@auth-craft/aws-cf-stack 1.10.0 → 1.10.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/admin/cli.mjs +23 -23
- package/assets/lambda/index.mjs +18 -18
- package/package.json +2 -2
package/assets/lambda/index.mjs
CHANGED
|
@@ -1,40 +1,40 @@
|
|
|
1
1
|
import{createRequire}from'module';const require=createRequire(import.meta.url);
|
|
2
|
-
var C_=Object.create;var Rd=Object.defineProperty;var P_=Object.getOwnPropertyDescriptor;var D_=Object.getOwnPropertyNames;var U_=Object.getPrototypeOf,L_=Object.prototype.hasOwnProperty;var ne=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var M_=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},Cc=(t,e)=>{for(var r in e)Rd(t,r,{get:e[r],enumerable:!0})},K_=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of D_(e))!L_.call(t,i)&&i!==r&&Rd(t,i,{get:()=>e[i],enumerable:!(n=P_(e,i))||n.enumerable});return t};var H_=(t,e,r)=>(r=t!=null?C_(U_(t)):{},K_(e||!t||!t.__esModule?Rd(r,"default",{value:t,enumerable:!0}):r,t));function kt(...t){let e=t.reduce((i,{length:o})=>i+o,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function Ud(t,e,r){if(e<0||e>=Lc)throw new RangeError(`value must be >= 0 and <= ${Lc-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Ld(t){let e=Math.floor(t/Lc),r=t%Lc,n=new Uint8Array(8);return Ud(n,e,0),Ud(n,r,4),n}function Mc(t){let e=new Uint8Array(4);return Ud(e,t),e}function Et(t){if(typeof t=="string"&&t.length>=128){if(j_.test(t))throw new TypeError("non-ASCII string encountered in encode()");return on.encode(t)}let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}function Kc(t,e=!1){if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:e?"base64url":"base64",omitPadding:e});let r=32768,n=[];for(let o=0;o<t.length;o+=r)n.push(String.fromCharCode.apply(null,t.subarray(o,o+r)));let i=btoa(n.join(""));return e?i.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"):i}function Hc(t,e=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t,{alphabet:e?"base64url":"base64"});if(e){if(t.includes("+")||t.includes("/"))throw new TypeError("Invalid base64url");t=t.replace(/-/g,"+").replace(/_/g,"/")}let r=atob(t),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}async function Fc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var on,ao,co,Lc,j_,Ft=ne(()=>{on=new TextEncoder,ao=new TextDecoder,co=new TextDecoder("utf-8",{fatal:!0}),Lc=2**32;j_=/[^\x00-\x7f]/});var Md={};Cc(Md,{JOSEAlgNotAllowed:()=>Dn,JOSEError:()=>nt,JOSENotSupported:()=>Te,JWEDecryptionFailed:()=>sn,JWEInvalid:()=>W,JWKInvalid:()=>uo,JWKSInvalid:()=>po,JWKSMultipleMatchingKeys:()=>Ds,JWKSNoMatchingKey:()=>_i,JWKSTimeout:()=>Us,JWSInvalid:()=>ee,JWSSignatureVerificationFailed:()=>Un,JWTClaimValidationFailed:()=>ir,JWTExpired:()=>lo,JWTInvalid:()=>je});var nt,ir,lo,Dn,Te,sn,W,ee,je,uo,po,_i,Ds,Us,Un,Ie=ne(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ir=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},lo=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Dn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},Te=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},sn=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},W=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},je=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},uo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},po=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},_i=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},Ds=class extends nt{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},Us=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},Un=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});var Vc={};Cc(Vc,{decode:()=>Fr,encode:()=>Pe});function Fr(t){try{return Hc(typeof t=="string"?t:ao.decode(t),!0)}catch(e){throw new TypeError(G_,{cause:e})}}function Pe(t){return Kc(typeof t=="string"?on.encode(t):t,!0)}var G_,zt=ne(()=>{Ft();G_="The input to be decoded is not correctly encoded."});function at(t,e){if(!(t instanceof Uint8Array))throw new TypeError(`${e} must be an instance of Uint8Array`)}function he(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;let e=Object.getPrototypeOf(t);return e===null||Object.getPrototypeOf(e)===null}function Bc(t){return he(t)&&Array.isArray(t.keys)&&Array.from(t.keys).every(he)}function Ln(...t){let e=new Set;for(let r of t)if(r)for(let n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}function Se(t,e){if(t!==void 0)throw new TypeError(`${e} can only be called once`)}function xt(t,e,r){try{return Fr(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function jc(t,e,r){try{return Et(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}function Mn(t,e,r){let n;try{n=JSON.parse(co.decode(Fr(t)))}catch{throw new e(r)}if(!he(n))throw new e(r);return n}function Ls(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);return e===void 0?void 0:new Set(e)}function $c(t,e){let{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function Vr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(s=>typeof s!="string"||s.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let o=r===void 0?e:{__proto__:null,...r,...e};for(let s of n.crit){if(!(s in o))throw new Te(`Extension Header Parameter "${s}" is not recognized`);if(!Object.hasOwn(i,s)||i[s]===void 0)throw new t(`Extension Header Parameter "${s}" is missing`);if(o[s]&&(!Object.hasOwn(n,s)||n[s]===void 0))throw new t(`Extension Header Parameter "${s}" MUST be integrity protected`)}return n.crit}function mo(t,e){if(e.includes("b64")){let r=t.b64;if(typeof r!