[p]=0;n.setBigUint64(i-8,BigInt(this.length*8),s),this.process(n,0);let a=Hs(e),c=this.outputLen;if(c%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let l=c/4,d=this.get();if(l>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<l;p++)a.setUint32(4*p,d[p],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||=new this.constructor,e.set(...this.get());let{blockLen:r,buffer:n,length:i,finished:s,destroyed:o,pos:a}=this;return e.destroyed=o,e.finished=s,e.length=i,e.pos=a,i%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},En=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Il=BigInt(4294967295),Fy=BigInt(32);function Gb(t,e=!1){return e?{h:Number(t&Il),l:Number(t>>Fy&Il)}:{h:Number(t>>Fy&Il)|0,l:Number(t&Il)|0}}function Vy(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let s=0;s<r;s++){let{h:o,l:a}=Gb(t[s],e);[n[s],i[s]]=[o,a]}return[n,i]}var By=(t,e,r)=>t<<r|e>>>32-r,qy=(t,e,r)=>e<<r|t>>>32-r,jy=(t,e,r)=>e<<r-32|t>>>64-r,Gy=(t,e,r)=>t<<r-32|e>>>64-r;var $b=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Hn=new Uint32Array(64),Qd=class extends Tl{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:i,E:s,F:o,G:a,H:c}=this;return[e,r,n,i,s,o,a,c]}set(e,r,n,i,s,o,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=s|0,this.F=o|0,this.G=a|0,this.H=c|0}process(e,r){for(let p=0;p<16;p++,r+=4)Hn[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let m=Hn[p-15],E=Hn[p-2],v=xr(m,7)^xr(m,18)^m>>>3,b=xr(E,17)^xr(E,19)^E>>>10;Hn[p]=b+Hn[p-7]+v+Hn[p-16]|0}let{A:n,B:i,C:s,D:o,E:a,F:c,G:l,H:d}=this;for(let p=0;p<64;p++){let m=xr(a,6)^xr(a,11)^xr(a,25),E=d+m+Ky(a,c,l)+$b[p]+Hn[p]|0,b=(xr(n,2)^xr(n,13)^xr(n,22))+Hy(n,i,s)|0;d=l,l=c,c=a,a=o+E|0,o=s,s=i,i=n,n=E+b|0}n=n+this.A|0,i=i+this.B|0,s=s+this.C|0,o=o+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,d=d+this.H|0,this.set(n,i,s,o,a,c,l,d)}roundClean(){jt(Hn)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),jt(this.buffer)}},Zd=class extends Qd{A=En[0]|0;B=En[1]|0;C=En[2]|0;D=En[3]|0;E=En[4]|0;F=En[5]|0;G=En[6]|0;H=En[7]|0;constructor(){super(32)}};var ep=gl(()=>new Zd,vl(1));function $y(t,e,r,n,i,s){let o=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],d=t[e++]^r[n++],p=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],b=t[e++]^r[n++],k=t[e++]^r[n++],C=t[e++]^r[n++],L=t[e++]^r[n++],B=t[e++]^r[n++],G=t[e++]^r[n++],j=t[e++]^r[n++],$=o,te=a,A=c,x=l,S=d,y=p,I=m,N=E,R=v,w=b,O=k,P=C,U=L,K=B,W=G,J=j;for(let de=0;de<8;de+=2)S^=xe($+U|0,7),R^=xe(S+$|0,9),U^=xe(R+S|0,13),$^=xe(U+R|0,18),w^=xe(y+te|0,7),K^=xe(w+y|0,9),te^=xe(K+w|0,13),y^=xe(te+K|0,18),W^=xe(O+I|0,7),A^=xe(W+O|0,9),I^=xe(A+W|0,13),O^=xe(I+A|0,18),x^=xe(J+P|0,7),N^=xe(x+J|0,9),P^=xe(N+x|0,13),J^=xe(P+N|0,18),te^=xe($+x|0,7),A^=xe(te+$|0,9),x^=xe(A+te|0,13),$^=xe(x+A|0,18),I^=xe(y+S|0,7),N^=xe(I+y|0,9),S^=xe(N+I|0,13),y^=xe(S+N|0,18),P^=xe(O+w|0,7),R^=xe(P+O|0,9),w^=xe(R+P|0,13),O^=xe(w+R|0,18),U^=xe(J+W|0,7),K^=xe(U+J|0,9),W^=xe(K+U|0,13),J^=xe(W+K|0,18);i[s++]=o+$|0,i[s++]=a+te|0,i[s++]=c+A|0,i[s++]=l+x|0,i[s++]=d+S|0,i[s++]=p+y|0,i[s++]=m+I|0,i[s++]=E+N|0,i[s++]=v+R|0,i[s++]=b+w|0,i[s++]=k+O|0,i[s++]=C+P|0,i[s++]=L+U|0,i[s++]=B+K|0,i[s++]=G+W|0,i[s++]=j+J|0}function tp(t,e,r,n,i){let s=n+0,o=n+16*i;for(let a=0;a<16;a++)r[o+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,s+=16,e+=16)$y(r,o,t,e,r,s),a>0&&(o+=16),$y(r,s,t,e+=16,r,o)}function Wb(t,e,r){let n=yl({dkLen:32,asyncTick:10,maxmem:1073742848},r),{N:i,r:s,p:o,dkLen:a,asyncTick:c,maxmem:l,onProgress:d}=n;if(yt(i,"N"),yt(s,"r"),yt(o,"p"),yt(a,"dkLen"),yt(c,"asyncTick"),yt(l,"maxmem"),d!==void 0&&typeof d!="function")throw new Error("progressCb must be a function");let p=128*s,m=p/4,E=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>E)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(o<1||o>(E-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(E-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let v=p*(i+o+1);if(v>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+v+", maxmem="+l);let b=Xd(ep,t,e,{c:1,dkLen:p*o}),k=Ks(b),C=Ks(new Uint8Array(p*i)),L=Ks(new Uint8Array(p)),B=()=>{};if(d){let G=2*i*o,j=Math.max(Math.floor(G/1e4),1),$=0;B=()=>{$++,d&&(!($%j)||$===G)&&d($/G)}}return{N:i,r:s,p:o,dkLen:a,blockSize32:m,V:C,B32:k,B:b,tmp:L,blockMixCb:B,asyncTick:c}}function zb(t,e,r,n,i){let s=Xd(ep,t,r,{c:1,dkLen:e});return jt(r,n,i),s}function _l(t,e,r){let{N:n,r:i,p:s,dkLen:o,blockSize32:a,V:c,B32:l,B:d,tmp:p,blockMixCb:m}=Wb(t,e,r);Fs(l);for(let E=0;E<s;E++){let v=a*E;for(let b=0;b<a;b++)c[b]=l[v+b];for(let b=0,k=0;b<n-1;b++)tp(c,k,c,k+=a,i),m();tp(c,(n-1)*a,l,v,i),m();for(let b=0;b<n;b++){let k=(l[v+a-16]&n-1)>>>0;for(let C=0;C<a;C++)p[C]=l[v+C]^c[k*a+C];tp(p,0,l,v,i),m()}}return Fs(l),zb(t,o,d,c,p)}var Jb={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Yb={N:2**14,r:8,p:1};function Wy(t,e,r){return`${t.N}.${t.r}.${t.p}.${zy(e)}.${zy(r)}`}function Xb(t){let e=t.split(".");if(e.length===5){let[r,n,i,s,o]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:xl(s),expected:xl(o)}}if(e.length===2){let[r,n]=e;return{params:Yb,salt:xl(r),expected:xl(n)}}return null}function zy(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function xl(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Jy(t={}){let e={...Jb,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=Yd(e.saltLength),s=await _l(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),o=Wy({N:e.N,r:e.r,p:e.p},i,s);return g({value:o,data:n.metadata??null})}catch(i){let s=i instanceof Error?i.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async update(n,i){if(!n.value)return g({});try{if(typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let s=Yd(e.saltLength),o=await _l(r.encode(n.value),s,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Wy({N:e.N,r:e.r,p:e.p},s,o);return g({value:a,...n.data&&{data:n.data}})}catch(s){let o=s instanceof Error?s.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async verify(n){try{if(!n.credential?.value)return u([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return u([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Xb(n.credential.value);if(!i)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:s,salt:o,expected:a}=i;if(o.length!==e.saltLength||a.length!==e.dkLen)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await _l(r.encode(n.credentialValue),o,{N:s.N,r:s.r,p:s.p,dkLen:e.dkLen});if(c.length!==a.length)return u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?g({userId:n.userId,credentialId:"password"}):u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),u([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var Xy=Of(Yy(),1);function Qy(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new Xy.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let s=r.browser.name??"",o=r.os.name??"";return{deviceName:i,browser:s,os:o,browserName:s,osName:o}}}}import{createHash as Qb}from"node:crypto";import{SendMessageCommand as Zb,SQSClient as eS}from"@aws-sdk/client-sqs";var tS={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Sl=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new eS(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Zb({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:rS(n)})}return g(void 0)}catch(r){return u({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},s=this.config.eventTypeMap?.[e.template]??tS[e.template]??e.template,o=Ii(i.eventId)??Ii(i.challengeId)??crypto.randomUUID(),a=n?`${o}:${nS(r)}`:o,c=Ii(i.locale),l=Ii(i.traceId)??a,d=iS(this.config.defaultMetadata,i),p=sS(i);if(this.config.envelope==="snapshot-auth-v1"){let m=Ii(d?.tenantId),E=Ii(d?.tenantType),v=Ii(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:s,to:r,...v?{userId:v}:{},...m?{tenantId:m}:{},...E?{tenantType:E}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:s,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...d?{metadata:d}:{},data:p}}};function Ii(t){return typeof t=="string"&&t.length>0?t:void 0}function rS(t){return t.split("@")[1]||"(unknown)"}function nS(t){return Qb("sha256").update(t).digest("hex").slice(0,16)}function iS(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function sS(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var oa=class t{static createAwsSqs(e){return new Sl(e)}static create(e){return t.createAwsSqs(e.sqs)}};var zv=Of(Wv(),1);var Dl=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=zv.default.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,s;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),s=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),s=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",s=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",s=r.text||""}let o={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:s,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(o),g(void 0)}catch(r){return u({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
60
+ `)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function zn(){return new qa}function Uf(t,e){return t?.[e]??t?.["*"]??0}var uT="AUTH_INVALID_CREDENTIALS",ja=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[tr.JWT,tr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return u($t({message:"No auth methods configured"}));for(let i of n){let s=this.methods.get(i);if(!s)continue;let o=await s.authenticate(r);if(o.ok)return g({user:o.data,method:i});if(!o.errors||o.errors.length===0)continue;let a=o.errors[0];if(a?.code===uT)return u(a)}return u($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Jn(t,e={}){return new ja(t,e)}var Qs={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function vn(t,e){return{name:tr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return u(rr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return u(Qr({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return u(rr({message:"Bearer token is empty"}));let s=await e(i,t);if(!s.ok){let a=s.errors[0];return a?.code===Qs.TOKEN_EXPIRED?u(Dr()):a?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let o=s.data;return o.exp&&o.exp<Date.now()/1e3?u(Dr()):g({id:o.sub,perms:o.perms,tenantId:o.tid,tenantType:o.tty,roles:o.roles??[]})}}}function Ga(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function An(t){return{name:tr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return u(rr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?g({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):u(Wt({message:"Invalid API key"}))}}}ho();function vc(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var zT="x-gateway-auth";function es(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??zT;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let s=vc(e);n=it({kty:"OKP",crv:"Ed25519",x:s},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:tr.GATEWAY_JWT,async authenticate(s){if(e!==void 0){let l=s.headers[r];if(!l)return u(rr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return u(Wt({message:`${r} must use Bearer scheme`}));let d=l.slice(7);if(!d)return u(rr({message:"Gateway JWT is empty"}));let p;try{let m=await i(),{payload:E}=await bn(d,m,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=E}catch(m){return m.code==="ERR_JWT_EXPIRED"?u(Dr({message:"Gateway JWT expired"})):u(Wt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let m=typeof p.jti=="string"?p.jti:void 0;if(!m)return u(Wt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(m))return u(Wt({message:"Gateway JWT jti already used (replay)"}))}}let o=Ga(s.headers);if(o===null)return s.headers.authorization??s.headers.Authorization?u(Qr({message:"Authorization header must use Bearer scheme"})):u(rr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(o,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Qs.TOKEN_EXPIRED?u(Dr()):l?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?u(Dr()):g({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var qU=globalThis.performance;ho();var dI="TOKEN_EXPIRED",dh="TOKEN_MALFORMED";function pI(t){return"secret"in t}function fI(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function mI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=vc(t);return it({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function ph(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function hI(t){try{let e=atob(t);return ph(e)}catch{return null}}async function EI(t){if(pI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=ph(e);if(n)return it(n,r);let i=hI(e);return i?it(i,r):r==="EdDSA"&&fI(e)?mI(e):sc(e,r)}function yI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function gr(t){let e=null;return async(r,n)=>{try{e||(e=EI(t));let i=await e,{payload:s}=await bn(r,i,yI(t));return g(s)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?u({code:dI,message:"Token has expired"}):u({code:dh,message:i.message}):u({code:dh,message:"JWT verification failed"})}}}function Fu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as gI}from"crypto";async function Vu(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??gI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function tn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:Pi(t)}:{status:e?.error??400,body:Pi(t)}}var ts=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function rs(t,e){let r=e?.name;return function(i){if(i.ok)return tn(i);let s=i.errors[0]?.code;if(!s||!(s in t))throw new ts(s,i,r);let o=t[s];return tn(i,{error:o})}}function ns(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof ts)return tn(n.result,{error:e});throw n}}}var vI={...Ct},aM=ns(rs(vI),400);var NM=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var Bu=(t,e,r)=>(n,i)=>{let s=-1;return o(0);async function o(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,d;if(t[a]?(d=t[a][0][0],n.req.routeIndex=a):d=a===t.length&&i||void 0,d)try{c=await d(n,()=>o(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Eh=Symbol();var yh=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,s=(t instanceof _c?t.raw.headers:t.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?SI(t,{all:r,dot:n}):{}};async function SI(t,e){let r=await t.formData();return r?NI(r,e):{}}function NI(t,e){let r=Object.create(null);return t.forEach((n,i)=>{e.all||i.endsWith("[]")?wI(r,i,n):r[i]=n}),e.dot&&Object.entries(r).forEach(([n,i])=>{n.includes(".")&&(RI(r,n,i),delete r[n])}),r}var wI=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},RI=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,i=e.split(".");i.forEach((s,o)=>{o===i.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var ju=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},gh=t=>{let{groups:e,path:r}=OI(t),n=ju(r);return kI(n,e)},OI=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},kI=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},xc={},vh=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return xc[n]||(r[2]?xc[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:xc[n]=[t,r[1],!0]),xc[n]}return null},ss=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},CI=t=>ss(t,decodeURI),Gu=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let s=e.indexOf("?",n),o=e.indexOf("#",n),a=s===-1?o===-1?void 0:o:o===-1?s:Math.min(s,o),c=e.slice(r,a);return CI(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var Ah=t=>{let e=Gu(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Nn=(t,e,...r)=>(r.length&&(e=Nn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),bc=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(/\?/.test(i)){r.length===0&&n===""?r.push("/"):r.push(n);let s=i.replace("?","");n+="/"+s,r.push(n)}else n+="/"+i}),r.filter((i,s,o)=>o.indexOf(i)===s)},qu=t=>/[%+]/.test(t)?(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),t.indexOf("%")!==-1?ss(t,yo):t):t,Th=(t,e,r)=>{let n;if(!r&&e&&!/[%+]/.test(e)){let o=t.indexOf("?",8);if(o===-1)return;for(t.startsWith(e,o+1)||(o=t.indexOf(`&${e}`,o+1));o!==-1;){let a=t.charCodeAt(o+e.length+1);if(a===61){let c=o+e.length+2,l=t.indexOf("&",c);return qu(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";o=t.indexOf(`&${e}`,o+1)}if(n=/[%+]/.test(t),!n)return}let i={};n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let o=t.indexOf("&",s+1),a=t.indexOf("=",s);a>o&&o!==-1&&(a=-1);let c=t.slice(s+1,a===-1?o===-1?void 0:o:a);if(n&&(c=qu(c)),s=o,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,o===-1?void 0:o),n&&(l=qu(l))),r?(i[c]&&Array.isArray(i[c])||(i[c]=[]),i[c].push(l)):i[c]??=l}return e?i[e]:i},Ih=Th,_h=(t,e)=>Th(t,e,!0),yo=decodeURIComponent;var xh=t=>ss(t,yo),_c=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r,this.#e={}}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#t[0][this.routeIndex][1][t],r=this.#n(e);return r&&/\%/.test(r)?xh(r):r}#s(){let t={},e=Object.keys(this.#t[0][this.routeIndex][1]);for(let r of e){let n=this.#n(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=/\%/.test(n)?xh(n):n)}return t}#n(t){return this.#t[1]?this.#t[1][t]:t}query(t){return Ih(this.url,t)}queries(t){return _h(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e={};return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return yh(this,t)}#i=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;let i=Object.keys(e)[0];return i?e[i].then(s=>(i==="json"&&(s=JSON.stringify(s)),new Response(s)[t]())):e[t]=r[t]()};json(){return this.#i("text").then(t=>JSON.parse(t))}text(){return this.#i("text")}arrayBuffer(){return this.#i("arrayBuffer")}bytes(){return this.#i("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#i("blob")}formData(){return this.#i("formData")}addValidatedData(t,e){this.#e[t]=e}valid(t){return this.#e[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[Eh](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var bh={Stringify:1,BeforeStream:2,Stream:3},DI=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var $u=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let o=Promise.all(s.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>$u(c,e,!1,n,i))).then(()=>i[0]));return r?DI(await o,s):o};var PI="text/plain; charset=UTF-8",Wu=(t,e)=>({"Content-Type":t,...e}),go=(t,e)=>new Response(t,e),zu=class{#e;#t;env={};#r;finalized=!1;error;#s;#n;#i;#a;#o;#l;#c;#d;#p;constructor(t,e){this.#e=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new _c(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#i||=go(null,{headers:this.#c??=new Headers})}set res(t){if(this.#i&&t){t=go(t.body,t);for(let[e,r]of this.#i.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#i.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#i=t,this.finalized=!0}render=(...t)=>(this.#o??=e=>this.html(e),this.#o(...t));setLayout=t=>this.#a=t;getLayout=()=>this.#a;setRenderer=t=>{this.#o=t};header=(t,e,r)=>{this.finalized&&(this.#i=go(this.#i.body,this.#i));let n=this.#i?this.#i.headers:this.#c??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#u(t,e,r){let n=this.#i?new Headers(this.#i.headers):this.#c??new Headers;if(typeof e=="object"&&"headers"in e){let s=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[o,a]of s)o.toLowerCase()==="set-cookie"?n.append(o,a):n.set(o,a)}if(r)for(let[s,o]of Object.entries(r))if(typeof o=="string")n.set(s,o);else{n.delete(s);for(let a of o)n.append(s,a)}let i=typeof e=="number"?e:e?.status??this.#s;return go(t,{status:i,headers:n})}newResponse=(...t)=>this.#u(...t);body=(t,e,r)=>this.#u(t,e,r);text=(t,e,r)=>!this.#c&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#u(t,e,Wu(PI,r));json=(t,e,r)=>this.#u(JSON.stringify(t),e,Wu("application/json",r));html=(t,e,r)=>{let n=i=>this.#u(i,e,Wu("text/html; charset=UTF-8",r));return typeof t=="object"?$u(t,bh.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>go(),this.#l(this))};var Be="ALL",Sh="all",Nh=["get","post","put","delete","options","patch"],Sc="Can not add a route since the matcher is already built.",Nc=class extends Error{};var wh="__COMPOSED_HANDLER";var UI=t=>t.text("404 Not Found",404),Rh=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},Oh=class kh{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...Nh,Sh].forEach(s=>{this[s]=(o,...a)=>(typeof o=="string"?this.#e=o:this.#s(s,this.#e,o),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,o,...a)=>{for(let c of[o].flat()){this.#e=c;for(let l of[s].flat())a.map(d=>{this.#s(l.toUpperCase(),this.#e,d)})}return this},this.use=(s,...o)=>(typeof s=="string"?this.#e=s:(this.#e="*",o.unshift(s)),o.forEach(a=>{this.#s(Be,this.#e,a)}),this);let{strict:n,...i}=e;Object.assign(this,i),this.getPath=n??!0?e.getPath??Gu:Ah}#t(){let e=new kh({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=UI;errorHandler=Rh;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let s;r.errorHandler===Rh?s=i.handler:(s=async(o,a)=>(await Bu([],r.errorHandler)(o,()=>i.handler(o,a))).res,s[wh]=i.handler),n.#s(i.method,i.path,s,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=Nn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let o=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=Nn(this._basePath,e),l=c==="/"?0:c.length;return d=>{let p=new URL(d.url);return p.pathname=this.getPath(d).slice(l)||"/",new Request(p,d)}})();let a=async(c,l)=>{let d=await r(i(c.req.raw),...o(c));if(d)return d;await l()};return this.#s(Be,Nn(e,"*"),a),this}#s(e,r,n,i){e=e.toUpperCase(),r=Nn(this._basePath,r);let s={basePath:i!==void 0?Nn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#i(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#i(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),o=this.router.match(i,s),a=new zu(e,{path:s,matchResult:o,env:n,executionCtx:r,notFoundHandler:this.#r});if(o[0].length===1){let l;try{l=o[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(d){return this.#n(d,a)}return l instanceof Promise?l.then(d=>d||(a.finalized?a.res:this.#r(a))).catch(d=>this.#n(d,a)):l??this.#r(a)}let c=Bu(o[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,a)}})()}fetch=(e,...r)=>this.#i(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Nn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#i(e.request,e,void 0,e.request.method))})}};var wc=[];function Ju(t,e){let r=this.buildAllMatchers(),n=((i,s)=>{let o=r[i]||r[Be],a=o[2][s];if(a)return a;let c=s.match(o[0]);if(!c)return[[],wc];let l=c.indexOf("",1);return[o[1][l],c]});return this.match=n,n(t,e)}var Rc="[^/]+",vo=".*",Ao="(?:|/.*)",oi=Symbol(),LI=new Set(".\\+*[^]$()");function MI(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1||t===vo||t===Ao?1:e===vo||e===Ao?-1:t===Rc?1:e===Rc?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var Ch=class Yu{#e;#t;#r=Object.create(null);insert(e,r,n,i,s){if(e.length===0){if(this.#e!==void 0)throw oi;if(s)return;this.#e=r;return}let[o,...a]=e,c=o==="*"?a.length===0?["","",vo]:["","",Rc]:o==="/*"?["","",Ao]:o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let d=c[1],p=c[2]||Rc;if(d&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw oi;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(m=>m!==vo&&m!==Ao))throw oi;if(s)return;l=this.#r[p]=new Yu,d!==""&&(l.#t=i.varIndex++)}!s&&d!==""&&n.push([d,l.#t])}else if(l=this.#r[o],!l){if(Object.keys(this.#r).some(d=>d.length>1&&d!==vo&&d!==Ao))throw oi;if(s)return;l=this.#r[o]=new Yu}l.insert(a,r,n,i,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(MI).map(n=>{let i=this.#r[n];return(typeof i.#t=="number"?`(${n})@${i.#t}`:LI.has(n)?`\\${n}`:n)+i.buildRegExpStr()});return typeof this.#e=="number"&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Dh=class{#e={varIndex:0};#t=new Ch;insert(t,e,r){let n=[],i=[];for(let o=0;;){let a=!1;if(t=t.replace(/\{[^}]+\}/g,c=>{let l=`@\\${o}`;return i[o]=[l,c],o++,a=!0,l}),!a)break}let s=t.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let o=i.length-1;o>=0;o--){let[a]=i[o];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,i[o][1]);break}}return this.#t.insert(s,e,n,this.#e,r),n}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,s,o)=>s!==void 0?(r[++e]=Number(s),"$()"):(o!==void 0&&(n[Number(o)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var KI=[/^$/,[],Object.create(null)],Ph=Object.create(null);function Uh(t){return Ph[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function HI(){Ph=Object.create(null)}function FI(t){let e=new Dh,r=[];if(t.length===0)return KI;let n=t.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,d],[p,m])=>l?1:p?-1:d.length-m.length),i=Object.create(null);for(let l=0,d=-1,p=n.length;l<p;l++){let[m,E,v]=n[l];m?i[E]=[v.map(([k])=>[k,Object.create(null)]),wc]:d++;let b;try{b=e.insert(E,d,m)}catch(k){throw k===oi?new Nc(E):k}m||(r[d]=v.map(([k,C])=>{let L=Object.create(null);for(C-=1;C>=0;C--){let[B,G]=b[C];L[B]=G}return[k,L]}))}let[s,o,a]=e.buildRegExp();for(let l=0,d=r.length;l<d;l++)for(let p=0,m=r[l].length;p<m;p++){let E=r[l][p]?.[1];if(!E)continue;let v=Object.keys(E);for(let b=0,k=v.length;b<k;b++)E[v[b]]=a[E[v[b]]]}let c=[];for(let l in o)c[l]=r[o[l]];return[s,c,i]}function os(t,e){if(t){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Uh(r).test(e))return[...t[r]]}}var Oc=class{name="RegExpRouter";#e;#t;constructor(){this.#e={[Be]:Object.create(null)},this.#t={[Be]:Object.create(null)}}add(t,e,r){let n=this.#e,i=this.#t;if(!n||!i)throw new Error(Sc);n[t]||[n,i].forEach(a=>{a[t]=Object.create(null),Object.keys(a[Be]).forEach(c=>{a[t][c]=[...a[Be][c]]})}),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=Uh(e);t===Be?Object.keys(n).forEach(c=>{n[c][e]||=os(n[c],e)||os(n[Be],e)||[]}):n[t][e]||=os(n[t],e)||os(n[Be],e)||[],Object.keys(n).forEach(c=>{(t===Be||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(i).forEach(c=>{(t===Be||t===c)&&Object.keys(i[c]).forEach(l=>a.test(l)&&i[c][l].push([r,s]))});return}let o=bc(e)||[e];for(let a=0,c=o.length;a<c;a++){let l=o[a];Object.keys(i).forEach(d=>{(t===Be||t===d)&&(i[d][l]||=[...os(n[d],l)||os(n[Be],l)||[]],i[d][l].push([r,s-c+a+1]))})}}match=Ju;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach(e=>{t[e]||=this.#r(e)}),this.#e=this.#t=void 0,HI(),t}#r(t){let e=[],r=t===Be;return[this.#e,this.#t].forEach(n=>{let i=n[t]?Object.keys(n[t]).map(s=>[s,n[t][s]]):[];i.length!==0?(r||=!0,e.push(...i)):t!==Be&&e.push(...Object.keys(n[Be]).map(s=>[s,n[Be][s]]))}),r?FI(e):null}};var Xu=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Sc);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,s=0,o;for(;s<i;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);o=a.match(t,e)}catch(c){if(c instanceof Nc)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,o}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var To=Object.create(null),VI=t=>{for(let e in t)return!0;return!1},Lh=class Mh{#e;#t;#r;#s=0;#n=To;constructor(e,r,n){if(this.#t=n||Object.create(null),this.#e=[],e&&r){let i=Object.create(null);i[e]={handler:r,possibleKeys:[],score:0},this.#e=[i]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let i=this,s=gh(r),o=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],d=s[a+1],p=vh(l,d),m=Array.isArray(p)?p[0]:l;if(m in i.#t){i=i.#t[m],p&&o.push(p[1]);continue}i.#t[m]=new Mh,p&&(i.#r.push(p),o.push(p[1])),i=i.#t[m]}return i.#e.push({[e]:{handler:n,possibleKeys:o.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),i}#i(e,r,n,i,s){for(let o=0,a=r.#e.length;o<a;o++){let c=r.#e[o],l=c[n]||c[Be],d={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),i!==To||s&&s!==To))for(let p=0,m=l.possibleKeys.length;p<m;p++){let E=l.possibleKeys[p],v=d[l.score];l.params[E]=s?.[E]&&!v?s[E]:i[E]??s?.[E],d[l.score]=!0}}}search(e,r){let n=[];this.#n=To;let s=[this],o=ju(r),a=[],c=o.length,l=null;for(let d=0;d<c;d++){let p=o[d],m=d===c-1,E=[];for(let b=0,k=s.length;b<k;b++){let C=s[b],L=C.#t[p];L&&(L.#n=C.#n,m?(L.#t["*"]&&this.#i(n,L.#t["*"],e,C.#n),this.#i(n,L,e,C.#n)):E.push(L));for(let B=0,G=C.#r.length;B<G;B++){let j=C.#r[B],$=C.#n===To?{}:{...C.#n};if(j==="*"){let y=C.#t["*"];y&&(this.#i(n,y,e,C.#n),y.#n=$,E.push(y));continue}let[te,A,x]=j;if(!p&&!(x instanceof RegExp))continue;let S=C.#t[te];if(x instanceof RegExp){if(l===null){l=new Array(c);let w=r[0]==="/"?1:0;for(let R=0;R<c;R++)l[R]=w,w+=o[R].length+1}let y=r.substring(l[d]),I=x.exec(y);if(I){if($[A]=I[0],this.#i(n,S,e,C.#n,$),VI(S.#t)){S.#n=$;let w=I[0].match(/\//)?.length??0;(a[w]||=[]).push(S)}continue}}(x===!0||x.test(p))&&($[A]=p,m?(this.#i(n,S,e,$,C.#n),S.#t["*"]&&this.#i(n,S.#t["*"],e,$,C.#n)):(S.#n=$,E.push(S)))}}let v=a.shift();s=v?E.concat(v):E}return n.length>1&&n.sort((d,p)=>d.score-p.score),[n.map(({handler:d,params:p})=>[d,p])]}};var Qu=class{name="TrieRouter";#e;constructor(){this.#e=new Lh}add(t,e,r){let n=bc(e);if(n){for(let i=0,s=n.length;i<s;i++)this.#e.insert(t,n[i],r);return}this.#e.insert(t,e,r)}match(t,e){return this.#e.search(t,e)}};var Vr=class extends Oh{constructor(t={}){super(t),this.router=t.router??new Xu({routers:[new Oc,new Qu]})}};function Zu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}function sr(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var ed={...Ct},Kh=ns(rs(ed),400);function td(t){ed={...Ct,...t},Kh=ns(rs(ed),400)}function Hh(){return Kh}function qe(t,e,r){let{traceId:n,successStatus:i,adapter:s=Hh()}=r??{},o=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:o}},l=s(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let d=e.ok?g(e.data,a):{...e,meta:a},p=Pi(d);return t.json(p,l)}async function BI(t){let e={};t.req.raw.headers.forEach((o,a)=>{e[a]=o});let r={},n=t.req.query();for(let[o,a]of Object.entries(n))r[o]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function Io(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,s)=>{let o=sr(i);try{let a=await BI(i),c=await e.resolve(n,a);if(!c.ok){if(r){await s();return}return qe(i,u($t()),{traceId:o})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await s()}catch{if(r){await s();return}return qe(i,u($t()),{traceId:o})}}}function rd(t){return async(e,r)=>{let n=sr(e),i=e.get("authResult");if(!i)return qe(e,u($t()),{traceId:n});let{user:s}=i,o;if(t.loadResource){let l=e.req.param(),d=await t.loadResource(l,s);if(d===null)return qe(e,u(zt({message:"Resource not found for boundary check"})),{traceId:n});o=d}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(s,a,o);if(!c.ok)return qe(e,c,{traceId:n});await r()}}function _o(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?u(r.issues.map(n=>{let i=n.path?.map(s=>typeof s=="object"?s.key:s).join(".")??"";return $n({message:i?`${i}: ${n.message}`:n.message})})):g(r.value)}function xo(t){return async(e,r)=>{let n=sr(e);try{let i={};if(t.body){let s;try{s=await e.req.json()}catch{return qe(e,u(Ui({reason:"Request body is not valid JSON"})),{traceId:n})}let o=_o(t.body,s);if(!o.ok)return qe(e,o,{traceId:n});i.body=o.data}if(t.params){let s=_o(t.params,e.req.param());if(!s.ok)return qe(e,s,{traceId:n});i.params=s.data}if(t.query){let s=_o(t.query,e.req.query());if(!s.ok)return qe(e,s,{traceId:n});i.query=s.data}if(t.headers){let s={};e.req.raw.headers.forEach((a,c)=>{s[c]=a});let o=_o(t.headers,s);if(!o.ok)return qe(e,o,{traceId:n});i.headers=o.data}e.set("validatedData",i),await r()}catch(i){let s={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return qe(e,u($n(),s),{traceId:n})}}}function bo(t){return t.get("validatedData")?.body}function So(t){return t.get("validatedData")?.params}function No(t){return t.get("validatedData")?.query}var uH=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function qI(t,e){let r=[...t,e];return async(n,i)=>{let s,o=async a=>{if(s||a>=r.length){!s&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await o(a+1)});l instanceof Response&&(s=l)};return await o(0),s}}function Y(t,e){let r=[];if(e.auth!==!1){let s=Array.isArray(e.auth)?e.auth:void 0;r.push(Io({engine:t.auth,methods:s}))}e.permission&&r.push(rd({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(s,o)=>{let a={body:void 0,query:void 0,params:s,user:o};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(xo({body:e.input.body,query:e.input.query,params:e.input.params}));let i=qI(r,async s=>{let o=sr(s);try{let a=s.get("authResult"),c={body:bo(s),query:No(s),params:So(s),user:a?.user,tenantContext:s.get("tenantContext"),traceId:o},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},d=await e.handler(l),p=e.successStatus??200;return qe(s,d,{traceId:o,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:o,route:`${e.method} ${e.path}`,error:{message:c}})),qe(s,u(Li()),{traceId:o})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function nd(t,e){let r=new Vr;for(let n of e){let{method:i,path:s}=n.routeMeta,o=s==="/"?t:`${t}${s}`;switch(i){case"GET":r.get(o,n);break;case"POST":r.post(o,n);break;case"PUT":r.put(o,n);break;case"PATCH":r.patch(o,n);break;case"DELETE":r.delete(o,n);break}}return r}var Fh={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var kc,jI={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function GI(t){return!t&&!kc?jI:{lang:t?.lang??kc?.lang,message:t?.message,abortEarly:t?.abortEarly??kc?.abortEarly,abortPipeEarly:t?.abortPipeEarly??kc?.abortPipeEarly}}var $I;function WI(t){return $I?.get(t)}var zI;function JI(t){return zI?.get(t)}var YI;function XI(t,e){return YI?.get(t)?.get(e)}function ai(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function mt(t,e,r,n,i){let s=i&&"input"in i?i.input:r.value,o=i?.expected??t.expects??null,a=i?.received??ai(s),c={kind:t.kind,type:t.type,input:s,expected:o,received:a,message:`Invalid ${e}: ${o?`Expected ${o} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",d=i?.message??t.message??XI(t.reference,c.lang)??(l?JI(c.lang):null)??n.message??WI(c.lang);d!==void 0&&(c.message=typeof d=="function"?d(c):d),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}var Vh=new WeakMap;function Yt(t){let e=Vh.get(t);return e||(e={version:1,vendor:"valibot",validate(r){return t["~run"]({value:r},GI())}},Vh.set(t,e)),e}function QI(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function qh(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}var ZI=/^[\w+-]+(?:\.[\w+-]+)*@[\da-z]+(?:[.-][\da-z]+)*\.[a-z]{2,}$/iu;function Cc(t,e){return{kind:"validation",type:"check",reference:Cc,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&mt(this,"input",r,n),r}}}function rn(t){return{kind:"validation",type:"email",reference:rn,expects:null,async:!1,requirement:ZI,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&mt(this,"email",e,r),e}}}function wn(t){return{kind:"validation",type:"integer",reference:wn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&mt(this,"integer",e,r),e}}}function ht(t,e){return{kind:"validation",type:"max_length",reference:ht,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function as(t,e){return{kind:"validation",type:"max_value",reference:as,async:!1,expects:`<=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function id(t,e){return{kind:"validation",type:"min_length",reference:id,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function cs(t,e){return{kind:"validation",type:"min_value",reference:cs,async:!1,expects:`>=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function ls(t){return{kind:"transformation",type:"transform",reference:ls,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function e_(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function sd(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return{kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let s=0;s<i.length;s++){let o=i[s],a=this.item["~run"]({value:o},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:s,value:o};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else mt(this,"type",r,n);return r}}}function It(t){return{kind:"schema",type:"boolean",reference:It,expects:"boolean",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:mt(this,"type",e,r),e}}}function us(t,e){return{kind:"schema",type:"literal",reference:us,expects:ai(t),async:!1,literal:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===this.literal?r.typed=!0:mt(this,"type",r,n),r}}}function ci(t,e){return{kind:"schema",type:"nullable",reference:ci,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function $e(t){return{kind:"schema",type:"number",reference:$e,expects:"number",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:mt(this,"type",e,r),e}}}function H(t,e){return{kind:"schema",type:"object",reference:H,expects:"Object",async:!1,entries:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let s in this.entries){let o=this.entries[s];if(s in i||(o.type==="exact_optional"||o.type==="optional"||o.type==="nullish")&&o.default!==void 0){let a=s in i?i[s]:sd(o),c=o["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:s,value:a};for(let d of c.issues)d.path?d.path.unshift(l):d.path=[l],r.issues?.push(d);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[s]=c.value}else if(o.fallback!==void 0)r.value[s]=e_(o);else if(o.type!=="exact_optional"&&o.type!=="optional"&&o.type!=="nullish"&&(mt(this,"key",r,n,{input:void 0,expected:`"${s}"`,path:[{type:"object",origin:"key",input:i,key:s,value:i[s]}]}),n.abortEarly))break}}else mt(this,"type",r,n);return r}}}function _(t,e){return{kind:"schema",type:"optional",reference:_,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function Xt(t,e){return{kind:"schema",type:"picklist",reference:Xt,expects:qh(t.map(ai),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:mt(this,"type",r,n),r}}}function me(t,e,r){return{kind:"schema",type:"record",reference:me,expects:"Object",async:!1,key:t,value:e,message:r,get"~standard"(){return Yt(this)},"~run"(n,i){let s=n.value;if(s&&typeof s=="object"){n.typed=!0,n.value={};for(let o in s)if(QI(s,o)){let a=s[o],c=this.key["~run"]({value:o},i);if(c.issues){let d={type:"object",origin:"key",input:s,key:o,value:a};for(let p of c.issues)p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let d={type:"object",origin:"value",input:s,key:o,value:a};for(let p of l.issues)p.path?p.path.unshift(d):p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else mt(this,"type",n,i);return n}}}function h(t){return{kind:"schema",type:"string",reference:h,expects:"string",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="string"?e.typed=!0:mt(this,"type",e,r),e}}}function Bh(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function wo(t,e){return{kind:"schema",type:"union",reference:wo,expects:qh(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i,s,o;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)s?s.push(c):s=[c];else{i=c;break}else o?o.push(c):o=[c]}if(i)return i;if(s){if(s.length===1)return s[0];mt(this,"type",r,n,{issues:Bh(s)}),r.typed=!0}else{if(o?.length===1)return o[0];mt(this,"type",r,n,{issues:Bh(o)})}return r}}}function ge(){return{kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,get"~standard"(){return Yt(this)},"~run"(t){return t.typed=!0,t}}}function we(...t){return{...t[0],pipe:t,get"~standard"(){return Yt(this)},"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}}}var Vt=(t=100)=>we(h(),ht(t)),Dc=we(h(),ht(320)),Rn=we(h(),ht(4096)),Ro=(t=256)=>we(h(),ht(t)),od=(t=8192)=>we(h(),ht(t)),Oo=we(ge(),ls(Number),$e(),wn(),cs(1),as(100));var Ut=H({message:_(h())}),jh=H({accessToken:h(),refreshToken:_(h()),expiresAt:$e()}),Gh=H({requiresChallenge:us(!0),challenge:H({type:_(h()),phase:_(h()),expiresAt:_(wo([h(),$e()])),data:me(h(),ge())})}),$h=H({requiresMfa:us(!0),mfa:H({phase:_(h()),challengeId:h(),methods:Z(h()),method:_(h()),expiresAt:wo([h(),$e()]),userId:h()})}),Wh=H({requiresVerification:us(!0),verification:H({channel:us("email"),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h(),userId:h()})}),li=wo([Gh,$h,Wh,jh]),ko=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),username:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),metadata:_(me(h(),ge())),createdAt:h(),updatedAt:h()}),Co=H({challengeId:h(),expiresAt:h()});var ad=H({maskedRecipient:_(h()),expiresAt:h()}),cd=H({userId:h(),verification:_(H({channel:h(),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h()}))});var ld=H({userId:h(),identityType:h(),identityValue:h(),verifiedAt:h()});var zh=H({id:h(),tokenId:h(),tenantId:_(h()),deviceLabel:_(h()),country:_(h()),city:_(h()),createdAt:h(),expiresAt:h(),lastUsedAt:h(),revokedAt:_(ci(h())),metadata:_(me(h(),ge())),isCurrent:_(It())}),ud=Z(zh);var dd=H({method:h(),data:me(h(),ge())}),pd=H({method:h(),verified:It(),data:me(h(),ge())}),Jh=H({method:h(),verifiedAt:ci(h()),createdAt:h(),id:_(h()),label:_(h()),lastUsedAt:_(h())}),fd=H({authenticators:Z(Jh),total:$e()});var md=H({state:h()}),Yh=H({provider:h(),providerId:_(h()),email:_(h()),linkedAt:_(h())}),hd=Z(Yh);var Xh=H({id:h(),tenantId:h(),inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),status:h(),roles:_(Z(h())),authPerms:Z(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h()),invitedBy:_(ge()),createdAt:h(),updatedAt:h(),expiresAt:h()}),Ed=Z(Xh),yd=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),Qh=H({userId:h(),tenantId:h(),status:h(),roles:_(Z(h())),authPerms:Z(h()),isOwner:It(),createdAt:h(),updatedAt:h()}),gd=H({members:Z(Qh)}),Pc=H({userId:h(),tenantId:h(),status:h(),roles:_(Z(h())),authPerms:Z(h()),isOwner:It(),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),jobTitle:_(h()),contactEmail:_(h()),contactPhone:_(h()),bio:_(h()),locale:_(h()),metadata:_(me(h(),ge())),createdAt:_(h()),memberUpdatedAt:_(h()),profileUpdatedAt:_(h())}),vd=H({tenantId:h(),roles:_(Z(h())),authPerms:Z(h())});var r_={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:_(Rn),metadata:_(me(Vt(),ge())),country:_(Vt()),city:_(Vt())}),response:li},n_={method:"POST",path:"/auth/register",kind:"data",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:Rn,displayName:_(Ro()),givenName:_(Ro()),familyName:_(Ro()),avatarUrl:_(od(2048)),locale:_(Vt()),metadata:_(me(Vt(),ge()))}),response:cd},i_={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:H({challengeId:h(),code:h()}),response:li},s_={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:H({challengeId:h(),method:h(),code:h()}),response:li},o_={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:H({challengeId:h(),method:h(),userId:h()}),response:ad},a_={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},c_={method:"POST",path:"/auth/logout",kind:"logout",public:!0},l_={method:"GET",path:"/auth/me",kind:"data",response:ko},u_={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:H({tenantId:h()})},Lt={authenticate:r_,register:n_,completeChallenge:i_,completeMfaChallenge:s_,issueMfaChallenge:o_,refresh:a_,logout:c_,me:l_,selectTenant:u_};var d_={method:"PATCH",path:"/password/change",kind:"data",body:H({currentPassword:Rn,newPassword:Rn}),response:Ut},p_={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:H({email:we(h(),ht(320),rn())}),response:Co},f_={method:"POST",path:"/password/reset",kind:"data",public:!0,body:H({challengeId:Vt(),code:Vt(),newPassword:Rn}),response:Ut},sn={changePassword:d_,forgotPassword:p_,resetPassword:f_};var m_={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:H({challengeId:h(),code:h()}),response:ld},h_={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:H({channel:Xt(["sms","email"]),identityValue:h(),previousChallengeId:_(h())}),response:Co},ui={verifyCode:m_,resendVerification:h_};var E_={method:"GET",path:"/sessions",kind:"data",query:H({includeRevoked:_(Xt(["true","false"])),limit:_(Oo),cursor:_(h())}),response:ud},y_={method:"DELETE",path:"/sessions",kind:"data",body:H({sessionId:h()}),response:Ut},g_={method:"POST",path:"/sessions/revoke",kind:"data",body:H({refreshToken:h()}),response:Ut},on={listSessions:E_,deleteSession:y_,revokeToken:g_};var v_={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:H({method:h(),data:_(me(h(),ge()))}),response:dd},A_={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:H({method:h(),data:_(me(h(),ge())),authenticatorId:_(h())}),response:pd},T_={method:"GET",path:"/mfa/authenticators",kind:"data",query:H({method:_(h()),verifiedOnly:_(It())}),response:fd},I_={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:H({method:h(),authenticatorId:_(h()),password:_(h())}),response:H({message:_(h())})},__={method:"PATCH",path:"/mfa/settings",kind:"data",body:H({mfaRequired:_(It()),mfaMethods:_(Z(h())),password:_(h())}),response:H({mfaRequired:_(It()),mfaMethods:_(Z(h()))})},vr={setupAuthenticator:v_,verifyAuthenticator:A_,listAuthenticators:T_,removeAuthenticator:I_,updateMfaSettings:__};var x_={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:md},b_={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:H({provider:we(h(),ht(100)),code:_(we(h(),ht(8192))),credential:_(we(h(),ht(8192))),state:_(we(h(),ht(1024))),tenantId:_(we(h(),ht(100)))}),response:li},S_={method:"POST",path:"/oauth/link",kind:"data",body:H({provider:h(),code:_(h())}),response:Ut},N_={method:"POST",path:"/oauth/unlink",kind:"data",body:H({provider:h()}),response:Ut},w_={method:"GET",path:"/oauth/providers",kind:"data",response:hd},an={oauthState:x_,oauthCallback:b_,linkProvider:S_,unlinkProvider:N_,getProviders:w_};var R_={method:"PATCH",path:"/users/profile",kind:"data",body:H({email:_(we(h(),rn())),phone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),metadata:_(me(h(),ge()))}),response:ko},Do={updateProfile:R_};var O_={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Pc},k_={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:H({contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))}),response:Pc},C_={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:H({inviteeEmail:_(we(h(),rn())),inviteeUserId:_(h()),inviteePhone:_(h()),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),response:yd},D_={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:H({status:_(h()),limit:_(Oo),cursor:_(h())}),response:Ed},P_={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:H({inviteId:_(h()),inviteToken:_(h())}),response:vd},U_={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:H({inviteId:_(h()),inviteToken:_(h())}),response:Ut},L_={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:H({inviteId:h()}),response:Ut},M_={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:H({limit:_(Oo),cursor:_(h())}),response:gd},K_={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h(),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h()))}),response:Ut},H_={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h()}),response:Ut},Ad={getTenantProfile:O_,updateTenantProfile:k_,createInvite:C_,listInvites:D_,acceptInvite:P_,declineInvite:U_,revokeInvite:L_,listMembers:M_,updateMember:K_,removeMember:H_};var iF={...Lt,...sn,...ui,...on,...vr,...an,...Do,...Ad};var V={VALIDATION_ERROR:T("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:T("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:T("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:T("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:T("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:T("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:T("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:T("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:T("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:T("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:T("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:T("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:T("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:T("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:T("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function ds(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function On(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:s,device:o}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=o?.deviceLabel,d={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...o?.country&&{country:o.country},...o?.city&&{city:o.city},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}},p=await e.plugins.database.sessions.create(d);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u(V.DATABASE_ERROR());let m=p.data,E=ds(n,e.security),v=await e.plugins.token.signAccessToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}}),b=await e.plugins.token.signRefreshToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i}});return g({accessToken:v.token,refreshToken:b.token,expiresAt:v.expiresAt,...n&&{tenantId:n}})}var Po={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};function Zh(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function Uo(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?u(Po.USER_NOT_FOUND()):g(Zh(r.data))}var Td={SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:V.DATABASE_ERROR};async function Uc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return g();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(Td.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?g():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(Td.DATABASE_ERROR()):g():g()}var kn={INVALID_TOKEN:T("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:T("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_SUSPENDED:V.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var cn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(cn||(cn={}));async function Lc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return u(kn.INVALID_TOKEN());if(r.typ!==cn.Refresh)return u(kn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(V.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return u(kn.INVALID_TOKEN());let s=Date.now(),o=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&s-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!o&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(V.DATABASE_ERROR()):u(kn.INVALID_TOKEN());if(a&&!o){let v=ds(i.tenantId,e.security),b=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),k=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),g({accessToken:b.token,refreshToken:k.token,expiresAt:b.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:s,expiresAt:new Date(s+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return u(V.DATABASE_ERROR());let d=ds(i.tenantId,e.security);if(l.data===!1){let v=await e.plugins.database.sessions.get(i.id);if(v.ok===!1)return u(V.DATABASE_ERROR());let b=v.data;if(!b||b.revokedAt)return u(kn.INVALID_TOKEN());let k=await e.plugins.token.signAccessToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType},...b.perms!==void 0&&{perms:b.perms},...b.roles&&{roles:b.roles}}),C=await e.plugins.token.signRefreshToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),m=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),E={accessToken:p.token,refreshToken:m.token,expiresAt:p.expiresAt};return g(E)}var Rt={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:T("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:X("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:X("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:X("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:T("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:X("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var Fe={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},Ar={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},_e={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var or={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function Id(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Mc(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let o=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(o)}async function eE(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:s,codeHash:o,challengeId:a,expiresAt:c,...l}=t.nextStepData,d={id:r,userId:t.userId,purpose:_e.LOGIN,status:Fe.PENDING,phase:Ar.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(d.tenantId=t.tenantId),t.deviceLabel!==void 0&&(d.deviceLabel=t.deviceLabel),t.country!==void 0&&(d.country=t.country),t.city!==void 0&&(d.city=t.city),i!==void 0&&(d.codeHash=i),(await e.plugins.database.challenges.create(d)).ok===!1?u([V.DATABASE_ERROR()]):g({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:d.phase})}async function Kc(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,s=t.userHasMethods.length===1&&t.deliveryMethods.length===0,o=i?t.deliveryMethods[0]:s?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:_e.LOGIN,status:Fe.PENDING,phase:o?Ar.VERIFY_MFA:Ar.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),o!==void 0&&(a.method=o),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return u(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...o!==void 0&&{selectedMethod:o}};return g(l)}var lt={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var _d={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},Hc={ACCOUNT_DELETED:V.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:T(_d.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:T(_d.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T(_d.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function Br(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return u(Hc.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return u(Hc.ACCOUNT_SUSPENDED());let s,o,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return u(Hc.NO_ACCESS_TO_TENANT());let d=l.data;if(d.status!==lt.ACTIVE)return u(Hc.SUSPENDED_IN_TENANT());if(o=d.roles,s=d.isOwner?{"*":-1}:d.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return s!==void 0&&(c.perms=s),o!==void 0&&(c.roles=o),a!==void 0&&(c.tenantType=a),g(c)}var Ze={SMS:"sms",EMAIL:"email"},di={PHONE:"phone",EMAIL:"email"},pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Cn={type:Ze.EMAIL,purpose:_e.EMAIL_VERIFICATION,identityType:di.EMAIL,template:pi.EMAIL_CODE};var Dn={type:Ze.SMS,purpose:_e.PHONE_VERIFICATION,identityType:di.PHONE,template:pi.SMS_CODE};var Re={CHANNEL_NOT_CONFIGURED:T("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:T("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:T("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:T("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:T("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:T("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:T("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function Ie(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function ln(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function qr(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return F_(n)}async function ps(t,e){let r=await qr(t);return r.length!==e.length?!1:V_(r,e)}function F_(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function V_(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function B_(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function fs(t,e){let r=B_(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,s=await e.plugins.database.identities.get(r.identityType,i);if(!s.ok||!s.data)return u(Re.IDENTITY_NOT_FOUND());let o=s.data;if(o.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let a=o.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,d=t.previousChallengeId===void 0&&l===c;if(!l)return u(Re.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return u(p.errors,p.meta);let m=p.data;if(m&&(m.status!==Fe.PENDING||m.userId!==o.userId||m.purpose!==r.purpose||m.method!==r.type||m.identityType!==r.identityType||m.identityValue!==i))return u(Re.CHALLENGE_NOT_FOUND());if(!m&&!d)return u(Re.CHALLENGE_NOT_FOUND());let E=e.security.verificationResendCooldownSeconds*1e3,v=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(m?.createdAt.getTime()??0)+E;if(E>0&&Date.now()<v)return u(Re.RESEND_COOLDOWN_ACTIVE());let b=ln(6),k=await qr(b),C=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),L=e.plugins.database.challenges.generateChallengeId(),B=await e.plugins.database.challenges.create({id:L,userId:o.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:k,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:C});if(B.ok===!1)return u(B.errors,B.meta);let G=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,j=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:L,purpose:r.purpose,channel:r.type,expiresAt:C,resendAvailableAt:G}});return j.ok===!1?(await e.plugins.database.challenges.remove(L),u(j.errors,j.meta)):(await q_(t.channel,i,b,r.template,L,C,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(L),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),u(Re.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),Ie(e,{event:`verification_code_resent_${t.channel}`,userId:o.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:L,previousChallengeId:l}})]),g({challengeId:L,expiresAt:C}))}async function q_(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}function j_(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function ms(t,e){let r=j_(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return u(Re.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let s=i.guards.email_verification;if(s?.lockedUntil&&new Date(s.lockedUntil)>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let o=i.pendingVerification,a=o&&o.purpose===r.purpose&&o.channel===r.type&&o.expiresAt>new Date?o.challengeId:null;if(o?.resendAvailableAt&&o.purpose===r.purpose&&o.channel===r.type&&o.resendAvailableAt>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let c=ln(6),l=await qr(c),d=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),m=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:d});if(m.ok===!1)return u(m.errors,m.meta);let E=Math.max(0,e.security.verificationResendCooldownSeconds),v=E>0?new Date(Date.now()+E*1e3):null,b=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:d,resendAvailableAt:v}});return b.ok===!1?(await e.plugins.database.challenges.remove(p),u(b.errors,b.meta)):(await G_(t.channel,t.identityValue,c,r.template,p,d,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:o??null}),u(Re.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),Ie(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),g({challengeId:p,expiresAt:d}))}async function G_(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}var $_=[_e.PHONE_VERIFICATION,_e.EMAIL_VERIFICATION];async function hs(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(Re.CHALLENGE_NOT_FOUND());let n=r.data;if(!$_.includes(n.purpose))return u(Re.CHALLENGE_NOT_FOUND());if(n.status!==Fe.PENDING)return u(Re.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return u(Re.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?u(Re.TOO_MANY_ATTEMPTS()):u(i.errors,i.meta);if(!n.codeHash)return u(Re.INVALID_CODE());if(!await ps(t.code,n.codeHash))return u(Re.INVALID_CODE());let o=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:o,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await Ie(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),g({userId:n.userId,identityType:a,identityValue:c,verifiedAt:o})}function Lo(t,e){return e[t]??null}function tE(t,e){return e[t]??null}async function rE(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function nE(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,s=r.security.maxFailedAttempts||5,o=i>=s,a=null;if(o){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>s){let d=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*d**(i-s),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function iE(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Mo(t,e){let r=t.tid,n=Lo(t.identityType,e.plugins.identity);if(!n)return u(Rt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return u(Rt.INVALID_IDENTITY_FORMAT());let s=n.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,s);if(o.ok===!1||!o.data)return u(Rt.INVALID_CREDENTIALS());let a=o.data;if(!a.loginEnabled)return u(Rt.LOGIN_DISABLED());let c=Id(a,t.credentialType);if(c.locked)return u(Rt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=tE(t.credentialType,e.plugins.credential);if(!l)return u(Rt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let d=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=d.ok?d.data:null,m=await l.verify({userId:a.userId,identityValue:s,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(m.ok===!1)return await nE(a,t.credentialType,e),u(Rt.INVALID_CREDENTIALS());let{userId:E,nextStep:v,intents:b}=m.data;b&&b.length>0&&await rE(b,e);let k;if(t.userAgent&&e.plugins.deviceParser){let w=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),R=w.browser||"Unknown Browser",N=w.os||"Unknown OS";k=`${R} - ${N}`}if(v){let w={userId:E,credentialType:t.credentialType,identityType:t.identityType,identityValue:s,nextStepData:v.data,nextStepType:v.type};t.tid!==void 0&&(w.tenantId=t.tid),k!==void 0&&(w.deviceLabel=k),t.country!==void 0&&(w.country=t.country),t.city!==void 0&&(w.city=t.city);let R=await eE(w,e);if(R.ok===!1)return u(R.errors,R.meta);if(!R.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:N,expiresAt:O,displayData:P,challengeType:U,phase:K}=R.data;return g({requiresChallenge:!0,challenge:{type:U,phase:K,expiresAt:O,data:{challengeId:N,expiresAt:O,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return u(Rt.IDENTITY_NOT_VERIFIED());let w=a.pendingVerification;if(!!w&&w.purpose===_e.EMAIL_VERIFICATION&&w.channel==="email"&&w.expiresAt>new Date&&w)return g({requiresVerification:!0,verification:{channel:"email",challengeId:w.challengeId,expiresAt:w.expiresAt,identityType:t.identityType,identityValue:s,userId:E}});let N=await ms({channel:"email",identityValue:s,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!N.ok){let O=await e.plugins.database.identities.get(t.identityType,s),P=O.ok&&O.data?O.data.pendingVerification:null;return P&&P.purpose===_e.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?g({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:s,userId:E}}):u(Rt.IDENTITY_NOT_VERIFIED())}return g({requiresVerification:!0,verification:{channel:"email",challengeId:N.data.challengeId,expiresAt:N.data.expiresAt,identityType:t.identityType,identityValue:s,userId:E}})}let C=await e.plugins.database.userAuths.get(E);if(C.ok===!1||!C.data)return u(Rt.USER_AUTH_NOT_FOUND());let L=C.data,B={userStatus:L.userStatus,userId:E,...r&&{tenantId:r}},G=await Br(B,e);if(G.ok===!1)return u(G.errors,G.meta);if(!G.ok)return u(V.DATABASE_ERROR());let{perms:j,roles:$,tenantType:te}=G.data;if(L.mfaRequired){let w=L.mfaMethods;if(!(!w||w.length===0)){let R=w.filter(N=>e.plugins.mfa?.[N]);if(R.length!==0){let N=R.filter(fe=>e.plugins.mfa?.[fe]?.requiresServerDelivery),O=R.filter(fe=>!e.plugins.mfa?.[fe]?.requiresServerDelivery),P={};k!==void 0&&(P.deviceLabel=k),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let U={userId:E,availableMethods:R,deliveryMethods:N,userHasMethods:O,device:P};t.tid!==void 0&&(U.tenantId=t.tid);let K=await Kc(U,e);if(K.ok===!1)return u(K.errors,K.meta);if(!K.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:W,expiresAt:J,phase:de,selectedMethod:ke,availableMethods:He}=K.data;return g({requiresMfa:!0,mfa:{phase:de,challengeId:W,methods:He,...ke&&{method:ke},expiresAt:J,userId:E}})}}}let A={userId:E,...r&&{tenantId:r},...te&&{tenantType:te},...j!==void 0||$?{permissions:{...$&&{roles:$},...j!==void 0&&{perms:j}}}:{},...k||t.country||t.city?{device:{...k&&{deviceLabel:k},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await On(A,e);if(x.ok===!1)return u(x.errors,x.meta);if(!x.ok)return u(V.DATABASE_ERROR());let{accessToken:S,refreshToken:y,expiresAt:I}=x.data;return await Mc(E,e),await iE(a,t.credentialType,e),g({accessToken:S,refreshToken:y,expiresAt:I})}var _t={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:T("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};var W_={CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function cE(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:s,device:o}=t;if(!r)return g({requiresMfa:!1});if(!n||n.length===0)return g({requiresMfa:!1});let a=n.filter(C=>e.plugins.mfa?.[C]);if(a.length===0)return g({requiresMfa:!1});let c=a.filter(C=>e.plugins.mfa?.[C]?.requiresServerDelivery),l=a.filter(C=>!e.plugins.mfa?.[C]?.requiresServerDelivery),d={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};s!==void 0&&(d.tenantId=s),o!==void 0&&(d.device=o);let p=await Kc(d,e);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u([W_.CHALLENGE_CREATE_FAILED()]);let{challengeId:m,expiresAt:E,phase:v,selectedMethod:b,availableMethods:k}=p.data;return g({requiresMfa:!0,mfa:{phase:v,challengeId:m,methods:k,...b&&{method:b},expiresAt:E,userId:i}})}async function Ko(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return u(_t.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Fe.PENDING)return u(_t.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_CREDENTIAL)return u(_t.INVALID_CHALLENGE_STATE());if(n.purpose!==_e.LOGIN)return u(_t.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(_t.CHALLENGE_EXPIRED());let s=n.method;if(!s)return u(_t.INTERNAL_ERROR());let o=e.plugins.credential[s];if(!o)return u(_t.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Fe.EXPIRED}),u(_t.MAX_ATTEMPTS_EXCEEDED())):u(a.errors,a.meta);if((await o.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return u(_t.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return u(_t.USER_AUTH_NOT_FOUND());let d=l.data,p={userStatus:d.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let m=await Br(p,e);if(m.ok===!1)return u(m.errors,m.meta);if(!m.ok)return u(_t.INTERNAL_ERROR());let{perms:E,roles:v,tenantType:b}=m.data,k=n.deviceLabel,C=n.country,L=n.city,B={};k!==void 0&&(B.deviceLabel=k),C!==void 0&&(B.country=C),L!==void 0&&(B.city=L);let G={mfaRequired:d.mfaRequired,...d.mfaMethods&&{mfaMethods:d.mfaMethods},userId:n.userId,device:B},j=await cE(G,e);if(j.ok===!1)return u(j.errors,j.meta);if(!j.ok)return u(_t.INTERNAL_ERROR());if(j.data.requiresMfa){let I={requiresMfa:!0,mfa:j.data.mfa};return g(I)}let $={};E!==void 0&&($.perms=E),v!==void 0&&($.roles=v);let te={userId:n.userId,permissions:$,device:B};i!==void 0&&(te.tenantId=i),b!==void 0&&(te.tenantType=b);let A=await On(te,e);if(A.ok===!1)return u(A.errors,A.meta);if(!A.ok)return u(_t.INTERNAL_ERROR());let{accessToken:x,refreshToken:S,expiresAt:y}=A.data;return g({accessToken:x,refreshToken:S,expiresAt:y})}var ot={MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function Ho(t,e){if(!e.plugins.mfa)return u(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,s=n.deviceLabel,o=n.country,a=n.city;if(n.status!==Fe.PENDING)return u(ot.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_MFA)return u(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==_e.LOGIN)return u(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return u(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return u(ot.MFA_METHOD_NOT_SUPPORTED());let d=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(d.ok===!1)return d.errors.some(te=>te.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(ot.TOO_MANY_ATTEMPTS())):u(d.errors,d.meta);if(l.requiresServerDelivery){if(!n.codeHash)return u(ot.INVALID_CHALLENGE_STATE());if(!await ps(t.code,n.codeHash))return u(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return u(ot.MFA_METHOD_NOT_SUPPORTED());let te=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if(te.ok===!1||!te.data)return u(ot.INVALID_MFA_CODE());let A=te.data;if(!A.verifiedAt)return u(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return u(ot.INVALID_MFA_CODE());let S=x.data.data?.usedBackupCodeHash;if(S){let I=(A.data.backupCodeHashes??[]).filter(w=>w!==S);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return u(ot.USER_AUTH_NOT_FOUND());let E={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},v=await Br(E,e);if(v.ok===!1)return u(v.errors,v.meta);if(!v.ok)return u(V.DATABASE_ERROR());let{perms:b,roles:k,tenantType:C}=v.data,L={userId:n.userId,...i&&{tenantId:i},...C&&{tenantType:C},...b!==void 0||k?{permissions:{...k&&{roles:k},...b!==void 0&&{perms:b}}}:{},...s||o||a?{device:{...s&&{deviceLabel:s},...o&&{country:o},...a&&{city:a}}}:{}},B=await On(L,e);if(B.ok===!1)return u(B.errors,B.meta);if(!B.ok)return u(V.DATABASE_ERROR());let{accessToken:G,refreshToken:j,expiresAt:$}=B.data;return g({accessToken:G,refreshToken:j,expiresAt:$})}var xt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:X("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:X("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:X("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:X("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:T("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:T("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:T("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function Fo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(xt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Fe.PENDING)return u(xt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return u(xt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return u(xt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return u(xt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return u(xt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let s=await e.plugins.database.userAuths.get(t.userId);if(!s.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let o=s.data;if(!o)return u(xt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(m=>m.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(xt.TOO_MANY_ISSUES())):u(a.errors,a.meta);if(!i.sendCode)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:o},e);if(!c.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,d=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:Ar.VERIFY_MFA,codeHash:l})).ok===!1?u(xt.CHALLENGE_UPDATE_FAILED()):g({maskedRecipient:d,expiresAt:n.expiresAt})}var je={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:X("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:X("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:T("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:T("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:T("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:T("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:T("INTERNAL_ERROR","Internal error occurred during registration")};function z_(t,e){return e[t]}function J_(t,e){return e[t]}async function Vo(t,e){let r=z_(t.identityType,e.plugins.identity);if(!r)return u(je.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return u(je.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,i);if(s.ok===!1)return u(je.DATABASE_ERROR());if(s.data)return u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let o=J_(t.credentialType,e.plugins.credential);if(!o)return u(je.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await o.create({value:t.credentialValue});if(a.ok===!1)return u(je.INVALID_CREDENTIAL());if(!a.ok)return u(je.INTERNAL_ERROR());let{value:c,data:l}=a.data,d=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let m={id:d,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===or.EMAIL&&{contactEmail:t.identityValue},...t.identityType===or.PHONE&&{contactPhone:t.identityValue},...t.identityType===or.USERNAME&&{username:t.identityValue}},E={userId:d,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},v={type:t.identityType,value:i,userId:d,loginEnabled:!0,verifiedAt:null,guards:{}},b={userId:d,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===or.EMAIL&&e.plugins.database.registration){let j=await Y_({profileData:{...m,id:d},userAuthData:E,identityData:v,credentialRepoData:b,identityValue:i},e);return j.ok===!1?j.errors.some($=>$.code==="UNIQUE_CONSTRAINT_VIOLATION")?u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):u(j.errors,j.meta):j.ok?g({userId:d,verification:{channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}):u(je.INTERNAL_ERROR())}let k=await e.plugins.database.users.create(m);if(k.ok===!1||!k.data)return u(je.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(E)).ok===!1)return await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(v)).ok===!1)return await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let B=await e.plugins.database.credentials.create(b);if(B.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let G;if(t.identityType===or.EMAIL){let j=await Z_({userId:d,identityType:t.identityType,identityValue:i},e);if(j.ok===!1)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(j.errors,j.meta);if(!j.ok)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.INTERNAL_ERROR());G={channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}return g({userId:d,...G&&{verification:G}})}async function Y_(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await X_(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?u(je.USER_CREATION_FAILED()):((await Q_({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),g({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function X_(t,e,r){let n=ln(6),i=await qr(n),s=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),o=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:o,userId:t,purpose:_e.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:or.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:s},pendingVerification:{challengeId:o,purpose:_e.EMAIL_VERIFICATION,channel:"email",expiresAt:s,resendAvailableAt:a}}}async function Q_(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:_e.EMAIL_VERIFICATION}})).ok===!1?u(je.VERIFICATION_EMAIL_SEND_FAILED()):g(void 0):u(je.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Z_(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=ln(6),n=await qr(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),s=e.plugins.database.challenges.generateChallengeId(),o=await e.plugins.database.challenges.create({id:s,userId:t.userId,purpose:_e.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(o.ok===!1)return u(o.errors,o.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:s,purpose:_e.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(s),u(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:s,expiresAt:i.toISOString(),purpose:_e.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(s),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),u(je.VERIFICATION_EMAIL_SEND_FAILED())):g({challengeId:s,expiresAt:i})}var Pn={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Bo(t,e){let{sessionId:r,userId:n,tenantId:i}=t,s=await e.plugins.database.sessions.get(r);if(s.ok===!1)return u(s.errors,s.meta);if(!s.data)return u(Pn.SESSION_NOT_FOUND());let o=s.data;if(o.revokedAt)return u(Pn.SESSION_REVOKED());if(o.userId!==n)return u(Pn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return u(a.errors,a.meta);if(!a.data)return u(Pn.USER_NOT_FOUND());let c=a.data,l=await Br({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return u(l.errors,l.meta);if(!l.ok)return u(V.DATABASE_ERROR());let{perms:d,roles:p,tenantType:m}=l.data,E=e.plugins.database.sessions.generateTokenId(),v=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:E,...d!==void 0&&{perms:d},...p&&{roles:p},...m&&{tenantType:m}});if(v.ok===!1)return u(v.errors,v.meta);let b=ds(i,e.security),k=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m},...d!==void 0&&{perms:d},...p&&{roles:p}}),C=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt,tenantId:i})}var uE=/^[\w!#$%&'*.^`|~+-]+$/,ex=/^[ !#-:<-[\]-~]*$/,lE=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},xd=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let s=i.indexOf("=");if(s===-1)continue;let o=lE(i.substring(0,s));if(e&&e!==o||!uE.test(o)||o in n)continue;let a=lE(i.substring(s+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),ex.test(a)&&(n[o]=a.indexOf("%")!==-1?ss(a,yo):a,e))break}return n};var tx=(t,e,r={})=>{if(!uE.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Fc=(t,e,r)=>(e=encodeURIComponent(e),tx(t,e,r));var bd=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let s=e;return r==="secure"?s="__Secure-"+e:r==="host"&&(s="__Host-"+e),xd(n,s)[s]}return n?xd(n):{}};var rx=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Fc("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Fc("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Fc(t,e,{path:"/",...r}),n},qo=(t,e,r,n)=>{let i=rx(e,r,n);t.header("Set-Cookie",i,{append:!0})};var jo=(t,e,r)=>{let n=bd(t,e,r?.prefix);return qo(t,e,"",{...r,maxAge:0}),n};function Sd(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function Vc(t){return t==="cookie"||t==="both"}function nx(t){let e=t.tokenStrategy;return typeof e=="string"?Vc(e):Object.values(e).some(r=>r!==void 0&&Vc(r))}function Nd(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function ix(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function dE(t,e,r,n,i){let s=r.refreshTokenCookie??{},o=i??ix(r,n),a=Sd(r,o),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=Nd(r,o);sx(t,c,{...s,name:l})}if(a==="cookie"){let{refreshToken:l,...d}=e;return d}return e}function pE(t,e,r){if(!(r?Vc(Sd(e,r)):nx(e)))return;let i=e.refreshTokenCookie??{},s={path:i.path??"/",...i.domain?{domain:i.domain}:{}},o=e.audienceCookieNames?.cookieNames;if(o&&!r){let c=i.name??"refresh_token",l=new Set([o.customer??c,o.tenant??c,o.system??c]);for(let d of l)jo(t,d,s);return}let a=Nd(e,r);jo(t,a,s)}function Bc(t,e,r){let n=Sd(e,r);if(!Vc(n)||!t)return;let i=Nd(e,r);return ox(t,i)}function sx(t,e,r){qo(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function ox(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var fE=new Set(["customer","tenant","system"]);function Ue(t,e){let r=[];if(e.auth!==!1&&r.push(Io({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(xo(a))}let n=async a=>{let c=sr(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let d=a.get("authResult"),p={body:bo(a),query:No(a),params:So(a),user:d?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},m=await e.handler(p),E=e.successStatus;if(m.ok&&m.data!==void 0&&e.tokenMode==="auth"){let v=m.data,b=typeof v.tenantId=="string"?v.tenantId:void 0,k=p.authContextHeader,C=b!==void 0?void 0:typeof k=="string"&&fE.has(k)?k:void 0,L=dE(a,v,t,b,C),B={...m,data:L};return qe(a,B,{traceId:c,...E!==void 0?{successStatus:E}:{}})}if(m.ok&&e.tokenMode==="logout"){let v=p.authContextHeader,b=typeof v=="string"&&fE.has(v)?v:void 0;pE(a,t,b)}return qe(a,m,{traceId:c,...E!==void 0?{successStatus:E}:{}})}catch(l){let d=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:d}})),qe(a,u(oe.InternalError()),{traceId:c})}},i=[...r,n],o=async(a,c)=>{let l,d=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let m=i[p],E=await m(a,async()=>{await d(p+1)});E instanceof Response&&(l=E)};return await d(0),l};return o.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},o}function jr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function mE(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function hE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function EE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function yE(t){return{plugins:{database:t.plugins.database}}}var dj=we(h(),ht(320)),pj=we(h(),ht(4096));function gE(t){return Ue(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Lt.authenticate.body},handler:async e=>{let r=jr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Mo(n,r)}})}function vE(t){return Ue(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeChallenge.body},handler:async e=>{let r=jr(t.auth);return Ko({challengeId:e.body.challengeId,code:e.body.code},r)}})}function AE(t){return Ue(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Ho({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function TE(t){return Ue(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Lt.issueMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Fo({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function qc(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var ax=new Set(["customer","tenant","system"]);function IE(t){return Ue(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&ax.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=hE(t.auth);return Uc({refreshToken:a},c)}})}function cx(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function Un(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=cx(e);return typeof r?.sid=="string"?r.sid:void 0}function _E(t){return Ue(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return u(oe.NotAuthenticated())}let n=yE(t.auth);return Uo({userId:e.user.id},n)}})}var lx=new Set(["customer","tenant","system"]);function xE(t){return Ue(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&lx.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=EE(t.auth);return Lc({refreshToken:a},c)}})}function bE(t){return Ue(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Lt.register.body},handler:async e=>{let r=mE(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Vo(n,r)}})}function SE(t){return Ue(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Lt.selectTenant.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(!r)return u(oe.NotAuthenticated());let n=jr(t.auth);return Bo({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Go={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function jc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Go.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return u(Go.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return u(i.errors,i.meta);let s=i.data??[];t.verifiedOnly&&(s=s.filter(a=>a.verifiedAt!==null));let o=s.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return g({authenticators:o,total:o.length})}var un={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:X("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:X("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:X("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:X("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:X("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var dn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Gc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(un.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(un.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(un.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok||!i.data)return u(un.AUTHENTICATOR_NOT_FOUND());let s=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(s.ok===!1)return u(s.errors,s.meta);let o=s.data??[],a=o.filter(b=>b.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return u(un.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let b=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(b.ok===!1)return u(b.errors,b.meta);let k=b.data;if(k&&k.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:k.value,data:k.data??{}},credentialValue:t.password})).ok===!1)return u(un.INVALID_PASSWORD())}let d=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(d.ok===!1)return u(d.errors,d.meta);let m=o.filter(b=>b.method===t.method&&(b.id!==t.authenticatorId||b.method!==t.method)).length,E=a.length>1||a.length===1&&!l;await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:E,remainingCount:m}});let v={method:t.method,mfaStillEnabled:E,remainingCount:m};return t.authenticatorId!==void 0&&(v.authenticatorId=t.authenticatorId),g(v)}var pn={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function $c(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(pn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(pn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(pn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return u(pn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return u(pn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let s=await i.setup({userId:t.userId,data:t.data||{}},e);if(s.ok===!1)return u(s.errors,s.meta);if(!s.ok)return u(pn.INTERNAL_ERROR());let o=s.data;if(o.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:o.credentialData});if(l.ok===!1)return u(l.errors,l.meta)}await Ie({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=o;return g({method:t.method,data:c})}var Et={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:T("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:T("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:T("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:T("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:X("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:X("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:T("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:V.INTERNAL_ERROR};var NE=["totp","webauthn","passkey","hardware"],wE=["email","sms","phone"],ux=new Set([...NE,...wE]);async function Wc(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return u(Et.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!ux.has(i))return u(Et.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return u(Et.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Et.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Et.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Et.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return u(Et.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return u(Et.MFA_NOT_ENABLED());if(!t.password)return u(Et.PASSWORD_REQUIRED());let i=await dx(t.userId,t.password,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await px(t.userId,t.mfaMethods,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return u(i.errors,i.meta)}return await Ie({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),g()}async function dx(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let s=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return s.ok===!1?u(s.errors,s.meta):g()}async function px(t,e,r){let n=e.filter(s=>NE.includes(s)),i=e.filter(s=>wE.includes(s));if(n.length>0){let s=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let s=await r.plugins.database.identities.getByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}return g()}var Tr={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:T("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:T("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function zc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Tr.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Tr.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Tr.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok)return u(Tr.INTERNAL_ERROR());let s=i.data;if(!s)return u(Tr.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return u(Tr.MFA_NOT_AVAILABLE());let o=e.plugins.mfa[t.method];if(!o?.verifyWithCredentials)return u(Tr.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await o.verifyWithCredentials({credentialData:s.data,data:t.data||{}});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Tr.INTERNAL_ERROR());let c=a.data;if(!c.verified)return g({method:t.method,verified:!1,data:c.data||{}});if(!s.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return u(l.errors,l.meta);let d=n.mfaMethods||[];if(!d.