="boolean")throw new ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function Ii(t,e){let r,n;try{r=JSON.stringify(e),n=JSON.parse(r)}catch(i){throw new t("JOSE Header is not valid JSON",{cause:i})}if(!he(n))throw new t("JOSE Header is not a JSON object");return[n,r]}var fo,Gc,De=ne(()=>{Ie();zt();Ft();fo={__proto__:null,b64:!0},Gc={__proto__:null}});async function hr(t,e,r){let{alg:n,secret:i}=t,o=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return e;let s,a;if(he(e)){if(s=Ks(e),typeof s.kty!="string")throw xh(n,e,i);if(!(i?s.kty==="oct"&&typeof s.k=="string":s.kty!=="oct"&&(o?s.kty==="AKP"&&typeof s.priv=="string"||typeof s.d=="string":s.d===void 0&&s.priv===void 0)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${o?"private":"public"} JWK`);if(q_(t,s,r),s.kty==="oct")return Fr(s.k);if(!Object.isFrozen(e)){let{key_ops:u}=e;Array.isArray(u)&&Object.freeze(u),Object.freeze(e)}}else{if(!Hd(e))throw xh(n,e,i);let u=i?"secret":o?"private":"public";if(e.type!==u&&(i||["secret","public","private"].includes(e.type)))throw new TypeError(`${$_(e)} instances must be of type "${u}" for the ${n} algorithm`);if(Br(e))return e;if(a=e,a.type==="secret")return a.export()}Kd||=new WeakMap;let c=e,l=Kd.get(c);if(l?.[n])return l[n];if(l||Kd.set(c,l={}),a&&typeof a.toCryptoKey=="function"){let u=a.type==="public",p=W_[a.asymmetricKeyDetails?.namedCurve],f=t.resolve?.({crv:p,asymmetricKeyType:a.asymmetricKeyType})??t.subtle;return l[n]=a.toCryptoKey(f,u,t.usages[u?0:1])}return s??=a.export({format:"jwk"}),s.alg=n,l[n]=await jr(t,s)}function Wc(t){if(!Br(t))throw new Error("CryptoKey instance expected")}function bh(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}function xh(t,e,r){let n=["CryptoKey","KeyObject","JSON Web Key"];return r&&n.push("Uint8Array"),new TypeError(bh(`Key for the ${t} algorithm must be `,e,...n))}function Fd(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function ho(t,e){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Vd(t,e,r){let n=t.algorithm;if(n.name!==e.name)throw qc(e.name);if(e.hash&&n.hash?.name!==e.hash)throw qc(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw qc(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw qc(e.length,"algorithm.length");Fd(t,r)}function Eo(t){return{__proto__:null,...t}}function Ks(t){let e=Eo(t);if(e.ext!==void 0&&typeof e.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(e.key_ops!==void 0){let r=e.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(i=>typeof i!="string")||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');e.key_ops=n}return e}function Kn(t){if(t!==void 0&&typeof t!="boolean")throw new TypeError('"extractable" option must be a boolean');return t}async function jr(t,e,r){if(!t.kty.includes(e.kty))throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let n=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,i=!!(e.d||e.priv),o={...e,ext:r??e.ext};return o.kty!=="AKP"&&delete o.alg,delete o.use,crypto.subtle.importKey("jwk",o,n,o.ext??!i,e.key_ops??t.usages[i?1:0])}async function yr(t,e,r,n=!1){return t instanceof Uint8Array&&(t=await crypto.subtle.importKey("raw",t,e,n,[r])),Vd(t,e,r),t}var $_,q_,Kd,W_,Br,Ms,Hd,Er,qc,Ct=ne(()=>{De();zt();Ie();$_=t=>t[Symbol.toStringTag],q_=(t,e,r)=>{let{alg:n}=t;if(e.use!==void 0){let i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){let i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};W_={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};Br=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},Ms=t=>t?.[Symbol.toStringTag]==="KeyObject",Hd=t=>Br(t)||Ms(t);Er=(t,...e)=>bh("Key must be ",t,...e);qc=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)});function zc(t,e){let r=t.byteLength<<3;if(r!==e)throw new W(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Sh(t,e){if(e.length<<3!==t.ivBits)throw new W("Invalid Initialization Vector length")}async function wh(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Er(e,"Uint8Array"));let n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),o=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,o,n]}async function Nh(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function J_(t,e,r,n,i){let[o,s,a]=await wh(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},o,e)),l=kt(i,n,c,Ld(i.length*8)),u=await Nh(s,l,a);return{ciphertext:c,tag:u,iv:n}}async function Y_(t,e){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function X_(t,e,r,n,i,o){let[s,a,c]=await wh(t,e,"decrypt"),l=kt(o,n,r,Ld(o.length*8)),u=await Nh(a,l,c);try{if(await Y_(i,u))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},s,r))}catch{}throw new sn}async function Jc(t,e,r,n,i){if(!Br(r)&&!(r instanceof Uint8Array))throw new TypeError(Er(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n?Sh(t,n):n=z_(t),r instanceof Uint8Array&&zc(r,t.cekBits),t.cbc)return J_(t,e,r,n,i);let o=await yr(r,t.subtle,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},o,e));return{ciphertext:s.subarray(0,-16),tag:s.subarray(-16),iv:n}}async function Yc(t,e,r,n,i,o){if(!Br(e)&&!(e instanceof Uint8Array))throw new TypeError(Er(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new W("JWE Initialization Vector missing");if(!i)throw new W("JWE Authentication Tag missing");if(!t.cbc&&i.length!