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...d,t.method]);if(p.ok===!1)return u(p.errors,p.meta)}}return await Ie(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),g({method:t.method,verified:!0,data:c.data||{}})}function $o(t){return{system:{systemId:t.system.system.systemId}}}function RE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function OE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function kE(t){return{plugins:{database:t.plugins.database},system:$o(t)}}function CE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function DE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function PE(t){return Y(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=kE(t.auth);return jc({userId:e.user.id},r)}})}function UE(t){return Y(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:vr.removeAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=CE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Gc(n,r)}})}function LE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:vr.setupAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=RE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),$c(n,r)}})}function ME(t){return Y(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:vr.updateMfaSettings.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=DE(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),Wc(n,r)}})}function KE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:vr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=OE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),zc(n,r)}})}var Jc={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Yc(t,e){if(!await e.plugins.database.users.getById(t.userId))return u(Jc.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(!i)return g([]);let s=i.map(o=>{let a={provider:o.provider,externalId:o.externalId,linkedAt:o.createdAt};return o.externalEmail&&(a.externalEmail=o.externalEmail),o.externalName&&(a.externalName=o.externalName),a});return g(s)}var bt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:T("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:T("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:T("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function fx(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return u(V.DATABASE_ERROR());let d=l.data;if(d.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(d.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let m=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(m.ok===!1)return u(m.errors,m.meta)}return g(c)}let s=null;if(t.email){let c=Lo(or.EMAIL,e.plugins.identity);if(!c)return u(V.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),d=await e.plugins.database.identities.get(or.EMAIL,l);if(d.ok===!1)return u(V.DATABASE_ERROR());if(d.data){if(t.emailVerified!==!0)return u(bt.EMAIL_NOT_VERIFIED_BY_PROVIDER());s=d.data.userId;let p=await e.plugins.database.userAuths.get(s);if(!p.ok||!p.data)return u(V.DATABASE_ERROR());let m=p.data;if(m.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(m.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED())}}if(!s){if(!t.email)return u(bt.EMAIL_REQUIRED());s=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let k=t.name.trim().split(/\s+/);c=k[0]||"",l=k.slice(1).join(" ")||""}let d={id:s,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(d)).ok)return u(V.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:s,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(s),u(V.DATABASE_ERROR());let E=Lo(or.EMAIL,e.plugins.identity);if(!E)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(V.PLUGIN_NOT_FOUND());let v=E.normalize(t.email),b=await e.plugins.database.identities.create({type:or.EMAIL,value:v,userId:s,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(b.ok===!1)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(b.errors,b.meta)}let o={userId:s,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(o.externalEmail=t.email),t.name!==void 0&&(o.externalName=t.name),t.avatarUrl!==void 0&&(o.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(o);return a.ok===!1?u(a.errors,a.meta):g(s)}async function Xc(t,e){if(!t.provider)return u(bt.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return u(bt.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return u(bt.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return u(bt.PROVIDER_NOT_FOUND());let b=await r.verifyCredential(t.credential);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}else if(t.code){let b=await r.exchangeCodeForToken(t.code);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());let k=b.data;if(!k)return u(bt.CODE_EXCHANGE_FAILED());i=k.accessToken}if(!n){if(!i)return u(bt.INVALID_ACCESS_TOKEN());let b=await r.getUserProfile(i);if(b.ok===!1)return u(bt.PROFILE_FETCH_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}let s=await fx(n,e,t);if(!s.ok)return u(s.errors,s.meta);let o=s.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(o);if(!c.ok||!c.data)return u(V.DATABASE_ERROR());let l=await Br({userStatus:c.data.userStatus,userId:o,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return u(l.errors,l.meta);let{perms:d,roles:p,tenantType:m}=l.data,E={userId:o,...t.tenantId&&{tenantId:t.tenantId},...m&&{tenantType:m},...d!==void 0||p?{permissions:{...p&&{roles:p},...d!==void 0&&{perms:d}}}:{}},v=await On(E,a);return v.ok===!1?u(v.errors,v.meta):(await Ie(e,{event:"oauth_login_success",userId:o,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Mc(o,e),g({accessToken:v.data.accessToken,refreshToken:v.data.refreshToken,expiresAt:v.data.expiresAt}))}catch(n){return await Ie(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),u(bt.PROFILE_FETCH_FAILED())}}var Mt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:T("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:T("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function Qc(t,e){if(!t.code)return u(Mt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return u(Mt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return u(Mt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let m=await n.exchangeCodeForToken(t.code);if(m.ok===!1)return u(Mt.CODE_EXCHANGE_FAILED());let E=m.data;if(!E)return u(Mt.CODE_EXCHANGE_FAILED());i=E.accessToken}if(!i)return u(Mt.INVALID_ACCESS_TOKEN());let s=await n.getUserProfile(i);if(s.ok===!1)return u(Mt.PROFILE_FETCH_FAILED());let o=s.data;if(!o)return u(Mt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,o.id);if(a.ok===!1)return u(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?u(Mt.PROVIDER_ALREADY_LINKED()):u(Mt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:o.id,createdAt:new Date};o.email!==void 0&&(l.externalEmail=o.email),o.name!==void 0&&(l.externalName=o.name),o.avatarUrl!==void 0&&(l.externalAvatarUrl=o.avatarUrl);let d=await e.plugins.database.userProviders.create(l);if(d.ok===!1)return u(d.errors,d.meta);let p=d.data;return p?(await Ie(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:o.id}}),g(p)):u(Mt.PROFILE_FETCH_FAILED())}catch(i){return await Ie(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),u(Mt.PROFILE_FETCH_FAILED())}}var Es={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:T("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:T("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function Zc(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return u(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return u(Es.PROVIDER_NOT_LINKED());let i=n.find(o=>o.provider===t.provider);if(!i)return u(Es.PROVIDER_NOT_LINKED());if(n.length<=1){let o=await e.plugins.database.identities.getByUserId(t.userId);if(!(o.ok&&o.data&&o.data.length>0))return u(Es.CANNOT_UNLINK_LAST_PROVIDER())}let s=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return s.ok===!1?u(s.errors,s.meta):(await Ie(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),g())}function HE(t){return Y(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Yc({userId:e.user.id},r)}})}function FE(t){return Y(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:an.linkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),Qc(n,r)}})}function VE(t){return Ue(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:an.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),Xc(n,r)}})}function BE(t){return Y(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:an.unlinkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Zc({userId:e.user.id,provider:e.body.provider},r)}})}var Ot={PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:T("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:T("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:T("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:T("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},Ir={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:Ot.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:Ot.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:Ot.SAME_PASSWORD},fi={EMAIL_SYSTEM_NOT_AVAILABLE:Ot.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:Ot.SEND_EMAIL_ERROR},Bt={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:Ot.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:Ot.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:Ot.CHALLENGE_ALREADY_USED,INVALID_CODE:Ot.INVALID_CODE,TOO_MANY_ATTEMPTS:Ot.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:Ot.AUTH_SCOPE_MISMATCH};async function ys(t,e){if(!e.plugins.credential?.password)return u(Ir.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Ir.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Ir.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return u(Ir.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return u(Ir.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Ir.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return u(l.errors,l.meta);let d=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return d.ok===!1&&console.error("Failed to revoke sessions after password change:",d.errors),await Ie(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),g()}async function gs(t,e){if(!e.plugins.emailSystem)return u(fi.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=ln(6),s=await qr(i),o=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return g({challengeId:`fake_challenge_${Date.now()}`,expiresAt:o});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===_e.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return g({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),d=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:_e.PASSWORD_RESET,status:Fe.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:s,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:o});if(d.ok===!1)return u(d.errors,d.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:o.toISOString(),purpose:_e.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),u(fi.SEND_EMAIL_ERROR());let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=!c||c.purpose===_e.PASSWORD_RESET;return await Promise.all([v?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:_e.PASSWORD_RESET,channel:"email",expiresAt:o,resendAvailableAt:E}}):Promise.resolve(),Ie(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),g({challengeId:l,expiresAt:o})}async function vs(t,e){if(!e.plugins.credential?.password)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Bt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==_e.PASSWORD_RESET)return u(Bt.CHALLENGE_NOT_FOUND());if(i.status!==Fe.PENDING)return u(Bt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return u(Bt.CHALLENGE_EXPIRED());let s=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(s.ok===!1)return s.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?u(Bt.TOO_MANY_ATTEMPTS()):u(s.errors,s.meta);if(!i.codeHash)return u(Bt.INVALID_CODE());if(!await ps(t.code,i.codeHash))return u(Bt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,dn.PASSWORD);if(l.ok===!1)return u(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return u(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:dn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return u(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let d=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return d.ok===!1&&console.error("Failed to revoke sessions after password reset:",d.errors),await Ie(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),g()}var el={NO_CHANGES_PROVIDED:T("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function tl(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return u(el.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return u(V.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return u(V.INTERNAL_ERROR());await Ie(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let o=await e.plugins.database.users.getById(t.userId);return!o.ok||o.data===null?u(V.NOT_FOUND()):g(o.data)}function As(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function qE(t){return Ue(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:sn.changePassword.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=As(t.auth),n=e.body,i=Un(e.authorizationHeader);return ys({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function jE(t){return Ue(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:sn.forgotPassword.body},handler:async e=>{let r=As(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),gs(n,r)}})}function GE(t){return Y(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:sn.resetPassword.body},handler:async e=>{let r=As(t.auth);return vs({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var Wo={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:T("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to delete session")};async function zo(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?u(Wo.DATABASE_ERROR()):(await Ie(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),g())}var Jo={DATABASE_ERROR:T("DATABASE_ERROR","Failed to retrieve sessions")};async function Yo(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return u(Jo.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return g(a,i.meta)}var Ts={INVALID_TOKEN:T("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to revoke token")};async function Xo(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?u(Ts.DATABASE_ERROR()):(await Ie(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),g()):u(Ts.INVALID_TOKEN())}function $E(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function WE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function zE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function JE(t){return Y(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:on.deleteSession.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=WE(t.auth);return zo({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function YE(t){return Ue(t,{method:"GET",path:"/sessions",auth:!0,input:{query:on.listSessions.query},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=$E(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Yo(n,r);if(!i.ok)return i;let s=Un(e.authorizationHeader);if(s&&i.data){let o=i.data.map(a=>a.id===s?{...a,isCurrent:!0}:a);return g(o,i.meta)}return i}})}function XE(t){return Y(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:on.revokeToken.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=zE(t.auth);return Xo({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},Qo=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Zo(t,e){return t===void 0?!1:(t&e)===e}var wd={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},QE=Object.fromEntries(Object.entries(wd).map(([t,e])=>[e,Number(t)]));function Qt(t){return t?Object.entries(wd).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function Ln(t){let e=0;for(let r of t){let n=QE[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Zt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var Gr={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:T("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),DATABASE_ERROR:V.DATABASE_ERROR};var mx={IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:T("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:T("IDENTITY_ALREADY_EXISTS","This identity is already registered")},hx={GUARD_LOCKED:T("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},Ex={INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:T("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:T("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:T("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:T("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},yx={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:T("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:T("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:T("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},gx={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:T("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:T("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},vx={MFA_NOT_CONFIGURED:T("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:T("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:T("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:T("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Ax={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:T("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:T("INVALID_SESSION","Invalid session")},Tx={TOKEN_NOT_FOUND:T("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:T("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:T("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:T("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:T("TOKEN_VERIFICATION_FAILED","Token verification failed")},kt={NOT_MEMBER_OF_TENANT:T("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:T("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:T("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:T("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:T("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},Z$={...mx,...hx,...Ex,...yx,...gx,...vx,...Ax,...Tx,...kt};async function Is(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Gr.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let k=await s.tenantInvites.getById(r);if(!k.ok)return u(k.errors,k.meta);o=k.data}else if(n){let k=await s.tenantInvites.getByToken(n);if(!k.ok)return u(k.errors,k.meta);o=k.data}if(!o)return u(Gr.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Gr.INVITE_NOT_PENDING());if(o.expiresAt<new Date)return u(Gr.INVITE_EXPIRED());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Gr.INVITE_USER_MISMATCH());if(!o.inviteeUserId&&(o.inviteeEmail||o.inviteePhone)){let k=await s.identities.getByUserId(i);if(!k.ok)return u(k.errors,k.meta);let C=k.data.filter(j=>j.verifiedAt!==null),L=(j,$)=>{let te=$.trim().toLowerCase();return C.some(A=>A.type===j&&A.value.trim().toLowerCase()===te)},B=o.inviteeEmail?L("email",o.inviteeEmail):!1,G=o.inviteePhone?L("phone",o.inviteePhone):!1;if(!B&&!G)return u(Gr.INVITE_IDENTITY_MISMATCH())}let a=await s.tenantMembers.get(o.tenantId,i);if(!a.ok)return u(a.errors,a.meta);if(a.data&&a.data.status!==lt.REMOVED)return u(Gr.ALREADY_MEMBER());let c=await s.tenants.get(o.tenantId);if(!c.ok)return u(c.errors,c.meta);if(o.authPerm!==void 0&&(o.authPerm&Qo)!==0){if(!c.data)return u(kt.TENANT_NOT_FOUND());if(c.data.type!==Zt.SYSTEM)return u(kt.ACCOUNT_PERMS_SYSTEM_ONLY())}let l={tenantId:o.tenantId,userId:i,status:lt.ACTIVE,isOwner:!1,tenantType:o.tenantType};c.data?.parentTenantId!==void 0&&(l.parentTenantId=c.data.parentTenantId),o.roles!==void 0&&(l.roles=o.roles),o.perms!==void 0&&(l.perms=o.perms),o.authPerm!==void 0&&(l.authPerm=o.authPerm);let d=await s.tenantMembers.create(l);if(!d.ok)return u(d.errors,d.meta);let p={tenantId:o.tenantId,userId:i},m=await s.users.getById(i);m.ok&&m.data&&(m.data.contactEmail&&(p.contactEmail=m.data.contactEmail),m.data.contactPhone&&(p.contactPhone=m.data.contactPhone),m.data.displayName&&(p.displayName=m.data.displayName),m.data.givenName&&(p.givenName=m.data.givenName),m.data.familyName&&(p.familyName=m.data.familyName),m.data.avatarUrl&&(p.avatarUrl=m.data.avatarUrl),m.data.locale&&(p.locale=m.data.locale)),o.displayName&&(p.displayName=o.displayName),o.givenName&&(p.givenName=o.givenName),o.familyName&&(p.familyName=o.familyName),o.jobTitle&&(p.jobTitle=o.jobTitle);let E=await s.userTenantProfiles.create(p);if(!E.ok)return u(E.errors,E.meta);let v=await s.tenantInvites.updateStatus(o.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!v.ok)return u(v.errors,v.meta);let b={tenantId:o.tenantId};return o.roles!==void 0&&(b.roles=o.roles),o.perms!==void 0&&(b.perms=o.perms),o.authPerm!==void 0&&(b.authPerm=o.authPerm),g(b)}var mi={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function hi(t,e,r){if(t===void 0||(t&Qo)===0)return g(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g(void 0):u(kt.TENANT_NOT_FOUND()):u(n.errors,n.meta)}var rl={NOT_MEMBER:kt.NOT_MEMBER_OF_TENANT,SUSPENDED:kt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:kt.INSUFFICIENT_TENANT_PERMISSIONS};async function ut(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,s=await e.tenantMembers.get(r,n);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(rl.NOT_MEMBER());let o=s.data;return o.status!==lt.ACTIVE?u(rl.SUSPENDED()):o.isOwner?g(o):Zo(o.authPerm,i)?g(o):u(rl.INSUFFICIENT_PERMISSIONS())}async function nl(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(t.authPerm!==void 0&&(t.authPerm&se.CHANGE_MEMBER_PERMISSION)!==0&&!o.data.isOwner)return u(mi.CANNOT_ESCALATE_PERMISSIONS());let a=await hi(t.authPerm,r,s.tenants);if(!a.ok)return u(a.errors,a.meta);let c=await s.users.getById(n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(mi.USER_NOT_FOUND());let l=c.data,d=await s.tenantMembers.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(d.data&&d.data.status!==lt.REMOVED)return u(mi.ALREADY_MEMBER());let p=await s.tenants.get(r);if(!p.ok)return u(p.errors,p.meta);if(!p.data)return u(mi.TENANT_NOT_FOUND());let m=p.data,E={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!1,tenantType:m.type};m.parentTenantId!==void 0&&(E.parentTenantId=m.parentTenantId),t.roles!==void 0&&(E.roles=t.roles),t.perms!==void 0&&(E.perms=t.perms),t.authPerm!==void 0&&(E.authPerm=t.authPerm);let v=await s.tenantMembers.create(E);if(!v.ok)return u(v.errors,v.meta);let b={tenantId:r,userId:n};l.contactEmail&&(b.contactEmail=l.contactEmail),l.contactPhone&&(b.contactPhone=l.contactPhone),l.displayName&&(b.displayName=l.displayName),l.givenName&&(b.givenName=l.givenName),l.familyName&&(b.familyName=l.familyName),l.avatarUrl&&(b.avatarUrl=l.avatarUrl),l.locale&&(b.locale=l.locale),t.contactEmail!==void 0&&(b.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(b.contactPhone=t.contactPhone),t.displayName!==void 0&&(b.displayName=t.displayName),t.givenName!==void 0&&(b.givenName=t.givenName),t.familyName!==void 0&&(b.familyName=t.familyName),t.avatarUrl!==void 0&&(b.avatarUrl=t.avatarUrl),t.locale!==void 0&&(b.locale=t.locale),t.jobTitle!==void 0&&(b.jobTitle=t.jobTitle),t.bio!==void 0&&(b.bio=t.bio),t.metadata!==void 0&&(b.metadata=t.metadata);let k=await s.userTenantProfiles.create(b);return k.ok?g({tenantId:r,userId:n}):u(k.errors,k.meta)}var _s={TENANT_ALREADY_HAS_OWNER:T("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:T("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:V.DATABASE_ERROR};async function il(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:s,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k}=t,C=e.plugins.database,L=i??"org";if(L===Zt.SYSTEM)return u(_s.SYSTEM_TYPE_FORBIDDEN());let B=await C.users.getById(n);if(!B.ok)return u(B.errors,B.meta);if(!B.data)return u(_s.USER_NOT_FOUND());let G=await C.tenants.get(r);if(!G.ok)return u(G.errors,G.meta);if(!G.data){let S={id:r,type:L,ownerId:n};s!==void 0&&(S.parentTenantId=s);let y=await C.tenants.create(S);if(!y.ok)return u(y.errors,y.meta)}let j=await C.tenantMembers.hasOwner(r);if(!j.ok)return u(j.errors,j.meta);if(j.data)return u(_s.TENANT_ALREADY_HAS_OWNER());let $=G.data?.parentTenantId??s,te={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!0,tenantType:L};$!==void 0&&(te.parentTenantId=$);let A=await C.tenantMembers.create(te);if(!A.ok)return u(A.errors,A.meta);let x=await C.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k});return x.ok?g({tenantId:r,userId:n}):u(x.errors,x.meta)}async function sl(t,e){let{email:r,phone:n}=t,i=e.plugins.database,s=[],o=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}return g({pendingInvites:s})}var Ei={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),DATABASE_ERROR:V.DATABASE_ERROR};async function xs(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Ei.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let c=await s.tenantInvites.getById(r);if(!c.ok)return u(c.errors,c.meta);o=c.data}else if(n){let c=await s.tenantInvites.getByToken(n);if(!c.ok)return u(c.errors,c.meta);o=c.data}if(!o)return u(Ei.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Ei.INVITE_NOT_PENDING());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Ei.INVITE_USER_MISMATCH());let a=await s.tenantInvites.updateStatus(o.id,{status:ar.DECLINED,declinedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}async function yi(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[s,o]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(kt.NOT_MEMBER_OF_TENANT());if(!o.ok)return u(o.errors,o.meta);let a=s.data,c=o.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),g(l)}var qt={INVITEE_REQUIRED:T("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:X("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:T("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:X("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};function Ix(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function bs(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:s,inviteePhone:o,roles:a,perms:c,authPerm:l,displayName:d,givenName:p,familyName:m,jobTitle:E}=t,v=e.plugins.database,b=await ut({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!b.ok)return u(b.errors,b.meta);if(l!==void 0&&(l&se.CHANGE_MEMBER_PERMISSION)!==0&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());if(a?.includes("owner")&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());let k=await hi(l,r,v.tenants);if(!k.ok)return u(k.errors,k.meta);if(!i&&!s&&!o)return u(qt.INVITEE_REQUIRED());if(i){let R=await v.users.getById(i);if(!R.ok)return u(R.errors,R.meta);if(!R.data)return u(qt.INVITEE_USER_NOT_FOUND({userId:i}));let N=await v.tenantMembers.get(r,i);if(!N.ok)return u(N.errors,N.meta);if(N.data&&N.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER());let O=await v.tenantInvites.findByTenantAndUserId(r,i);if(!O.ok)return u(O.errors,O.meta);if(O.data)return u(qt.INVITE_ALREADY_EXISTS())}if(s){let R=await v.identities.get("email",s);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndEmail(r,s);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}if(o){let R=await v.identities.get("phone",o);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndPhone(r,o);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}let C=await v.tenantInvites.countPendingByTenant(r);if(!C.ok)return u(C.errors,C.meta);if(C.data>=e.security.maxPendingInvitesPerTenant)return u(qt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let L,B,G,j=await v.users.getById(n);j.ok&&j.data&&(j.data.displayName!==void 0&&(L=j.data.displayName),j.data.contactEmail!==void 0&&(B=j.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(L=$.data.displayName),$.data.jobTitle!==void 0&&(G=$.data.jobTitle));let te=Zt.DEFAULT,A=await v.tenants.get(r);A.ok&&A.data&&(te=A.data.type);let x=v.tenantInvites.generateInviteId(),S=Ix(),y=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),I={id:x,tenantId:r,tenantType:te,invitedById:n,status:ar.PENDING,inviteToken:S,expiresAt:y};L!==void 0&&(I.invitedByName=L),B!==void 0&&(I.invitedByEmail=B),G!==void 0&&(I.invitedByJobTitle=G),i!==void 0&&(I.inviteeUserId=i),s!==void 0&&(I.inviteeEmail=s),o!==void 0&&(I.inviteePhone=o),a!==void 0&&(I.roles=a),c!==void 0&&(I.perms=c),l!==void 0&&(I.authPerm=l),d!==void 0&&(I.displayName=d),p!==void 0&&(I.givenName=p),m!==void 0&&(I.familyName=m),E!==void 0&&(I.jobTitle=E);let w=await v.tenantInvites.create(I);return w.ok?g({inviteId:x,inviteToken:S,expiresAt:y}):u(w.errors,w.meta)}async function Ss(t,e){let{tenantId:r,actorUserId:n,status:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await s.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?g(c.data,c.meta):u(c.errors,c.meta)}async function Ns(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,s=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return u(s.errors,s.meta);let o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(o).length>0?o:void 0);return a.ok?g(a.data,a.meta):u(a.errors,a.meta)}async function ol(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let s=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return s.ok?g(s.data,s.meta):u(s.errors,s.meta)}var gi={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:T("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:T("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:V.DATABASE_ERROR};async function ws(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(i===n)return u(gi.CANNOT_REMOVE_SELF());let a=await s.tenantMembers.get(r,n);if(!a.ok)return u(a.errors,a.meta);if(!a.data)return u(gi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!o.data.isOwner)return u(gi.CANNOT_MODIFY_OWNER());if(c.isOwner){let d=await s.tenantMembers.listByTenant(r);if(!d.ok)return u(d.errors,d.meta);if(d.data.filter(m=>m.isOwner&&m.status===lt.ACTIVE).length<=1)return u(gi.CANNOT_REMOVE_LAST_OWNER())}let l=await s.tenantMembers.remove(r,n);return l.ok?(await s.userTenantProfiles.remove(r,n),g(void 0)):u(l.errors,l.meta)}var ea={INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rs(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,s=await i.tenantInvites.getById(r);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(ea.INVITE_NOT_FOUND());let o=await ut({tenantId:s.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(s.data.status!==ar.PENDING)return u(ea.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}var Mn={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};async function Os(t,e){let{tenantId:r,userId:n,actorUserId:i,role:s,perms:o,authPerm:a}=t,c=t.roles??(s!==void 0?[s]:void 0),l=e.plugins.database,d=await ut({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!d.ok)return u(d.errors,d.meta);let p=d.data;if(i===n)return u(Mn.CANNOT_MODIFY_SELF());let m=await l.tenantMembers.get(r,n);if(!m.ok)return u(m.errors,m.meta);if(!m.data)return u(Mn.MEMBER_NOT_FOUND());if(m.data.isOwner)return u(Mn.CANNOT_MODIFY_OWNER());if(a!==void 0&&!p.isOwner&&(a&se.CHANGE_MEMBER_PERMISSION)!==0)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());if(c?.includes("owner")&&!p.isOwner)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());let E=await hi(a,r,l.tenants);if(!E.ok)return u(E.errors,E.meta);let v={};if(c!==void 0&&(v.roles=c),o!==void 0&&(v.perms=o),a!==void 0&&(v.authPerm=a),Object.keys(v).length>0){let b=await l.tenantMembers.updatePermissions(r,n,v);if(!b.ok)return u(b.errors,b.meta)}return g(void 0)}var ta={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rd(t,e){let{tenantId:r,userId:n,actorUserId:i,status:s}=t,o=e.plugins.database,a=await ut({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:o.tenantMembers});if(!a.ok)return u(a.errors,a.meta);if(i===n)return u(ta.CANNOT_MODIFY_SELF());let c=await o.tenantMembers.get(r,n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(ta.MEMBER_NOT_FOUND());if(c.data.isOwner)return u(ta.CANNOT_MODIFY_OWNER());let l=await o.tenantMembers.updateStatus(r,n,s);return l.ok?g(void 0):u(l.errors,l.meta)}var al={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:T("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:V.DATABASE_ERROR};async function ks(t,e){let{tenantId:r,userId:n,...i}=t,s=e.plugins.database,o=await s.tenantMembers.get(r,n);if(!o.ok)return u(o.errors,o.meta);if(!o.data)return u(al.MEMBER_NOT_FOUND());let a=o.data,c=a.isOwner||Zo(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let d=await s.userTenantProfiles.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(!d.data){let m=await s.userTenantProfiles.create({tenantId:r,userId:n,...l});return m.ok?g(void 0):u(m.errors,m.meta)}let p=await s.userTenantProfiles.update(r,n,l);return p.ok?g(void 0):u(p.errors,p.meta)}var _x=10080,xx=100;function bx(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??_x,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??xx}}}var $r=H({tenantId:we(h(),id(1))}),Sx=H({limit:_(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:_(h())}),Nx=we(H({inviteeEmail:_(we(h(),rn())),inviteeUserId:_(h()),inviteePhone:_(h()),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),Cc(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),ZE=we(H({inviteId:_(h()),inviteToken:_(h())}),Cc(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),wx=H({inviteId:h()}),Rx=H({status:_(h()),limit:_(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:_(h())}),Ox=H({userId:h(),role:_(h()),roles:_(Z(h())),authPerms:_(Z(h()))}),kx=H({userId:h()}),Cx=H({contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))});function ey(t){let{auth:e,policy:r}=t,n=Y(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r},handler:async E=>{let v=await yi({tenantId:E.params.tenantId,userId:E.user.id},e);if(!v.ok)return v;let b=v.data;if(!b)return g({});let{authPerm:k,...C}=b;return g({...C,authPerms:Qt(k)})}}),i=Y(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Cx},handler:async E=>{let v=E.params.tenantId,b=E.user.id,k={tenantId:v,userId:b},C=E.body;C.contactEmail!==void 0&&(k.contactEmail=C.contactEmail),C.contactPhone!==void 0&&(k.contactPhone=C.contactPhone),C.displayName!==void 0&&(k.displayName=C.displayName),C.givenName!==void 0&&(k.givenName=C.givenName),C.familyName!==void 0&&(k.familyName=C.familyName),C.avatarUrl!==void 0&&(k.avatarUrl=C.avatarUrl),C.locale!==void 0&&(k.locale=C.locale),C.bio!==void 0&&(k.bio=C.bio),C.jobTitle!==void 0&&(k.jobTitle=C.jobTitle),C.metadata!==void 0&&(k.metadata=C.metadata);let L=await ks(k,e);if(!L.ok)return L;let B=await yi({tenantId:v,userId:b},e);if(!B.ok)return B;let G=B.data;if(!G)return g({});let{authPerm:j,...$}=G;return g({...$,authPerms:Qt(j)})}}),s=Y(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Nx},handler:async E=>{let{inviteeEmail:v,inviteeUserId:b,inviteePhone:k,role:C,roles:L,authPerms:B,displayName:G,givenName:j,familyName:$,jobTitle:te}=E.body,A={tenantId:E.params.tenantId,invitedBy:E.user.id};return v!==void 0&&(A.inviteeEmail=v),b!==void 0&&(A.inviteeUserId=b),k!==void 0&&(A.inviteePhone=k),C!==void 0&&(A.role=C),L!==void 0&&(A.roles=L),B!==void 0&&(A.authPerm=Ln(B)),G!==void 0&&(A.displayName=G),j!==void 0&&(A.givenName=j),$!==void 0&&(A.familyName=$),te!==void 0&&(A.jobTitle=te),bs(A,bx(t))}}),o=Y(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Rx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.status!==void 0&&(v.status=E.query.status),E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ss(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g(k,b.meta)}}),a=Y(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken);let b=await Is(v,e);if(!b.ok)return b;let k=b.data;if(!k)return b;let{authPerm:C,...L}=k;return g({...L,authPerms:Qt(C)})}}),c=Y(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};return E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken),xs(v,e)}}),l=Y(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:wx},handler:async E=>Rs({inviteId:E.body.inviteId,revokedBy:E.user.id},e)}),d=Y(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Sx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ns(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g({members:k},b.meta)}}),p=Y(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Ox},handler:async E=>{let v={tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id};return E.body.role!==void 0&&(v.role=E.body.role),E.body.roles!==void 0&&(v.roles=E.body.roles),E.body.authPerms!==void 0&&(v.authPerm=Ln(E.body.authPerms)),Os(v,e)}}),m=Y(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:kx},handler:async E=>ws({tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id},e)});return nd("/tenants",[n,i,s,o,a,c,l,d,p,m])}function ty(t){return Y(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Do.updateProfile.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),tl(n,r)}})}function cl(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function ry(t){return Ue(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:ui.resendVerification.body},handler:async e=>{let r=cl(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),fs(n,r)}})}function ny(t){return Y(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:ui.verifyCode.body},handler:async e=>{let r=cl(t.auth);return hs({challengeId:e.body.challengeId,code:e.body.code},r)}})}var Od="oauth_state",Dx=600;function iy(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function sy(t,e,r){qo(t,Od,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:Dx})}function Px(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function oy(t,e){let r=bd(t,Od);return jo(t,Od,{path:"/"}),!r||!e?!1:Px(r,e)}function Ux(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function Lx(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function ay(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:s=[]}=e;return async(o,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=Ux(o),d=await Lx(o,s),p=[`${i}:ip:${l}`];d&&p.push(`${i}:id:${d}`);for(let m of p){let E=await c.consume(m,{limit:r,windowMs:n});if(!E.allowed){let v=Math.ceil(E.retryAfterMs/1e3);return o.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(v)})}}return a()}}function Le(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function cy(t,e,r={}){let n=Object.keys(r).length===0,i=o=>n||r[o]!==!1;t.get("/health",o=>o.json({ok:!0},200));let s=(o,a)=>t.use(o,ay(e.auth,a));if(s("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),s("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),s("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),s("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),s("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),s("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),s("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),s("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),s("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Le(t,gE(e)),Le(t,bE(e)),Le(t,IE(e)),Le(t,xE(e)),Le(t,_E(e)),Le(t,SE(e)),Le(t,vE(e)),Le(t,AE(e)),Le(t,TE(e))),i("password")&&(Le(t,qE(e)),Le(t,jE(e)),Le(t,GE(e))),i("verification")&&(Le(t,ny(e)),Le(t,ry(e))),i("sessions")&&(Le(t,YE(e)),Le(t,JE(e)),Le(t,XE(e))),i("mfa")&&(Le(t,LE(e)),Le(t,KE(e)),Le(t,PE(e)),Le(t,UE(e)),Le(t,ME(e))),i("oauth")){let o=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=iy();return sy(a,c,o),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let d=await a.req.raw.clone().json();typeof d.state=="string"&&(l=d.state)}catch{l=void 0}return l!==void 0&&!oy(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Le(t,VE(e)),Le(t,FE(e)),Le(t,BE(e)),Le(t,HE(e))}i("users")&&Le(t,ty(e)),i("tenants")&&t.route("",ey(e))}function kd(t){td(Fh);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:s,features:o}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),s&&s.length>0&&(a.trustedOrigins=s);let c=e.security.tokenAudiences?.cookieNames;if(c){let d={cookieNames:c};e.security.systemTenantId&&(d.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=d}let l=new Vr;return cy(l,a,o),l}async function Kn(t,e,r,n){let i=await ut({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return u(i.errors,i.meta);let s=await n.tenants.get(e);return s.ok?s.data?s.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g({actor:i.data}):u(kt.TENANT_NOT_FOUND()):u(s.errors,s.meta)}var fn={CANNOT_REMOVE_ACTIVE_ACCOUNT:T("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:T("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:T("NO_CHANGES","At least one field must be provided")};var Mx=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function Cd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=t.status??"active",s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let o=await r.users.getByStatus(i,s);if(!o.ok)return u(o.errors,o.meta);let a=[];for(let c of o.data){let l=await r.users.getById(c);if(l.ok&&l.data){let d=l.data,p={id:d.id,status:d.status,createdAt:d.createdAt,updatedAt:d.updatedAt};d.contactEmail!==void 0&&(p.contactEmail=d.contactEmail),d.contactPhone!==void 0&&(p.contactPhone=d.contactPhone),d.displayName!==void 0&&(p.displayName=d.displayName),a.push(p)}}return g(a,o.meta)}async function Dd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return u(i.errors,i.meta);if(!i.data)return u(V.NOT_FOUND());let s=i.data,o=await r.userAuths.get(t.userId),a={id:s.id,status:s.status,createdAt:s.createdAt,updatedAt:s.updatedAt,mfaRequired:o.ok&&o.data?o.data.mfaRequired:!1,mfaMethods:o.ok&&o.data?o.data.mfaMethods:null};return s.contactEmail!==void 0&&(a.contactEmail=s.contactEmail),s.contactPhone!==void 0&&(a.contactPhone=s.contactPhone),s.displayName!==void 0&&(a.displayName=s.displayName),s.givenName!==void 0&&(a.givenName=s.givenName),s.familyName!==void 0&&(a.familyName=s.familyName),s.avatarUrl!==void 0&&(a.avatarUrl=s.avatarUrl),s.locale!==void 0&&(a.locale=s.locale),s.username!==void 0&&(a.username=s.username),s.metadata!==void 0&&(a.metadata=s.metadata),g(a)}async function Pd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return u(fn.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?g(void 0):u(c.errors,c.meta)}async function Ud(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);if(!Mx.has(t.status))return u(fn.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.userAuths.updateStatus(t.userId,t.status);if(!o.ok)return u(o.errors,o.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?g(void 0):u(a.errors,a.meta)}async function Ld(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.credentials.getByUserId(t.userId);if(!o.ok)return u(o.errors,o.meta);for(let a of o.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return u(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return u(a.errors,a.meta)}return g(void 0)}async function Md(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(s.data.status===ye.ACTIVE)return u(fn.CANNOT_REMOVE_ACTIVE_ACCOUNT());let o=await r.credentials.getByUserId(t.userId);if(o.ok)for(let l of o.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?g(void 0):u(c.errors,c.meta)}var _r=H({message:_(h())}),ly=H({message:_(h()),tenantId:h(),userId:h()}),Kd={tenantId:h(),userId:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),displayNameSource:_(Xt(["user","admin","system"])),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))},uy=H({...Kd,status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),isOwner:It(),createdAt:h(),memberUpdatedAt:h(),profileUpdatedAt:_(h())}),Kx=H({...Kd,createdAt:h(),updatedAt:h()}),Hx=H({tenantId:h(),userId:h(),status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),isOwner:It(),createdAt:h(),updatedAt:h(),tenantProfile:_(Kx)}),dy=Z(Hx),py=H({tenantId:h(),userId:h()}),Fx=H({...Kd,status:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerm:_($e()),isOwner:It(),createdAt:h(),updatedAt:h()}),fy=Z(Fx),Vx=H({id:h(),name:_(h()),email:_(h()),jobTitle:_(h())}),my=H({id:h(),tenantId:h(),invitedBy:Vx,inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:Z(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h()),status:h(),expiresAt:h(),createdAt:h(),updatedAt:h()}),hy=Z(my),Ey=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),yy=H({tenantId:h(),userId:h()}),gy=H({invites:Z(my)}),Bx=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),status:h(),createdAt:h(),updatedAt:h()}),vy=Z(Bx),Ay=H({id:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),status:h(),createdAt:h(),updatedAt:h(),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),username:_(h()),metadata:_(me(h(),ge())),mfaRequired:It(),mfaMethods:ci(Z(h()))});var ll={limit:_(we($e(),wn())),cursor:_(h())},qx={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:H({tenantId:h(),userId:h(),tenantType:_(h()),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),displayNameSource:_(Xt(["user","admin","system"])),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))}),response:ly},jx={method:"POST",path:"/tenant/profile",kind:"data",body:H({tenantId:h(),userId:h()}),response:uy},Gx={method:"POST",path:"/tenant/profile/update",kind:"data",body:H({tenantId:h(),userId:h(),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),bio:_(h()),jobTitle:_(h()),metadata:_(me(h(),ge()))}),response:_r},$x={method:"POST",path:"/tenant/members/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),...ll}),response:dy},Wx={method:"POST",path:"/tenant/members/update-status",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),status:Xt(["invited","active","suspended","removed"])}),response:_r},zx={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h()))}),response:_r},Jx={method:"POST",path:"/tenant/members/remove",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h()}),response:_r},Yx={method:"POST",path:"/tenant/members/add",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h())),contactEmail:_(h()),contactPhone:_(h()),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),jobTitle:_(h()),bio:_(h()),metadata:_(me(h(),ge()))}),response:py},Xx={method:"POST",path:"/tenant/invites/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),status:_(Xt(["pending","accepted","declined","revoked","expired"])),...ll}),response:hy},Qx={method:"POST",path:"/tenant/invites/create",kind:"data",body:H({tenantId:h(),invitedBy:h(),inviteeUserId:_(h()),inviteeEmail:_(h()),inviteePhone:_(h()),roles:_(Z(h())),perms:_(me(h(),$e())),authPerms:_(Z(h())),displayName:_(h()),givenName:_(h()),familyName:_(h()),jobTitle:_(h())}),response:Ey},Iy=H({userId:h(),inviteId:_(h()),inviteToken:_(h())}),Zx={method:"POST",path:"/tenant/invites/accept",kind:"data",body:Iy,response:yy},eb={method:"POST",path:"/tenant/invites/decline",kind:"data",body:Iy,response:_r},tb={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:H({inviteId:h(),revokedBy:h()}),response:_r},rb={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:H({email:_(h()),phone:_(h())}),response:gy},nb={method:"POST",path:"/user/tenants/list",kind:"data",body:H({userId:h(),tenantType:_(h()),parentTenantId:_(h()),...ll}),response:fy},Cs={actorUserId:h(),systemTenantId:h()},ib={method:"POST",path:"/accounts/list",kind:"data",body:H({...Cs,status:_(Xt(["active","inactive"])),...ll}),response:vy},sb={method:"POST",path:"/accounts/get",kind:"data",body:H({...Cs,userId:h()}),response:Ay},ob={method:"POST",path:"/accounts/update-profile",kind:"data",body:H({...Cs,userId:h(),displayName:_(h()),givenName:_(h()),familyName:_(h()),avatarUrl:_(h()),locale:_(h()),contactEmail:_(h()),contactPhone:_(h()),metadata:_(me(h(),ge()))}),response:_r},ab={method:"POST",path:"/accounts/update-status",kind:"data",body:H({...Cs,userId:h(),status:Xt(["active","suspended","deleted"])}),response:_r},cb={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:H({...Cs,userId:h(),credentialType:_(h())}),response:_r},lb={method:"POST",path:"/accounts/remove",kind:"data",body:H({...Cs,userId:h()}),response:_r},Je={bootstrapTenantOwner:qx,getTenantProfile:jx,updateTenantProfile:Gx,listTenantMembers:$x,updateTenantMemberStatus:Wx,updateTenantMemberPermission:zx,removeTenantMember:Jx,addMemberToTenant:Yx,listTenantInvites:Xx,inviteToTenant:Qx,acceptInvite:Zx,declineInvite:eb,revokeInvite:tb,checkPendingInvites:rb,listUserTenants:nb,listAccounts:ib,getAccount:sb,updateAccountProfile:ob,updateAccountStatus:ab,resetAccountCredentials:cb,removeAccount:lb};var ub=3,db=10080,pb=100;function fb(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??db,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??pb}}}function Ds(t){return{plugins:{database:t.plugins.database}}}function mb(t){return Zu({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Hd(t){let{auth:e,internal:r}=t,n=mb(r),i=new Vr;i.use("/*",async(y,I)=>{let w=y.req.header("Authorization");if(!w){await I();return}let R=w.match(/^Bearer\s+(.+)$/i);if(!R){await I();return}let O=R[1].split(".");if(O.length!==3||!O[1]){await I();return}let P;try{let U=O[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(U))}catch{await I();return}if(P.typ!==ub)return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let U=P.roles,K=Array.isArray(U)?U:[];if(!r.requiredRoles.some(J=>K.includes(J)))return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let s=Y(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId};return y.body.tenantType!==void 0&&(I.tenantType=y.body.tenantType),y.body.contactEmail!==void 0&&(I.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(I.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.displayNameSource!==void 0&&(I.displayNameSource=y.body.displayNameSource),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(I.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(I.locale=y.body.locale),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(I.bio=y.body.bio),y.body.metadata!==void 0&&(I.metadata=y.body.metadata),il(I,e)}}),o=Y(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async y=>{let I=await yi({tenantId:y.body.tenantId,userId:y.body.userId},e);if(!I.ok)return I;let w=I.data;if(!w)return I;let{authPerm:R,...N}=w;return g({...N,authPerms:Qt(R)})}}),a=Y(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async y=>{let{tenantId:I,userId:w,...R}=y.body,N={tenantId:I,userId:w};return R.contactEmail!==void 0&&(N.contactEmail=R.contactEmail),R.contactPhone!==void 0&&(N.contactPhone=R.contactPhone),R.displayName!==void 0&&(N.displayName=R.displayName),R.givenName!==void 0&&(N.givenName=R.givenName),R.familyName!==void 0&&(N.familyName=R.familyName),R.avatarUrl!==void 0&&(N.avatarUrl=R.avatarUrl),R.locale!==void 0&&(N.locale=R.locale),R.bio!==void 0&&(N.bio=R.bio),R.jobTitle!==void 0&&(N.jobTitle=R.jobTitle),R.metadata!==void 0&&(N.metadata=R.metadata),ks(N,e)}}),c=Y(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async y=>{let I={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let w=await Ns(I,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),l=Y(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async y=>Rd({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId,status:y.body.status},e)}),d=Y(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),Os(I,e)}}),p=Y(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async y=>ws({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId},e)}),m=Y(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async y=>{let I={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),y.body.contactEmail!==void 0&&(I.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(I.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(I.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(I.locale=y.body.locale),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(I.bio=y.body.bio),y.body.metadata!==void 0&&(I.metadata=y.body.metadata),nl(I,e)}}),E=Y(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async y=>{let I={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.status!==void 0&&(I.status=y.body.status),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let w=await Ss(I,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),v=Y(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async y=>{let I={tenantId:y.body.tenantId,invitedBy:y.body.invitedBy};return y.body.inviteeUserId!==void 0&&(I.inviteeUserId=y.body.inviteeUserId),y.body.inviteeEmail!==void 0&&(I.inviteeEmail=y.body.inviteeEmail),y.body.inviteePhone!==void 0&&(I.inviteePhone=y.body.inviteePhone),y.body.roles!==void 0&&(I.roles=y.body.roles),y.body.perms!==void 0&&(I.perms=y.body.perms),y.body.authPerms!==void 0&&(I.authPerm=Ln(y.body.authPerms)),y.body.displayName!==void 0&&(I.displayName=y.body.displayName),y.body.givenName!==void 0&&(I.givenName=y.body.givenName),y.body.familyName!==void 0&&(I.familyName=y.body.familyName),y.body.jobTitle!==void 0&&(I.jobTitle=y.body.jobTitle),bs(I,fb(e))}}),b=Y(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async y=>{let I={userId:y.body.userId};y.body.inviteId!==void 0&&(I.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(I.inviteToken=y.body.inviteToken);let w=await Is(I,e);if(!w.ok)return w;let R=w.data;if(!R)return w;let{authPerm:N,...O}=R;return g({...O,authPerms:Qt(N)})}}),k=Y(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async y=>{let I={userId:y.body.userId};return y.body.inviteId!==void 0&&(I.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(I.inviteToken=y.body.inviteToken),xs(I,e)}}),C=Y(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async y=>Rs({inviteId:y.body.inviteId,revokedBy:y.body.revokedBy},e)}),L=Y(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async y=>{let I={};return y.body.email!==void 0&&(I.email=y.body.email),y.body.phone!==void 0&&(I.phone=y.body.phone),sl(I,e)}}),B=Y(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async y=>{let I={userId:y.body.userId};y.body.tenantType!==void 0&&(I.tenantType=y.body.tenantType),y.body.parentTenantId!==void 0&&(I.parentTenantId=y.body.parentTenantId),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor);let w=await ol(I,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),G=Y(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async y=>{let I={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId};return y.body.status!==void 0&&(I.status=y.body.status),y.body.limit!==void 0&&(I.limit=y.body.limit),y.body.cursor!==void 0&&(I.cursor=y.body.cursor),Cd(I,Ds(e))}}),j=Y(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async y=>Dd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))}),$=Y(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async y=>{let{actorUserId:I,systemTenantId:w,userId:R,...N}=y.body,O={actorUserId:I,systemTenantId:w,userId:R};return N.displayName!==void 0&&(O.displayName=N.displayName),N.givenName!==void 0&&(O.givenName=N.givenName),N.familyName!==void 0&&(O.familyName=N.familyName),N.avatarUrl!==void 0&&(O.avatarUrl=N.avatarUrl),N.locale!==void 0&&(O.locale=N.locale),N.contactEmail!==void 0&&(O.contactEmail=N.contactEmail),N.contactPhone!==void 0&&(O.contactPhone=N.contactPhone),N.metadata!==void 0&&(O.metadata=N.metadata),Pd(O,Ds(e))}}),te=Y(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async y=>Ud({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId,status:y.body.status},Ds(e))}),A=Y(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async y=>{let I={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId};return y.body.credentialType!==void 0&&(I.credentialType=y.body.credentialType),Ld(I,Ds(e))}}),x=Y(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async y=>Md({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))});function S(y){let{method:I,path:w}=y.routeMeta,R=I.toLowerCase();i[R](w,y)}return S(s),S(o),S(a),S(c),S(l),S(d),S(p),S(m),S(E),S(v),S(b),S(k),S(C),S(L),S(B),S(G),S(j),S($),S(te),S(A),S(x),i}var _y=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},xy=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,s=e.length-1;i<=n;i++,s--)r[i]=e.charCodeAt(i),r[s]=e.charCodeAt(s);return r};function ra(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var hb=t=>t.requestContext;var Fd=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=xb(r),s,o;try{s=i.createRequest(r),o=hb(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(s,{event:r,requestContext:o,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},ul=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=this.getDomainName(t),n=this.getPath(t),i=`https://${r}${n}`,s=e?`${i}?${e}`:i,o=this.getHeaders(t),a=this.getMethod(t),c={headers:o,method:a};if(t.body){let l=t.isBase64Encoded?xy(t.body):new TextEncoder().encode(t.body);c.body=l,o.set("content-length",l.length.toString())}return new Request(s,c)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??by,s=!!(n&&i(n));if(!s){let c=e.headers.get("content-encoding");s=wb(c)}let a={body:s?_y(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:s,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,a),a.multiValueHeaders?e.headers.forEach((c,l)=>{a.multiValueHeaders[l]=[c]}):e.headers.forEach((c,l)=>{a.headers[l]=c}),a}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},Eb=class extends ul{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},yb=new Eb,gb=class extends ul{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,ra(n));if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},vb=new gb,Ab=class extends ul{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=ra(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,ra(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},Tb=new Ab,Ib=class extends ul{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers){for(let[r,n]of Object.entries(t.headers))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},_b=new Ib,xb=t=>bb(t)?Tb:Sb(t)?yb:Nb(t)?_b:vb,bb=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,Sb=t=>Object.hasOwn(t,"rawPath"),Nb=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,by=t=>!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(t),wb=t=>t===null?!1:/^(gzip|deflate|compress|br)/.test(t);var Sy=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...t},r=(i=>typeof i=="string"?i==="*"?()=>i:s=>i===s?s:null:typeof i=="function"?i:s=>i.includes(s)?s:null)(e.origin),n=(i=>typeof i=="function"?i:Array.isArray(i)?()=>i:()=>[])(e.allowMethods);return async function(s,o){function a(l,d){s.res.headers.set(l,d)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),e.credentials&&a("Access-Control-Allow-Credentials","true"),e.exposeHeaders?.length&&a("Access-Control-Expose-Headers",e.exposeHeaders.join(",")),s.req.method==="OPTIONS"){e.origin!=="*"&&a("Vary","Origin"),e.maxAge!=null&&a("Access-Control-Max-Age",e.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let d=e.allowHeaders;if(!d?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(d=p.split(/\s*,\s*/))}return d?.length&&(a("Access-Control-Allow-Headers",d.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await o(),e.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};var Rb={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function vi(t={}){let e={...Rb,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var Vd={LOW:vi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:vi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:vi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:vi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var Ny={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function Bd(t,e={}){return{system:t,policy:{...Ny.policy,...e.policy??{}},version:e.version??Ny.version,...e.email&&{email:e.email}}}var wy=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],Ry=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],qd=[...wy,...Ry];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function Oy(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function ky(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Cy={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function Dy(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",s=typeof r.parseUserAgent=="function";if(!i&&!s)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Cy[e];n&&ky(t,String(e),n)}function jd(t,e){Oy(t,String(e)),Dy(t,e)}var Py={debug:0,info:1,warn:2,error:3},dl=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=Py[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&Py[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),s=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${s} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function Uy(t){return new dl(t)}var pl=new dl({enabled:!1});function Ps(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Ai(t,e){let r=Ps(t),n=Ps(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Ly(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Ai(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&Ai(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Ai(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Ai(t,e.slice(2))>=0:e.startsWith(">")?Ai(t,e.slice(1))>0:e.startsWith("<=")?Ai(t,e.slice(2))<=0:e.startsWith("<")?Ai(t,e.slice(1))<0:!1}function Ob(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function kb(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function Us(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())Gd(n,i);return t}let e=[];if(Ob(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,s]=n;Gd(i,s),r.set(i,s)}return r}function Gd(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");kb(t,e)}function $d(t,e){Gd(t,e)}function fl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function ml(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Wd(t,e={},r,n=pl,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let s=new Map;for(let v of t)s.set(v.name,v);let o=new Map,a=new Map;for(let v of s.keys())o.set(v,0),a.set(v,[]);for(let v of s.values()){let b=v.dependencies??[];for(let k of b){let C=typeof k=="string"?k:k.name,L=typeof k=="string"?void 0:k.version;if(!s.has(C))throw new Error(`Plugin '${String(v.name)}' depends on '${String(C)}' which is not defined`);if(L){let B=s.get(C);if(B.version&&!Ly(B.version,L))throw new Error(`Plugin '${String(v.name)}' requires '${String(C)}' ${L}, but version ${B.version} is provided`)}a.get(C).push(v.name),o.set(v.name,(o.get(v.name)??0)+1)}}let c=[];for(let[v,b]of o.entries())b===0&&c.push(v);let l=[];for(;c.length>0;){let v=c.shift();l.push(v);for(let b of a.get(v)??[]){let k=(o.get(b)??0)-1;o.set(b,k),k===0&&c.push(b)}}if(l.length!==s.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let d={},p={get(v){if(!d[v])throw new Error(`Plugin '${String(v)}' not found or not yet initialized`);return d[v]},has(v){return v in d},getRegistry(){return d}};for(let v of l){n.group(`Initializing plugin: ${String(v)}`),n.time(`Plugin: ${String(v)}`);let b=s.get(v),k=e[v],C=null;if(k!==void 0?(n.debug("Using override"),fl(k)?(n.debug("Creating from factory wrapper"),C=await k.create(p)):ml(k)?(n.debug("Lazy loading plugin"),C=await k.load()):(n.debug("Using direct instance"),C=k)):b.factory?(n.debug("Creating from descriptor factory"),C=await b.factory(p)):b.instance&&(n.debug("Using descriptor instance"),C=b.instance),!C&&b.required)throw new Error(`Required plugin '${String(v)}' is missing`);if(C){if(v==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{jd(C,v),n.debug("Validation passed")}catch(G){throw n.error("Validation failed:",G),new Error(`Plugin '${String(v)}' validation failed: ${G instanceof Error?G.message:String(G)}`)}}d[v]=C;let B=C;B.initialize&&(n.debug("Calling plugin initialize()"),await B.initialize()),n.info(`Plugin '${String(v)}' initialized successfully`)}else n.warn(`Plugin '${String(v)}' is null/undefined`);n.timeEnd(`Plugin: ${String(v)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),d.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),d.credential=e.credential),i.extraEntries&&Object.assign(d,i.extraEntries),!Cb(d))throw new Error("Plugin registry is incomplete - missing required plugins");let m=d,E=Us(m.oauthProviders);if(!E){let v=e.oauthProviders;v!==void 0&&!fl(v)&&!ml(v)?E=Us(v)??new Map:E=new Map}return m.oauthProviders=E,await r?.afterInit?.(m),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),m}function Cb(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function zd(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function na(t){let e=t.debug?Uy({enabled:!0,prefix:"[auth-core SDK]"}):pl;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=Us(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Wd(qd,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let s=vi(t.security??{});e.debug("Security level:",s.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let o=Bd({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",o.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:s,system:o,async healthCheck(){let a=[];for(let[l,d]of Object.entries(i)){if(!d||typeof d!="object")continue;let p=d,m={name:String(l),healthy:!0};if(p.health)try{let E=await p.health();m.healthy=E,E||(m.error=`Plugin '${l}' health check failed`)}catch(E){m.healthy=!1,m.error=E instanceof Error?E.message:"Health check threw error"}a.push(m)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await zd(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");$d(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var El=[];function ia(t){let e=process.env[t];return e||(El.push(t),"")}function Jd(t,e){return e?ia(t):process.env[t]??""}function My(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function Lb(t){let e=My(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var Mb=process.env.SMTP_MODE==="smtp"?"smtp":"console",Ti=process.env.EMAIL_MODE;if(Ti&&Ti!=="queue"&&Ti!=="smtp"&&Ti!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Ti}`);var Ls=Ti||Mb,Kb=Ls==="console"?"console":"smtp",Yd=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",yl=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(Ls==="queue"&&Yd!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Yd}`);if(yl!=="generic"&&yl!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${yl}`);function hl(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function Hb(){let t=hl(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=hl(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=hl(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=hl(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var sa=Hb(),Fb=typeof sa=="string"?sa==="cookie"||sa==="both":Object.values(sa).some(t=>t==="cookie"||t==="both"),F={dynamodbTableName:ia("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:ia("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:ia("JWT_PRIVATE_KEY"),jwtPublicKey:ia("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:Jd("SMTP_USER",Ls==="smtp"),pass:Jd("SMTP_PASS",Ls==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Kb},email:{mode:Ls,queue:{provider:Yd,url:Jd("EMAIL_QUEUE_URL",Ls==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:yl,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:Lb("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:My("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:sa,...Fb?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__"},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function Ky(){if(El.length>0){let t=El.map(e=>` - ${e}`).join(`
61
+ `);throw new Error(`Missing required environment variables (${El.length}):
62
+ ${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Xd(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Vb(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function gl(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Vb(r)}async function Qd(t,e){let r=await gl(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Bb="otp",Hy={INVALID_CODE:T("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:T("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function qb(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Fy(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Bb,challengeType:"verification-code",async create(){return g({value:"",data:null})},async update(){return g({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let o=Xd(e),a=await gl(o),c=new Date(Date.now()+r*60*1e3);return g({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:o,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:qb(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Qd(n.credentialValue,i)?g({userId:n.userId,intents:[]}):u(Hy.INVALID_CODE()):u(Hy.MISSING_CHALLENGE_CONTEXT())}}}function jb(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}function yt(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(`${r}expected number, got ${typeof t}`)}if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new RangeError(`${r}expected integer >= 0, got ${t}`)}}function mn(t,e,r=""){let n=jb(t),i=t?.length,s=e!==void 0;if(!n||s&&i!==e){let o=r&&`"${r}" `,a=s?` of length ${e}`:"",c=n?`length=${i}`:`type=${typeof t}`,l=o+"expected Uint8Array"+a+", got "+c;throw n?new RangeError(l):new TypeError(l)}return t}function vl(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("Hash must wrapped by utils.createHasher");if(yt(t.outputLen),yt(t.blockLen),t.outputLen<1)throw new Error('"outputLen" must be >= 1');if(t.blockLen<1)throw new Error('"blockLen" must be >= 1')}function hn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Ms(t,e){mn(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new RangeError('"digestInto() output" expected to be of length >='+r)}function Ks(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function jt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Hs(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function xr(t,e){return t<<32-e|t>>>e}function xe(t,e){return t<<e|t>>>32-e>>>0}var Gb=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function $b(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Wb(t){for(let e=0;e<t.length;e++)t[e]=$b(t[e]);return t}var Fs=Gb?t=>t:Wb;function zb(t){if(typeof t!="string")throw new TypeError("string expected");return new Uint8Array(new TextEncoder().encode(t))}function Zd(t,e=""){return typeof t=="string"?zb(t):mn(t,void 0,e)}function Al(t,e){if(e!==void 0&&{}.toString.call(e)!=="[object Object]")throw new TypeError("options must be object or undefined");return Object.assign(t,e)}function Tl(t,e={}){let r=(i,s)=>t(s).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function ep(t=32){yt(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var Il=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var _l=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(vl(e),mn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<i.length;s++)i[s]^=54;this.iHash.update(i),this.oHash=e.create();for(let s=0;s<i.length;s++)i[s]^=106;this.oHash.update(i),jt(i)}update(e){return hn(this),this.iHash.update(e),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:s,blockLen:o,outputLen:a}=this;return e=e,e.finished=i,e.destroyed=s,e.blockLen=o,e.outputLen=a,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Vy=(()=>{let t=((e,r,n)=>new _l(e,r).update(n).digest());return t.create=(e,r)=>new _l(e,r),t})();function Yb(t,e,r,n){vl(t);let i=Al({dkLen:32,asyncTick:10},n),{c:s,dkLen:o,asyncTick:a}=i;if(yt(s,"c"),yt(o,"dkLen"),yt(a,"asyncTick"),s<1)throw new Error("iterations (c) must be >= 1");if(o<1)throw new Error('"dkLen" must be >= 1');if(o>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Zd(e,"password"),l=Zd(r,"salt"),d=new Uint8Array(o),p=Vy.create(t,c),m=p._cloneInto().update(l);return{c:s,dkLen:o,asyncTick:a,DK:d,PRF:p,PRFSalt:m}}function Xb(t,e,r,n,i){return t.destroy(),e.destroy(),n&&n.destroy(),jt(i),r}function tp(t,e,r,n){let{c:i,dkLen:s,DK:o,PRF:a,PRFSalt:c}=Yb(t,e,r,n),l,d=new Uint8Array(4),p=Hs(d),m=new Uint8Array(a.outputLen);for(let E=1,v=0;v<s;E++,v+=a.outputLen){let b=o.subarray(v,v+a.outputLen);p.setInt32(0,E,!1),(l=c._cloneInto(l)).update(d).digestInto(m),b.set(m.subarray(0,b.length));for(let k=1;k<i;k++){a._cloneInto(l).update(m).digestInto(m);for(let C=0;C<b.length;C++)b[C]^=m[C]}}return Xb(a,c,o,l,m)}function By(t,e,r){return t&e^~t&r}function qy(t,e,r){return t&e^t&r^e&r}var xl=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=Hs(this.buffer)}update(e){hn(this),mn(e);let{view:r,buffer:n,blockLen:i}=this,s=e.length;for(let o=0;o<s;){let a=Math.min(i-this.pos,s-o);if(a===i){let c=Hs(e);for(;i<=s-o;o+=i)this.process(c,o);continue}n.set(e.subarray(o,o+a),this.pos),this.pos+=a,o+=a,this.pos===i&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:s}=this,{pos:o}=this;r[o++]=128,jt(this.buffer.subarray(o)),this.padOffset>i-o&&(this.process(n,0),o=0);for(let p=o;p<i;p++)r[p]=0;n.setBigUint64(i-8,BigInt(this.length*8),s),this.process(n,0);let a=Hs(e),c=this.outputLen;if(c%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let l=c/4,d=this.get();if(l>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<l;p++)a.setUint32(4*p,d[p],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||=new this.constructor,e.set(...this.get());let{blockLen:r,buffer:n,length:i,finished:s,destroyed:o,pos:a}=this;return e.destroyed=o,e.finished=s,e.length=i,e.pos=a,i%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},En=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var bl=BigInt(4294967295),jy=BigInt(32);function Qb(t,e=!1){return e?{h:Number(t&bl),l:Number(t>>jy&bl)}:{h:Number(t>>jy&bl)|0,l:Number(t&bl)|0}}function Gy(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let s=0;s<r;s++){let{h:o,l:a}=Qb(t[s],e);[n[s],i[s]]=[o,a]}return[n,i]}var $y=(t,e,r)=>t<<r|e>>>32-r,Wy=(t,e,r)=>e<<r|t>>>32-r,zy=(t,e,r)=>e<<r-32|t>>>64-r,Jy=(t,e,r)=>t<<r-32|e>>>64-r;var Zb=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Hn=new Uint32Array(64),rp=class extends xl{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:i,E:s,F:o,G:a,H:c}=this;return[e,r,n,i,s,o,a,c]}set(e,r,n,i,s,o,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=s|0,this.F=o|0,this.G=a|0,this.H=c|0}process(e,r){for(let p=0;p<16;p++,r+=4)Hn[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let m=Hn[p-15],E=Hn[p-2],v=xr(m,7)^xr(m,18)^m>>>3,b=xr(E,17)^xr(E,19)^E>>>10;Hn[p]=b+Hn[p-7]+v+Hn[p-16]|0}let{A:n,B:i,C:s,D:o,E:a,F:c,G:l,H:d}=this;for(let p=0;p<64;p++){let m=xr(a,6)^xr(a,11)^xr(a,25),E=d+m+By(a,c,l)+Zb[p]+Hn[p]|0,b=(xr(n,2)^xr(n,13)^xr(n,22))+qy(n,i,s)|0;d=l,l=c,c=a,a=o+E|0,o=s,s=i,i=n,n=E+b|0}n=n+this.A|0,i=i+this.B|0,s=s+this.C|0,o=o+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,d=d+this.H|0,this.set(n,i,s,o,a,c,l,d)}roundClean(){jt(Hn)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),jt(this.buffer)}},np=class extends rp{A=En[0]|0;B=En[1]|0;C=En[2]|0;D=En[3]|0;E=En[4]|0;F=En[5]|0;G=En[6]|0;H=En[7]|0;constructor(){super(32)}};var ip=Tl(()=>new np,Il(1));function Yy(t,e,r,n,i,s){let o=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],d=t[e++]^r[n++],p=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],b=t[e++]^r[n++],k=t[e++]^r[n++],C=t[e++]^r[n++],L=t[e++]^r[n++],B=t[e++]^r[n++],G=t[e++]^r[n++],j=t[e++]^r[n++],$=o,te=a,A=c,x=l,S=d,y=p,I=m,w=E,R=v,N=b,O=k,P=C,U=L,K=B,W=G,J=j;for(let de=0;de<8;de+=2)S^=xe($+U|0,7),R^=xe(S+$|0,9),U^=xe(R+S|0,13),$^=xe(U+R|0,18),N^=xe(y+te|0,7),K^=xe(N+y|0,9),te^=xe(K+N|0,13),y^=xe(te+K|0,18),W^=xe(O+I|0,7),A^=xe(W+O|0,9),I^=xe(A+W|0,13),O^=xe(I+A|0,18),x^=xe(J+P|0,7),w^=xe(x+J|0,9),P^=xe(w+x|0,13),J^=xe(P+w|0,18),te^=xe($+x|0,7),A^=xe(te+$|0,9),x^=xe(A+te|0,13),$^=xe(x+A|0,18),I^=xe(y+S|0,7),w^=xe(I+y|0,9),S^=xe(w+I|0,13),y^=xe(S+w|0,18),P^=xe(O+N|0,7),R^=xe(P+O|0,9),N^=xe(R+P|0,13),O^=xe(N+R|0,18),U^=xe(J+W|0,7),K^=xe(U+J|0,9),W^=xe(K+U|0,13),J^=xe(W+K|0,18);i[s++]=o+$|0,i[s++]=a+te|0,i[s++]=c+A|0,i[s++]=l+x|0,i[s++]=d+S|0,i[s++]=p+y|0,i[s++]=m+I|0,i[s++]=E+w|0,i[s++]=v+R|0,i[s++]=b+N|0,i[s++]=k+O|0,i[s++]=C+P|0,i[s++]=L+U|0,i[s++]=B+K|0,i[s++]=G+W|0,i[s++]=j+J|0}function sp(t,e,r,n,i){let s=n+0,o=n+16*i;for(let a=0;a<16;a++)r[o+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,s+=16,e+=16)Yy(r,o,t,e,r,s),a>0&&(o+=16),Yy(r,s,t,e+=16,r,o)}function eS(t,e,r){let n=Al({dkLen:32,asyncTick:10,maxmem:1073742848},r),{N:i,r:s,p:o,dkLen:a,asyncTick:c,maxmem:l,onProgress:d}=n;if(yt(i,"N"),yt(s,"r"),yt(o,"p"),yt(a,"dkLen"),yt(c,"asyncTick"),yt(l,"maxmem"),d!==void 0&&typeof d!="function")throw new Error("progressCb must be a function");let p=128*s,m=p/4,E=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>E)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(o<1||o>(E-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(E-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let v=p*(i+o+1);if(v>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+v+", maxmem="+l);let b=tp(ip,t,e,{c:1,dkLen:p*o}),k=Ks(b),C=Ks(new Uint8Array(p*i)),L=Ks(new Uint8Array(p)),B=()=>{};if(d){let G=2*i*o,j=Math.max(Math.floor(G/1e4),1),$=0;B=()=>{$++,d&&(!($%j)||$===G)&&d($/G)}}return{N:i,r:s,p:o,dkLen:a,blockSize32:m,V:C,B32:k,B:b,tmp:L,blockMixCb:B,asyncTick:c}}function tS(t,e,r,n,i){let s=tp(ip,t,r,{c:1,dkLen:e});return jt(r,n,i),s}function Sl(t,e,r){let{N:n,r:i,p:s,dkLen:o,blockSize32:a,V:c,B32:l,B:d,tmp:p,blockMixCb:m}=eS(t,e,r);Fs(l);for(let E=0;E<s;E++){let v=a*E;for(let b=0;b<a;b++)c[b]=l[v+b];for(let b=0,k=0;b<n-1;b++)sp(c,k,c,k+=a,i),m();sp(c,(n-1)*a,l,v,i),m();for(let b=0;b<n;b++){let k=(l[v+a-16]&n-1)>>>0;for(let C=0;C<a;C++)p[C]=l[v+C]^c[k*a+C];sp(p,0,l,v,i),m()}}return Fs(l),tS(t,o,d,c,p)}var rS={N:2**15,r:8,p:1,dkLen:32,saltLength:32},nS={N:2**14,r:8,p:1};function Xy(t,e,r){return`${t.N}.${t.r}.${t.p}.${Qy(e)}.${Qy(r)}`}function iS(t){let e=t.split(".");if(e.length===5){let[r,n,i,s,o]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Nl(s),expected:Nl(o)}}if(e.length===2){let[r,n]=e;return{params:nS,salt:Nl(r),expected:Nl(n)}}return null}function Qy(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Nl(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Zy(t={}){let e={...rS,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=ep(e.saltLength),s=await Sl(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),o=Xy({N:e.N,r:e.r,p:e.p},i,s);return g({value:o,data:n.metadata??null})}catch(i){let s=i instanceof Error?i.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async update(n,i){if(!n.value)return g({});try{if(typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let s=ep(e.saltLength),o=await Sl(r.encode(n.value),s,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Xy({N:e.N,r:e.r,p:e.p},s,o);return g({value:a,...n.data&&{data:n.data}})}catch(s){let o=s instanceof Error?s.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async verify(n){try{if(!n.credential?.value)return u([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return u([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=iS(n.credential.value);if(!i)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:s,salt:o,expected:a}=i;if(o.length!==e.saltLength||a.length!==e.dkLen)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Sl(r.encode(n.credentialValue),o,{N:s.N,r:s.r,p:s.p,dkLen:e.dkLen});if(c.length!==a.length)return u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?g({userId:n.userId,credentialId:"password"}):u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),u([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var tg=Pf(eg(),1);function rg(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new tg.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let s=r.browser.name??"",o=r.os.name??"";return{deviceName:i,browser:s,os:o,browserName:s,osName:o}}}}import{createHash as sS}from"node:crypto";import{SendMessageCommand as oS,SQSClient as aS}from"@aws-sdk/client-sqs";var cS={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Rl=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new aS(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new oS({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:lS(n)})}return g(void 0)}catch(r){return u({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},s=this.config.eventTypeMap?.[e.template]??cS[e.template]??e.template,o=Ii(i.eventId)??Ii(i.challengeId)??crypto.randomUUID(),a=n?`${o}:${uS(r)}`:o,c=Ii(i.locale),l=Ii(i.traceId)??a,d=dS(this.config.defaultMetadata,i),p=pS(i);if(this.config.envelope==="snapshot-auth-v1"){let m=Ii(d?.tenantId),E=Ii(d?.tenantType),v=Ii(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:s,to:r,...v?{userId:v}:{},...m?{tenantId:m}:{},...E?{tenantType:E}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:s,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...d?{metadata:d}:{},data:p}}};function Ii(t){return typeof t=="string"&&t.length>0?t:void 0}function lS(t){return t.split("@")[1]||"(unknown)"}function uS(t){return sS("sha256").update(t).digest("hex").slice(0,16)}function dS(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function pS(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var aa=class t{static createAwsSqs(e){return new Rl(e)}static create(e){return t.createAwsSqs(e.sqs)}};var Qv=Pf(Xv(),1);var Ll=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=Qv.default.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,s;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),s=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),s=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",s=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",s=r.text||""}let o={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:s,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(o),g(void 0)}catch(r){return u({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
63
63
  <!DOCTYPE html>
64
64
  <html>
65
65
  <head>
@@ -125,10 +125,10 @@ ${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SE
125
125
  </div>
126
126
  </body>
127
127
  </html>
128