==16)throw new W("Invalid Authentication Tag length");if(Sh(t,n),e instanceof Uint8Array&&zc(e,t.cekBits),t.cbc)return X_(t,e,r,n,i,o);let s=await yr(e,t.subtle,"decrypt");try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},s,kt(r,i)))}catch{throw new sn}}var xi,z_,Hs=ne(()=>{Ft();Ct();Ie();xi=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));z_=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3))});function Fs(t){let e={__proto__:null};for(let r in t)e[r]={...t[r],alg:r};return e}var Bd=ne(()=>{});function Xc(t){return{kty:["RSA"],mode:"key-encryption",subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:Q_,ops:["wrapKey","unwrapKey"]}}function Qc(t){return{kty:["EC","OKP"],mode:t,subtle:{name:"ECDH"},resolve:({kty:e,crv:r,asymmetricKeyType:n})=>{if(r==="X25519"||n==="x25519")return{name:"X25519"};if(e==="OKP")throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:r}},usages:Z_,ops:[void 0,"deriveBits"]}}function yo(t,e=!1){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:Zc,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function jd(){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:"PBKDF2"},usages:Zc,ops:["deriveBits","deriveBits"]}}function go(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:Zc,ops:eI,cekBits:t,ivBits:e?128:96,cbc:e}}function Rh(t,e){throw new Te(`Invalid or unsupported "${t}" (JWE ${e}) header value`)}function gr(t){return(typeof t=="string"?an[t]:void 0)??Rh("alg","Algorithm")}function vr(t){return t.mode==="key-wrapping"||t.mode==="key-encryption"||t.mode==="key-agreement-with-key-wrapping"}function bi(t){return(typeof t=="string"?tI[t]:void 0)??Rh("enc","Encryption Algorithm")}var Q_,Z_,Zc,an,eI,tI,Si=ne(()=>{Ie();Bd();Q_=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Z_=[[],["deriveBits"]],Zc=[[],[]];an=Fs({dir:{kty:["oct"],mode:"direct-encryption",secret:!0,subtle:{name:"AES-GCM"},usages:Zc,ops:["encrypt","decrypt"]},"RSA-OAEP":Xc(1),"RSA-OAEP-256":Xc(256),"RSA-OAEP-384":Xc(384),"RSA-OAEP-512":Xc(512),"ECDH-ES":Qc("direct-key-agreement"),"ECDH-ES+A128KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A192KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A256KW":Qc("key-agreement-with-key-wrapping"),A128KW:yo(128),A192KW:yo(192),A256KW:yo(256),A128GCMKW:yo(128,!0),A192GCMKW:yo(192,!0),A256GCMKW:yo(256,!0),"PBES2-HS256+A128KW":jd(),"PBES2-HS384+A192KW":jd(),"PBES2-HS512+A256KW":jd()}),eI=["encrypt","decrypt"];tI=Fs({A128GCM:go(128),A192GCM:go(192),A256GCM:go(256),"A128CBC-HS256":go(256,!0),"A192CBC-HS384":go(384,!0),"A256CBC-HS512":go(512,!0)})});function Oh(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");Fd(t,e)}async function rI(t,e,r){let n=await yr(e,gr(t).subtle,"wrapKey",!0),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function nI(t,e,r){let n=await yr(e,gr(t).subtle,"unwrapKey",!0),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function Ch(t,e,r){Vd(e,gr(t).subtle,r),ho(t,e)}async function Ph(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new W("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new W("PBES2 Count Input must be a positive integer");let i=kt(Et(e),Uint8Array.of(0),t),o=parseInt(e.slice(13,16),10),s={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await yr(n,gr(e).subtle,"deriveBits");return new Uint8Array(await crypto.subtle.deriveBits(s,a,o))}function Gd(t){return kt(Mc(t.length),t)}async function iI(t,e,r){let n=e>>3,i=32,o=Math.ceil(n/i),s=new Uint8Array(o*i);for(let a=1;a<=o;a++){let c=await Fc("sha256",kt(Mc(a),t,r));s.set(c,(a-1)*i)}return s.slice(0,n)}async function Dh(t,e,r,n,i=new Uint8Array,o=new Uint8Array){Oh(t),Oh(e,"deriveBits");let s=kt(Gd(Et(r)),Gd(i),Gd(o),Mc(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return iI(a,n,s)}function Uh(t){Wc(t);let e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new Te("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function el(t,e){let r=t[e];if(r!==void 0){if(typeof r!="string")throw new W(`JOSE Header "${e}" (Agreement Party${e==="apu"?"U":"V"}Info) invalid`);return xt(r,e,W)}}function Lh(t,e){if(!(t===void 0||e===void 0||t.byteLength!==e.byteLength)){for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return;throw new W('JOSE Header "apu" and "apv" values must be distinct')}}function oI(t){if(t===void 0)throw new W("JWE Encrypted Key missing")}function kh(t){if(t!==void 0)throw new W("Encountered unexpected JWE Encrypted Key")}function sI(t){if(t!==void 0&&t!==1/0&&(!Number.isSafeInteger(t)||t<1))throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity")}async function Mh(t,e,r,n,i,o){let{alg:s}=t,a=t.mode;if(a==="direct-encryption")return kh(n),r;let c=a==="direct-key-agreement";switch(c?kh(n):oI(n),t.subtle.name){case"ECDH":{let{epk:l}=i;if(!he(l)||["d","k","p","q","dp","dq","qi","oth","priv"].some(E=>Object.hasOwn(l,E)))throw new W('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');Uh(r);let u=await jr(t,l),p=el(i,"apu"),f=el(i,"apv");Lh(p,f);let m=await Dh(u,r,c?e.alg:s,c?e.cekBits:parseInt(s.slice(-5,-2),10),p,f);if(c)return m;r=m;break}case"RSA-OAEP":return Wc(r),Ch(s,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(typeof i.p2c!="number")throw new W('JOSE Header "p2c" (PBES2 Count) missing or invalid');sI(o);let l=o??1e4;if(i.p2c>l)throw new W('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof i.p2s!="string")throw new W('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let u=xt(i.p2s,"p2s",W);r=await Ph(u,s,i.p2c,r);break}case"AES-GCM":{if(typeof i.iv!="string")throw new W('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new W('JOSE Header "tag" (Authentication Tag) missing or invalid');let l=xt(i.iv,"iv",W),u=xt(i.tag,"tag",W);if(l.byteLength!==12)throw new W("Invalid Initialization Vector length");if(u.byteLength!==16)throw new W("Invalid Authentication Tag length");return Yc(bi(s.slice(0,-2)),r,n,l,u,new Uint8Array)}}return nI(s.slice(-6),r,n)}async function tl(t,e,r,n,i,o={}){let{alg:s,mode:a}=t,c=vr(t);if(i!