- `}};var ha=class t{static createDirectSmtp(e){return new Dl(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var IN={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function Jv(t={}){let e={...IN,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let s=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${s}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return u([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return u([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return u([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let s=i.split("@");if(s.length!==2)return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[o,a]=s;return!o||o.length>64?u([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?u([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):g()}}}function Jp(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function _N(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Yp(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return _N(r)}var Xp="email",Pl={EMAIL_SYSTEM_NOT_AVAILABLE:T("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:T("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:T("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:T("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function xN(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Yv(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:Xp,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return u(Pl.EMAIL_SYSTEM_NOT_AVAILABLE());let s=await i.plugins.database.users.getById(n.userId),o=s.ok&&s.data?s.data.contactEmail:void 0;if(!o)return u(Pl.RECIPIENT_NOT_FOUND());let a=Jp(e),c=await Yp(a);return(await i.plugins.emailSystem.send({to:o,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?u(Pl.SEND_FAILED()):g({codeHash:c,maskedRecipient:xN(o)})},async issueChallenge(n){return g({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(Xp)?[Xp]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Pl.USE_CHALLENGE_CODE_HASH())}}}var Xv="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function Ul(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let s="";for(let o of i)s+=Xv[o%Xv.length];r.push(s)}return r}function bN(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Ll(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return bN(r)}function SN(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Qp(t,e){let r=await Ll(t),n=null;for(let i of e)SN(r,i)&&(n=i);return n}var Zp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Qv(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let s of e){let o=Zp.indexOf(s);if(o===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|o,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function Zv(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=Zp[r>>>e&31];return e>0&&(n+=Zp[r<<5-e&31]),n}function Ml(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),Zv(e)}function wN(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function NN(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,wN(e))),s=i[i.length-1]&15;return(((i[s]&127)<<24|(i[s+1]&255)<<16|(i[s+2]&255)<<8|i[s+3]&255)%10**r).toString().padStart(r,"0")}async function Kl(t,e,r=Date.now(),n={}){let i=n.period??30,s=n.digits??6,o=n.window??1,a=e.trim();if(a.length!==s||!/^\d+$/u.test(a))return!1;let c=Qv(t),l=Math.floor(r/1e3/i),d=!1;for(let p=-o;p<=o;p++){let m=await NN(c,l+p,s);RN(m,a)&&(d=!0)}return d}function RN(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function eA(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var ef="totp",ON={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function tA(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:ef,requiresServerDelivery:!1,generateSecret(){return Ml()},generateBackupCodes(i){return Ul(i||r)},async issueChallenge(i){return g({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(ef)?[ef]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(ON.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let s=Ml(),o=Ul(r),a=await Promise.all(o.map(p=>Ll(p))),c=i.data.accountName??i.userId,l=eA({secretBase32:s,accountName:c,issuer:e});return g({secret:s,otpauthUri:l,backupCodes:o,credentialData:{secret:s,backupCodeHashes:a}})},async verifyWithCredentials(i){let s=i.credentialData,o=i.data.code?.trim();if(!o||!s?.secret)return g({verified:!1,data:{}});if(await Kl(s.secret,o,Date.now(),{window:n}))return g({verified:!0,data:{}});let c=s.backupCodeHashes??[];if(c.length>0){let l=await Qp(o,c);if(l)return g({verified:!0,data:{usedBackupCodeHash:l}})}return g({verified:!1,data:{}})},async verifyCredential(i,s){let o=i.data.code,a=i.data.secret;if(!o||!a)return g({verified:!1,data:{}});let c=await Kl(a,o,Date.now(),{window:n});return g({verified:c,data:{}})}}}var tf={scopes:["email","public_profile"],apiVersion:"v18.0"};var Yr={INVALID_CODE:T("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:T("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function rf(t={}){let{scopes:e=tf.scopes,apiVersion:r=tf.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,s){let o=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...s&&{state:s}});return`${n.AUTHORIZATION}?${o.toString()}`},async exchangeCodeForToken(i,s){try{if(!i)return u(Yr.INVALID_CODE());let o=new URLSearchParams({client_id:s.clientId,client_secret:s.clientSecret,code:i,redirect_uri:s.redirectUri}),a=await fetch(`${n.TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return g({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(o){return console.error("Facebook token exchange error:",o),u(Yr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=["id","email","name","first_name","last_name","picture","locale"],o=new URLSearchParams({fields:s.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return g(l)}catch(s){return console.error("Facebook user profile error:",s),u(Yr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=`${t.appId}|${t.appSecret}`,o=new URLSearchParams({input_token:i,access_token:s}),a=await fetch(`${n.DEBUG_TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):u(Yr.INVALID_TOKEN()):u(Yr.INVALID_TOKEN())}catch(s){return console.error("Facebook token verification error:",s),u(Yr.INVALID_TOKEN())}}}}var Hl={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},bi={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var et={INVALID_CODE:T("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:T("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:T("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:T("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:T("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function kN(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function CN(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=kN(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function nf(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=Hl.scopes,accessType:s=Hl.accessType,includeGrantedScopes:o=Hl.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let d=c?.clientId??e,p=c?.redirectUri??n;if(!d||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let m=new URLSearchParams({client_id:d,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:s,...l&&{state:l},...a&&{prompt:a},...o&&{include_granted_scopes:"true"}});return`${bi.AUTHORIZATION}?${m.toString()}`},async exchangeCodeForToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r,m=l?.redirectUri??n;try{if(!c)return u(et.INVALID_CODE());if(!d||!p||!m)return u(et.MISSING_CONFIG());let E=new URLSearchParams({client_id:d,client_secret:p,code:c,redirect_uri:m,grant_type:"authorization_code"}),v=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E.toString()});if(!v.ok)return console.error("Google token exchange failed with status:",v.status),u(et.TOKEN_EXCHANGE_FAILED());let b=await v.json();return g({accessToken:b.access_token,...b.refresh_token&&{refreshToken:b.refresh_token},...b.expires_in&&{expiresIn:b.expires_in}})}catch(E){return console.error("Google token exchange error:",E),u(et.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(bi.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),u(et.USER_PROFILE_FAILED());let d=await l.json(),p={id:d.id,...d.email&&{email:d.email},...d.verified_email!==void 0&&{emailVerified:d.verified_email},...d.name&&{name:d.name},...d.given_name&&{givenName:d.given_name},...d.family_name&&{familyName:d.family_name},...d.picture&&{avatarUrl:d.picture},...d.locale&&{locale:d.locale},provider:"google"};return g(p)}catch(l){return console.error("Google user profile error:",l),u(et.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(`${bi.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return u(et.INVALID_TOKEN());let d=await l.json();return parseInt(d.expires_in,10)<=0?u(et.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),u(et.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return u(et.INVALID_CREDENTIAL());let l=await fetch(`${bi.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),u(et.INVALID_CREDENTIAL());let d=await l.json();if(!e)return u(et.MISSING_CONFIG());if(d.aud!==e)return u(et.INVALID_CREDENTIAL());if(parseInt(d.expires_in,10)<=0)return u(et.INVALID_CREDENTIAL());let m=d.email_verified==="true",E=CN(c),v={id:d.sub,...d.email&&{email:d.email},...d.email&&{emailVerified:m},...E?.name&&{name:E.name},...E?.given_name&&{givenName:E.given_name},...E?.family_name&&{familyName:E.family_name},...E?.picture&&{avatarUrl:E.picture},...E?.locale&&{locale:E.locale},provider:"google"};return g(v)}catch(l){return console.error("Google credential verification error:",l),u(et.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return u(et.INVALID_TOKEN());if(!d||!p)return u(et.MISSING_CONFIG());let m=new URLSearchParams({client_id:d,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),E=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google refresh token failed with status:",E.status),u(et.REFRESH_TOKEN_FAILED());let v=await E.json();return g({accessToken:v.access_token,...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google refresh token error:",m),u(et.REFRESH_TOKEN_FAILED())}}}}function rA(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function s(){if(n===0)return;let o=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(d=>d>o);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(s,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(o,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let d=Date.now(),p=d-l,m=e.get(o)??{hits:[]},E=m.hits.filter(v=>v>p);if(E.length>=c){let v=E[0]??d,b=Math.max(0,v+l-d);return m.hits=E,e.set(o,m),{allowed:!1,remaining:0,retryAfterMs:b,limit:c}}return E.push(d),m.hits=E,e.set(o,m),{allowed:!0,remaining:c-E.length,retryAfterMs:0,limit:c}},async reset(o){e.delete(o)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as e0,DynamoDBClient as t0}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as r0}from"@aws-sdk/lib-dynamodb";var M={DatabaseConnectionError:T("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:X("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:X("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:X("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:X("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:T("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:T("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:X("INVALID_DATA","Invalid data: {reason}"),Timeout:T("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:T("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:X("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:X("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function ne(t){return t.getTime()}function z(t){return new Date(t)}function nA(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function Ea(t){return t instanceof Date?nA(t.getTime()):nA(t)}function sf(t){return t<Date.now()}function wr(t){return t?ne(t):null}function Ht(t){return t==null?null:z(t)}function Ft(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Nr(t){let e=[],r=[],n={},i={},s=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let d=`#${c}`;if(n[d]=c,l==null)r.push(d);else{let p=`:val${s}`;e.push(`${d} = ${p}`),i[p]=l,s++}}let o=[];return e.length>0&&o.push(`SET ${e.join(", ")}`),r.length>0&&o.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:o.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function of(t="PK"){return`attribute_not_exists(${t})`}var af={USER:"USR"},ce={USER:`${af.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Ve={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},St="#",D={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Ve.AUTH,USER_PROFILE_SK:()=>Ve.PROFILE,USER_MFA_SK:t=>`${Ve.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Ve.MFA}${t}${St}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Ve.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Ve.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Ve.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Ve.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Ve.METADATA,SESSION_SK:()=>Ve.METADATA,PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${St}${e}`,PROVIDER_METADATA_SK:()=>Ve.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Ve.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Ve.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Ve.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Ve.PROVIDER.length),r=e.indexOf(St);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Ve.MFA.length),r=e.indexOf(St);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Ve.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${af.USER}${St}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${St}${e}${St}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${St}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${St}${e??"ROOT"}${St}${r}${St}${n}`},f={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},Se={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},Fl={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${St}${e}`,extractCreatedAt:t=>{let e=t.indexOf(St),r=e===-1?t:t.slice(0,e);return Number(r)}};import{DeleteCommand as QN,GetCommand as ZN,PutCommand as eR,UpdateCommand as yA}from"@aws-sdk/lib-dynamodb";var DN=BigInt(0),ya=BigInt(1),PN=BigInt(2),UN=BigInt(7),LN=BigInt(256),MN=BigInt(113),oA=[],aA=[],cA=[];for(let t=0,e=ya,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],oA.push(2*(5*n+r)),aA.push((t+1)*(t+2)/2%64);let i=DN;for(let s=0;s<7;s++)e=(e<<ya^(e>>UN)*MN)%LN,e&PN&&(i^=ya<<(ya<<BigInt(s))-ya);cA.push(i)}var lA=Vy(cA,!0),KN=lA[0],HN=lA[1],iA=(t,e,r)=>r>32?jy(t,e,r):By(t,e,r),sA=(t,e,r)=>r>32?Gy(t,e,r):qy(t,e,r);function FN(t,e=24){if(yt(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let o=0;o<10;o++)r[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let a=(o+8)%10,c=(o+2)%10,l=r[c],d=r[c+1],p=iA(l,d,1)^r[a],m=sA(l,d,1)^r[a+1];for(let E=0;E<50;E+=10)t[o+E]^=p,t[o+E+1]^=m}let i=t[2],s=t[3];for(let o=0;o<24;o++){let a=aA[o],c=iA(i,s,a),l=sA(i,s,a),d=oA[o];i=t[d],s=t[d+1],t[d]=c,t[d+1]=l}for(let o=0;o<50;o+=10){let a=t[o],c=t[o+1],l=t[o+2],d=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&a,t[o+7]^=~t[o+9]&c,t[o+8]^=~a&l,t[o+9]^=~c&d}t[0]^=KN[n],t[1]^=HN[n]}jt(r)}var cf=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=s,yt(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=Ks(this.state)}clone(){return this._cloneInto()}keccak(){Fs(this.state32),FN(this.state32,this.rounds),Fs(this.state32),this.posOut=0,this.pos=0}update(e){hn(this),mn(e);let{blockLen:r,state:n}=this,i=e.length;for(let s=0;s<i;){let o=Math.min(r-this.pos,i-s);for(let a=0;a<o;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){hn(this,!1),mn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,s=e.length;i<s;){this.posOut>=n&&this.keccak();let o=Math.min(n-this.posOut,s-i);e.set(r.subarray(this.posOut,this.posOut+o),i),this.posOut+=o,i+=o}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return yt(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(Ms(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,jt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:s,enableXOF:o}=this;return e||=new t(r,n,i,o,s),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=i,e.enableXOF=o,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},VN=(t,e,r,n={})=>gl(()=>new cf(e,t,r),n);var uA=VN(6,72,64,vl(10));var BN=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,lf=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",dA=Gt+"Number primitive has more than 15 significant digits: ",Rr=1e14,ue=14,uf=9007199254740991,df=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],Bn=1e7,vt=1e9;function pA(t){var e,r,n,i=L.prototype={constructor:L,toString:null,valueOf:null},s=new L(1),o=20,a=4,c=-7,l=21,d=-1e7,p=1e7,m=!1,E=1,v=0,b={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},k="0123456789abcdefghijklmnopqrstuvwxyz",C=!0;function L(A,x){var S,y,I,N,R,w,O,P,U=this;if(!(U instanceof L))return new L(A,x);if(x==null){if(A&&A._isBigNumber===!0){U.s=A.s,!A.c||A.e>p?U.c=U.e=null:A.e<d?U.c=[U.e=0]:(U.e=A.e,U.c=A.c.slice());return}if((w=typeof A=="number")&&A*0==0){if(U.s=1/A<0?(A=-A,-1):1,A===~~A){for(N=0,R=A;R>=10;R/=10,N++);N>p?U.c=U.e=null:(U.e=N,U.c=[A]);return}P=String(A)}else{if(!BN.test(P=String(A)))return n(U,P,w);U.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(N=P.indexOf("."))>-1&&(P=P.replace(".","")),(R=P.search(/e/i))>0?(N<0&&(N=R),N+=+P.slice(R+1),P=P.substring(0,R)):N<0&&(N=P.length)}else{if(We(x,2,k.length,"Base"),x==10&&C)return U=new L(A),$(U,o+U.e+1,a);if(P=String(A),w=typeof A=="number"){if(A*0!=0)return n(U,P,w,x);if(U.s=1/A<0?(P=P.slice(1),-1):1,L.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(dA+A)}else U.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(S=k.slice(0,x),N=R=0,O=P.length;R<O;R++)if(S.indexOf(y=P.charAt(R))<0){if(y=="."){if(R>N){N=O;continue}}else if(!I&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){I=!0,R=-1,N=0;continue}return n(U,String(A),w,x)}w=!1,P=r(P,x,10,U.s),(N=P.indexOf("."))>-1?P=P.replace(".",""):N=P.length}for(R=0;P.charCodeAt(R)===48;R++);for(O=P.length;P.charCodeAt(--O)===48;);if(P=P.slice(R,++O)){if(O-=R,w&&L.DEBUG&&O>15&&(A>uf||A!==pr(A)))throw Error(dA+U.s*A);if((N=N-R-1)>p)U.c=U.e=null;else if(N<d)U.c=[U.e=0];else{if(U.e=N,U.c=[],R=(N+1)%ue,N<0&&(R+=ue),R<O){for(R&&U.c.push(+P.slice(0,R)),O-=ue;R<O;)U.c.push(+P.slice(R,R+=ue));R=ue-(P=P.slice(R)).length}else R-=O;for(;R--;P+="0");U.c.push(+P)}}else U.c=[U.e=0]}L.clone=pA,L.ROUND_UP=0,L.ROUND_DOWN=1,L.ROUND_CEIL=2,L.ROUND_FLOOR=3,L.ROUND_HALF_UP=4,L.ROUND_HALF_DOWN=5,L.ROUND_HALF_EVEN=6,L.ROUND_HALF_CEIL=7,L.ROUND_HALF_FLOOR=8,L.EUCLID=9,L.config=L.set=function(A){var x,S;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(S=A[x],We(S,0,vt,x),o=S),A.hasOwnProperty(x="ROUNDING_MODE")&&(S=A[x],We(S,0,8,x),a=S),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(S=A[x],S&&S.pop?(We(S[0],-vt,0,x),We(S[1],0,vt,x),c=S[0],l=S[1]):(We(S,-vt,vt,x),c=-(l=S<0?-S:S))),A.hasOwnProperty(x="RANGE"))if(S=A[x],S&&S.pop)We(S[0],-vt,-1,x),We(S[1],1,vt,x),d=S[0],p=S[1];else if(We(S,-vt,vt,x),S)d=-(p=S<0?-S:S);else throw Error(Gt+x+" cannot be zero: "+S);if(A.hasOwnProperty(x="CRYPTO"))if(S=A[x],S===!!S)if(S)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))m=S;else throw m=!S,Error(Gt+"crypto unavailable");else m=S;else throw Error(Gt+x+" not true or false: "+S);if(A.hasOwnProperty(x="MODULO_MODE")&&(S=A[x],We(S,0,9,x),E=S),A.hasOwnProperty(x="POW_PRECISION")&&(S=A[x],We(S,0,vt,x),v=S),A.hasOwnProperty(x="FORMAT"))if(S=A[x],typeof S=="object")b=S;else throw Error(Gt+x+" not an object: "+S);if(A.hasOwnProperty(x="ALPHABET"))if(S=A[x],typeof S=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(S))C=S.slice(0,10)=="0123456789",k=S;else throw Error(Gt+x+" invalid: "+S)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:o,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[d,p],CRYPTO:m,MODULO_MODE:E,POW_PRECISION:v,FORMAT:b,ALPHABET:k}},L.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!L.DEBUG)return!0;var x,S,y=A.c,I=A.e,N=A.s;e:if({}.toString.call(y)=="[object Array]"){if((N===1||N===-1)&&I>=-vt&&I<=vt&&I===pr(I)){if(y[0]===0){if(I===0&&y.length===1)return!0;break e}if(x=(I+1)%ue,x<1&&(x+=ue),String(y[0]).length==x){for(x=0;x<y.length;x++)if(S=y[x],S<0||S>=Rr||S!==pr(S))break e;if(S!==0)return!0}}}else if(y===null&&I===null&&(N===null||N===1||N===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},L.maximum=L.max=function(){return G(arguments,-1)},L.minimum=L.min=function(){return G(arguments,1)},L.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(S){var y,I,N,R,w,O=0,P=[],U=new L(s);if(S==null?S=o:We(S,0,vt),R=lf(S/ue),m)if(crypto.getRandomValues){for(y=crypto.getRandomValues(new Uint32Array(R*=2));O<R;)w=y[O]*131072+(y[O+1]>>>11),w>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),y[O]=I[0],y[O+1]=I[1]):(P.push(w%1e14),O+=2);O=R/2}else if(crypto.randomBytes){for(y=crypto.randomBytes(R*=7);O<R;)w=(y[O]&31)*281474976710656+y[O+1]*1099511627776+y[O+2]*4294967296+y[O+3]*16777216+(y[O+4]<<16)+(y[O+5]<<8)+y[O+6],w>=9e15?crypto.randomBytes(7).copy(y,O):(P.push(w%1e14),O+=7);O=R/7}else throw m=!1,Error(Gt+"crypto unavailable");if(!m)for(;O<R;)w=x(),w<9e15&&(P[O++]=w%1e14);for(R=P[--O],S%=ue,R&&S&&(w=df[ue-S],P[O]=pr(R/w)*w);P[O]===0;P.pop(),O--);if(O<0)P=[N=0];else{for(N=-1;P[0]===0;P.splice(0,1),N-=ue);for(O=1,w=P[0];w>=10;w/=10,O++);O<ue&&(N-=ue-O)}return U.e=N,U.c=P,U}})(),L.sum=function(){for(var A=1,x=arguments,S=new L(x[0]);A<x.length;)S=S.plus(x[A++]);return S},r=(function(){var A="0123456789";function x(S,y,I,N){for(var R,w=[0],O,P=0,U=S.length;P<U;){for(O=w.length;O--;w[O]*=y);for(w[0]+=N.indexOf(S.charAt(P++)),R=0;R<w.length;R++)w[R]>I-1&&(w[R+1]==null&&(w[R+1]=0),w[R+1]+=w[R]/I|0,w[R]%=I)}return w.reverse()}return function(S,y,I,N,R){var w,O,P,U,K,W,J,de,ke=S.indexOf("."),He=o,fe=a;for(ke>=0&&(U=v,v=0,S=S.replace(".",""),de=new L(y),W=de.pow(S.length-ke),v=U,de.c=x(yn(dr(W.c),W.e,"0"),10,I,A),de.e=de.c.length),J=x(S,y,I,R?(w=k,A):(w=A,k)),P=U=J.length;J[--U]==0;J.pop());if(!J[0])return w.charAt(0);if(ke<0?--P:(W.c=J,W.e=P,W.s=N,W=e(W,de,He,fe,I),J=W.c,K=W.r,P=W.e),O=P+He+1,ke=J[O],U=I/2,K=K||O<0||J[O+1]!=null,K=fe<4?(ke!=null||K)&&(fe==0||fe==(W.s<0?3:2)):ke>U||ke==U&&(fe==4||K||fe==6&&J[O-1]&1||fe==(W.s<0?8:7)),O<1||!J[0])S=K?yn(w.charAt(1),-He,w.charAt(0)):w.charAt(0);else{if(J.length=O,K)for(--I;++J[--O]>I;)J[O]=0,O||(++P,J=[1].concat(J));for(U=J.length;!J[--U];);for(ke=0,S="";ke<=U;S+=w.charAt(J[ke++]));S=yn(S,P,w.charAt(0))}return S}})(),e=(function(){function A(y,I,N){var R,w,O,P,U=0,K=y.length,W=I%Bn,J=I/Bn|0;for(y=y.slice();K--;)O=y[K]%Bn,P=y[K]/Bn|0,R=J*O+P*W,w=W*O+R%Bn*Bn+U,U=(w/N|0)+(R/Bn|0)+J*P,y[K]=w%N;return U&&(y=[U].concat(y)),y}function x(y,I,N,R){var w,O;if(N!=R)O=N>R?1:-1;else for(w=O=0;w<N;w++)if(y[w]!=I[w]){O=y[w]>I[w]?1:-1;break}return O}function S(y,I,N,R){for(var w=0;N--;)y[N]-=w,w=y[N]<I[N]?1:0,y[N]=w*R+y[N]-I[N];for(;!y[0]&&y.length>1;y.splice(0,1));}return function(y,I,N,R,w){var O,P,U,K,W,J,de,ke,He,fe,we,at,Ri,gn,Oi,wt,Gn,Nt=y.s==I.s?1:-1,Ye=y.c,Le=I.c;if(!Ye||!Ye[0]||!Le||!Le[0])return new L(!y.s||!I.s||(Ye?Le&&Ye[0]==Le[0]:!Le)?NaN:Ye&&Ye[0]==0||!Le?Nt*0:Nt/0);for(ke=new L(Nt),He=ke.c=[],P=y.e-I.e,Nt=N+P+1,w||(w=Rr,P=fr(y.e/ue)-fr(I.e/ue),Nt=Nt/ue|0),U=0;Le[U]==(Ye[U]||0);U++);if(Le[U]>(Ye[U]||0)&&P--,Nt<0)He.push(1),K=!0;else{for(gn=Ye.length,wt=Le.length,U=0,Nt+=2,W=pr(w/(Le[0]+1)),W>1&&(Le=A(Le,W,w),Ye=A(Ye,W,w),wt=Le.length,gn=Ye.length),Ri=wt,fe=Ye.slice(0,wt),we=fe.length;we<wt;fe[we++]=0);Gn=Le.slice(),Gn=[0].concat(Gn),Oi=Le[0],Le[1]>=w/2&&Oi++;do{if(W=0,O=x(Le,fe,wt,we),O<0){if(at=fe[0],wt!=we&&(at=at*w+(fe[1]||0)),W=pr(at/Oi),W>1)for(W>=w&&(W=w-1),J=A(Le,W,w),de=J.length,we=fe.length;x(J,fe,de,we)==1;)W--,S(J,wt<de?Gn:Le,de,w),de=J.length,O=1;else W==0&&(O=W=1),J=Le.slice(),de=J.length;if(de<we&&(J=[0].concat(J)),S(fe,J,we,w),we=fe.length,O==-1)for(;x(Le,fe,wt,we)<1;)W++,S(fe,wt<we?Gn:Le,we,w),we=fe.length}else O===0&&(W++,fe=[0]);He[U++]=W,fe[0]?fe[we++]=Ye[Ri]||0:(fe=[Ye[Ri]],we=1)}while((Ri++<gn||fe[0]!=null)&&Nt--);K=fe[0]!=null,He[0]||He.splice(0,1)}if(w==Rr){for(U=1,Nt=He[0];Nt>=10;Nt/=10,U++);$(ke,N+(ke.e=U+P*ue-1)+1,R,K)}else ke.e=P,ke.r=+K;return ke}})();function B(A,x,S,y){var I,N,R,w,O;if(S==null?S=a:We(S,0,8),!A.c)return A.toString();if(I=A.c[0],R=A.e,x==null)O=dr(A.c),O=y==1||y==2&&(R<=c||R>=l)?Bl(O,R):yn(O,R,"0");else if(A=$(new L(A),x,S),N=A.e,O=dr(A.c),w=O.length,y==1||y==2&&(x<=N||N<=c)){for(;w<x;O+="0",w++);O=Bl(O,N)}else if(x-=R+(y===2&&N>R),O=yn(O,N,"0"),N+1>w){if(--x>0)for(O+=".";x--;O+="0");}else if(x+=N-w,x>0)for(N+1==w&&(O+=".");x--;O+="0");return A.s<0&&I?"-"+O:O}function G(A,x){for(var S,y,I=1,N=new L(A[0]);I<A.length;I++)y=new L(A[I]),(!y.s||(S=Si(N,y))===x||S===0&&N.s===x)&&(N=y);return N}function j(A,x,S){for(var y=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,y++);return(S=y+S*ue-1)>p?A.c=A.e=null:S<d?A.c=[A.e=0]:(A.e=S,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,S=/^\.([^.]+)$/,y=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(N,R,w,O){var P,U=w?R:R.replace(I,"");if(y.test(U))N.s=isNaN(U)?null:U<0?-1:1;else{if(!w&&(U=U.replace(A,function(K,W,J){return P=(J=J.toLowerCase())=="x"?16:J=="b"?2:8,!O||O==P?W:K}),O&&(P=O,U=U.replace(x,"$1").replace(S,"0.$1")),R!=U))return new L(U,P);if(L.DEBUG)throw Error(Gt+"Not a"+(O?" base "+O:"")+" number: "+R);N.s=null}N.c=N.e=null}})();function $(A,x,S,y){var I,N,R,w,O,P,U,K=A.c,W=df;if(K){e:{for(I=1,w=K[0];w>=10;w/=10,I++);if(N=x-I,N<0)N+=ue,R=x,O=K[P=0],U=pr(O/W[I-R-1]%10);else if(P=lf((N+1)/ue),P>=K.length)if(y){for(;K.length<=P;K.push(0));O=U=0,I=1,N%=ue,R=N-ue+1}else break e;else{for(O=w=K[P],I=1;w>=10;w/=10,I++);N%=ue,R=N-ue+I,U=R<0?0:pr(O/W[I-R-1]%10)}if(y=y||x<0||K[P+1]!=null||(R<0?O:O%W[I-R-1]),y=S<4?(U||y)&&(S==0||S==(A.s<0?3:2)):U>5||U==5&&(S==4||y||S==6&&(N>0?R>0?O/W[I-R]:0:K[P-1])%10&1||S==(A.s<0?8:7)),x<1||!K[0])return K.length=0,y?(x-=A.e+1,K[0]=W[(ue-x%ue)%ue],A.e=-x||0):K[0]=A.e=0,A;if(N==0?(K.length=P,w=1,P--):(K.length=P+1,w=W[ue-N],K[P]=R>0?pr(O/W[I-R]%W[R])*w:0),y)for(;;)if(P==0){for(N=1,R=K[0];R>=10;R/=10,N++);for(R=K[0]+=w,w=1;R>=10;R/=10,w++);N!=w&&(A.e++,K[0]==Rr&&(K[0]=1));break}else{if(K[P]+=w,K[P]!=Rr)break;K[P--]=0,w=1}for(N=K.length;K[--N]===0;K.pop());}A.e>p?A.c=A.e=null:A.e<d&&(A.c=[A.e=0])}return A}function te(A){var x,S=A.e;return S===null?A.toString():(x=dr(A.c),x=S<=c||S>=l?Bl(x,S):yn(x,S,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new L(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Si(this,new L(A,x))},i.decimalPlaces=i.dp=function(A,x){var S,y,I,N=this;if(A!=null)return We(A,0,vt),x==null?x=a:We(x,0,8),$(new L(N),A+N.e+1,x);if(!(S=N.c))return null;if(y=((I=S.length-1)-fr(this.e/ue))*ue,I=S[I])for(;I%10==0;I/=10,y--);return y<0&&(y=0),y},i.dividedBy=i.div=function(A,x){return e(this,new L(A,x),o,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new L(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var S,y,I,N,R,w,O,P,U,K=this;if(A=new L(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+te(A));if(x!=null&&(x=new L(x)),w=A.e>14,!K.c||!K.c[0]||K.c[0]==1&&!K.e&&K.c.length==1||!A.c||!A.c[0])return U=new L(Math.pow(+te(K),w?A.s*(2-Vl(A)):+te(A))),x?U.mod(x):U;if(O=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new L(NaN);y=!O&&K.isInteger()&&x.isInteger(),y&&(K=K.mod(x))}else{if(A.e>9&&(K.e>0||K.e<-1||(K.e==0?K.c[0]>1||w&&K.c[1]>=24e7:K.c[0]<8e13||w&&K.c[0]<=9999975e7)))return N=K.s<0&&Vl(A)?-0:0,K.e>-1&&(N=1/N),new L(O?1/N:N);v&&(N=lf(v/ue+2))}for(w?(S=new L(.5),O&&(A.s=1),P=Vl(A)):(I=Math.abs(+te(A)),P=I%2),U=new L(s);;){if(P){if(U=U.times(K),!U.c)break;N?U.c.length>N&&(U.c.length=N):y&&(U=U.mod(x))}if(I){if(I=pr(I/2),I===0)break;P=I%2}else if(A=A.times(S),$(A,A.e+1,1),A.e>14)P=Vl(A);else{if(I=+te(A),I===0)break;P=I%2}K=K.times(K),N?K.c&&K.c.length>N&&(K.c.length=N):y&&(K=K.mod(x))}return y?U:(O&&(U=s.div(U)),x?U.mod(x):N?$(U,v,a,R):U)},i.integerValue=function(A){var x=new L(this);return A==null?A=a:We(A,0,8),$(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Si(this,new L(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Si(this,new L(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Si(this,new L(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/ue)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Si(this,new L(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Si(this,new L(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var S,y,I,N,R=this,w=R.s;if(A=new L(A,x),x=A.s,!w||!x)return new L(NaN);if(w!=x)return A.s=-x,R.plus(A);var O=R.e/ue,P=A.e/ue,U=R.c,K=A.c;if(!O||!P){if(!U||!K)return U?(A.s=-x,A):new L(K?R:NaN);if(!U[0]||!K[0])return K[0]?(A.s=-x,A):new L(U[0]?R:a==3?-0:0)}if(O=fr(O),P=fr(P),U=U.slice(),w=O-P){for((N=w<0)?(w=-w,I=U):(P=O,I=K),I.reverse(),x=w;x--;I.push(0));I.reverse()}else for(y=(N=(w=U.length)<(x=K.length))?w:x,w=x=0;x<y;x++)if(U[x]!=K[x]){N=U[x]<K[x];break}if(N&&(I=U,U=K,K=I,A.s=-A.s),x=(y=K.length)-(S=U.length),x>0)for(;x--;U[S++]=0);for(x=Rr-1;y>w;){if(U[--y]<K[y]){for(S=y;S&&!U[--S];U[S]=x);--U[S],U[y]+=Rr}U[y]-=K[y]}for(;U[0]==0;U.splice(0,1),--P);return U[0]?j(A,U,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var S,y,I=this;return A=new L(A,x),!I.c||!A.s||A.c&&!A.c[0]?new L(NaN):!A.c||I.c&&!I.c[0]?new L(I):(E==9?(y=A.s,A.s=1,S=e(I,A,0,3),A.s=y,S.s*=y):S=e(I,A,0,E),A=I.minus(S.times(A)),!A.c[0]&&E==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var S,y,I,N,R,w,O,P,U,K,W,J,de,ke,He,fe=this,we=fe.c,at=(A=new L(A,x)).c;if(!we||!at||!we[0]||!at[0])return!fe.s||!A.s||we&&!we[0]&&!at||at&&!at[0]&&!we?A.c=A.e=A.s=null:(A.s*=fe.s,!we||!at?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(y=fr(fe.e/ue)+fr(A.e/ue),A.s*=fe.s,O=we.length,K=at.length,O<K&&(de=we,we=at,at=de,I=O,O=K,K=I),I=O+K,de=[];I--;de.push(0));for(ke=Rr,He=Bn,I=K;--I>=0;){for(S=0,W=at[I]%He,J=at[I]/He|0,R=O,N=I+R;N>I;)P=we[--R]%He,U=we[R]/He|0,w=J*P+U*W,P=W*P+w%He*He+de[N]+S,S=(P/ke|0)+(w/He|0)+J*U,de[N--]=P%ke;de[N]=S}return S?++y:de.splice(0,1),j(A,de,y)},i.negated=function(){var A=new L(this);return A.s=-A.s||null,A},i.plus=function(A,x){var S,y=this,I=y.s;if(A=new L(A,x),x=A.s,!I||!x)return new L(NaN);if(I!=x)return A.s=-x,y.minus(A);var N=y.e/ue,R=A.e/ue,w=y.c,O=A.c;if(!N||!R){if(!w||!O)return new L(I/0);if(!w[0]||!O[0])return O[0]?A:new L(w[0]?y:I*0)}if(N=fr(N),R=fr(R),w=w.slice(),I=N-R){for(I>0?(R=N,S=O):(I=-I,S=w),S.reverse();I--;S.push(0));S.reverse()}for(I=w.length,x=O.length,I-x<0&&(S=O,O=w,w=S,x=I),I=0;x;)I=(w[--x]=w[x]+O[x]+I)/Rr|0,w[x]=Rr===w[x]?0:w[x]%Rr;return I&&(w=[I].concat(w),++R),j(A,w,R)},i.precision=i.sd=function(A,x){var S,y,I,N=this;if(A!=null&&A!==!!A)return We(A,1,vt),x==null?x=a:We(x,0,8),$(new L(N),A,x);if(!(S=N.c))return null;if(I=S.length-1,y=I*ue+1,I=S[I]){for(;I%10==0;I/=10,y--);for(I=S[0];I>=10;I/=10,y++);}return A&&N.e+1>y&&(y=N.e+1),y},i.shiftedBy=function(A){return We(A,-uf,uf),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,S,y,I,N=this,R=N.c,w=N.s,O=N.e,P=o+4,U=new L("0.5");if(w!==1||!R||!R[0])return new L(!w||w<0&&(!R||R[0])?NaN:R?N:1/0);if(w=Math.sqrt(+te(N)),w==0||w==1/0?(x=dr(R),(x.length+O)%2==0&&(x+="0"),w=Math.sqrt(+x),O=fr((O+1)/2)-(O<0||O%2),w==1/0?x="5e"+O:(x=w.toExponential(),x=x.slice(0,x.indexOf("e")+1)+O),S=new L(x)):S=new L(w+""),S.c[0]){for(O=S.e,w=O+P,w<3&&(w=0);;)if(I=S,S=U.times(I.plus(e(N,I,P,1))),dr(I.c).slice(0,w)===(x=dr(S.c)).slice(0,w))if(S.e<O&&--w,x=x.slice(w-3,w+1),x=="9999"||!y&&x=="4999"){if(!y&&($(I,I.e+o+2,0),I.times(I).eq(N))){S=I;break}P+=4,w+=4,y=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&($(S,S.e+o+2,1),A=!S.times(S).eq(N));break}}return $(S,S.e+o+1,a,A)},i.toExponential=function(A,x){return A!=null&&(We(A,0,vt),A++),B(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(We(A,0,vt),A=A+this.e+1),B(this,A,x)},i.toFormat=function(A,x,S){var y,I=this;if(S==null)A!=null&&x&&typeof x=="object"?(S=x,x=null):A&&typeof A=="object"?(S=A,A=x=null):S=b;else if(typeof S!="object")throw Error(Gt+"Argument not an object: "+S);if(y=I.toFixed(A,x),I.c){var N,R=y.split("."),w=+S.groupSize,O=+S.secondaryGroupSize,P=S.groupSeparator||"",U=R[0],K=R[1],W=I.s<0,J=W?U.slice(1):U,de=J.length;if(O&&(N=w,w=O,O=N,de-=N),w>0&&de>0){for(N=de%w||w,U=J.substr(0,N);N<de;N+=w)U+=P+J.substr(N,w);O>0&&(U+=P+J.slice(N)),W&&(U="-"+U)}y=K?U+(S.decimalSeparator||"")+((O=+S.fractionGroupSize)?K.replace(new RegExp("\\d{"+O+"}\\B","g"),"$&"+(S.fractionGroupSeparator||"")):K):U}return(S.prefix||"")+y+(S.suffix||"")},i.toFraction=function(A){var x,S,y,I,N,R,w,O,P,U,K,W,J=this,de=J.c;if(A!=null&&(w=new L(A),!w.isInteger()&&(w.c||w.s!==1)||w.lt(s)))throw Error(Gt+"Argument "+(w.isInteger()?"out of range: ":"not an integer: ")+te(w));if(!de)return new L(J);for(x=new L(s),P=S=new L(s),y=O=new L(s),W=dr(de),N=x.e=W.length-J.e-1,x.c[0]=df[(R=N%ue)<0?ue+R:R],A=!A||w.comparedTo(x)>0?N>0?x:P:w,R=p,p=1/0,w=new L(W),O.c[0]=0;U=e(w,x,0,1),I=S.plus(U.times(y)),I.comparedTo(A)!=1;)S=y,y=I,P=O.plus(U.times(I=P)),O=I,x=w.minus(U.times(I=x)),w=I;return I=e(A.minus(S),y,0,1),O=O.plus(I.times(P)),S=S.plus(I.times(y)),O.s=P.s=J.s,N=N*2,K=e(P,y,N,a).minus(J).abs().comparedTo(e(O,S,N,a).minus(J).abs())<1?[P,y]:[O,S],p=R,K},i.toNumber=function(){return+te(this)},i.toPrecision=function(A,x){return A!=null&&We(A,1,vt),B(this,A,x,2)},i.toString=function(A){var x,S=this,y=S.s,I=S.e;return I===null?y?(x="Infinity",y<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?Bl(dr(S.c),I):yn(dr(S.c),I,"0"):A===10&&C?(S=$(new L(S),o+I+1,a),x=yn(dr(S.c),S.e,"0")):(We(A,2,k.length,"Base"),x=r(yn(dr(S.c),I,"0"),10,A,y,!0)),y<0&&S.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return te(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&L.set(t),L}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,s=t[0]+"";n<i;){for(e=t[n++]+"",r=ue-e.length;r--;e="0"+e);s+=e}for(i=s.length;s.charCodeAt(--i)===48;);return s.slice(0,i+1||1)}function Si(t,e){var r,n,i=t.c,s=e.c,o=t.s,a=e.s,c=t.e,l=e.e;if(!o||!a)return null;if(r=i&&!i[0],n=s&&!s[0],r||n)return r?n?0:-a:o;if(o!=a)return o;if(r=o<0,n=c==l,!i||!s)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=s.length)?c:l,o=0;o<a;o++)if(i[o]!=s[o])return i[o]>s[o]^r?1:-1;return c==l?0:c>l^r?1:-1}function We(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function Vl(t){var e=t.c.length-1;return fr(t.e/ue)==e&&t.c[e]%2!=0}function Bl(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function yn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var qN=pA(),fA=qN;var jN=24,ga=32,GN=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,ff=GN(),pf=(t=4,e=ff)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function $N(t){let e=new fA(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var hA=(t="")=>{let e=new TextEncoder;return $N(uA(e.encode(t))).toString(36).slice(1)},mA=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),WN=t=>mA[Math.floor(t()*mA.length)],zN=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=ff}={})=>{let r=Object.keys(t).toString(),n=r.length?r+pf(ga,e):pf(ga,e);return hA(n).substring(0,ga)},JN=t=>()=>t++,YN=476782367,EA=({random:t=ff,counter:e=JN(Math.floor(t()*YN)),length:r=jN,fingerprint:n=zN({random:t})}={})=>{if(r>ga)throw new Error(`Length must be between 2 and ${ga}. Received: ${r}`);return function(){let s=WN(t),o=Date.now().toString(36),a=e().toString(36),c=pf(r,t),l=`${o+c+a+n}`;return`${s+hA(l).substring(1,r)}`}},At=XN(EA);function XN(t){let e;return()=>(e||(e=t()),e())}function va(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Pe(t){return va(t)==="ConditionalCheckFailedException"}var Aa=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return At()}async get(e){try{let r=await this.docClient.send(new ZN({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()}}));if(!r.Item)return g(null);let n=this.unmarshall(r.Item);return sf(ne(n.expiresAt))?g(null):g(n)}catch{return u(M.DatabaseQueryError({query:"get challenge"}))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:z(r)},s=ne(e.expiresAt),o=Math.floor((s+this.ttlGracePeriod)/1e3);return await this.docClient.send(new eR({TableName:this.tableName,Item:this.marshall(i,o)})),g(i)}catch{return u(M.DatabaseQueryError({query:"create challenge"}))}}async update(e,r){try{let n=[],i={},s={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=f.METHOD,s[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=f.PHASE,s[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=f.CODE_HASH,s[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=f.CHALLENGE_STATUS,s[":challengeStatus"]=r.status),n.length===0?g(void 0):(await this.docClient.send(new yA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g(void 0))}catch{return u(M.DatabaseQueryError({query:"update challenge"}))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let o=(await this.docClient.send(new yA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":f.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[f.ATTEMPTS]??0;return g(o)}catch(s){return Pe(s)?u(M.AttemptsExceeded()):u(M.DatabaseQueryError({query:"increment challenge attempts"}))}}async remove(e){try{return await this.docClient.send(new QN({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":f.PK}})),g(void 0)}catch(r){return Pe(r)?g(void 0):u(M.DatabaseQueryError({query:"remove challenge"}))}}marshall(e,r){let n={[f.PK]:D.CHALLENGE_PK(e.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:e.userId,[f.PURPOSE]:e.purpose,[f.CHALLENGE_STATUS]:e.status,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.TTL]:r};return e.tenantId&&(n[f.TENANT_ID]=e.tenantId),e.phase&&(n[f.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[f.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[f.METHOD]=e.method),e.codeHash&&(n[f.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[f.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[f.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[f.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[f.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[f.COUNTRY]=e.country),e.city&&(n[f.CITY]=e.city),e.metadata&&(n[f.METADATA]=e.metadata),e.flowKey&&(n[f.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[f.PK]),userId:e[f.USER_ID],purpose:e[f.PURPOSE],status:e[f.CHALLENGE_STATUS],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT])};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.PHASE]&&(n.phase=e[f.PHASE]),e[f.ALLOWED_METHODS]&&(n.allowedMethods=e[f.ALLOWED_METHODS]),e[f.METHOD]&&(n.method=e[f.METHOD]),e[f.CODE_HASH]&&(n.codeHash=e[f.CODE_HASH]),e[f.ATTEMPTS]!==void 0&&(n.attempts=e[f.ATTEMPTS]),e[f.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[f.MAX_ATTEMPTS]),e[f.IDENTITY_TYPE]&&(n.identityType=e[f.IDENTITY_TYPE]),e[f.IDENTITY_VALUE]&&(n.identityValue=e[f.IDENTITY_VALUE]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.FLOW_KEY]&&(n.flowKey=e[f.FLOW_KEY]),n}};import{BatchGetCommand as tR,DeleteCommand as rR,GetCommand as nR,PutCommand as iR,QueryCommand as ql,UpdateCommand as sR}from"@aws-sdk/lib-dynamodb";var Ta=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return At()}async get(e){try{let r=await this.docClient.send(new nR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get credential"}))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new ql({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return g(null);let i=n.Items[0];if(!i)return g(null);let s=le.credentialId(i[f.PK]);return this.get(s)}catch{return u(M.DatabaseQueryError({query:"get credential by user and type"}))}}async getByUserId(e){try{let r=await this.docClient.send(new ql({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(o=>le.credentialId(o[f.PK])),i=await this.batchGet(n);if(i.ok===!1)return u(i.errors,i.meta);if(!i.data)return g([]);let s=i.data.filter(o=>o!==null);return g(s)}catch{return u(M.DatabaseQueryError({query:"get credentials by user"}))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new iR({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(i)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"credential"})):u(M.DatabaseQueryError({query:"create credential"}))}}async update(e,r){try{let n=ae(),i=[],s={},o={};return i.push(`#${f.UPDATED_AT} = :updatedAt`),s[`#${f.UPDATED_AT}`]=f.UPDATED_AT,o[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${f.CREDENTIAL_VALUE} = :value`),s[`#${f.CREDENTIAL_VALUE}`]=f.CREDENTIAL_VALUE,o[":value"]=r.value),r.data!==void 0&&(i.push(`#${f.METADATA} = :data`),s[`#${f.METADATA}`]=f.METADATA,o[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${f.REVOKED_AT} = :revokedAt`),s[`#${f.REVOKED_AT}`]=f.REVOKED_AT,o[":revokedAt"]=r.revokedAt?ne(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${f.LAST_USED_AT} = :lastUsedAt`),s[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,o[":lastUsedAt"]=r.lastUsedAt?ne(r.lastUsedAt):null),await this.docClient.send(new sR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"update credential"}))}}async remove(e){try{return await this.docClient.send(new rR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(r){return Pe(r)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"delete credential"}))}}async hasType(e,r){try{let n=await this.docClient.send(new ql({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return g((n.Count||0)>0)}catch{return u(M.DatabaseQueryError({query:"check credential type"}))}}async countByUserId(e){try{let r=await this.docClient.send(new ql({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count credentials"}))}}async batchGet(e){if(e.length===0)return g([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let o=(await this.docClient.send(new tR({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[f.PK]:D.CREDENTIAL_PK(c),[f.SK]:D.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of o){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return g(n)}catch{return u(M.DatabaseQueryError({query:"batch get credentials"}))}}marshall(e){let r={[f.PK]:D.CREDENTIAL_PK(e.id),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(e.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(e.type,e.id),[f.USER_ID]:e.userId,[f.CREDENTIAL_VALUE]:e.value,[f.METADATA]:e.data,[f.REVOKED_AT]:e.revokedAt?ne(e.revokedAt):null,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)};return e.lastUsedAt&&(r[f.LAST_USED_AT]=ne(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[f.PK]),n=le.credentialTypeFromUserSK(e[f.CREDENTIAL_USER_SK]);return{id:r,userId:e[f.USER_ID],type:n,value:e[f.CREDENTIAL_VALUE],data:e[f.METADATA]||{},revokedAt:Ht(e[f.REVOKED_AT]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT]),lastUsedAt:Ht(e[f.LAST_USED_AT])}}};import{BatchGetCommand as oR,DeleteCommand as aR,GetCommand as cR,PutCommand as lR,QueryCommand as uR,UpdateCommand as mf}from"@aws-sdk/lib-dynamodb";function hf(t){return{failedAttempts:t.failedAttempts,lastFailedAt:wr(t.lastFailedAt),lockedUntil:wr(t.lockedUntil)}}function gA(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Ht(n.lastFailedAt),lockedUntil:Ht(n.lockedUntil)};return e}function vA(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=hf(n));return e}var Ia=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new cR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}}));if(!n.Item)return g(null);let i=this.unmarshall(n.Item);return g(i)}catch(n){return console.error("[DynamoDB] identities.get error:",n),u(M.DatabaseQueryError({query:"get identity"}))}}async getByUserId(e){try{let r=await this.docClient.send(new uR({TableName:this.tableName,IndexName:Se.USER_IDENTITIES,KeyConditionExpression:`${f.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":D.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let s=this.unmarshall(i);s!==null&&n.push(s)}return g(n)}catch{return u(M.DatabaseQueryError({query:"get identities by userId"}))}}async create(e){try{let r=ae(),n={...e,createdAt:z(r),updatedAt:z(r)};return await this.docClient.send(new lR({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"identity"})):u(M.DatabaseQueryError({query:"create identity"}))}}async update(e,r,n){try{let i=[],s=[],o={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),o["#loginEnabled"]=f.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=wr(n.verifiedAt);l===null?(s.push("#verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),o["#guards"]=f.GUARDS,a[":guards"]=vA(n.guards)),n.pendingVerification!==void 0&&(o["#pendingVerification"]=f.PENDING_VERIFICATION,n.pendingVerification===null?s.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:wr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),o["#updatedAt"]=f.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),s.length>0&&c.push(`REMOVE ${s.join(", ")}`),await this.docClient.send(new mf({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update identity"}))}}async remove(e,r){try{return await this.docClient.send(new aR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove identity"}))}}async updateGuard(e,r,n,i){let s={[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()};try{return await this.docClient.send(new mf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":f.GUARDS,"#guardKey":n,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guard":hf(i),":updatedAt":ae()}})),g(void 0)}catch(o){if(Pe(o))try{return await this.docClient.send(new mf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":f.GUARDS,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:hf(i)},":updatedAt":ae()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update guard"}))}return u(M.DatabaseQueryError({query:"update guard"}))}}async batchGet(e){try{if(e.length===0)return g([]);let n=(await this.docClient.send(new oR({RequestItems:{[this.tableName]:{Keys:e.map(({type:o,value:a})=>({[f.PK]:D.IDENTITY_PK(o,a),[f.SK]:D.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let o of n){let a=this.unmarshall(o);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let s=e.map(({type:o,value:a})=>{let c=`${o}#${a}`;return i.get(c)||null});return g(s)}catch{return u(M.DatabaseQueryError({query:"batch get identities"}))}}marshall(e){let r={[f.PK]:D.IDENTITY_PK(e.type,e.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(e.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(e.type,e.value),[f.USER_ID]:e.userId,[f.LOGIN_ENABLED]:e.loginEnabled,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)},n=wr(e.verifiedAt);return n!==null&&(r[f.VERIFIED_AT]=n),r[f.GUARDS]=vA(e.guards),e.pendingVerification&&(r[f.PENDING_VERIFICATION]=Ft({...e.pendingVerification,expiresAt:ne(e.pendingVerification.expiresAt),resendAvailableAt:wr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[f.PK]);if(!r){let n=e[f.IDENTITY_USER_SK]?le.userIndexSKInfo(e[f.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:gA(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[f.PK],GSI1SK:e[f.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:gA(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:z(r.expiresAt),resendAvailableAt:Ht(r.resendAvailableAt)}}};import{TransactWriteCommand as dR}from"@aws-sdk/lib-dynamodb";var _a=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=At(),i=ne(e.challenge.expiresAt),s=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new dR({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,s))]})),g(void 0)}catch(r){return va(r)==="TransactionCanceledException"||Pe(r)?u(M.UniqueConstraintViolation({field:"registration"})):u(M.DatabaseQueryError({query:"create email verification registration transaction"}))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ft(e),ConditionExpression:`attribute_not_exists(${f.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[f.PK]:D.USER_PK(e.profile.id),[f.SK]:D.USER_PROFILE_SK(),userStatus:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[f.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[f.PK]:D.USER_PK(e.userAuth.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[f.CREATED_AT]:r,[f.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[f.PK]:D.IDENTITY_PK(n.type,n.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(n.