==void 0&&!c)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${s}`);let l=await hr(a==="direct-encryption"?e:t,r,"encrypt");if(a==="direct-encryption")return[l,void 0,void 0];let u=c?i??xi(e):void 0;u&&zc(u,e.cekBits);let p,f;switch(t.subtle.name){case"ECDH":{Uh(l);let{apu:m,apv:E}=o;m!==void 0&&at(m,'"apu"'),E!==void 0&&at(E,'"apv"');let v=m??el(n,"apu"),N=E??el(n,"apv");Lh(v,N);let S;o.epk!==void 0?S=await hr(t,o.epk,"decrypt"):S=(await crypto.subtle.generateKey(l.algorithm,!0,["deriveBits"])).privateKey;let R=crypto.subtle,M=S;if(!M.extractable){if(typeof R.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');M=await R.getPublicKey(S,[])}let{x:K,y:B,crv:V,kty:$}=await R.exportKey("jwk",M),A=a==="direct-key-agreement",x=await Dh(l,S,A?e.alg:s,A?e.cekBits:parseInt(s.slice(-5,-2),10),v,N),b={x:K,crv:V,kty:$};if($==="EC"&&(b.y=B),f={epk:b},m!==void 0&&(f.apu=Pe(m)),E!==void 0&&(f.apv=Pe(E)),A)return[x,void 0,f];l=x;break}case"RSA-OAEP":{Wc(l),Ch(s,l,"encrypt"),p=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",l,u));break}case"PBKDF2":{let{p2c:m=2048,p2s:E=crypto.getRandomValues(new Uint8Array(16))}=o;l=await Ph(E,s,m,l),f={p2c:m,p2s:Pe(E)};break}case"AES-GCM":{let m=o.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):o.iv;if(!(m instanceof Uint8Array))throw new TypeError('"iv" must be an instance of Uint8Array');let E=await Jc(bi(s.slice(0,-2)),u,l,m,new Uint8Array);p=E.ciphertext,f={iv:Pe(E.iv),tag:Pe(E.tag)}}}if(p??=await rI(s.slice(-6),l,u),!(p instanceof Uint8Array)||!p.byteLength)throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");return[u,p,f]}var rl=ne(()=>{zt();Ct();Si();Ie();De();Ft();Hs()});function nl(t,e){if(t.zip!==void 0&&t.zip!=="DEF")throw new Te('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(t.zip!==void 0&&!e?.zip)throw new W('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function Kh(t){if(typeof globalThis[t]>"u")throw new Te(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Hh(t,e,r=1/0){let n=t.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let i=[],o=0,s=t.readable.getReader();for(;;){let{value:a,done:c}=await s.read();if(c)break;if(i.push(a),o+=a.byteLength,r!==1/0&&o>r)throw new W("Decompressed plaintext exceeded the configured limit")}return kt(...i)}async function Fh(t){return Kh("CompressionStream"),Hh(new CompressionStream("deflate-raw"),t)}async function Vh(t,e){return Kh("DecompressionStream"),Hh(new DecompressionStream("deflate-raw"),t,e)}var $d=ne(()=>{Ie();Ft()});function il(t){let{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s}=t;if(n!==void 0&&(typeof n!="string"||!n))throw new W("JWE Initialization Vector incorrect type");if(typeof r!="string")throw new W("JWE Ciphertext missing or incorrect type");if(o!==void 0&&(typeof o!="string"||!o))throw new W("JWE Authentication Tag incorrect type");if(i!==void 0&&typeof i!="string")throw new W("JWE Protected Header incorrect type");if(e!==void 0&&(typeof e!="string"||!e))throw new W("JWE AAD incorrect type");if(s!==void 0&&!he(s))throw new W("JWE Shared Unprotected Header incorrect type");return{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s===void 0?void 0:{...s}}}function ol(t){let e,r;try{let{header:n}=t;if(he(n)){r=n.alg;let o=Object.keys(n);o.includes("alg")||(r=void 0),e=Object.fromEntries(o.map(s=>[s,s==="alg"?r:n[s]]))}else e=n;let{encrypted_key:i}=t;return[{encrypted_key:i,header:e},r]}catch(n){return[void 0,r,n]}}function sl(t){let{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new W("JWE Encrypted Key incorrect type");if(r!==void 0&&!he(r))throw new W("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new W("JOSE Header missing")}function qd(t){let{protected:e,ciphertext:r,iv:n,tag:i,aad:o}=t,s;return e!==void 0&&(s=Mn(e,W,"JWE Protected Header is invalid")),[s,xt(r,"ciphertext",W),n!==void 0?xt(n,"iv",W):void 0,i!==void 0?xt(i,"tag",W):void 0,jc((e??"")+(o!==void 0?`.${o}`:""),"aad",W)]}function Hn(t){return[t&&Ls("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&Ls("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t?.crit,t?.maxPBES2Count,t?.maxDecompressedLength]}async function Vs(t,e,r,n=qd(t)){let[i,o,s,a,c]=n,{header:l,unprotected:u,aad:p}=t,f;if(l!==void 0||u!==void 0){if(!Ln(i,l,u))throw new W("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");f={...i,...l,...u}}else f=i??{};let[m,E,v,N,S]=e,{encrypted_key:R}=t;Vr(W,Gc,v,i,f),nl(f,i);let{alg:M,enc:K}=f;if(typeof M!="string"||!M)throw new W("missing JWE Algorithm (alg) in JWE Header");let B=an[M];if(R===""&&(!B||!vr(B)))throw new W("JWE Encrypted Key incorrect type");let V=B?.mode==="integrated-encryption";if(!V&&(typeof K!="string"||!K))throw new W("missing JWE Encryption Algorithm (enc) in JWE Header");if(m&&!m.has(M)||!m&&M.startsWith("PBES2"))throw new Dn('"alg" (Algorithm) Header Parameter value not allowed');let $;if(V){if(K!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(s?.byteLength)throw new W("JWE Initialization Vector must be empty for integrated encryption");if(a?.byteLength)throw new W("JWE Authentication Tag must be empty for integrated encryption")}else{if(E&&!E.has(K))throw new Dn('"enc" (Encryption Algorithm) Header Parameter value not allowed');$=bi(K)}let A;if(R!==void 0)try{A=xt(R,"encrypted_key",W)}catch(O){if(!B||!vr(B))throw O;A=new Uint8Array}let x=!1;typeof r=="function"&&(r=await r(i,t),x=!0);let b=B??gr(M);vr(b)&&A===void 0&&(A=new Uint8Array);let g=await hr(b.mode==="direct-encryption"?$:b,r,"decrypt"),I;if(b.mode==="integrated-encryption")I=await b.decrypt(g,A,o,c,i,f);else{let O=$,P;try{P=await Mh(b,O,g,A,f,N),vr(b)&&P instanceof Uint8Array&&P.byteLength<<3!==O.cekBits&&(P=xi(O))}catch(k){if(k instanceof TypeError||k instanceof W||k instanceof Te)throw k;P=xi(O)}I=await Yc(O,P,o,s,a,c)}if(f.zip==="DEF"){let O=S??25e4;if(O===0)throw new Te('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(O!==1/0&&(!Number.isSafeInteger(O)||O<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");I=await Vh(I,O).catch(P=>{throw P instanceof W?P:new W("Failed to decompress plaintext",{cause:P})})}return{plaintext:I,...i&&{protectedHeader:i},...p!==void 0&&{additionalAuthenticatedData:xt(p,"aad",W)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...x&&{key:g}}}async function al(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new W("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:o,3:s,4:a,length:c}=t.split(".");if(c!==5)throw new W("Invalid Compact JWE");return Vs({ciphertext:s,iv:o||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}var Bs=ne(()=>{Hs();De();Ie();rl();Ft();Ct();Si();$d()});async function Bh(t,e,r){return al(t,Hn(r),e)}var jh=ne(()=>{Bs()});async function Gh(t,e,r){if(!he(t))throw new W("Flattened JWE must be an object");let n=il(t),[i,,o]=ol(t);if(!i)throw o;let s={...n,...i};return sl(s),Vs(s,Hn(r),e)}var $h=ne(()=>{Ie();De();Bs()});async function qh(t,e,r){if(!he(t))throw new W("General JWE must be an object");let n=t.recipients;if(!Array.isArray(n))throw new W("JWE Recipients missing or incorrect type");let i=Array.from(n);if(!i.every(he))throw new W("JWE Recipients missing or incorrect type");if(!i.length)throw new W("JWE Recipients has no members");let o,s,a;try{o=Hn(r),s=il(t),a=qd(s)}catch{throw new sn}let c=i.map(l=>ol(l));if(i.length>1)for(let[,l]of c){let u=a[0]?.alg??l??s.unprotected?.alg,p=typeof u=="string"?an[u]:void 0;if(p&&!vr(p))throw new W(`"${u}" alg may only have a single recipient`)}for(let[l]of c)if(l)try{let u={...s,...l};return sl(u),await Vs(u,o,e,a)}catch{}throw new sn}var Wh=ne(()=>{Bs();Ie();De();Si()});function cl(t,e,r){if(!Ln(t,e,r))throw new W("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Wd(t,e,r=!1){if(!t[1]&&!t[2]&&!t[3])throw new W("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");e!==void 0&&(t[8]=e?.crit);let[,n,i,o,s,a,c,l,u]=t;if(s!==void 0&&at(s,"JWE Additional Authenticated Data"),a!==void 0&&at(a,"JWE Content Encryption Key"),c!==void 0&&at(c,"JWE Initialization Vector"),!r&&n!==void 0&&(n=Ii(W,n)[0],t[1]=n),i!==void 0&&(i=Ii(W,i)[0],t[2]=i),!r&&o!==void 0&&(o=Ii(W,o)[0],t[3]=o),l!==void 0&&!he(l))throw new TypeError("JWE Key Management Parameters must be an object");cl(n,i,o);let p={...n,...i,...o};$c(W,n),Vr(W,Gc,u,n,p),nl(p,n);let{alg:f,enc:m}=p;if(typeof f!="string"||!f)throw new W('JWE "alg" (Algorithm) Header Parameter missing or invalid');let E=an[f];if(E?.mode==="integrated-encryption"){if(m!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(a!==void 0)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[p,void 0,E]}if(typeof m!="string"||!m)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,bi(m),E]}async function zd(t,e,r){let[n,i,o]=e,[s,a,c,l,u,p,f,m,,E]=t,v=a,N=c,S=o??gr(n.alg),R,M,K;S.mode==="integrated-encryption"?K=await hr(S,r,"encrypt"):[K,R,M]=await tl(S,i,r,n,p,m),M&&(E?N=N?{...N,...M}:M:v=v?{...v,...M}:M,cl(v,N,l));let B=v?Pe(JSON.stringify(v)):"",V=u?.byteLength?Pe(u):void 0,$=Et(V?`${B}.${V}`:B),A=s;n.zip==="DEF"&&(A=await Fh(A).catch(O=>{throw new W("Failed to compress plaintext",{cause:O})}));let x,b,g;S.mode==="integrated-encryption"?[R,x]=await S.encrypt(K,A,$,v,n,m):{ciphertext:x,tag:b,iv:g}=await Jc(i,A,K,f,$);let I={ciphertext:Pe(x)};return g&&(I.iv=Pe(g)),b&&(I.tag=Pe(b)),R?.byteLength&&(I.encrypted_key=Pe(R)),V&&(I.aad=V),v&&(I.protected=B),l&&(I.unprotected=l),N&&(I.header=N),I}async function vo(t,e,r){return zd(t,Wd(t,r),e)}function ll(t){return[t.protected,t.encrypted_key,t.iv,t.ciphertext,t.tag].join(".")}var js=ne(()=>{zt();Hs();rl();Ie();De();Ft();Ct();Si();$d()});var Jd,ul,zh=ne(()=>{De();Ie();Hs();zt();js();rl();Si();Jd=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return Se(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return Se(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},ul=class{#e;#t=[];#r;#o;#i;constructor(e){this.#e=e}addRecipient(e,r){let n=new Jd(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return Se(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Se(this.#o,"setSharedUnprotectedHeader"),this.#o=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}async encrypt(){if(!this.#t.length)throw new W("at least one recipient must be added");at(this.#e,"plaintext");let e=this.#t.length>1,r,n=this.#r,i=this.#o,o=[];for(let E of this.#t){let[v,N,S,R]=E.state,M=[this.#e,n,v,i,this.#i,void 0,void 0,N,R,e],K=Wd(M,void 0,o.length>0);o.length||(n=M[1],i=M[3]),o.push([M,K,S]);let[{alg:B,enc:V},,$]=K;if(e&&$&&!vr($))throw new W(`"${B}" alg may only have a single recipient`);if(!r)r=V;else if(r!==V)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}for(let[,E]of o)E[2]??=gr(E[0].alg);let[s,a,c]=o[0],l=e?xi(a[1]):void 0;s[5]=l;let{encrypted_key:u,header:p,...f}=await zd(s,a,c),m={...f,recipients:[{}]};u&&(m.recipients[0].encrypted_key=u),p&&(m.recipients[0].header=p);for(let E=1;E<o.length;E++){let[v,[N,S,R],M]=o[E],K=v[2],[,B,V]=await tl(R,S,M,N,l,v[7]),$={encrypted_key:Pe(B)};if(K||V){let A={...K,...V};V&&cl(v[1],A,v[3]),$.header=A}m.recipients.push($)}return m}}});function Yd(t){let e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:Gs}}function Ao(t,e){let r={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:r,signing:e?