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(n.type,n.value),[f.USER_ID]:n.userId,[f.LOGIN_ENABLED]:n.loginEnabled,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.PENDING_VERIFICATION]:Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:wr(n.pendingVerification.resendAvailableAt)})},s=wr(n.verifiedAt);return s!==null&&(i[f.VERIFIED_AT]=s),i[f.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,s={[f.PK]:D.CREDENTIAL_PK(r),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(i.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(i.type,r),[f.USER_ID]:i.userId,[f.CREDENTIAL_VALUE]:i.value,[f.METADATA]:i.data,[f.REVOKED_AT]:i.revokedAt?ne(i.revokedAt):null,[f.CREATED_AT]:n,[f.UPDATED_AT]:n};return i.lastUsedAt&&(s[f.LAST_USED_AT]=ne(i.lastUsedAt)),s}marshallChallenge(e,r,n){let i=e.challenge,s={[f.PK]:D.CHALLENGE_PK(i.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:i.userId,[f.PURPOSE]:i.purpose,[f.CHALLENGE_STATUS]:i.status,[f.EXPIRES_AT]:ne(i.expiresAt),[f.CREATED_AT]:r,[f.TTL]:n};return i.tenantId&&(s[f.TENANT_ID]=i.tenantId),i.phase&&(s[f.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(s[f.ALLOWED_METHODS]=i.allowedMethods),i.method&&(s[f.METHOD]=i.method),i.codeHash&&(s[f.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(s[f.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(s[f.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(s[f.IDENTITY_TYPE]=i.identityType),i.identityValue&&(s[f.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(s[f.DEVICE_LABEL]=i.deviceLabel),i.country&&(s[f.COUNTRY]=i.country),i.city&&(s[f.CITY]=i.city),i.metadata&&(s[f.METADATA]=i.metadata),i.flowKey&&(s[f.FLOW_KEY]=i.flowKey),s}};import{DynamoDBClient as mR}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as hR,GetCommand as IA,PutCommand as ER,QueryCommand as xa,UpdateCommand as js}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as pR}from"@aws-sdk/lib-dynamodb";var AA=100,TA=5;function fR(t){return new Promise(e=>setTimeout(e,t))}async function qs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=AA){let s=r.slice(i,i+AA),o=0;for(;s.length>0;){let a=await t.send(new pR({RequestItems:{[e]:{Keys:s}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(o+=1,o>TA)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${TA} retries`);s=l,await fR(2**o*25)}}return n}var ba=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new mR({});this.docClient=e.docClient||hR.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return At()}generateTokenId(){return At()}async get(e){try{let r=await this.docClient.send(new IA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get session"}))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),s={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},o=Ea(ne(e.expiresAt)+this.ttlGracePeriod),a=Fl.sessionSK(r,n);return await this.docClient.send(new ER({TableName:this.tableName,Item:this.marshall(s,o,a)})),g(s)}catch{return u(M.DatabaseQueryError({query:"create session"}))}}async update(e,r){try{let n=[],i={},s={};if(r.tokenId!==void 0&&(n.push(`#${f.TOKEN_ID} = :tokenId`),i[`#${f.TOKEN_ID}`]=f.TOKEN_ID,s[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${f.EXPIRES_AT} = :expiresAt`),i[`#${f.EXPIRES_AT}`]=f.EXPIRES_AT,s[":expiresAt"]=ne(r.expiresAt);let o=Ea(ne(r.expiresAt)+this.ttlGracePeriod);n.push(`#${f.TTL} = :ttl`),i[`#${f.TTL}`]=f.TTL,s[":ttl"]=o}return r.lastUsedAt!==void 0&&(n.push(`#${f.LAST_USED_AT} = :lastUsedAt`),i[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,s[":lastUsedAt"]=ne(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${f.METADATA} = :metadata`),i[`#${f.METADATA}`]=f.METADATA,s[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${f.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${f.PREVIOUS_TOKEN_ID}`]=f.PREVIOUS_TOKEN_ID,s[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${f.ROTATED_AT} = :rotatedAt`),i[`#${f.ROTATED_AT}`]=f.ROTATED_AT,s[":rotatedAt"]=r.rotatedAt),n.length===0?g():(await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g())}catch{return u(M.DatabaseQueryError({query:"update session"}))}}async rotateToken(e,r,n){try{let i=Ea(ne(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.TOKEN_ID} = :tokenId, #${f.PREVIOUS_TOKEN_ID} = :previousTokenId, #${f.ROTATED_AT} = :rotatedAt, #${f.EXPIRES_AT} = :expiresAt, #${f.LAST_USED_AT} = :lastUsedAt, #${f.TTL} = :ttl`,ConditionExpression:`#${f.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.PREVIOUS_TOKEN_ID}`]:f.PREVIOUS_TOKEN_ID,[`#${f.ROTATED_AT}`]:f.ROTATED_AT,[`#${f.EXPIRES_AT}`]:f.EXPIRES_AT,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT,[`#${f.TTL}`]:f.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":ne(n.expiresAt),":lastUsedAt":ne(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),g(!0)}catch(i){return Pe(i)?g(!1):u(M.DatabaseQueryError({query:"rotate session token"}))}}async switchTenant(e,r){try{let n=[`#${f.TENANT_ID} = :tenantId`,`#${f.TOKEN_ID} = :tokenId`,`#${f.LAST_USED_AT} = :lastUsedAt`],i=[],s={[`#${f.TENANT_ID}`]:f.TENANT_ID,[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT},o={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};s[`#${f.TENANT_TYPE}`]=f.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${f.TENANT_TYPE} = :tenantType`),o[":tenantType"]=r.tenantType):i.push(`#${f.TENANT_TYPE}`),s[`#${f.PERM}`]=f.PERM,r.perms!==void 0?(n.push(`#${f.PERM} = :perms`),o[":perms"]=JSON.stringify(r.perms)):i.push(`#${f.PERM}`),s[`#${f.ROLES}`]=f.ROLES,r.roles!==void 0?(n.push(`#${f.ROLES} = :roles`),o[":roles"]=r.roles):i.push(`#${f.ROLES}`),s["#revokedAt"]=f.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK}) AND attribute_not_exists(#revokedAt)`})),g()}catch(n){return Pe(n)?u(M.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):u(M.DatabaseQueryError({query:"switch tenant"}))}}async revoke(e){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date)},ConditionExpression:`attribute_exists(${f.PK})`})),g()}catch(r){return Pe(r)?g():u(M.DatabaseQueryError({query:"revoke session"}))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ConditionExpression:`#${f.USER_ID} = :userId AND attribute_not_exists(#${f.REVOKED_AT})`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.USER_ID}`]:f.USER_ID,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date),":userId":r}})),g()}catch(n){return Pe(n)?g():u(M.DatabaseQueryError({query:"revoke session by user"}))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new xa({TableName:this.tableName,IndexName:Se.USER_SESSIONS,KeyConditionExpression:`${f.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find sessions by user"}))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new xa({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find active sessions by user"}))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new xa({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(i=>{let s=le.sessionId(i[f.PK]),o=Fl.extractCreatedAt(i[f.ACTIVE_SESSION_SK]);return{id:s,createdAt:new Date(o)}});return g(n)}catch{return u(M.DatabaseQueryError({query:"get active sessions for limit"}))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=ne(new Date),i=await Promise.allSettled(e.map(o=>this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(o),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),s=0;for(let o of i)o.status==="fulfilled"?s+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:va(o.reason)});return s}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new xa({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return g(0);let i=n.Items.map(o=>le.sessionId(o[f.PK])).filter(o=>!r||o!==r),s=await this.revokeSessionsByIds(i,"revokeAllByUserId");return g(s)}catch{return u(M.DatabaseQueryError({query:"revoke all sessions by user"}))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return g(r)}catch{return u(M.DatabaseQueryError({query:"revoke batch sessions"}))}}async countByUserId(e){try{let r=await this.docClient.send(new xa({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count active sessions by user"}))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new IA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(r),[f.SK]:D.SESSION_SK()},ProjectionExpression:`${f.TOKEN_ID}, ${f.REVOKED_AT}, ${f.EXPIRES_AT}`}));if(!n.Item)return g(!1);let i=n.Item,s=i[f.TOKEN_ID]===e&&!i[f.REVOKED_AT]&&z(i[f.EXPIRES_AT])>new Date;return g(s)}catch{return u(M.DatabaseQueryError({query:"check token active"}))}}marshall(e,r,n){let i={[f.PK]:D.SESSION_PK(e.id),[f.SK]:D.SESSION_SK(),[f.USER_SESSION_PK]:D.USER_PK(e.userId),[f.USER_SESSION_SK]:n,...!e.revokedAt&&{[f.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[f.ACTIVE_SESSION_SK]:n},[f.USER_ID]:e.userId,[f.TOKEN_ID]:e.tokenId,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.LAST_USED_AT]:ne(e.lastUsedAt),[f.TTL]:r};return e.tenantId&&(i[f.TENANT_ID]=e.tenantId),e.tenantType&&(i[f.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[f.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[f.ROLES]=e.roles),e.deviceLabel&&(i[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[f.COUNTRY]=e.country),e.city&&(i[f.CITY]=e.city),e.metadata&&(i[f.METADATA]=e.metadata),e.revokedAt&&(i[f.REVOKED_AT]=ne(e.revokedAt)),e.previousTokenId&&(i[f.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[f.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[f.PK]),userId:e[f.USER_ID],tokenId:e[f.TOKEN_ID],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT]),lastUsedAt:z(e[f.LAST_USED_AT]),revokedAt:e[f.REVOKED_AT]?z(e[f.REVOKED_AT]):null};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.TENANT_TYPE]&&(n.tenantType=e[f.TENANT_TYPE]),e[f.PERM]!==void 0&&(n.perms=JSON.parse(e[f.PERM])),e[f.ROLES]!==void 0&&(n.roles=e[f.ROLES]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[f.PREVIOUS_TOKEN_ID]),e[f.ROTATED_AT]!==void 0&&(n.rotatedAt=e[f.ROTATED_AT]),n}};import{QueryCommand as yR}from"@aws-sdk/lib-dynamodb";var Sa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new yR(o)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch(n){return console.error("[DynamoDBTenantInviteQuery.listByTenant] Error:",n instanceof Error?n.message:n),u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(i.declinedAt=z(e.declinedAt)),e.revokedAt&&(i.revokedAt=z(e.revokedAt)),i}};import{GetCommand as _A,PutCommand as gR,QueryCommand as qn,UpdateCommand as vR}from"@aws-sdk/lib-dynamodb";var AR=10080*60*1e3,wa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[f.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(n.declinedAt=z(e.declinedAt)),e.revokedAt&&(n.revokedAt=z(e.revokedAt)),n}generateInviteId(){return At()}async getById(e){try{let r=await this.docClient.send(new _A({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()}}));return r.Item?g(this.mapItemToEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getById invite"}))}}async getByToken(e){try{let n=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":f.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return g(null);let i=n[0],s=await this.docClient.send(new _A({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return s.Item?g(this.mapItemToEntity(s.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getByToken invite"}))}}async create(e){try{let r=ae(),n=ne(e.expiresAt),i=Math.floor((n+AR)/1e3),s={PK:D.INVITE_PK(e.id),SK:D.INVITE_SK(),[f.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[f.INVITED_BY_ID]:e.invitedById,[f.INVITE_STATUS]:e.status,[f.INVITE_TOKEN]:e.inviteToken,[f.EXPIRES_AT]:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.TTL]:i,[f.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[f.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[f.INVITE_TOKEN_GSI]:e.inviteToken},o={};e.invitedByName&&(o.name=e.invitedByName),e.invitedByEmail&&(o.email=e.invitedByEmail),e.invitedByJobTitle&&(o.jobTitle=e.invitedByJobTitle),Object.keys(o).length>0&&(s[f.INVITED_BY_INFO]=o),e.inviteeUserId&&(s[f.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(s[f.INVITEE_EMAIL]=e.inviteeEmail,s[f.INVITEE_EMAIL_GSI]=e.inviteeEmail,s[f.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(s[f.INVITEE_PHONE]=e.inviteePhone,s[f.INVITEE_PHONE_GSI]=e.inviteePhone,s[f.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(s[f.ROLES]=e.roles),e.perms!==void 0&&(s[f.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(s[f.AUTH_PERM]=e.authPerm),e.displayName&&(s[f.DISPLAY_NAME]=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.jobTitle&&(s.jobTitle=e.jobTitle),await this.docClient.send(new gR({TableName:this.tableName,Item:s,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:z(r),updatedAt:z(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),g(a)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"invite id"})):u(M.UnknownError({message:r.message}))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],s={"#inviteStatus":f.INVITE_STATUS,"#inviteTenantSk":f.INVITE_TENANT_SK,"#updatedAt":f.UPDATED_AT},o={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),s["#acceptedAt"]=f.ACCEPTED_AT,o[":acceptedAt"]=ne(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),s["#declinedAt"]=f.DECLINED_AT,o[":declinedAt"]=ne(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),s["#revokedAt"]=f.REVOKED_AT,o[":revokedAt"]=ne(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),s["#inviteTokenGsi"]=f.INVITE_TOKEN_GSI,s["#inviteeEmailGsi"]=f.INVITEE_EMAIL_GSI,s["#inviteeEmailTenantSk"]=f.INVITEE_EMAIL_TENANT_SK,s["#inviteePhoneGsi"]=f.INVITEE_PHONE_GSI,s["#inviteePhoneTenantSk"]=f.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new vR({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantInvite",id:e})):u(M.UnknownError({message:n.message}))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":f.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndEmail"}))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":f.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndPhone"}))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK,"#inviteeUserId":f.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndUserId"}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new qn(o)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByEmail"}))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByPhone"}))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return g(r.Count??0)}catch{return u(M.DatabaseQueryError({query:"countPendingByTenant"}))}}async expireOld(e){return g(0)}};import{QueryCommand as TR}from"@aws-sdk/lib-dynamodb";var Na=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=(await this.docClient.send(new TR(i))).Items||[],a=[],c=new Map;for(let E of o){let v=E.SK;if(v.startsWith(Ve.TENANT_PROFILE)){let b=le.tenantProfileUserId(v);c.set(b,E)}else v.startsWith(ce.USER)&&a.push(E)}a.sort((E,v)=>v.createdAt-E.createdAt);let l=a.slice(0,n),d=a.length>n,p=l.map(E=>{let v=le.tenantMemberUserId(E.SK),b=c.get(v);return this.toListItem(E,e,v,b)}),m=d&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:d,cursor:m,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e,r,n,i){let s={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};if(e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm),i){let o={tenantId:r,userId:n,createdAt:z(i.createdAt),updatedAt:z(i.updatedAt)};i.contactEmail&&(o.contactEmail=i.contactEmail),i.contactPhone&&(o.contactPhone=i.contactPhone),i.displayName&&(o.displayName=i.displayName),i.displayNameSource&&(o.displayNameSource=i.displayNameSource),i.givenName&&(o.givenName=i.givenName),i.familyName&&(o.familyName=i.familyName),i.avatarUrl&&(o.avatarUrl=i.avatarUrl),i.locale&&(o.locale=i.locale),i.jobTitle&&(o.jobTitle=i.jobTitle),i.bio&&(o.bio=i.bio),i.metadata&&(o.metadata=JSON.parse(i.metadata)),s.tenantProfile=o}return s}};import{DeleteCommand as IR,DynamoDBDocumentClient as _R,GetCommand as xA,PutCommand as xR,QueryCommand as bR,TransactWriteCommand as SR,UpdateCommand as bA}from"@aws-sdk/lib-dynamodb";var Ra=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=_R.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new xA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)}}));if(!n.Item)return g(null);let i=this.mapItemToEntity(n.Item);return g(i)}catch{return u(M.DatabaseQueryError({query:"get"}))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ft({PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new SR({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new xR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?u(M.UniqueConstraintViolation({field:"tenant owner"})):u(M.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant member"})):u(M.UnknownError({message:r.message}))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Nr(i);return await this.docClient.send(new bA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async updateStatus(e,r,n){try{return await this.docClient.send(new bA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=await this.docClient.send(new bR(i)),o=(s.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!s.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return mr(o,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async hasOwner(e){try{let r=await this.docClient.send(new xA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_OWNER_MARKER_SK()}}));return g(!!r.Item)}catch{return u(M.DatabaseQueryError({query:"hasOwner"}))}}async remove(e,r){try{return await this.docClient.send(new IR({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};import{BatchGetCommand as wR,QueryCommand as NR}from"@aws-sdk/lib-dynamodb";var Oa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Zt.DEFAULT,s=r?.parentTenantId,o=s?`${i}#${s}#`:`${i}#`,a={TableName:this.tableName,IndexName:Se.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":o},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new NR(a)),l=c.Items??[],d=await this.fetchProfileMap(e,l),p=l.map(v=>this.toListItem(v,e,d)),m=!!c.LastEvaluatedKey,E=m?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:m,cursor:E,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByUser query"}))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(o=>({PK:D.TENANT_PROFILE_PK(le.tenantId(o.PK)),SK:D.TENANT_PROFILE_SK(e)})),s=await this.docClient.send(new wR({RequestItems:{[this.tableName]:{Keys:i}}}));for(let o of s.Responses?.[this.tableName]??[]){let a=o,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),s={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm);let o=n.get(i);return o&&(o.contactEmail&&(s.contactEmail=o.contactEmail),o.contactPhone&&(s.contactPhone=o.contactPhone),o.displayName&&(s.displayName=o.displayName),o.displayNameSource&&(s.displayNameSource=o.displayNameSource),o.givenName&&(s.givenName=o.givenName),o.familyName&&(s.familyName=o.familyName),o.avatarUrl&&(s.avatarUrl=o.avatarUrl),o.locale&&(s.locale=o.locale),o.jobTitle&&(s.jobTitle=o.jobTitle),o.bio&&(s.bio=o.bio),o.metadata&&(s.metadata=JSON.parse(o.metadata))),s}};import{DeleteCommand as RR,GetCommand as OR,PutCommand as kR,UpdateCommand as CR}from"@aws-sdk/lib-dynamodb";var ka=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return At()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new OR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()}}));return r.Item?g(this.toEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get tenant"}))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ft({PK:D.TENANT_PK(r),SK:D.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new kR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant"})):u(M.UnknownError({message:r.message}))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o}=Nr(n);return await this.docClient.send(new CR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:n.message}))}}async delete(e){try{return await this.docClient.send(new RR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:r.message}))}}async list(){return u(M.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return u(M.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return u(M.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as DR,GetCommand as PR,PutCommand as UR,UpdateCommand as jl}from"@aws-sdk/lib-dynamodb";var Ca=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new PR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}}));return r.Item?g(this.unmarshall(r.Item,e)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user auth"}))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new UR({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"userAuth"})):u(M.DatabaseQueryError({query:"create user auth"}))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new jl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update user auth status"}))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new jl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa required"}))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new jl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa methods"}))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new jl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa settings"}))}}async remove(e){try{return await this.docClient.send(new DR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user auth"}))}}marshall(e){return{[f.PK]:D.USER_PK(e.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}};import{DynamoDBDocumentClient as LR,DeleteCommand as MR,GetCommand as KR,PutCommand as HR,QueryCommand as SA,UpdateCommand as Ef}from"@aws-sdk/lib-dynamodb";function Gs(t,e){return e?D.USER_MFA_WITH_ID_SK(t,e):D.USER_MFA_SK(t)}var Da=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=LR.from(e)}toDynamoDBItem(e){let r={PK:D.USER_PK(e.userId),SK:Gs(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:z(e.createdAt),verifiedAt:Ht(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Ht(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Ht(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Ht(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Gs(r,n),s=await this.docClient.send(new KR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}}));return s.Item?g(this.fromDynamoDBItem(s.Item,e)):g(null)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.get error:",i),u(M.DatabaseQueryError({query:"get MFA authenticator"}))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":Ve.MFA}},s=((await this.docClient.send(new SA(r))).Items??[]).map(o=>this.fromDynamoDBItem(o,e));return g(s)}catch(r){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserId error:",r),u(M.DatabaseQueryError({query:"find MFA authenticators by user"}))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":`${Ve.MFA}${r}`}},o=((await this.docClient.send(new SA(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return g(o)}catch(n){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserIdAndMethod error:",n),u(M.DatabaseQueryError({query:"find MFA authenticators by method"}))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=At());let n=this.toDynamoDBItem(r);return await this.docClient.send(new HR({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(this.fromDynamoDBItem(n,e.userId))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"MFA authenticator"})):(console.error("DynamoDBUserMFAAuthenticatorRepository.create error:",r),u(M.DatabaseQueryError({query:"create MFA authenticator"})))}}async update(e,r,n,i){try{let s=Gs(r,n),o=[],a={},c={};if(i.label!==void 0&&(o.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(o.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(o.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(o.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(o.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(o.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(o.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(o.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),o.length===0)return g(void 0);let l={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:s},UpdateExpression:`SET ${o.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new Ef(l)),g(void 0)}catch(s){return console.error("DynamoDBUserMFAAuthenticatorRepository.update error:",s),u(M.DatabaseQueryError({query:"update MFA authenticator"}))}}async remove(e,r,n){try{let i=Gs(r,n);return await this.docClient.send(new MR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}})),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.remove error:",i),u(M.DatabaseQueryError({query:"remove MFA authenticator"}))}}async incrementFailedAttempts(e,r,n,i,s){try{let o=Gs(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},d={":zero":0,":inc":1,":lastFailedAt":a};s!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",d[":lockedUntil"]=a+s*60*1e3,d[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:o},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:d};return await this.docClient.send(new Ef(p)),g(void 0)}catch(o){return console.error("DynamoDBUserMFAAuthenticatorRepository.incrementFailedAttempts error:",o),u(M.DatabaseQueryError({query:"increment failed attempts"}))}}async resetFailedAttempts(e,r,n){try{let i=Gs(r,n),s={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new Ef(s)),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.resetFailedAttempts error:",i),u(M.DatabaseQueryError({query:"reset failed attempts"}))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as FR,DynamoDBDocumentClient as VR,GetCommand as BR,PutCommand as qR,QueryCommand as wA,UpdateCommand as NA}from"@aws-sdk/lib-dynamodb";var Pa=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=VR.from(e)}generateUserId(){return At()}async getById(e){try{let r=await this.docClient.send(new BR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}}));if(!r.Item)return g(null);let n=r.Item;if(n.deletedAt)return g(null);let s={id:le.userId(n.PK),status:n.userStatus,createdAt:z(n.createdAt),updatedAt:z(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:z(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return g(s)}catch{return u(M.DatabaseQueryError({query:"getById user"}))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",s={PK:D.USER_PK(n),SK:D.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(s.contactEmail=e.contactEmail),e.contactPhone&&(s.contactPhone=e.contactPhone),e.username&&(s.username=e.username),e.displayName&&(s.displayName=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.avatarUrl&&(s.avatarUrl=e.avatarUrl),e.locale&&(s.locale=e.locale),e.metadata&&(s.metadata=JSON.stringify(e.metadata)),s[f.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),s[f.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new qR({TableName:this.tableName,Item:Ft(s),ConditionExpression:of("PK")}));let o={id:n,status:i,createdAt:z(r),updatedAt:z(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return g(o)}catch{return u(M.DatabaseQueryError({query:"create user"}))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return g(void 0);i.updatedAt=n;let s=Nr(i);return await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:s.UpdateExpression,ExpressionAttributeNames:s.ExpressionAttributeNames,ExpressionAttributeValues:s.ExpressionAttributeValues})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"updateProfile"}))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=Ae.USER_STATUS_PK(e),o=await this.docClient.send(new wA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":s},Limit:n,ExclusiveStartKey:i})),a=[];if(o.Items&&o.Items.length>0)for(let d of o.Items){let p=le.userId(d.PK);a.push(p)}let c=!!o.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return g(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch{return u(M.DatabaseQueryError({query:"get users by status"}))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new wA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return g(n.Count||0)}catch{return u(M.DatabaseQueryError({query:"count users by status"}))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt, #${f.USER_STATUS_PK} = :statusPk, #${f.USER_STATUS_SK} = :statusSk`,s={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",s[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${f.UPDATED_AT}`]:f.UPDATED_AT,[`#${f.USER_STATUS_PK}`]:f.USER_STATUS_PK,[`#${f.USER_STATUS_SK}`]:f.USER_STATUS_SK},ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userProfile",id:e})):u(M.DatabaseQueryError({query:"sync auth status"}))}}async remove(e){try{return await this.docClient.send(new FR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user profile"}))}}};import{DeleteCommand as jR,DynamoDBDocumentClient as GR,GetCommand as $R,PutCommand as WR,QueryCommand as zR,UpdateCommand as JR}from"@aws-sdk/lib-dynamodb";var Ua=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=GR.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:z(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:D.PROVIDER_PK(e.provider,e.externalId),SK:D.PROVIDER_METADATA_SK(),userProviderPk:D.USER_PK(e.userId),userProviderSk:D.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?ne(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ft(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new $R({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}}));return n.Item?g(this.mapItemToUserProviderLink(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"find provider by external id"}))}}async findByUserId(e){try{let r=await this.docClient.send(new zR({TableName:this.tableName,IndexName:Se.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":f.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":D.USER_PK(e)}}));return!r.Items||r.Items.length===0?g([]):g(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch{return u(M.DatabaseQueryError({query:"find providers by user id"}))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new WR({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),g(this.mapItemToUserProviderLink(n))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):u(M.DatabaseQueryError({query:"create user provider"}))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return g(void 0);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Nr(i);return await this.docClient.send(new JR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update user provider"}))}}async remove(e,r){try{return await this.docClient.send(new jR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"delete user provider"}))}}};import{DeleteCommand as YR,GetCommand as XR,PutCommand as QR,UpdateCommand as ZR}from"@aws-sdk/lib-dynamodb";var La=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new XR({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)}}));return n.Item?g(this.mapItemToEntity(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user tenant profile"}))}}async create(e){try{let r=ae(),n={PK:D.TENANT_PROFILE_PK(e.tenantId),SK:D.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new QR({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:z(r),updatedAt:z(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),g(i)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"user tenant profile"})):u(M.UnknownError({message:r.message}))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=Nr(i);return await this.docClient.send(new ZR({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async remove(e,r){try{return await this.docClient.send(new YR({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};var yf=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new t0(e.clientConfig||{});let r=r0.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Pa(this.client,this.tableName),this.sessions=new ba({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new Ua(this.client,this.tableName),this.userMfaAuthenticators=new Da(this.client,this.tableName),this.challenges=new Aa({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new Ia({docClient:r,tableName:this.tableName}),this.credentials=new Ta({docClient:r,tableName:this.tableName}),this.registration=new _a({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Ca({docClient:r,tableName:this.tableName}),this.tenantMembers=new Ra(this.client,this.tableName),this.tenantInvites=new wa({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new La(r,this.tableName),this.tenants=new ka({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new Sa({docClient:r,tableName:this.tableName}),tenantMembers:new Na({docClient:r,tableName:this.tableName}),tenants:new Oa({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new e0({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function RA(t){return new yf(t)}ho();var gf=1,OA=2,kA=3,CA="auth-craft:internal";async function n0(t){let e=t.replace(/^0x/,""),r=PA(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let s=`-----BEGIN PRIVATE KEY-----
128
+ `}};var Ea=class t{static createDirectSmtp(e){return new Ll(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var Rw={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function Zv(t={}){let e={...Rw,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let s=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${s}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return u([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return u([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return u([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let s=i.split("@");if(s.length!==2)return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[o,a]=s;return!o||o.length>64?u([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?u([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):g()}}}function Zp(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Ow(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function ef(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Ow(r)}var tf="email",Ml={EMAIL_SYSTEM_NOT_AVAILABLE:T("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:T("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:T("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:T("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function kw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function eA(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:tf,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return u(Ml.EMAIL_SYSTEM_NOT_AVAILABLE());let s=await i.plugins.database.users.getById(n.userId),o=s.ok&&s.data?s.data.contactEmail:void 0;if(!o)return u(Ml.RECIPIENT_NOT_FOUND());let a=Zp(e),c=await ef(a);return(await i.plugins.emailSystem.send({to:o,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?u(Ml.SEND_FAILED()):g({codeHash:c,maskedRecipient:kw(o)})},async issueChallenge(n){return g({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(tf)?[tf]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Ml.USE_CHALLENGE_CODE_HASH())}}}var tA="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function Kl(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let s="";for(let o of i)s+=tA[o%tA.length];r.push(s)}return r}function Cw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Hl(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return Cw(r)}function Dw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function rf(t,e){let r=await Hl(t),n=null;for(let i of e)Dw(r,i)&&(n=i);return n}var nf="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function rA(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let s of e){let o=nf.indexOf(s);if(o===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|o,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function nA(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=nf[r>>>e&31];return e>0&&(n+=nf[r<<5-e&31]),n}function Fl(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),nA(e)}function Pw(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function Uw(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,Pw(e))),s=i[i.length-1]&15;return(((i[s]&127)<<24|(i[s+1]&255)<<16|(i[s+2]&255)<<8|i[s+3]&255)%10**r).toString().padStart(r,"0")}async function Vl(t,e,r=Date.now(),n={}){let i=n.period??30,s=n.digits??6,o=n.window??1,a=e.trim();if(a.length!==s||!/^\d+$/u.test(a))return!1;let c=rA(t),l=Math.floor(r/1e3/i),d=!1;for(let p=-o;p<=o;p++){let m=await Uw(c,l+p,s);Lw(m,a)&&(d=!0)}return d}function Lw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function iA(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var sf="totp",Mw={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function sA(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:sf,requiresServerDelivery:!1,generateSecret(){return Fl()},generateBackupCodes(i){return Kl(i||r)},async issueChallenge(i){return g({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(sf)?[sf]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Mw.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let s=Fl(),o=Kl(r),a=await Promise.all(o.map(p=>Hl(p))),c=i.data.accountName??i.userId,l=iA({secretBase32:s,accountName:c,issuer:e});return g({secret:s,otpauthUri:l,backupCodes:o,credentialData:{secret:s,backupCodeHashes:a}})},async verifyWithCredentials(i){let s=i.credentialData,o=i.data.code?.trim();if(!o||!s?.secret)return g({verified:!1,data:{}});if(await Vl(s.secret,o,Date.now(),{window:n}))return g({verified:!0,data:{}});let c=s.backupCodeHashes??[];if(c.length>0){let l=await rf(o,c);if(l)return g({verified:!0,data:{usedBackupCodeHash:l}})}return g({verified:!1,data:{}})},async verifyCredential(i,s){let o=i.data.code,a=i.data.secret;if(!o||!a)return g({verified:!1,data:{}});let c=await Vl(a,o,Date.now(),{window:n});return g({verified:c,data:{}})}}}var of={scopes:["email","public_profile"],apiVersion:"v18.0"};var Yr={INVALID_CODE:T("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:T("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function af(t={}){let{scopes:e=of.scopes,apiVersion:r=of.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,s){let o=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...s&&{state:s}});return`${n.AUTHORIZATION}?${o.toString()}`},async exchangeCodeForToken(i,s){try{if(!i)return u(Yr.INVALID_CODE());let o=new URLSearchParams({client_id:s.clientId,client_secret:s.clientSecret,code:i,redirect_uri:s.redirectUri}),a=await fetch(`${n.TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return g({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(o){return console.error("Facebook token exchange error:",o),u(Yr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=["id","email","name","first_name","last_name","picture","locale"],o=new URLSearchParams({fields:s.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return g(l)}catch(s){return console.error("Facebook user profile error:",s),u(Yr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=`${t.appId}|${t.appSecret}`,o=new URLSearchParams({input_token:i,access_token:s}),a=await fetch(`${n.DEBUG_TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):u(Yr.INVALID_TOKEN()):u(Yr.INVALID_TOKEN())}catch(s){return console.error("Facebook token verification error:",s),u(Yr.INVALID_TOKEN())}}}}var Bl={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},bi={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var et={INVALID_CODE:T("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:T("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:T("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:T("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:T("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function Kw(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function Hw(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=Kw(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function cf(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=Bl.scopes,accessType:s=Bl.accessType,includeGrantedScopes:o=Bl.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let d=c?.clientId??e,p=c?.redirectUri??n;if(!d||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let m=new URLSearchParams({client_id:d,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:s,...l&&{state:l},...a&&{prompt:a},...o&&{include_granted_scopes:"true"}});return`${bi.AUTHORIZATION}?${m.toString()}`},async exchangeCodeForToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r,m=l?.redirectUri??n;try{if(!c)return u(et.INVALID_CODE());if(!d||!p||!m)return u(et.MISSING_CONFIG());let E=new URLSearchParams({client_id:d,client_secret:p,code:c,redirect_uri:m,grant_type:"authorization_code"}),v=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E.toString()});if(!v.ok)return console.error("Google token exchange failed with status:",v.status),u(et.TOKEN_EXCHANGE_FAILED());let b=await v.json();return g({accessToken:b.access_token,...b.refresh_token&&{refreshToken:b.refresh_token},...b.expires_in&&{expiresIn:b.expires_in}})}catch(E){return console.error("Google token exchange error:",E),u(et.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(bi.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),u(et.USER_PROFILE_FAILED());let d=await l.json(),p={id:d.id,...d.email&&{email:d.email},...d.verified_email!==void 0&&{emailVerified:d.verified_email},...d.name&&{name:d.name},...d.given_name&&{givenName:d.given_name},...d.family_name&&{familyName:d.family_name},...d.picture&&{avatarUrl:d.picture},...d.locale&&{locale:d.locale},provider:"google"};return g(p)}catch(l){return console.error("Google user profile error:",l),u(et.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(`${bi.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return u(et.INVALID_TOKEN());let d=await l.json();return parseInt(d.expires_in,10)<=0?u(et.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),u(et.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return u(et.INVALID_CREDENTIAL());let l=await fetch(`${bi.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),u(et.INVALID_CREDENTIAL());let d=await l.json();if(!e)return u(et.MISSING_CONFIG());if(d.aud!==e)return u(et.INVALID_CREDENTIAL());if(parseInt(d.expires_in,10)<=0)return u(et.INVALID_CREDENTIAL());let m=d.email_verified==="true",E=Hw(c),v={id:d.sub,...d.email&&{email:d.email},...d.email&&{emailVerified:m},...E?.name&&{name:E.name},...E?.given_name&&{givenName:E.given_name},...E?.family_name&&{familyName:E.family_name},...E?.picture&&{avatarUrl:E.picture},...E?.locale&&{locale:E.locale},provider:"google"};return g(v)}catch(l){return console.error("Google credential verification error:",l),u(et.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return u(et.INVALID_TOKEN());if(!d||!p)return u(et.MISSING_CONFIG());let m=new URLSearchParams({client_id:d,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),E=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google refresh token failed with status:",E.status),u(et.REFRESH_TOKEN_FAILED());let v=await E.json();return g({accessToken:v.access_token,...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google refresh token error:",m),u(et.REFRESH_TOKEN_FAILED())}}}}function oA(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function s(){if(n===0)return;let o=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(d=>d>o);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(s,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(o,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let d=Date.now(),p=d-l,m=e.get(o)??