{...r,saltLength:e}:r,usages:Gs,minRsaBits:2048}}function Xd(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:Gs}}function Jh(){let t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:Gs}}function Qd(t){let e={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:e,signing:e,usages:Gs}}function To(t){let e=typeof t=="string"?$s[t]:void 0;if(!e)throw new Te(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}var Gs,$s,_o=ne(()=>{Ie();Bd();Gs=[["verify"],["sign"]];$s=Fs({HS256:Yd(256),HS384:Yd(384),HS512:Yd(512),RS256:Ao(256),RS384:Ao(384),RS512:Ao(512),PS256:Ao(256,32),PS384:Ao(384,48),PS512:Ao(512,64),ES256:Xd("P-256",256),ES384:Xd("P-384",384),ES512:Xd("P-521",512),EdDSA:Jh(),Ed25519:Jh(),"ML-DSA-44":Qd(44),"ML-DSA-65":Qd(65),"ML-DSA-87":Qd(87)})});function dl(t,e){let r=t.protected,n=t.header,i=he(n)?{...n}:n,o=e?e[0]:t.payload;!e&&o instanceof Uint8Array&&(o=new Uint8Array(o));let s=t.signature,a={payload:o,signature:s};if(r!==void 0&&(a.protected=r),n!==void 0&&(a.header=i),r===void 0&&i===void 0)throw new ee('Flattened JWS must have either of the "protected" or "header" members');if(r!==void 0&&typeof r!="string")throw new ee("JWS Protected Header incorrect type");if(o===void 0)throw new ee("JWS Payload missing");if(typeof s!="string")throw new ee("JWS Signature missing or incorrect type");if(i!==void 0&&!he(i))throw new ee("JWS Unprotected Header incorrect type");return a}function Fn(t){return[t&&Ls("algorithms",t.algorithms),t?.crit]}function Zd(t){return t===void 0?{}:Mn(t,ee,"JWS Protected Header is invalid")}function pl(t){let e=/[\p{Cs}\p{Cn}]/u.exec(t)?.[0];if(e!==void 0)throw new ee(/\p{Cs}/u.test(e)?"JWS Payload must be a well-formed Unicode string":"JWS Payload must not contain unassigned Unicode code points");return on.encode(t)}function aI(t){try{return Et(t)}catch{throw new ee("JWS Compact Serialization payload must use only ASCII characters")}}async function qs(t,e,r,n,i){let{protected:o,header:s,payload:a}=t,c=i??Zd(o);if(!Ln(c,s))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...c,...s},u=mo(c,Vr(ee,fo,e[1],c,l)),{alg:p}=l;if(typeof p!="string"||!p)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(p))throw new Dn('"alg" (Algorithm) Header Parameter value not allowed');if(u){if(typeof a!="string")throw new ee("JWS Payload must be a string")}else if(typeof a!="string"&&!(a instanceof Uint8Array))throw new ee("JWS Payload must be a string or an Uint8Array instance");let f=u||typeof a!="string"?a:n(a),m=!1;typeof r=="function"&&(r=await r(c,t),m=!0);let E=To(p),v=kt(o!==void 0?Et(o):new Uint8Array,Et("."),typeof f=="string"?e[2]??=jc(f,"payload",ee):f),N=xt(t.signature,"signature",ee),S=await hr(E,r,"verify"),R=await yr(S,E.subtle,"verify");E.minRsaBits&&ho(E.alg,R);let M=!1;try{M=await crypto.subtle.verify(E.signing,R,N,v)}catch{}if(!M)throw new Un;let K={payload:typeof f=="string"?xt(f,"payload",ee):f};return o!==void 0&&(K.protectedHeader=c),s!==void 0&&(K.unprotectedHeader=s),m?[{...K,key:S},u]:[K,u]}async function fl(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:o,length:s}=t.split(".");if(s!==3)throw new ee("Invalid Compact JWS");return qs({payload:i,protected:n,signature:o},e,r,aI)}var Ws=ne(()=>{_o();Ie();Ft();De();Ct()});async function Yh(t,e,r){let[n]=await fl(t,Fn(r),e);return n}var Xh=ne(()=>{Ws()});async function Qh(t,e,r){if(!he(t))throw new ee("Flattened JWS must be an object");let n=dl(t),[i]=await qs(n,Fn(r),e,pl);return i}var Zh=ne(()=>{Ie();De();Ws()});function cI(t,e){try{let r=dl(t,[e]),n=Zd(r.protected),{b64:i,crit:o}=n;return[r,n,Array.isArray(o)&&o.includes("b64")?typeof i=="boolean"?i?1:2:0:1]}catch{return}}async function eE(t,e,r){if(!he(t))throw new ee("General JWS must be an object");let{signatures:n,payload:i}=t;if(!Array.isArray(n))throw new ee("JWS Signatures missing or incorrect type");let o=Array.from(n);if(!o.every(he))throw new ee("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=Fn(r)}catch{throw new Un}let a=i instanceof Uint8Array?new Uint8Array(i):i,c=o.map(u=>cI(u,a)).filter(u=>u!==void 0),l=0;for(let[,,u]of c)if(l|=u,l===3)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");for(let u of c)try{let[p]=await qs(u[0],s,e,pl,u[1]);return p}catch{}throw new Un}var tE=ne(()=>{Ws();Ie();De()});function ep(){throw new TypeError("Invalid time period format")}function ml(t){typeof t!="string"&&ep();let e=uI.exec(t);(!e||e[4]&&e[1])&&ep();let r=parseFloat(e[2]),n=Math.round(r*lI[e[3][0].toLowerCase()]);return Number.isFinite(n)||ep(),e[1]==="-"||e[4]==="ago"?-n:n}function xo(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function tp(t,e){if(typeof e!="string")throw new TypeError(`"${t}" claim must be a string`)}function dI(t){if(typeof t!="string"&&(!Array.isArray(t)||Array.from(t).some(e=>typeof e!="string")))throw new TypeError('"aud" claim must be a string or an array of strings')}function rp(t,e){return typeof t=="number"?xo(e,t):t instanceof Date?xo(e,zs(t)):zs(new Date)+ml(t)}function np(t,e,r=!1){let n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new ir(`"${e}" claim must be a number`,t,e,"invalid");return n}}function ip(t,e){throw new ir(`unexpected "${e}" claim value`,t,e,Io)}function bo(t,e,r={}){let n;try{n=JSON.parse(co.decode(e))}catch{}if(!he(n))throw new je("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i!==void 0&&(typeof t.typ!="string"||rE(t.typ)!==rE(i)))throw new ir('unexpected "typ" JWT header value',n,"typ",Io);let{requiredClaims:o=[],issuer:s,subject:a,audience:c,maxTokenAge:l}=r,u=[...o];l!