{hits:[]},E=m.hits.filter(v=>v>p);if(E.length>=c){let v=E[0]??d,b=Math.max(0,v+l-d);return m.hits=E,e.set(o,m),{allowed:!1,remaining:0,retryAfterMs:b,limit:c}}return E.push(d),m.hits=E,e.set(o,m),{allowed:!0,remaining:c-E.length,retryAfterMs:0,limit:c}},async reset(o){e.delete(o)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as a0,DynamoDBClient as c0}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as l0}from"@aws-sdk/lib-dynamodb";var M={DatabaseConnectionError:T("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:X("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:X("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:X("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:X("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:T("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:T("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:X("INVALID_DATA","Invalid data: {reason}"),Timeout:T("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:T("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:X("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:X("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function ne(t){return t.getTime()}function z(t){return new Date(t)}function aA(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function ya(t){return t instanceof Date?aA(t.getTime()):aA(t)}function lf(t){return t<Date.now()}function Nr(t){return t?ne(t):null}function Ht(t){return t==null?null:z(t)}function Ft(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function wr(t){let e=[],r=[],n={},i={},s=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let d=`#${c}`;if(n[d]=c,l==null)r.push(d);else{let p=`:val${s}`;e.push(`${d} = ${p}`),i[p]=l,s++}}let o=[];return e.length>0&&o.push(`SET ${e.join(", ")}`),r.length>0&&o.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:o.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function uf(t="PK"){return`attribute_not_exists(${t})`}var df={USER:"USR"},ce={USER:`${df.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Ve={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},St="#",D={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Ve.AUTH,USER_PROFILE_SK:()=>Ve.PROFILE,USER_MFA_SK:t=>`${Ve.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Ve.MFA}${t}${St}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Ve.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Ve.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Ve.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Ve.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Ve.METADATA,SESSION_SK:()=>Ve.METADATA,PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${St}${e}`,PROVIDER_METADATA_SK:()=>Ve.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Ve.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Ve.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Ve.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Ve.PROVIDER.length),r=e.indexOf(St);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Ve.MFA.length),r=e.indexOf(St);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Ve.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${df.USER}${St}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${St}${e}${St}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${St}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${St}${e??"ROOT"}${St}${r}${St}${n}`},f={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},Se={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},ql={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${St}${e}`,extractCreatedAt:t=>{let e=t.indexOf(St),r=e===-1?t:t.slice(0,e);return Number(r)}};import{DeleteCommand as sR,GetCommand as oR,PutCommand as aR,UpdateCommand as TA}from"@aws-sdk/lib-dynamodb";var Fw=BigInt(0),ga=BigInt(1),Vw=BigInt(2),Bw=BigInt(7),qw=BigInt(256),jw=BigInt(113),uA=[],dA=[],pA=[];for(let t=0,e=ga,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],uA.push(2*(5*n+r)),dA.push((t+1)*(t+2)/2%64);let i=Fw;for(let s=0;s<7;s++)e=(e<<ga^(e>>Bw)*jw)%qw,e&Vw&&(i^=ga<<(ga<<BigInt(s))-ga);pA.push(i)}var fA=Gy(pA,!0),Gw=fA[0],$w=fA[1],cA=(t,e,r)=>r>32?zy(t,e,r):$y(t,e,r),lA=(t,e,r)=>r>32?Jy(t,e,r):Wy(t,e,r);function Ww(t,e=24){if(yt(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let o=0;o<10;o++)r[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let a=(o+8)%10,c=(o+2)%10,l=r[c],d=r[c+1],p=cA(l,d,1)^r[a],m=lA(l,d,1)^r[a+1];for(let E=0;E<50;E+=10)t[o+E]^=p,t[o+E+1]^=m}let i=t[2],s=t[3];for(let o=0;o<24;o++){let a=dA[o],c=cA(i,s,a),l=lA(i,s,a),d=uA[o];i=t[d],s=t[d+1],t[d]=c,t[d+1]=l}for(let o=0;o<50;o+=10){let a=t[o],c=t[o+1],l=t[o+2],d=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&a,t[o+7]^=~t[o+9]&c,t[o+8]^=~a&l,t[o+9]^=~c&d}t[0]^=Gw[n],t[1]^=$w[n]}jt(r)}var pf=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=s,yt(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=Ks(this.state)}clone(){return this._cloneInto()}keccak(){Fs(this.state32),Ww(this.state32,this.rounds),Fs(this.state32),this.posOut=0,this.pos=0}update(e){hn(this),mn(e);let{blockLen:r,state:n}=this,i=e.length;for(let s=0;s<i;){let o=Math.min(r-this.pos,i-s);for(let a=0;a<o;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){hn(this,!1),mn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,s=e.length;i<s;){this.posOut>=n&&this.keccak();let o=Math.min(n-this.posOut,s-i);e.set(r.subarray(this.posOut,this.posOut+o),i),this.posOut+=o,i+=o}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return yt(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(Ms(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,jt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:s,enableXOF:o}=this;return e||=new t(r,n,i,o,s),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=i,e.enableXOF=o,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},zw=(t,e,r,n={})=>Tl(()=>new pf(e,t,r),n);var mA=zw(6,72,64,Il(10));var Jw=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,ff=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",hA=Gt+"Number primitive has more than 15 significant digits: ",Rr=1e14,ue=14,mf=9007199254740991,hf=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],Bn=1e7,vt=1e9;function EA(t){var e,r,n,i=L.prototype={constructor:L,toString:null,valueOf:null},s=new L(1),o=20,a=4,c=-7,l=21,d=-1e7,p=1e7,m=!1,E=1,v=0,b={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},k="0123456789abcdefghijklmnopqrstuvwxyz",C=!0;function L(A,x){var S,y,I,w,R,N,O,P,U=this;if(!(U instanceof L))return new L(A,x);if(x==null){if(A&&A._isBigNumber===!0){U.s=A.s,!A.c||A.e>p?U.c=U.e=null:A.e<d?U.c=[U.e=0]:(U.e=A.e,U.c=A.c.slice());return}if((N=typeof A=="number")&&A*0==0){if(U.s=1/A<0?(A=-A,-1):1,A===~~A){for(w=0,R=A;R>=10;R/=10,w++);w>p?U.c=U.e=null:(U.e=w,U.c=[A]);return}P=String(A)}else{if(!Jw.test(P=String(A)))return n(U,P,N);U.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(w=P.indexOf("."))>-1&&(P=P.replace(".","")),(R=P.search(/e/i))>0?(w<0&&(w=R),w+=+P.slice(R+1),P=P.substring(0,R)):w<0&&(w=P.length)}else{if(We(x,2,k.length,"Base"),x==10&&C)return U=new L(A),$(U,o+U.e+1,a);if(P=String(A),N=typeof A=="number"){if(A*0!=0)return n(U,P,N,x);if(U.s=1/A<0?(P=P.slice(1),-1):1,L.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(hA+A)}else U.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(S=k.slice(0,x),w=R=0,O=P.length;R<O;R++)if(S.indexOf(y=P.charAt(R))<0){if(y=="."){if(R>w){w=O;continue}}else if(!I&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){I=!0,R=-1,w=0;continue}return n(U,String(A),N,x)}N=!1,P=r(P,x,10,U.s),(w=P.indexOf("."))>-1?P=P.replace(".",""):w=P.length}for(R=0;P.charCodeAt(R)===48;R++);for(O=P.length;P.charCodeAt(--O)===48;);if(P=P.slice(R,++O)){if(O-=R,N&&L.DEBUG&&O>15&&(A>mf||A!==pr(A)))throw Error(hA+U.s*A);if((w=w-R-1)>p)U.c=U.e=null;else if(w<d)U.c=[U.e=0];else{if(U.e=w,U.c=[],R=(w+1)%ue,w<0&&(R+=ue),R<O){for(R&&U.c.push(+P.slice(0,R)),O-=ue;R<O;)U.c.push(+P.slice(R,R+=ue));R=ue-(P=P.slice(R)).length}else R-=O;for(;R--;P+="0");U.c.push(+P)}}else U.c=[U.e=0]}L.clone=EA,L.ROUND_UP=0,L.ROUND_DOWN=1,L.ROUND_CEIL=2,L.ROUND_FLOOR=3,L.ROUND_HALF_UP=4,L.ROUND_HALF_DOWN=5,L.ROUND_HALF_EVEN=6,L.ROUND_HALF_CEIL=7,L.ROUND_HALF_FLOOR=8,L.EUCLID=9,L.config=L.set=function(A){var x,S;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(S=A[x],We(S,0,vt,x),o=S),A.hasOwnProperty(x="ROUNDING_MODE")&&(S=A[x],We(S,0,8,x),a=S),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(S=A[x],S&&S.pop?(We(S[0],-vt,0,x),We(S[1],0,vt,x),c=S[0],l=S[1]):(We(S,-vt,vt,x),c=-(l=S<0?-S:S))),A.hasOwnProperty(x="RANGE"))if(S=A[x],S&&S.pop)We(S[0],-vt,-1,x),We(S[1],1,vt,x),d=S[0],p=S[1];else if(We(S,-vt,vt,x),S)d=-(p=S<0?-S:S);else throw Error(Gt+x+" cannot be zero: "+S);if(A.hasOwnProperty(x="CRYPTO"))if(S=A[x],S===!!S)if(S)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))m=S;else throw m=!S,Error(Gt+"crypto unavailable");else m=S;else throw Error(Gt+x+" not true or false: "+S);if(A.hasOwnProperty(x="MODULO_MODE")&&(S=A[x],We(S,0,9,x),E=S),A.hasOwnProperty(x="POW_PRECISION")&&(S=A[x],We(S,0,vt,x),v=S),A.hasOwnProperty(x="FORMAT"))if(S=A[x],typeof S=="object")b=S;else throw Error(Gt+x+" not an object: "+S);if(A.hasOwnProperty(x="ALPHABET"))if(S=A[x],typeof S=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(S))C=S.slice(0,10)=="0123456789",k=S;else throw Error(Gt+x+" invalid: "+S)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:o,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[d,p],CRYPTO:m,MODULO_MODE:E,POW_PRECISION:v,FORMAT:b,ALPHABET:k}},L.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!L.DEBUG)return!0;var x,S,y=A.c,I=A.e,w=A.s;e:if({}.toString.call(y)=="[object Array]"){if((w===1||w===-1)&&I>=-vt&&I<=vt&&I===pr(I)){if(y[0]===0){if(I===0&&y.length===1)return!0;break e}if(x=(I+1)%ue,x<1&&(x+=ue),String(y[0]).length==x){for(x=0;x<y.length;x++)if(S=y[x],S<0||S>=Rr||S!==pr(S))break e;if(S!==0)return!0}}}else if(y===null&&I===null&&(w===null||w===1||w===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},L.maximum=L.max=function(){return G(arguments,-1)},L.minimum=L.min=function(){return G(arguments,1)},L.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(S){var y,I,w,R,N,O=0,P=[],U=new L(s);if(S==null?S=o:We(S,0,vt),R=ff(S/ue),m)if(crypto.getRandomValues){for(y=crypto.getRandomValues(new Uint32Array(R*=2));O<R;)N=y[O]*131072+(y[O+1]>>>11),N>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),y[O]=I[0],y[O+1]=I[1]):(P.push(N%1e14),O+=2);O=R/2}else if(crypto.randomBytes){for(y=crypto.randomBytes(R*=7);O<R;)N=(y[O]&31)*281474976710656+y[O+1]*1099511627776+y[O+2]*4294967296+y[O+3]*16777216+(y[O+4]<<16)+(y[O+5]<<8)+y[O+6],N>=9e15?crypto.randomBytes(7).copy(y,O):(P.push(N%1e14),O+=7);O=R/7}else throw m=!1,Error(Gt+"crypto unavailable");if(!m)for(;O<R;)N=x(),N<9e15&&(P[O++]=N%1e14);for(R=P[--O],S%=ue,R&&S&&(N=hf[ue-S],P[O]=pr(R/N)*N);P[O]===0;P.pop(),O--);if(O<0)P=[w=0];else{for(w=-1;P[0]===0;P.splice(0,1),w-=ue);for(O=1,N=P[0];N>=10;N/=10,O++);O<ue&&(w-=ue-O)}return U.e=w,U.c=P,U}})(),L.sum=function(){for(var A=1,x=arguments,S=new L(x[0]);A<x.length;)S=S.plus(x[A++]);return S},r=(function(){var A="0123456789";function x(S,y,I,w){for(var R,N=[0],O,P=0,U=S.length;P<U;){for(O=N.length;O--;N[O]*=y);for(N[0]+=w.indexOf(S.charAt(P++)),R=0;R<N.length;R++)N[R]>I-1&&(N[R+1]==null&&(N[R+1]=0),N[R+1]+=N[R]/I|0,N[R]%=I)}return N.reverse()}return function(S,y,I,w,R){var N,O,P,U,K,W,J,de,ke=S.indexOf("."),He=o,fe=a;for(ke>=0&&(U=v,v=0,S=S.replace(".",""),de=new L(y),W=de.pow(S.length-ke),v=U,de.c=x(yn(dr(W.c),W.e,"0"),10,I,A),de.e=de.c.length),J=x(S,y,I,R?(N=k,A):(N=A,k)),P=U=J.length;J[--U]==0;J.pop());if(!J[0])return N.charAt(0);if(ke<0?--P:(W.c=J,W.e=P,W.s=w,W=e(W,de,He,fe,I),J=W.c,K=W.r,P=W.e),O=P+He+1,ke=J[O],U=I/2,K=K||O<0||J[O+1]!=null,K=fe<4?(ke!=null||K)&&(fe==0||fe==(W.s<0?3:2)):ke>U||ke==U&&(fe==4||K||fe==6&&J[O-1]&1||fe==(W.s<0?8:7)),O<1||!J[0])S=K?yn(N.charAt(1),-He,N.charAt(0)):N.charAt(0);else{if(J.length=O,K)for(--I;++J[--O]>I;)J[O]=0,O||(++P,J=[1].concat(J));for(U=J.length;!J[--U];);for(ke=0,S="";ke<=U;S+=N.charAt(J[ke++]));S=yn(S,P,N.charAt(0))}return S}})(),e=(function(){function A(y,I,w){var R,N,O,P,U=0,K=y.length,W=I%Bn,J=I/Bn|0;for(y=y.slice();K--;)O=y[K]%Bn,P=y[K]/Bn|0,R=J*O+P*W,N=W*O+R%Bn*Bn+U,U=(N/w|0)+(R/Bn|0)+J*P,y[K]=N%w;return U&&(y=[U].concat(y)),y}function x(y,I,w,R){var N,O;if(w!=R)O=w>R?1:-1;else for(N=O=0;N<w;N++)if(y[N]!=I[N]){O=y[N]>I[N]?1:-1;break}return O}function S(y,I,w,R){for(var N=0;w--;)y[w]-=N,N=y[w]<I[w]?1:0,y[w]=N*R+y[w]-I[w];for(;!y[0]&&y.length>1;y.splice(0,1));}return function(y,I,w,R,N){var O,P,U,K,W,J,de,ke,He,fe,Ne,at,Ri,gn,Oi,Nt,Gn,wt=y.s==I.s?1:-1,Ye=y.c,Me=I.c;if(!Ye||!Ye[0]||!Me||!Me[0])return new L(!y.s||!I.s||(Ye?Me&&Ye[0]==Me[0]:!Me)?NaN:Ye&&Ye[0]==0||!Me?wt*0:wt/0);for(ke=new L(wt),He=ke.c=[],P=y.e-I.e,wt=w+P+1,N||(N=Rr,P=fr(y.e/ue)-fr(I.e/ue),wt=wt/ue|0),U=0;Me[U]==(Ye[U]||0);U++);if(Me[U]>(Ye[U]||0)&&P--,wt<0)He.push(1),K=!0;else{for(gn=Ye.length,Nt=Me.length,U=0,wt+=2,W=pr(N/(Me[0]+1)),W>1&&(Me=A(Me,W,N),Ye=A(Ye,W,N),Nt=Me.length,gn=Ye.length),Ri=Nt,fe=Ye.slice(0,Nt),Ne=fe.length;Ne<Nt;fe[Ne++]=0);Gn=Me.slice(),Gn=[0].concat(Gn),Oi=Me[0],Me[1]>=N/2&&Oi++;do{if(W=0,O=x(Me,fe,Nt,Ne),O<0){if(at=fe[0],Nt!=Ne&&(at=at*N+(fe[1]||0)),W=pr(at/Oi),W>1)for(W>=N&&(W=N-1),J=A(Me,W,N),de=J.length,Ne=fe.length;x(J,fe,de,Ne)==1;)W--,S(J,Nt<de?Gn:Me,de,N),de=J.length,O=1;else W==0&&(O=W=1),J=Me.slice(),de=J.length;if(de<Ne&&(J=[0].concat(J)),S(fe,J,Ne,N),Ne=fe.length,O==-1)for(;x(Me,fe,Nt,Ne)<1;)W++,S(fe,Nt<Ne?Gn:Me,Ne,N),Ne=fe.length}else O===0&&(W++,fe=[0]);He[U++]=W,fe[0]?fe[Ne++]=Ye[Ri]||0:(fe=[Ye[Ri]],Ne=1)}while((Ri++<gn||fe[0]!=null)&&wt--);K=fe[0]!=null,He[0]||He.splice(0,1)}if(N==Rr){for(U=1,wt=He[0];wt>=10;wt/=10,U++);$(ke,w+(ke.e=U+P*ue-1)+1,R,K)}else ke.e=P,ke.r=+K;return ke}})();function B(A,x,S,y){var I,w,R,N,O;if(S==null?S=a:We(S,0,8),!A.c)return A.toString();if(I=A.c[0],R=A.e,x==null)O=dr(A.c),O=y==1||y==2&&(R<=c||R>=l)?Gl(O,R):yn(O,R,"0");else if(A=$(new L(A),x,S),w=A.e,O=dr(A.c),N=O.length,y==1||y==2&&(x<=w||w<=c)){for(;N<x;O+="0",N++);O=Gl(O,w)}else if(x-=R+(y===2&&w>R),O=yn(O,w,"0"),w+1>N){if(--x>0)for(O+=".";x--;O+="0");}else if(x+=w-N,x>0)for(w+1==N&&(O+=".");x--;O+="0");return A.s<0&&I?"-"+O:O}function G(A,x){for(var S,y,I=1,w=new L(A[0]);I<A.length;I++)y=new L(A[I]),(!y.s||(S=Si(w,y))===x||S===0&&w.s===x)&&(w=y);return w}function j(A,x,S){for(var y=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,y++);return(S=y+S*ue-1)>p?A.c=A.e=null:S<d?A.c=[A.e=0]:(A.e=S,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,S=/^\.([^.]+)$/,y=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(w,R,N,O){var P,U=N?R:R.replace(I,"");if(y.test(U))w.s=isNaN(U)?null:U<0?-1:1;else{if(!N&&(U=U.replace(A,function(K,W,J){return P=(J=J.toLowerCase())=="x"?16:J=="b"?2:8,!O||O==P?W:K}),O&&(P=O,U=U.replace(x,"$1").replace(S,"0.$1")),R!=U))return new L(U,P);if(L.DEBUG)throw Error(Gt+"Not a"+(O?" base "+O:"")+" number: "+R);w.s=null}w.c=w.e=null}})();function $(A,x,S,y){var I,w,R,N,O,P,U,K=A.c,W=hf;if(K){e:{for(I=1,N=K[0];N>=10;N/=10,I++);if(w=x-I,w<0)w+=ue,R=x,O=K[P=0],U=pr(O/W[I-R-1]%10);else if(P=ff((w+1)/ue),P>=K.length)if(y){for(;K.length<=P;K.push(0));O=U=0,I=1,w%=ue,R=w-ue+1}else break e;else{for(O=N=K[P],I=1;N>=10;N/=10,I++);w%=ue,R=w-ue+I,U=R<0?0:pr(O/W[I-R-1]%10)}if(y=y||x<0||K[P+1]!=null||(R<0?O:O%W[I-R-1]),y=S<4?(U||y)&&(S==0||S==(A.s<0?3:2)):U>5||U==5&&(S==4||y||S==6&&(w>0?R>0?O/W[I-R]:0:K[P-1])%10&1||S==(A.s<0?8:7)),x<1||!K[0])return K.length=0,y?(x-=A.e+1,K[0]=W[(ue-x%ue)%ue],A.e=-x||0):K[0]=A.e=0,A;if(w==0?(K.length=P,N=1,P--):(K.length=P+1,N=W[ue-w],K[P]=R>0?pr(O/W[I-R]%W[R])*N:0),y)for(;;)if(P==0){for(w=1,R=K[0];R>=10;R/=10,w++);for(R=K[0]+=N,N=1;R>=10;R/=10,N++);w!=N&&(A.e++,K[0]==Rr&&(K[0]=1));break}else{if(K[P]+=N,K[P]!=Rr)break;K[P--]=0,N=1}for(w=K.length;K[--w]===0;K.pop());}A.e>p?A.c=A.e=null:A.e<d&&(A.c=[A.e=0])}return A}function te(A){var x,S=A.e;return S===null?A.toString():(x=dr(A.c),x=S<=c||S>=l?Gl(x,S):yn(x,S,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new L(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Si(this,new L(A,x))},i.decimalPlaces=i.dp=function(A,x){var S,y,I,w=this;if(A!=null)return We(A,0,vt),x==null?x=a:We(x,0,8),$(new L(w),A+w.e+1,x);if(!(S=w.c))return null;if(y=((I=S.length-1)-fr(this.e/ue))*ue,I=S[I])for(;I%10==0;I/=10,y--);return y<0&&(y=0),y},i.dividedBy=i.div=function(A,x){return e(this,new L(A,x),o,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new L(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var S,y,I,w,R,N,O,P,U,K=this;if(A=new L(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+te(A));if(x!=null&&(x=new L(x)),N=A.e>14,!K.c||!K.c[0]||K.c[0]==1&&!K.e&&K.c.length==1||!A.c||!A.c[0])return U=new L(Math.pow(+te(K),N?A.s*(2-jl(A)):+te(A))),x?U.mod(x):U;if(O=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new L(NaN);y=!O&&K.isInteger()&&x.isInteger(),y&&(K=K.mod(x))}else{if(A.e>9&&(K.e>0||K.e<-1||(K.e==0?K.c[0]>1||N&&K.c[1]>=24e7:K.c[0]<8e13||N&&K.c[0]<=9999975e7)))return w=K.s<0&&jl(A)?-0:0,K.e>-1&&(w=1/w),new L(O?1/w:w);v&&(w=ff(v/ue+2))}for(N?(S=new L(.5),O&&(A.s=1),P=jl(A)):(I=Math.abs(+te(A)),P=I%2),U=new L(s);;){if(P){if(U=U.times(K),!U.c)break;w?U.c.length>w&&(U.c.length=w):y&&(U=U.mod(x))}if(I){if(I=pr(I/2),I===0)break;P=I%2}else if(A=A.times(S),$(A,A.e+1,1),A.e>14)P=jl(A);else{if(I=+te(A),I===0)break;P=I%2}K=K.times(K),w?K.c&&K.c.length>w&&(K.c.length=w):y&&(K=K.mod(x))}return y?U:(O&&(U=s.div(U)),x?U.mod(x):w?$(U,v,a,R):U)},i.integerValue=function(A){var x=new L(this);return A==null?A=a:We(A,0,8),$(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Si(this,new L(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Si(this,new L(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Si(this,new L(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/ue)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Si(this,new L(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Si(this,new L(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var S,y,I,w,R=this,N=R.s;if(A=new L(A,x),x=A.s,!N||!x)return new L(NaN);if(N!=x)return A.s=-x,R.plus(A);var O=R.e/ue,P=A.e/ue,U=R.c,K=A.c;if(!O||!P){if(!U||!K)return U?(A.s=-x,A):new L(K?R:NaN);if(!U[0]||!K[0])return K[0]?(A.s=-x,A):new L(U[0]?R:a==3?-0:0)}if(O=fr(O),P=fr(P),U=U.slice(),N=O-P){for((w=N<0)?(N=-N,I=U):(P=O,I=K),I.reverse(),x=N;x--;I.push(0));I.reverse()}else for(y=(w=(N=U.length)<(x=K.length))?N:x,N=x=0;x<y;x++)if(U[x]!=K[x]){w=U[x]<K[x];break}if(w&&(I=U,U=K,K=I,A.s=-A.s),x=(y=K.length)-(S=U.length),x>0)for(;x--;U[S++]=0);for(x=Rr-1;y>N;){if(U[--y]<K[y]){for(S=y;S&&!U[--S];U[S]=x);--U[S],U[y]+=Rr}U[y]-=K[y]}for(;U[0]==0;U.splice(0,1),--P);return U[0]?j(A,U,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var S,y,I=this;return A=new L(A,x),!I.c||!A.s||A.c&&!A.c[0]?new L(NaN):!A.c||I.c&&!I.c[0]?new L(I):(E==9?(y=A.s,A.s=1,S=e(I,A,0,3),A.s=y,S.s*=y):S=e(I,A,0,E),A=I.minus(S.times(A)),!A.c[0]&&E==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var S,y,I,w,R,N,O,P,U,K,W,J,de,ke,He,fe=this,Ne=fe.c,at=(A=new L(A,x)).c;if(!Ne||!at||!Ne[0]||!at[0])return!fe.s||!A.s||Ne&&!Ne[0]&&!at||at&&!at[0]&&!Ne?A.c=A.e=A.s=null:(A.s*=fe.s,!Ne||!at?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(y=fr(fe.e/ue)+fr(A.e/ue),A.s*=fe.s,O=Ne.length,K=at.length,O<K&&(de=Ne,Ne=at,at=de,I=O,O=K,K=I),I=O+K,de=[];I--;de.push(0));for(ke=Rr,He=Bn,I=K;--I>=0;){for(S=0,W=at[I]%He,J=at[I]/He|0,R=O,w=I+R;w>I;)P=Ne[--R]%He,U=Ne[R]/He|0,N=J*P+U*W,P=W*P+N%He*He+de[w]+S,S=(P/ke|0)+(N/He|0)+J*U,de[w--]=P%ke;de[w]=S}return S?++y:de.splice(0,1),j(A,de,y)},i.negated=function(){var A=new L(this);return A.s=-A.s||null,A},i.plus=function(A,x){var S,y=this,I=y.s;if(A=new L(A,x),x=A.s,!I||!x)return new L(NaN);if(I!=x)return A.s=-x,y.minus(A);var w=y.e/ue,R=A.e/ue,N=y.c,O=A.c;if(!w||!R){if(!N||!O)return new L(I/0);if(!N[0]||!O[0])return O[0]?A:new L(N[0]?y:I*0)}if(w=fr(w),R=fr(R),N=N.slice(),I=w-R){for(I>0?(R=w,S=O):(I=-I,S=N),S.reverse();I--;S.push(0));S.reverse()}for(I=N.length,x=O.length,I-x<0&&(S=O,O=N,N=S,x=I),I=0;x;)I=(N[--x]=N[x]+O[x]+I)/Rr|0,N[x]=Rr===N[x]?0:N[x]%Rr;return I&&(N=[I].concat(N),++R),j(A,N,R)},i.precision=i.sd=function(A,x){var S,y,I,w=this;if(A!=null&&A!==!!A)return We(A,1,vt),x==null?x=a:We(x,0,8),$(new L(w),A,x);if(!(S=w.c))return null;if(I=S.length-1,y=I*ue+1,I=S[I]){for(;I%10==0;I/=10,y--);for(I=S[0];I>=10;I/=10,y++);}return A&&w.e+1>y&&(y=w.e+1),y},i.shiftedBy=function(A){return We(A,-mf,mf),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,S,y,I,w=this,R=w.c,N=w.s,O=w.e,P=o+4,U=new L("0.5");if(N!==1||!R||!R[0])return new L(!N||N<0&&(!R||R[0])?NaN:R?w:1/0);if(N=Math.sqrt(+te(w)),N==0||N==1/0?(x=dr(R),(x.length+O)%2==0&&(x+="0"),N=Math.sqrt(+x),O=fr((O+1)/2)-(O<0||O%2),N==1/0?x="5e"+O:(x=N.toExponential(),x=x.slice(0,x.indexOf("e")+1)+O),S=new L(x)):S=new L(N+""),S.c[0]){for(O=S.e,N=O+P,N<3&&(N=0);;)if(I=S,S=U.times(I.plus(e(w,I,P,1))),dr(I.c).slice(0,N)===(x=dr(S.c)).slice(0,N))if(S.e<O&&--N,x=x.slice(N-3,N+1),x=="9999"||!y&&x=="4999"){if(!y&&($(I,I.e+o+2,0),I.times(I).eq(w))){S=I;break}P+=4,N+=4,y=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&($(S,S.e+o+2,1),A=!S.times(S).eq(w));break}}return $(S,S.e+o+1,a,A)},i.toExponential=function(A,x){return A!=null&&(We(A,0,vt),A++),B(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(We(A,0,vt),A=A+this.e+1),B(this,A,x)},i.toFormat=function(A,x,S){var y,I=this;if(S==null)A!=null&&x&&typeof x=="object"?(S=x,x=null):A&&typeof A=="object"?(S=A,A=x=null):S=b;else if(typeof S!="object")throw Error(Gt+"Argument not an object: "+S);if(y=I.toFixed(A,x),I.c){var w,R=y.split("."),N=+S.groupSize,O=+S.secondaryGroupSize,P=S.groupSeparator||"",U=R[0],K=R[1],W=I.s<0,J=W?U.slice(1):U,de=J.length;if(O&&(w=N,N=O,O=w,de-=w),N>0&&de>0){for(w=de%N||N,U=J.substr(0,w);w<de;w+=N)U+=P+J.substr(w,N);O>0&&(U+=P+J.slice(w)),W&&(U="-"+U)}y=K?U+(S.decimalSeparator||"")+((O=+S.fractionGroupSize)?K.replace(new RegExp("\\d{"+O+"}\\B","g"),"$&"+(S.fractionGroupSeparator||"")):K):U}return(S.prefix||"")+y+(S.suffix||"")},i.toFraction=function(A){var x,S,y,I,w,R,N,O,P,U,K,W,J=this,de=J.c;if(A!=null&&(N=new L(A),!N.isInteger()&&(N.c||N.s!==1)||N.lt(s)))throw Error(Gt+"Argument "+(N.isInteger()?"out of range: ":"not an integer: ")+te(N));if(!de)return new L(J);for(x=new L(s),P=S=new L(s),y=O=new L(s),W=dr(de),w=x.e=W.length-J.e-1,x.c[0]=hf[(R=w%ue)<0?ue+R:R],A=!A||N.comparedTo(x)>0?w>0?x:P:N,R=p,p=1/0,N=new L(W),O.c[0]=0;U=e(N,x,0,1),I=S.plus(U.times(y)),I.comparedTo(A)!=1;)S=y,y=I,P=O.plus(U.times(I=P)),O=I,x=N.minus(U.times(I=x)),N=I;return I=e(A.minus(S),y,0,1),O=O.plus(I.times(P)),S=S.plus(I.times(y)),O.s=P.s=J.s,w=w*2,K=e(P,y,w,a).minus(J).abs().comparedTo(e(O,S,w,a).minus(J).abs())<1?[P,y]:[O,S],p=R,K},i.toNumber=function(){return+te(this)},i.toPrecision=function(A,x){return A!=null&&We(A,1,vt),B(this,A,x,2)},i.toString=function(A){var x,S=this,y=S.s,I=S.e;return I===null?y?(x="Infinity",y<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?Gl(dr(S.c),I):yn(dr(S.c),I,"0"):A===10&&C?(S=$(new L(S),o+I+1,a),x=yn(dr(S.c),S.e,"0")):(We(A,2,k.length,"Base"),x=r(yn(dr(S.c),I,"0"),10,A,y,!0)),y<0&&S.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return te(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&L.set(t),L}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,s=t[0]+"";n<i;){for(e=t[n++]+"",r=ue-e.length;r--;e="0"+e);s+=e}for(i=s.length;s.charCodeAt(--i)===48;);return s.slice(0,i+1||1)}function Si(t,e){var r,n,i=t.c,s=e.c,o=t.s,a=e.s,c=t.e,l=e.e;if(!o||!a)return null;if(r=i&&!i[0],n=s&&!s[0],r||n)return r?n?0:-a:o;if(o!=a)return o;if(r=o<0,n=c==l,!i||!s)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=s.length)?c:l,o=0;o<a;o++)if(i[o]!=s[o])return i[o]>s[o]^r?1:-1;return c==l?0:c>l^r?1:-1}function We(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function jl(t){var e=t.c.length-1;return fr(t.e/ue)==e&&t.c[e]%2!=0}function Gl(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function yn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var Yw=EA(),yA=Yw;var Xw=24,va=32,Qw=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,yf=Qw(),Ef=(t=4,e=yf)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function Zw(t){let e=new yA(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var vA=(t="")=>{let e=new TextEncoder;return Zw(mA(e.encode(t))).toString(36).slice(1)},gA=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),eR=t=>gA[Math.floor(t()*gA.length)],tR=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=yf}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Ef(va,e):Ef(va,e);return vA(n).substring(0,va)},rR=t=>()=>t++,nR=476782367,AA=({random:t=yf,counter:e=rR(Math.floor(t()*nR)),length:r=Xw,fingerprint:n=tR({random:t})}={})=>{if(r>va)throw new Error(`Length must be between 2 and ${va}. Received: ${r}`);return function(){let s=eR(t),o=Date.now().toString(36),a=e().toString(36),c=Ef(r,t),l=`${o+c+a+n}`;return`${s+vA(l).substring(1,r)}`}},At=iR(AA);function iR(t){let e;return()=>(e||(e=t()),e())}function Aa(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Pe(t){return Aa(t)==="ConditionalCheckFailedException"}var Ta=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return At()}async get(e){try{let r=await this.docClient.send(new oR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()}}));if(!r.Item)return g(null);let n=this.unmarshall(r.Item);return lf(ne(n.expiresAt))?g(null):g(n)}catch{return u(M.DatabaseQueryError({query:"get challenge"}))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:z(r)},s=ne(e.expiresAt),o=Math.floor((s+this.ttlGracePeriod)/1e3);return await this.docClient.send(new aR({TableName:this.tableName,Item:this.marshall(i,o)})),g(i)}catch{return u(M.DatabaseQueryError({query:"create challenge"}))}}async update(e,r){try{let n=[],i={},s={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=f.METHOD,s[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=f.PHASE,s[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=f.CODE_HASH,s[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=f.CHALLENGE_STATUS,s[":challengeStatus"]=r.status),n.length===0?g(void 0):(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g(void 0))}catch{return u(M.DatabaseQueryError({query:"update challenge"}))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let o=(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":f.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[f.ATTEMPTS]??0;return g(o)}catch(s){return Pe(s)?u(M.AttemptsExceeded()):u(M.DatabaseQueryError({query:"increment challenge attempts"}))}}async remove(e){try{return await this.docClient.send(new sR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":f.PK}})),g(void 0)}catch(r){return Pe(r)?g(void 0):u(M.DatabaseQueryError({query:"remove challenge"}))}}marshall(e,r){let n={[f.PK]:D.CHALLENGE_PK(e.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:e.userId,[f.PURPOSE]:e.purpose,[f.CHALLENGE_STATUS]:e.status,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.TTL]:r};return e.tenantId&&(n[f.TENANT_ID]=e.tenantId),e.phase&&(n[f.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[f.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[f.METHOD]=e.method),e.codeHash&&(n[f.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[f.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[f.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[f.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[f.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[f.COUNTRY]=e.country),e.city&&(n[f.CITY]=e.city),e.metadata&&(n[f.METADATA]=e.metadata),e.flowKey&&(n[f.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[f.PK]),userId:e[f.USER_ID],purpose:e[f.PURPOSE],status:e[f.CHALLENGE_STATUS],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT])};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.PHASE]&&(n.phase=e[f.PHASE]),e[f.ALLOWED_METHODS]&&(n.allowedMethods=e[f.ALLOWED_METHODS]),e[f.METHOD]&&(n.method=e[f.METHOD]),e[f.CODE_HASH]&&(n.codeHash=e[f.CODE_HASH]),e[f.ATTEMPTS]!==void 0&&(n.attempts=e[f.ATTEMPTS]),e[f.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[f.MAX_ATTEMPTS]),e[f.IDENTITY_TYPE]&&(n.identityType=e[f.IDENTITY_TYPE]),e[f.IDENTITY_VALUE]&&(n.identityValue=e[f.IDENTITY_VALUE]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.FLOW_KEY]&&(n.flowKey=e[f.FLOW_KEY]),n}};import{BatchGetCommand as cR,DeleteCommand as lR,GetCommand as uR,PutCommand as dR,QueryCommand as $l,UpdateCommand as pR}from"@aws-sdk/lib-dynamodb";var Ia=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return At()}async get(e){try{let r=await this.docClient.send(new uR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get credential"}))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return g(null);let i=n.Items[0];if(!i)return g(null);let s=le.credentialId(i[f.PK]);return this.get(s)}catch{return u(M.DatabaseQueryError({query:"get credential by user and type"}))}}async getByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(o=>le.credentialId(o[f.PK])),i=await this.batchGet(n);if(i.ok===!1)return u(i.errors,i.meta);if(!i.data)return g([]);let s=i.data.filter(o=>o!==null);return g(s)}catch{return u(M.DatabaseQueryError({query:"get credentials by user"}))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new dR({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(i)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"credential"})):u(M.DatabaseQueryError({query:"create credential"}))}}async update(e,r){try{let n=ae(),i=[],s={},o={};return i.push(`#${f.UPDATED_AT} = :updatedAt`),s[`#${f.UPDATED_AT}`]=f.UPDATED_AT,o[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${f.CREDENTIAL_VALUE} = :value`),s[`#${f.CREDENTIAL_VALUE}`]=f.CREDENTIAL_VALUE,o[":value"]=r.value),r.data!==void 0&&(i.push(`#${f.METADATA} = :data`),s[`#${f.METADATA}`]=f.METADATA,o[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${f.REVOKED_AT} = :revokedAt`),s[`#${f.REVOKED_AT}`]=f.REVOKED_AT,o[":revokedAt"]=r.revokedAt?ne(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${f.LAST_USED_AT} = :lastUsedAt`),s[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,o[":lastUsedAt"]=r.lastUsedAt?ne(r.lastUsedAt):null),await this.docClient.send(new pR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"update credential"}))}}async remove(e){try{return await this.docClient.send(new lR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(r){return Pe(r)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"delete credential"}))}}async hasType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return g((n.Count||0)>0)}catch{return u(M.DatabaseQueryError({query:"check credential type"}))}}async countByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count credentials"}))}}async batchGet(e){if(e.length===0)return g([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let o=(await this.docClient.send(new cR({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[f.PK]:D.CREDENTIAL_PK(c),[f.SK]:D.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of o){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return g(n)}catch{return u(M.DatabaseQueryError({query:"batch get credentials"}))}}marshall(e){let r={[f.PK]:D.CREDENTIAL_PK(e.id),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(e.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(e.type,e.id),[f.USER_ID]:e.userId,[f.CREDENTIAL_VALUE]:e.value,[f.METADATA]:e.data,[f.REVOKED_AT]:e.revokedAt?ne(e.revokedAt):null,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)};return e.lastUsedAt&&(r[f.LAST_USED_AT]=ne(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[f.PK]),n=le.credentialTypeFromUserSK(e[f.CREDENTIAL_USER_SK]);return{id:r,userId:e[f.USER_ID],type:n,value:e[f.CREDENTIAL_VALUE],data:e[f.METADATA]||{},revokedAt:Ht(e[f.REVOKED_AT]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT]),lastUsedAt:Ht(e[f.LAST_USED_AT])}}};import{BatchGetCommand as fR,DeleteCommand as mR,GetCommand as hR,PutCommand as ER,QueryCommand as yR,UpdateCommand as gf}from"@aws-sdk/lib-dynamodb";function vf(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Nr(t.lastFailedAt),lockedUntil:Nr(t.lockedUntil)}}function IA(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Ht(n.lastFailedAt),lockedUntil:Ht(n.lockedUntil)};return e}function _A(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=vf(n));return e}var _a=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new hR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}}));if(!n.Item)return g(null);let i=this.unmarshall(n.Item);return g(i)}catch(n){return console.error("[DynamoDB] identities.get error:",n),u(M.DatabaseQueryError({query:"get identity"}))}}async getByUserId(e){try{let r=await this.docClient.send(new yR({TableName:this.tableName,IndexName:Se.USER_IDENTITIES,KeyConditionExpression:`${f.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":D.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let s=this.unmarshall(i);s!==null&&n.push(s)}return g(n)}catch{return u(M.DatabaseQueryError({query:"get identities by userId"}))}}async create(e){try{let r=ae(),n={...e,createdAt:z(r),updatedAt:z(r)};return await this.docClient.send(new ER({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"identity"})):u(M.DatabaseQueryError({query:"create identity"}))}}async update(e,r,n){try{let i=[],s=[],o={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),o["#loginEnabled"]=f.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Nr(n.verifiedAt);l===null?(s.push("#verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),o["#guards"]=f.GUARDS,a[":guards"]=_A(n.guards)),n.pendingVerification!==void 0&&(o["#pendingVerification"]=f.PENDING_VERIFICATION,n.pendingVerification===null?s.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),o["#updatedAt"]=f.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),s.length>0&&c.push(`REMOVE ${s.join(", ")}`),await this.docClient.send(new gf({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update identity"}))}}async remove(e,r){try{return await this.docClient.send(new mR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove identity"}))}}async updateGuard(e,r,n,i){let s={[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()};try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":f.GUARDS,"#guardKey":n,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guard":vf(i),":updatedAt":ae()}})),g(void 0)}catch(o){if(Pe(o))try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":f.GUARDS,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:vf(i)},":updatedAt":ae()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update guard"}))}return u(M.DatabaseQueryError({query:"update guard"}))}}async batchGet(e){try{if(e.length===0)return g([]);let n=(await this.docClient.send(new fR({RequestItems:{[this.tableName]:{Keys:e.map(({type:o,value:a})=>({[f.PK]:D.IDENTITY_PK(o,a),[f.SK]:D.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let o of n){let a=this.unmarshall(o);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let s=e.map(({type:o,value:a})=>{let c=`${o}#${a}`;return i.get(c)||null});return g(s)}catch{return u(M.DatabaseQueryError({query:"batch get identities"}))}}marshall(e){let r={[f.PK]:D.IDENTITY_PK(e.type,e.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(e.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(e.type,e.value),[f.USER_ID]:e.userId,[f.LOGIN_ENABLED]:e.loginEnabled,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)},n=Nr(e.verifiedAt);return n!==null&&(r[f.VERIFIED_AT]=n),r[f.GUARDS]=_A(e.guards),e.pendingVerification&&(r[f.PENDING_VERIFICATION]=Ft({...e.pendingVerification,expiresAt:ne(e.pendingVerification.expiresAt),resendAvailableAt:Nr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[f.PK]);if(!r){let n=e[f.IDENTITY_USER_SK]?le.userIndexSKInfo(e[f.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:IA(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[f.PK],GSI1SK:e[f.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:IA(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:z(r.expiresAt),resendAvailableAt:Ht(r.resendAvailableAt)}}};import{TransactWriteCommand as gR}from"@aws-sdk/lib-dynamodb";var xa=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=At(),i=ne(e.challenge.expiresAt),s=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new gR({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,s))]})),g(void 0)}catch(r){return Aa(r)==="TransactionCanceledException"||Pe(r)?u(M.UniqueConstraintViolation({field:"registration"})):u(M.DatabaseQueryError({query:"create email verification registration transaction"}))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ft(e),ConditionExpression:`attribute_not_exists(${f.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[f.PK]:D.USER_PK(e.profile.id),[f.SK]:D.USER_PROFILE_SK(),userStatus:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[f.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[f.PK]:D.USER_PK(e.userAuth.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[f.CREATED_AT]:r,[f.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[f.PK]:D.IDENTITY_PK(n.type,n.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(n.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(n.type,n.value),[f.USER_ID]:n.userId,[f.LOGIN_ENABLED]:n.loginEnabled,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.PENDING_VERIFICATION]:Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)})},s=Nr(n.verifiedAt);return s!==null&&(i[f.VERIFIED_AT]=s),i[f.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,s={[f.PK]:D.CREDENTIAL_PK(r),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(i.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(i.type,r),[f.USER_ID]:i.userId,[f.CREDENTIAL_VALUE]:i.value,[f.METADATA]:i.data,[f.REVOKED_AT]:i.revokedAt?ne(i.revokedAt):null,[f.CREATED_AT]:n,[f.UPDATED_AT]:n};return i.lastUsedAt&&(s[f.LAST_USED_AT]=ne(i.lastUsedAt)),s}marshallChallenge(e,r,n){let i=e.challenge,s={[f.PK]:D.CHALLENGE_PK(i.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:i.userId,[f.PURPOSE]:i.purpose,[f.CHALLENGE_STATUS]:i.status,[f.EXPIRES_AT]:ne(i.expiresAt),[f.CREATED_AT]:r,[f.TTL]:n};return i.tenantId&&(s[f.TENANT_ID]=i.tenantId),i.phase&&(s[f.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(s[f.ALLOWED_METHODS]=i.allowedMethods),i.method&&(s[f.METHOD]=i.method),i.codeHash&&(s[f.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(s[f.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(s[f.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(s[f.IDENTITY_TYPE]=i.identityType),i.identityValue&&(s[f.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(s[f.DEVICE_LABEL]=i.deviceLabel),i.country&&(s[f.COUNTRY]=i.country),i.city&&(s[f.CITY]=i.city),i.metadata&&(s[f.METADATA]=i.metadata),i.flowKey&&(s[f.FLOW_KEY]=i.flowKey),s}};import{DynamoDBClient as TR}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as IR,GetCommand as SA,PutCommand as _R,QueryCommand as ba,UpdateCommand as js}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as vR}from"@aws-sdk/lib-dynamodb";var xA=100,bA=5;function AR(t){return new Promise(e=>setTimeout(e,t))}async function qs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=xA){let s=r.slice(i,i+xA),o=0;for(;s.length>0;){let a=await t.send(new vR({RequestItems:{[e]:{Keys:s}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(o+=1,o>bA)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${bA} retries`);s=l,await AR(2**o*25)}}return n}var Sa=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new TR({});this.docClient=e.docClient||IR.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return At()}generateTokenId(){return At()}async get(e){try{let r=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get session"}))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),s={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},o=ya(ne(e.expiresAt)+this.ttlGracePeriod),a=ql.sessionSK(r,n);return await this.docClient.send(new _R({TableName:this.tableName,Item:this.marshall(s,o,a)})),g(s)}catch{return u(M.DatabaseQueryError({query:"create session"}))}}async update(e,r){try{let n=[],i={},s={};if(r.tokenId!==void 0&&(n.push(`#${f.TOKEN_ID} = :tokenId`),i[`#${f.TOKEN_ID}`]=f.TOKEN_ID,s[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${f.EXPIRES_AT} = :expiresAt`),i[`#${f.EXPIRES_AT}`]=f.EXPIRES_AT,s[":expiresAt"]=ne(r.expiresAt);let o=ya(ne(r.expiresAt)+this.ttlGracePeriod);n.push(`#${f.TTL} = :ttl`),i[`#${f.TTL}`]=f.TTL,s[":ttl"]=o}return r.lastUsedAt!==void 0&&(n.push(`#${f.LAST_USED_AT} = :lastUsedAt`),i[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,s[":lastUsedAt"]=ne(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${f.METADATA} = :metadata`),i[`#${f.METADATA}`]=f.METADATA,s[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${f.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${f.PREVIOUS_TOKEN_ID}`]=f.PREVIOUS_TOKEN_ID,s[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${f.ROTATED_AT} = :rotatedAt`),i[`#${f.ROTATED_AT}`]=f.ROTATED_AT,s[":rotatedAt"]=r.rotatedAt),n.length===0?g():(await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g())}catch{return u(M.DatabaseQueryError({query:"update session"}))}}async rotateToken(e,r,n){try{let i=ya(ne(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.TOKEN_ID} = :tokenId, #${f.PREVIOUS_TOKEN_ID} = :previousTokenId, #${f.ROTATED_AT} = :rotatedAt, #${f.EXPIRES_AT} = :expiresAt, #${f.LAST_USED_AT} = :lastUsedAt, #${f.TTL} = :ttl`,ConditionExpression:`#${f.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.PREVIOUS_TOKEN_ID}`]:f.PREVIOUS_TOKEN_ID,[`#${f.ROTATED_AT}`]:f.ROTATED_AT,[`#${f.EXPIRES_AT}`]:f.EXPIRES_AT,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT,[`#${f.TTL}`]:f.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":ne(n.expiresAt),":lastUsedAt":ne(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),g(!0)}catch(i){return Pe(i)?g(!1):u(M.DatabaseQueryError({query:"rotate session token"}))}}async switchTenant(e,r){try{let n=[`#${f.TENANT_ID} = :tenantId`,`#${f.TOKEN_ID} = :tokenId`,`#${f.LAST_USED_AT} = :lastUsedAt`],i=[],s={[`#${f.TENANT_ID}`]:f.TENANT_ID,[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT},o={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};s[`#${f.TENANT_TYPE}`]=f.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${f.TENANT_TYPE} = :tenantType`),o[":tenantType"]=r.tenantType):i.push(`#${f.TENANT_TYPE}`),s[`#${f.PERM}`]=f.PERM,r.perms!==void 0?(n.push(`#${f.PERM} = :perms`),o[":perms"]=JSON.stringify(r.perms)):i.push(`#${f.PERM}`),s[`#${f.ROLES}`]=f.ROLES,r.roles!==void 0?(n.push(`#${f.ROLES} = :roles`),o[":roles"]=r.roles):i.push(`#${f.ROLES}`),s["#revokedAt"]=f.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK}) AND attribute_not_exists(#revokedAt)`})),g()}catch(n){return Pe(n)?u(M.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):u(M.DatabaseQueryError({query:"switch tenant"}))}}async revoke(e){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date)},ConditionExpression:`attribute_exists(${f.PK})`})),g()}catch(r){return Pe(r)?g():u(M.DatabaseQueryError({query:"revoke session"}))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ConditionExpression:`#${f.USER_ID} = :userId AND attribute_not_exists(#${f.REVOKED_AT})`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.USER_ID}`]:f.USER_ID,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date),":userId":r}})),g()}catch(n){return Pe(n)?g():u(M.DatabaseQueryError({query:"revoke session by user"}))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.USER_SESSIONS,KeyConditionExpression:`${f.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find sessions by user"}))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find active sessions by user"}))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(i=>{let s=le.sessionId(i[f.PK]),o=ql.extractCreatedAt(i[f.ACTIVE_SESSION_SK]);return{id:s,createdAt:new Date(o)}});return g(n)}catch{return u(M.DatabaseQueryError({query:"get active sessions for limit"}))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=ne(new Date),i=await Promise.allSettled(e.map(o=>this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(o),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),s=0;for(let o of i)o.status==="fulfilled"?s+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Aa(o.reason)});return s}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return g(0);let i=n.Items.map(o=>le.sessionId(o[f.PK])).filter(o=>!r||o!==r),s=await this.revokeSessionsByIds(i,"revokeAllByUserId");return g(s)}catch{return u(M.DatabaseQueryError({query:"revoke all sessions by user"}))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return g(r)}catch{return u(M.DatabaseQueryError({query:"revoke batch sessions"}))}}async countByUserId(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count active sessions by user"}))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(r),[f.SK]:D.SESSION_SK()},ProjectionExpression:`${f.TOKEN_ID}, ${f.REVOKED_AT}, ${f.EXPIRES_AT}`}));if(!n.Item)return g(!1);let i=n.Item,s=i[f.TOKEN_ID]===e&&!i[f.REVOKED_AT]&&z(i[f.EXPIRES_AT])>new Date;return g(s)}catch{return u(M.DatabaseQueryError({query:"check token active"}))}}marshall(e,r,n){let i={[f.PK]:D.SESSION_PK(e.id),[f.SK]:D.SESSION_SK(),[f.USER_SESSION_PK]:D.USER_PK(e.userId),[f.USER_SESSION_SK]:n,...!e.revokedAt&&{[f.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[f.ACTIVE_SESSION_SK]:n},[f.USER_ID]:e.userId,[f.TOKEN_ID]:e.tokenId,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.LAST_USED_AT]:ne(e.lastUsedAt),[f.TTL]:r};return e.tenantId&&(i[f.TENANT_ID]=e.tenantId),e.tenantType&&(i[f.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[f.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[f.ROLES]=e.roles),e.deviceLabel&&(i[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[f.COUNTRY]=e.country),e.city&&(i[f.CITY]=e.city),e.metadata&&(i[f.METADATA]=e.metadata),e.revokedAt&&(i[f.REVOKED_AT]=ne(e.revokedAt)),e.previousTokenId&&(i[f.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[f.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[f.PK]),userId:e[f.USER_ID],tokenId:e[f.TOKEN_ID],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT]),lastUsedAt:z(e[f.LAST_USED_AT]),revokedAt:e[f.REVOKED_AT]?z(e[f.REVOKED_AT]):null};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.TENANT_TYPE]&&(n.tenantType=e[f.TENANT_TYPE]),e[f.PERM]!==void 0&&(n.perms=JSON.parse(e[f.PERM])),e[f.ROLES]!==void 0&&(n.roles=e[f.ROLES]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[f.PREVIOUS_TOKEN_ID]),e[f.ROTATED_AT]!==void 0&&(n.rotatedAt=e[f.ROTATED_AT]),n}};import{QueryCommand as xR}from"@aws-sdk/lib-dynamodb";var Na=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new xR(o)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch(n){return console.error("[DynamoDBTenantInviteQuery.listByTenant] Error:",n instanceof Error?n.message:n),u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(i.declinedAt=z(e.declinedAt)),e.revokedAt&&(i.revokedAt=z(e.revokedAt)),i}};import{GetCommand as NA,PutCommand as bR,QueryCommand as qn,UpdateCommand as SR}from"@aws-sdk/lib-dynamodb";var NR=10080*60*1e3,wa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[f.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(n.declinedAt=z(e.declinedAt)),e.revokedAt&&(n.revokedAt=z(e.revokedAt)),n}generateInviteId(){return At()}async getById(e){try{let r=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()}}));return r.Item?g(this.mapItemToEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getById invite"}))}}async getByToken(e){try{let n=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":f.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return g(null);let i=n[0],s=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return s.Item?g(this.mapItemToEntity(s.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getByToken invite"}))}}async create(e){try{let r=ae(),n=ne(e.expiresAt),i=Math.floor((n+NR)/1e3),s={PK:D.INVITE_PK(e.id),SK:D.INVITE_SK(),[f.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[f.INVITED_BY_ID]:e.invitedById,[f.INVITE_STATUS]:e.status,[f.INVITE_TOKEN]:e.inviteToken,[f.EXPIRES_AT]:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.TTL]:i,[f.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[f.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[f.INVITE_TOKEN_GSI]:e.inviteToken},o={};e.invitedByName&&(o.name=e.invitedByName),e.invitedByEmail&&(o.email=e.invitedByEmail),e.invitedByJobTitle&&(o.jobTitle=e.invitedByJobTitle),Object.keys(o).length>0&&(s[f.INVITED_BY_INFO]=o),e.inviteeUserId&&(s[f.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(s[f.INVITEE_EMAIL]=e.inviteeEmail,s[f.INVITEE_EMAIL_GSI]=e.inviteeEmail,s[f.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(s[f.INVITEE_PHONE]=e.inviteePhone,s[f.INVITEE_PHONE_GSI]=e.inviteePhone,s[f.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(s[f.ROLES]=e.roles),e.perms!==void 0&&(s[f.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(s[f.AUTH_PERM]=e.authPerm),e.displayName&&(s[f.DISPLAY_NAME]=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.jobTitle&&(s.jobTitle=e.jobTitle),await this.docClient.send(new bR({TableName:this.tableName,Item:s,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:z(r),updatedAt:z(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),g(a)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"invite id"})):u(M.UnknownError({message:r.message}))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],s={"#inviteStatus":f.INVITE_STATUS,"#inviteTenantSk":f.INVITE_TENANT_SK,"#updatedAt":f.UPDATED_AT},o={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),s["#acceptedAt"]=f.ACCEPTED_AT,o[":acceptedAt"]=ne(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),s["#declinedAt"]=f.DECLINED_AT,o[":declinedAt"]=ne(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),s["#revokedAt"]=f.REVOKED_AT,o[":revokedAt"]=ne(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),s["#inviteTokenGsi"]=f.INVITE_TOKEN_GSI,s["#inviteeEmailGsi"]=f.INVITEE_EMAIL_GSI,s["#inviteeEmailTenantSk"]=f.INVITEE_EMAIL_TENANT_SK,s["#inviteePhoneGsi"]=f.INVITEE_PHONE_GSI,s["#inviteePhoneTenantSk"]=f.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new SR({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantInvite",id:e})):u(M.UnknownError({message:n.message}))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":f.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndEmail"}))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":f.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndPhone"}))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK,"#inviteeUserId":f.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndUserId"}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new qn(o)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByEmail"}))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByPhone"}))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return g(r.Count??0)}catch{return u(M.DatabaseQueryError({query:"countPendingByTenant"}))}}async expireOld(e){return g(0)}};import{QueryCommand as wR}from"@aws-sdk/lib-dynamodb";var Ra=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=(await this.docClient.send(new wR(i))).Items||[],a=[],c=new Map;for(let E of o){let v=E.SK;if(v.startsWith(Ve.TENANT_PROFILE)){let b=le.tenantProfileUserId(v);c.set(b,E)}else v.startsWith(ce.USER)&&a.push(E)}a.sort((E,v)=>v.createdAt-E.createdAt);let l=a.slice(0,n),d=a.length>n,p=l.map(E=>{let v=le.tenantMemberUserId(E.SK),b=c.get(v);return this.toListItem(E,e,v,b)}),m=d&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:d,cursor:m,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e,r,n,i){let s={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};if(e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm),i){let o={tenantId:r,userId:n,createdAt:z(i.createdAt),updatedAt:z(i.updatedAt)};i.contactEmail&&(o.contactEmail=i.contactEmail),i.contactPhone&&(o.contactPhone=i.contactPhone),i.displayName&&(o.displayName=i.displayName),i.displayNameSource&&(o.displayNameSource=i.displayNameSource),i.givenName&&(o.givenName=i.givenName),i.familyName&&(o.familyName=i.familyName),i.avatarUrl&&(o.avatarUrl=i.avatarUrl),i.locale&&(o.locale=i.locale),i.jobTitle&&(o.jobTitle=i.jobTitle),i.bio&&(o.bio=i.bio),i.metadata&&(o.metadata=JSON.parse(i.metadata)),s.tenantProfile=o}return s}};import{DeleteCommand as RR,DynamoDBDocumentClient as OR,GetCommand as wA,PutCommand as kR,QueryCommand as CR,TransactWriteCommand as DR,UpdateCommand as RA}from"@aws-sdk/lib-dynamodb";var Oa=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=OR.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)}}));if(!n.Item)return g(null);let i=this.mapItemToEntity(n.Item);return g(i)}catch{return u(M.DatabaseQueryError({query:"get"}))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ft({PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new DR({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new kR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?u(M.UniqueConstraintViolation({field:"tenant owner"})):u(M.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant member"})):u(M.UnknownError({message:r.message}))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async updateStatus(e,r,n){try{return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=await this.docClient.send(new CR(i)),o=(s.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!s.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return mr(o,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async hasOwner(e){try{let r=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_OWNER_MARKER_SK()}}));return g(!!r.Item)}catch{return u(M.DatabaseQueryError({query:"hasOwner"}))}}async remove(e,r){try{return await this.docClient.send(new RR({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};import{BatchGetCommand as PR,QueryCommand as UR}from"@aws-sdk/lib-dynamodb";var ka=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Zt.DEFAULT,s=r?.parentTenantId,o=s?`${i}#${s}#`:`${i}#`,a={TableName:this.tableName,IndexName:Se.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":o},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new UR(a)),l=c.Items??[],d=await this.fetchProfileMap(e,l),p=l.map(v=>this.toListItem(v,e,d)),m=!!c.LastEvaluatedKey,E=m?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:m,cursor:E,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByUser query"}))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(o=>({PK:D.TENANT_PROFILE_PK(le.tenantId(o.PK)),SK:D.TENANT_PROFILE_SK(e)})),s=await this.docClient.send(new PR({RequestItems:{[this.tableName]:{Keys:i}}}));for(let o of s.Responses?.[this.tableName]??[]){let a=o,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),s={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm);let o=n.get(i);return o&&(o.contactEmail&&(s.contactEmail=o.contactEmail),o.contactPhone&&(s.contactPhone=o.contactPhone),o.displayName&&(s.displayName=o.displayName),o.displayNameSource&&(s.displayNameSource=o.displayNameSource),o.givenName&&(s.givenName=o.givenName),o.familyName&&(s.familyName=o.familyName),o.avatarUrl&&(s.avatarUrl=o.avatarUrl),o.locale&&(s.locale=o.locale),o.jobTitle&&(s.jobTitle=o.jobTitle),o.bio&&(s.bio=o.bio),o.metadata&&(s.metadata=JSON.parse(o.metadata))),s}};import{DeleteCommand as LR,GetCommand as MR,PutCommand as KR,UpdateCommand as HR}from"@aws-sdk/lib-dynamodb";var Ca=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return At()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new MR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()}}));return r.Item?g(this.toEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get tenant"}))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ft({PK:D.TENANT_PK(r),SK:D.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new KR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant"})):u(M.UnknownError({message:r.message}))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o}=wr(n);return await this.docClient.send(new HR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:n.message}))}}async delete(e){try{return await this.docClient.send(new LR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:r.message}))}}async list(){return u(M.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return u(M.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return u(M.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as FR,GetCommand as VR,PutCommand as BR,UpdateCommand as Wl}from"@aws-sdk/lib-dynamodb";var Da=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new VR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}}));return r.Item?g(this.unmarshall(r.Item,e)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user auth"}))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new BR({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"userAuth"})):u(M.DatabaseQueryError({query:"create user auth"}))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update user auth status"}))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa required"}))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa methods"}))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa settings"}))}}async remove(e){try{return await this.docClient.send(new FR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user auth"}))}}marshall(e){return{[f.PK]:D.USER_PK(e.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}};import{DynamoDBDocumentClient as qR,DeleteCommand as jR,GetCommand as GR,PutCommand as $R,QueryCommand as OA,UpdateCommand as Af}from"@aws-sdk/lib-dynamodb";function Gs(t,e){return e?D.USER_MFA_WITH_ID_SK(t,e):D.USER_MFA_SK(t)}var Pa=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=qR.from(e)}toDynamoDBItem(e){let r={PK:D.USER_PK(e.userId),SK:Gs(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:z(e.createdAt),verifiedAt:Ht(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Ht(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Ht(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Ht(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Gs(r,n),s=await this.docClient.send(new GR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}}));return s.Item?g(this.fromDynamoDBItem(s.Item,e)):g(null)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.get error:",i),u(M.DatabaseQueryError({query:"get MFA authenticator"}))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":Ve.MFA}},s=((await this.docClient.send(new OA(r))).Items??[]).map(o=>this.fromDynamoDBItem(o,e));return g(s)}catch(r){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserId error:",r),u(M.DatabaseQueryError({query:"find MFA authenticators by user"}))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":`${Ve.MFA}${r}`}},o=((await this.docClient.send(new OA(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return g(o)}catch(n){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserIdAndMethod error:",n),u(M.DatabaseQueryError({query:"find MFA authenticators by method"}))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=At());let n=this.toDynamoDBItem(r);return await this.docClient.send(new $R({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(this.fromDynamoDBItem(n,e.userId))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"MFA authenticator"})):(console.error("DynamoDBUserMFAAuthenticatorRepository.create error:",r),u(M.DatabaseQueryError({query:"create MFA authenticator"})))}}async update(e,r,n,i){try{let s=Gs(r,n),o=[],a={},c={};if(i.label!==void 0&&(o.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(o.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(o.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(o.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(o.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(o.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(o.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(o.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),o.length===0)return g(void 0);let l={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:s},UpdateExpression:`SET ${o.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new Af(l)),g(void 0)}catch(s){return console.error("DynamoDBUserMFAAuthenticatorRepository.update error:",s),u(M.DatabaseQueryError({query:"update MFA authenticator"}))}}async remove(e,r,n){try{let i=Gs(r,n);return await this.docClient.send(new jR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}})),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.remove error:",i),u(M.DatabaseQueryError({query:"remove MFA authenticator"}))}}async incrementFailedAttempts(e,r,n,i,s){try{let o=Gs(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},d={":zero":0,":inc":1,":lastFailedAt":a};s!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",d[":lockedUntil"]=a+s*60*1e3,d[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:o},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:d};return await this.docClient.send(new Af(p)),g(void 0)}catch(o){return console.error("DynamoDBUserMFAAuthenticatorRepository.incrementFailedAttempts error:",o),u(M.DatabaseQueryError({query:"increment failed attempts"}))}}async resetFailedAttempts(e,r,n){try{let i=Gs(r,n),s={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new Af(s)),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.resetFailedAttempts error:",i),u(M.DatabaseQueryError({query:"reset failed attempts"}))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as WR,DynamoDBDocumentClient as zR,GetCommand as JR,PutCommand as YR,QueryCommand as kA,UpdateCommand as CA}from"@aws-sdk/lib-dynamodb";var Ua=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=zR.from(e)}generateUserId(){return At()}async getById(e){try{let r=await this.docClient.send(new JR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}}));if(!r.Item)return g(null);let n=r.Item;if(n.deletedAt)return g(null);let s={id:le.userId(n.PK),status:n.userStatus,createdAt:z(n.createdAt),updatedAt:z(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:z(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return g(s)}catch{return u(M.DatabaseQueryError({query:"getById user"}))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",s={PK:D.USER_PK(n),SK:D.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(s.contactEmail=e.contactEmail),e.contactPhone&&(s.contactPhone=e.contactPhone),e.username&&(s.username=e.username),e.displayName&&(s.displayName=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.avatarUrl&&(s.avatarUrl=e.avatarUrl),e.locale&&(s.locale=e.locale),e.metadata&&(s.metadata=JSON.stringify(e.metadata)),s[f.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),s[f.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new YR({TableName:this.tableName,Item:Ft(s),ConditionExpression:uf("PK")}));let o={id:n,status:i,createdAt:z(r),updatedAt:z(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return g(o)}catch{return u(M.DatabaseQueryError({query:"create user"}))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return g(void 0);i.updatedAt=n;let s=wr(i);return await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:s.UpdateExpression,ExpressionAttributeNames:s.ExpressionAttributeNames,ExpressionAttributeValues:s.ExpressionAttributeValues})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"updateProfile"}))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=Ae.USER_STATUS_PK(e),o=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":s},Limit:n,ExclusiveStartKey:i})),a=[];if(o.Items&&o.Items.length>0)for(let d of o.Items){let p=le.userId(d.PK);a.push(p)}let c=!!o.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return g(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch{return u(M.DatabaseQueryError({query:"get users by status"}))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return g(n.Count||0)}catch{return u(M.DatabaseQueryError({query:"count users by status"}))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt, #${f.USER_STATUS_PK} = :statusPk, #${f.USER_STATUS_SK} = :statusSk`,s={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",s[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${f.UPDATED_AT}`]:f.UPDATED_AT,[`#${f.USER_STATUS_PK}`]:f.USER_STATUS_PK,[`#${f.USER_STATUS_SK}`]:f.USER_STATUS_SK},ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userProfile",id:e})):u(M.DatabaseQueryError({query:"sync auth status"}))}}async remove(e){try{return await this.docClient.send(new WR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user profile"}))}}};import{DeleteCommand as XR,DynamoDBDocumentClient as QR,GetCommand as ZR,PutCommand as e0,QueryCommand as t0,UpdateCommand as r0}from"@aws-sdk/lib-dynamodb";var La=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=QR.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:z(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:D.PROVIDER_PK(e.provider,e.externalId),SK:D.PROVIDER_METADATA_SK(),userProviderPk:D.USER_PK(e.userId),userProviderSk:D.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?ne(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ft(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new ZR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}}));return n.Item?g(this.mapItemToUserProviderLink(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"find provider by external id"}))}}async findByUserId(e){try{let r=await this.docClient.send(new t0({TableName:this.tableName,IndexName:Se.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":f.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":D.USER_PK(e)}}));return!r.Items||r.Items.length===0?g([]):g(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch{return u(M.DatabaseQueryError({query:"find providers by user id"}))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new e0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),g(this.mapItemToUserProviderLink(n))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):u(M.DatabaseQueryError({query:"create user provider"}))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return g(void 0);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new r0({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update user provider"}))}}async remove(e,r){try{return await this.docClient.send(new XR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"delete user provider"}))}}};import{DeleteCommand as n0,GetCommand as i0,PutCommand as s0,UpdateCommand as o0}from"@aws-sdk/lib-dynamodb";var Ma=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new i0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)}}));return n.Item?g(this.mapItemToEntity(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user tenant profile"}))}}async create(e){try{let r=ae(),n={PK:D.TENANT_PROFILE_PK(e.tenantId),SK:D.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new s0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:z(r),updatedAt:z(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),g(i)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"user tenant profile"})):u(M.UnknownError({message:r.message}))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new o0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async remove(e,r){try{return await this.docClient.send(new n0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};var Tf=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new c0(e.clientConfig||{});let r=l0.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ua(this.client,this.tableName),this.sessions=new Sa({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new La(this.client,this.tableName),this.userMfaAuthenticators=new Pa(this.client,this.tableName),this.challenges=new Ta({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new _a({docClient:r,tableName:this.tableName}),this.credentials=new Ia({docClient:r,tableName:this.tableName}),this.registration=new xa({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Da({docClient:r,tableName:this.tableName}),this.tenantMembers=new Oa(this.client,this.tableName),this.tenantInvites=new wa({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new Ma(r,this.tableName),this.tenants=new Ca({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new Na({docClient:r,tableName:this.tableName}),tenantMembers:new Ra({docClient:r,tableName:this.tableName}),tenants:new ka({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new a0({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function DA(t){return new Tf(t)}ho();var If=1,PA=2,UA=3,LA="auth-craft:internal";async function u0(t){let e=t.replace(/^0x/,""),r=KA(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let s=`-----BEGIN PRIVATE KEY-----
129
129
  `+btoa(String.fromCharCode(...i)).match(/.{1,64}/g).join(`
130
130
  `)+`
131
- -----END PRIVATE KEY-----`;return ao(s,"EdDSA")}async function i0(t){let e=t.replace(/^0x/,""),r=PA(e),n=o0(r);return it({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function vf(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
132
- `)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return n0(r)}if(r.startsWith("-----"))return ao(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function DA(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
133
- `)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return i0(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ho(),ih));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function s0(t){return new TextEncoder().encode(t)}function PA(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function o0(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var Gl=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await s0(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await vf(this.config.privateKey,e),i=await DA(this.config.publicKey,e),s,o;return this.config.servicePrivateKey&&this.config.servicePublicKey?(s=await vf(this.config.servicePrivateKey,e),o=await DA(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(s=await vf(this.config.servicePrivateKey,e),o=i):(s=n,o=i),{privateKey:n,publicKey:i,servicePrivateKey:s,servicePublicKey:o}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),s=i+r*60,o=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:o??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?OA:gf,iat:i,exp:s};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new Zi(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,s=this.config.clockTolerance??0,o={algorithms:[i],clockTolerance:s};this.config.issuer&&(o.issuer=this.config.issuer),n&&(o.audience=n);let{payload:a}=await bn(e,r,o);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1);return this.signJwt(s,n.privateKey)}async verify(e){let r=await this.ensureKeys(),n=this.config.accessTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==gf?null:i}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1),o={...s};return e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=e.perms),{token:await this.signJwt(o,n.privateKey),expiresAt:s.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=this.config.accessTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==gf||!("jti"in i)?null:i}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,s=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(s,n.privateKey),expiresAt:s.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=this.config.refreshTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==OA||!("sid"in i)||!("jti"in i)?null:i}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,s=e.aud??this.config.serviceTokenAudience??CA,o={sub:e.sub,aud:s,iss:this.config.issuer??"",jti:e.jti,typ:kA,iat:n,exp:n+i*60};return e.roles!==void 0&&(o.roles=e.roles),this.signJwt(o,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??CA,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==kA?null:i}async initialize(){}async cleanup(){}};function Af(t){return new Gl(t)}import{DynamoDBClient as a0}from"@aws-sdk/client-dynamodb";function c0(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),g(void 0)}}}function l0(){return F.email.mode==="console"?c0():F.email.mode==="queue"?oa.createAwsSqs({queueUrl:F.email.queue.url,...F.email.queue.region?{region:F.email.queue.region}:{},envelope:F.email.queue.envelope,sourceSystem:F.email.queue.sourceSystem,eventTypeMap:F.email.queue.eventTypeMap,defaultMetadata:F.email.queue.defaultMetadata}):ha.createDirectSmtp({host:F.smtp.host,port:F.smtp.port,secure:F.smtp.secure,auth:{user:F.smtp.user,pass:F.smtp.pass},fromEmail:F.smtp.from,fromName:"Auth Craft"})}async function UA(){let t=Jy(),e=Ly({codeLifetimeMinutes:F.auth.verificationCodeLifetimeMinutes}),r=Jv(),n=Af({algorithm:F.jwtAlgorithm,privateKey:F.jwtPrivateKey,publicKey:F.jwtPublicKey,accessTokenExpiresIn:F.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:F.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:F.jwtIssuer,accessTokenAudience:F.jwtAccessTokenAudience,refreshTokenAudience:F.jwtRefreshTokenAudience}),i=new a0({region:F.awsRegion,...F.dynamodbEndpoint?{endpoint:F.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),s=RA({tableName:F.dynamodbTableName,client:i}),o=l0(),a=new Map;F.oauth.facebook&&a.set("facebook",rf({appId:F.oauth.facebook.clientId,appSecret:F.oauth.facebook.clientSecret,redirectUri:F.oauth.facebook.redirectUri})),F.oauth.google&&a.set("google",nf({clientId:F.oauth.google.clientId,clientSecret:F.oauth.google.clientSecret,redirectUri:F.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:s,emailSystem:o,deviceParser:Qy(),rateLimiter:rA(),mfa:{totp:tA({issuer:F.auth.systemName}),email:Yv()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await na({systemId:F.auth.systemName,plugins:c,security:{...Md.HIGH,maxFailedAttempts:F.security.maxLoginAttempts,lockoutDurationMinutes:F.security.lockoutDurationMinutes,requireVerifiedIdentity:F.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:F.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:F.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:F.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:F.auth.verificationResendCooldownSeconds,verifySessionOnAuth:F.security.verifySessionOnAuth,systemTenantId:F.security.systemTenantId},system:{environment:F.nodeEnv},policy:{auditEnabled:F.features.auditEnabled,deviceTrackingEnabled:F.features.deviceTracking,sessionRotationEnabled:!0},version:F.auth.appVersion,email:{appName:"Auth Craft",appUrl:F.auth.appUrl,supportEmail:F.auth.supportEmail}})}var Ma={INTERNAL_ERROR:X("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:T("INVALID_TOKEN_TYPE","Access token required")};function zA(t,e){let r=tn(e);return t.json(r.body,r.status)}function N0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}Py();var Ni=F.appBasePath?(F.appBasePath.startsWith("/")?F.appBasePath:`/${F.appBasePath}`).replace(/\/$/,""):"",JA=Ni?`${Ni}/health`:"/health",Sf=null,Or=null;async function R0(){return Sf||(Sf=await UA(),console.log("\u2705 Auth SDK initialized")),Sf}async function YA(){if(!Or){let t=await R0(),e={algorithm:F.jwtAlgorithm,publicKey:F.jwtPublicKey,issuer:F.jwtIssuer},r=gr(e),n=es({gateway:{...F.gatewayJwt.publicKeyHex?{publicKeyHex:F.gatewayJwt.publicKeyHex}:{},expectedIssuer:F.gatewayJwt.issuer,expectedAudience:F.gatewayJwt.audience,header:F.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ma.INVALID_TOKEN_TYPE()):c}}}),i=Mu({auth:{jwt:{...e,verify:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ma.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Or=new Vr,F.nodeEnv!=="production"&&Or.use("*",async(o,a)=>{let c=o.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:o.req.method,path:o.req.path,gatewaySecret:o.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:o.res.status,duration:`${Date.now()-l}ms`}))}),F.corsOrigins.length>0&&Or.use("*",Iy({origin:F.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),F.gatewaySecret&&Or.use("*",async(o,a)=>{if(o.req.path===JA)return a();let c=o.req.header("X-Gateway-Secret");return!c||!N0(c,F.gatewaySecret)?(F.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),o.notFound()):a()}),Or.get(JA,o=>zA(o,g({status:"healthy",timestamp:new Date().toISOString()}))),Or.use("*",Ku);let s=wd({auth:t,policy:i,tokenStrategy:F.auth.tokens.refreshTokenStrategy,...F.auth.tokens.refreshTokenCookie?{refreshTokenCookie:F.auth.tokens.refreshTokenCookie}:{},...F.corsOrigins.length>0?{trustedOrigins:F.corsOrigins}:{}});if(Or.route(Ni,s),console.log(`\u{1F510} Auth routes mounted at ${Ni||"/"}`),F.internal.publicKey){let o=Ni?`${Ni}${F.internal.serviceRoutePath}`:F.internal.serviceRoutePath,a=Ud({auth:t,internal:{publicKeyJwk:F.internal.publicKey,alg:F.internal.alg,audience:F.internal.audience,issuer:F.internal.issuer}});Or.route(o,a),console.log(`\u{1F512} Internal routes mounted at ${o}`)}Or.onError((o,a)=>{console.error("\u274C [Error]",{message:o.message,stack:o.stack,path:a.req.path});let c=F.nodeEnv==="production"?"Internal Server Error":o.message||"Internal Server Error";return zA(a,u(Ma.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Or}var Vte=async(t,e)=>{try{let r=await YA();return Ld(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=F.nodeEnv==="production"?"Internal Server Error":n,s=tn(u(Ma.INTERNAL_ERROR({message:i})));return{statusCode:s.status,body:JSON.stringify(s.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(WA(),$A));YA().then(e=>{let r=F.port,n=F.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${F.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Ni||""}`),console.log(`\u{1F511} Gateway secret: ${F.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${F.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{Vte as handler};
131
+ -----END PRIVATE KEY-----`;return ao(s,"EdDSA")}async function d0(t){let e=t.replace(/^0x/,""),r=KA(e),n=f0(r);return it({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function _f(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
132
+ `)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return u0(r)}if(r.startsWith("-----"))return ao(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function MA(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
133
+ `)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return d0(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ho(),ch));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function p0(t){return new TextEncoder().encode(t)}function KA(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function f0(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var zl=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await p0(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await _f(this.config.privateKey,e),i=await MA(this.config.publicKey,e),s,o;return this.config.servicePrivateKey&&this.config.servicePublicKey?(s=await _f(this.config.servicePrivateKey,e),o=await MA(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(s=await _f(this.config.servicePrivateKey,e),o=i):(s=n,o=i),{privateKey:n,publicKey:i,servicePrivateKey:s,servicePublicKey:o}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),s=i+r*60,o=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:o??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?PA:If,iat:i,exp:s};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new Zi(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,s=this.config.clockTolerance??0,o={algorithms:[i],clockTolerance:s};this.config.issuer&&(o.issuer=this.config.issuer),n&&(o.audience=n);let{payload:a}=await bn(e,r,o);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1);return this.signJwt(s,n.privateKey)}async verify(e){let r=await this.ensureKeys(),n=this.config.accessTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==If?null:i}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1),o={...s};return e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=e.perms),{token:await this.signJwt(o,n.privateKey),expiresAt:s.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=this.config.accessTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==If||!("jti"in i)?null:i}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,s=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(s,n.privateKey),expiresAt:s.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=this.config.refreshTokenAudience??this.config.audience,i=await this.verifyJwt(e,r.publicKey,n);return!i||i.typ!==PA||!("sid"in i)||!("jti"in i)?null:i}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,s=e.aud??this.config.serviceTokenAudience??LA,o={sub:e.sub,aud:s,iss:this.config.issuer??"",jti:e.jti,typ:UA,iat:n,exp:n+i*60};return e.roles!==void 0&&(o.roles=e.roles),this.signJwt(o,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??LA,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==UA?null:i}async initialize(){}async cleanup(){}};function xf(t){return new zl(t)}import{DynamoDBClient as m0}from"@aws-sdk/client-dynamodb";function h0(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),g(void 0)}}}function E0(){return F.email.mode==="console"?h0():F.email.mode==="queue"?aa.createAwsSqs({queueUrl:F.email.queue.url,...F.email.queue.region?{region:F.email.queue.region}:{},envelope:F.email.queue.envelope,sourceSystem:F.email.queue.sourceSystem,eventTypeMap:F.email.queue.eventTypeMap,defaultMetadata:F.email.queue.defaultMetadata}):Ea.createDirectSmtp({host:F.smtp.host,port:F.smtp.port,secure:F.smtp.secure,auth:{user:F.smtp.user,pass:F.smtp.pass},fromEmail:F.smtp.from,fromName:"Auth Craft"})}async function HA(){let t=Zy(),e=Fy({codeLifetimeMinutes:F.auth.verificationCodeLifetimeMinutes}),r=Zv(),n=xf({algorithm:F.jwtAlgorithm,privateKey:F.jwtPrivateKey,publicKey:F.jwtPublicKey,accessTokenExpiresIn:F.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:F.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:F.jwtIssuer,accessTokenAudience:F.jwtAccessTokenAudience,refreshTokenAudience:F.jwtRefreshTokenAudience}),i=new m0({region:F.awsRegion,...F.dynamodbEndpoint?{endpoint:F.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),s=DA({tableName:F.dynamodbTableName,client:i}),o=E0(),a=new Map;F.oauth.facebook&&a.set("facebook",af({appId:F.oauth.facebook.clientId,appSecret:F.oauth.facebook.clientSecret,redirectUri:F.oauth.facebook.redirectUri})),F.oauth.google&&a.set("google",cf({clientId:F.oauth.google.clientId,clientSecret:F.oauth.google.clientSecret,redirectUri:F.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:s,emailSystem:o,deviceParser:rg(),rateLimiter:oA(),mfa:{totp:sA({issuer:F.auth.systemName}),email:eA()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await na({systemId:F.auth.systemName,plugins:c,security:{...Vd.HIGH,maxFailedAttempts:F.security.maxLoginAttempts,lockoutDurationMinutes:F.security.lockoutDurationMinutes,requireVerifiedIdentity:F.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:F.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:F.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:F.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:F.auth.verificationResendCooldownSeconds,verifySessionOnAuth:F.security.verifySessionOnAuth,systemTenantId:F.security.systemTenantId},system:{environment:F.nodeEnv},policy:{auditEnabled:F.features.auditEnabled,deviceTrackingEnabled:F.features.deviceTracking,sessionRotationEnabled:!0},version:F.auth.appVersion,email:{appName:"Auth Craft",appUrl:F.auth.appUrl,supportEmail:F.auth.supportEmail}})}var Ka={INTERNAL_ERROR:X("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:T("INVALID_TOKEN_TYPE","Access token required")};function QA(t,e){let r=tn(e);return t.json(r.body,r.status)}function U0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}Ky();var wi=F.appBasePath?(F.appBasePath.startsWith("/")?F.appBasePath:`/${F.appBasePath}`).replace(/\/$/,""):"",ZA=wi?`${wi}/health`:"/health",Of=null,Or=null;async function L0(){return Of||(Of=await HA(),console.log("\u2705 Auth SDK initialized")),Of}async function eT(){if(!Or){let t=await L0(),e={algorithm:F.jwtAlgorithm,publicKey:F.jwtPublicKey,issuer:F.jwtIssuer},r=gr(e),n=es({gateway:{...F.gatewayJwt.publicKeyHex?{publicKeyHex:F.gatewayJwt.publicKeyHex}:{},expectedIssuer:F.gatewayJwt.issuer,expectedAudience:F.gatewayJwt.audience,header:F.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}}}),i=Fu({auth:{jwt:{...e,verify:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Or=new Vr,F.nodeEnv!=="production"&&Or.use("*",async(o,a)=>{let c=o.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:o.req.method,path:o.req.path,gatewaySecret:o.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:o.res.status,duration:`${Date.now()-l}ms`}))}),F.corsOrigins.length>0&&Or.use("*",Sy({origin:F.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),F.gatewaySecret&&Or.use("*",async(o,a)=>{if(o.req.path===ZA)return a();let c=o.req.header("X-Gateway-Secret");return!c||!U0(c,F.gatewaySecret)?(F.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),o.notFound()):a()}),Or.get(ZA,o=>QA(o,g({status:"healthy",timestamp:new Date().toISOString()}))),Or.use("*",Vu);let s=kd({auth:t,policy:i,tokenStrategy:F.auth.tokens.refreshTokenStrategy,...F.auth.tokens.refreshTokenCookie?{refreshTokenCookie:F.auth.tokens.refreshTokenCookie}:{},...F.corsOrigins.length>0?{trustedOrigins:F.corsOrigins}:{}});if(Or.route(wi,s),console.log(`\u{1F510} Auth routes mounted at ${wi||"/"}`),F.internal.publicKey){let o=wi?`${wi}${F.internal.serviceRoutePath}`:F.internal.serviceRoutePath,a=Hd({auth:t,internal:{publicKeyJwk:F.internal.publicKey,alg:F.internal.alg,audience:F.internal.audience,issuer:F.internal.issuer}});Or.route(o,a),console.log(`\u{1F512} Internal routes mounted at ${o}`)}Or.onError((o,a)=>{console.error("\u274C [Error]",{message:o.message,stack:o.stack,path:a.req.path});let c=F.nodeEnv==="production"?"Internal Server Error":o.message||"Internal Server Error";return QA(a,u(Ka.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Or}var zte=async(t,e)=>{try{let r=await eT();return Fd(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=F.nodeEnv==="production"?"Internal Server Error":n,s=tn(u(Ka.INTERNAL_ERROR({message:i})));return{statusCode:s.status,body:JSON.stringify(s.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(XA(),YA));eT().then(e=>{let r=F.port,n=F.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${F.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${wi||""}`),console.log(`\u{1F511} Gateway secret: ${F.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${F.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{zte as handler};
134
134
  //# sourceMappingURL=index.mjs.map