==void 0&&u.push("iat"),c!==void 0&&u.push("aud"),a!==void 0&&u.push("sub"),s!==void 0&&u.push("iss");for(let R of new Set(u.reverse()))if(!Object.hasOwn(n,R))throw new ir(`missing required "${R}" claim`,n,R,"missing");s!==void 0&&!(Array.isArray(s)?s:[s]).includes(n.iss)&&ip(n,"iss"),a!==void 0&&n.sub!==a&&ip(n,"sub"),c!==void 0&&!pI(n.aud,typeof c=="string"?[c]:c)&&ip(n,"aud");let{clockTolerance:p}=r,f=0;if(typeof p=="string")f=ml(p);else if(p!==void 0){if(typeof p!="number")throw new TypeError("Invalid clockTolerance option type");f=p}xo("clockTolerance option",f);let{currentDate:m}=r,E=xo("currentDate option",zs(m===void 0?new Date:m)),v=np(n,"iat",l!==void 0),N=np(n,"nbf");if(N!==void 0&&N>E+f)throw new ir('"nbf" claim timestamp check failed',n,"nbf",Io);let S=np(n,"exp");if(S!==void 0&&S<=E-f)throw new lo('"exp" claim timestamp check failed',n,"exp",Io);if(l!==void 0){let R=E-v,M=xo("maxTokenAge option",typeof l=="number"?l:ml(l));if(R-f>M)throw new lo('"iat" claim timestamp check failed (too far in the past)',n,"iat",Io);if(R<-f)throw new ir('"iat" claim timestamp check failed (it should be in the past)',n,"iat",Io)}return n}function cn(t){return nE.get(t)}function So(t){let e=cn(t);for(let r of["iat","nbf","exp"]){let n=e[r];if(typeof n=="number"&&!Number.isFinite(n))throw new TypeError(`"${r}" claim must be a finite number`)}return on.encode(JSON.stringify(e))}function hl(t,e){return cn(t)[e]}var zs,lI,uI,Io,rE,pI,nE,Vn,wo=ne(()=>{Ie();Ft();De();zs=t=>Math.floor(t.getTime()/1e3),lI={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},uI=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Io="check_failed";rE=t=>{let e=t.toLowerCase();return t.includes("/")?e:`application/${e}`},pI=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;Vn=class{constructor(e={}){if(!he(e))throw new TypeError("JWT Claims Set MUST be an object");(nE||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return tp("iss",e),cn(this).iss=e,this}setSubject(e){return tp("sub",e),cn(this).sub=e,this}setAudience(e){return dI(e),cn(this).aud=e,this}setJti(e){return tp("jti",e),cn(this).jti=e,this}setNotBefore(e){return cn(this).nbf=rp(e,"setNotBefore"),this}setExpirationTime(e){return cn(this).exp=rp(e,"setExpirationTime"),this}setIssuedAt(e){let r=cn(this);return e===void 0?r.iat=zs(new Date):typeof e=="string"?r.iat=xo("setIssuedAt",zs(new Date)+ml(e)):r.iat=rp(e,"setIssuedAt"),this}}});async function Bn(t,e,r){let[n,i]=await fl(t,Fn(r),e);if(!i)throw new je("JWTs MUST NOT use unencoded payload");let o=bo(n.protectedHeader,n.payload,r);return{...n,payload:o}}var iE=ne(()=>{Ws();wo();Ie()});async function oE(t,e,r){let{plaintext:n,...i}=await al(t,Hn(r),e),{protectedHeader:o}=i,s=bo(o,n,r);for(let a of["iss","sub","aud"])if(o[a]!==void 0&&(a==="aud"?JSON.stringify(o.aud)!==JSON.stringify(s.aud):o[a]!==s[a]))throw new ir(`replicated "${a}" claim header parameter mismatch`,s,a,"mismatch");return{payload:s,...i}}var sE=ne(()=>{Bs();wo();Ie()});var El,aE=ne(()=>{De();js();El=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}async encrypt(e,r){return ll(await vo([...this.#e],e,r))}}});var yl,cE=ne(()=>{De();js();yl=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setSharedUnprotectedHeader(e){return Se(this.#e[3],"setSharedUnprotectedHeader"),this.#e[3]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}setAdditionalAuthenticatedData(e){return this.#e[4]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}async encrypt(e,r){return vo([...this.#e],e,r)}}});async function Js(t,e,r){let[n,i,o,s]=t,a="";if(i!==void 0){let S=Ii(ee,i);i=S[0],a=Pe(S[1])}if(o!==void 0&&(o=Ii(ee,o)[0]),!i&&!o)throw new ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Ln(i,o))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let c={...i,...o};$c(ee,i);let l=mo(i,Vr(ee,fo,s,i,c));l||r?.();let{alg:u}=c;if(typeof u!="string"||!u)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let p=To(u),f="",m=n,E;if(l){let S=t[4];S?(f=S[0]??=Pe(n),m=S[1]??=Et(f)):(f=Pe(n),E=on.encode(`${a}.${f}`))}E??=kt(Et(a),Et("."),m);let v=await yr(await hr(p,e,"sign"),p.subtle,"sign");p.minRsaBits&&ho(p.alg,v);let N={signature:Pe(new Uint8Array(await crypto.subtle.sign(p.signing,v,E))),payload:f};return i&&(N.protected=a),o&&(N.header=o),[N,l]}async function gl(t,e,r,n,i){let[o]=await Js([t,e,void 0,r],n,i);return`${o.protected}.${o.payload}.${o.signature}`}var Ys=ne(()=>{zt();_o();De();Ie();Ft();Ct()});var vl,lE=ne(()=>{Ys();De();vl=class{#e;#t;constructor(e){at(e,"payload"),this.#e=e}setProtectedHeader(e){return Se(this.#t,"setProtectedHeader"),this.#t=e,this}async sign(e,r){return gl(this.#e,this.#t,r?.crit,e,()=>{throw new TypeError("use the flattened module for creating JWS with b64: false")})}}});var Al,uE=ne(()=>{Ys();De();Al=class{#e;constructor(e){at(e,"payload"),this.#e=[e]}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}async sign(e,r){let n=[...this.#e];n[3]=r?.crit;let[i]=await Js(n,e);return i}}});var op,Tl,dE=ne(()=>{Ys();Ie();De();op=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return Se(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return Se(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Tl=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new op(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new ee("at least one signature must be added");at(this.#e,"payload");let e={signatures:[],payload:""},r=[],n;for(let i of this.#t){let[o,s,a,c]=i.state,[{payload:l,...u},p]=await Js([this.#e,o,s,c,r],a);if(n===void 0)n=p,e.payload=l;else if(n!==p)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(u)}return e}}});var fI,No,pE=ne(()=>{Ys();Ie();wo();De();fI=Vn,No=class extends fI{#e;setProtectedHeader(e){return Se(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,r){return gl(So(this),this.#e,r?.crit,e,()=>{throw new je("JWTs MUST NOT use unencoded payload")})}}});var mI,_l,fE=ne(()=>{js();wo();De();mI=Vn,_l=class extends mI{#e=[void 0];#t;#r;#o;setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#r=!0,this}replicateAudienceAsHeader(){return this.#o=!0,this}async encrypt(e,r){let n=So(this);this.#e[1]&&(this.#t||this.#r||this.#o)&&(this.#e[1]={...this.#e[1],iss:this.#t?hl(this,"iss"):void 0,sub:this.#r?hl(this,"sub"):void 0,aud:this.#o?hl(this,"aud"):void 0});let i=[...this.#e];return i[0]=n,ll(await vo(i,e,r))}}});function wi(t='JWK "alg" (Algorithm) Parameter'){throw new Te(`Invalid or unsupported ${t} value`)}function Ni(t,e){return(typeof t=="string"?$s[t]??an[t]:void 0)??wi(e)}var jn,Xs=ne(()=>{Ie();_o();Si();jn='"alg" (Algorithm)'});function yI(t,e){if(Gn(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),ln(t),e==="pkcs8"){Gn(t,2,"Expected version field");let r=ln(t);t.pos+=r}Gn(t,48,"Expected algorithm identifier"),ln(t)}function vI(t){let e=gE(t);Gn(e,48,"Invalid certificate structure");let r=ln(e);if(r<0||e.pos+r>e.data.length)throw new Error("Unexpected end of ASN.1 input");Gn(e,48,"Invalid tbsCertificate structure"),ln(e),t[e.pos]===160?mE(e,6):mE(e,5);let n=e.pos;Gn(e,48,"Invalid SPKI structure");let i=ln(e);return t.subarray(n,n+i+(e.pos-n))}var hI,hE,EE,yE,Qs,gE,sp,ln,mE,Gn,vE,EI,gI,ap,cp,AE,TE,_E,lp=ne(()=>{Ct();Ft();Ie();Xs();hI=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
|
|
2
|
+
var C_=Object.create;var Rd=Object.defineProperty;var D_=Object.getOwnPropertyDescriptor;var P_=Object.getOwnPropertyNames;var U_=Object.getPrototypeOf,L_=Object.prototype.hasOwnProperty;var ne=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var M_=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},Cc=(t,e)=>{for(var r in e)Rd(t,r,{get:e[r],enumerable:!0})},K_=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of P_(e))!L_.call(t,i)&&i!==r&&Rd(t,i,{get:()=>e[i],enumerable:!(n=D_(e,i))||n.enumerable});return t};var H_=(t,e,r)=>(r=t!=null?C_(U_(t)):{},K_(e||!t||!t.__esModule?Rd(r,"default",{value:t,enumerable:!0}):r,t));function kt(...t){let e=t.reduce((i,{length:o})=>i+o,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function Ud(t,e,r){if(e<0||e>=Lc)throw new RangeError(`value must be >= 0 and <= ${Lc-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Ld(t){let e=Math.floor(t/Lc),r=t%Lc,n=new Uint8Array(8);return Ud(n,e,0),Ud(n,r,4),n}function Mc(t){let e=new Uint8Array(4);return Ud(e,t),e}function Et(t){if(typeof t=="string"&&t.length>=128){if(j_.test(t))throw new TypeError("non-ASCII string encountered in encode()");return on.encode(t)}let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}function Kc(t,e=!1){if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:e?"base64url":"base64",omitPadding:e});let r=32768,n=[];for(let o=0;o<t.length;o+=r)n.push(String.fromCharCode.apply(null,t.subarray(o,o+r)));let i=btoa(n.join(""));return e?i.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"):i}function Hc(t,e=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t,{alphabet:e?"base64url":"base64"});if(e){if(t.includes("+")||t.includes("/"))throw new TypeError("Invalid base64url");t=t.replace(/-/g,"+").replace(/_/g,"/")}let r=atob(t),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}async function Fc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var on,ao,co,Lc,j_,Ft=ne(()=>{on=new TextEncoder,ao=new TextDecoder,co=new TextDecoder("utf-8",{fatal:!0}),Lc=2**32;j_=/[^\x00-\x7f]/});var Md={};Cc(Md,{JOSEAlgNotAllowed:()=>Un,JOSEError:()=>nt,JOSENotSupported:()=>Te,JWEDecryptionFailed:()=>sn,JWEInvalid:()=>W,JWKInvalid:()=>uo,JWKSInvalid:()=>po,JWKSMultipleMatchingKeys:()=>Ps,JWKSNoMatchingKey:()=>_i,JWKSTimeout:()=>Us,JWSInvalid:()=>ee,JWSSignatureVerificationFailed:()=>Ln,JWTClaimValidationFailed:()=>ir,JWTExpired:()=>lo,JWTInvalid:()=>je});var nt,ir,lo,Un,Te,sn,W,ee,je,uo,po,_i,Ps,Us,Ln,Ie=ne(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ir=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},lo=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Un=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},Te=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},sn=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},W=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},je=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},uo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},po=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},_i=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},Ps=class extends nt{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},Us=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},Ln=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});var Vc={};Cc(Vc,{decode:()=>Fr,encode:()=>De});function Fr(t){try{return Hc(typeof t=="string"?t:ao.decode(t),!0)}catch(e){throw new TypeError(G_,{cause:e})}}function De(t){return Kc(typeof t=="string"?on.encode(t):t,!0)}var G_,zt=ne(()=>{Ft();G_="The input to be decoded is not correctly encoded."});function at(t,e){if(!(t instanceof Uint8Array))throw new TypeError(`${e} must be an instance of Uint8Array`)}function he(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;let e=Object.getPrototypeOf(t);return e===null||Object.getPrototypeOf(e)===null}function Bc(t){return he(t)&&Array.isArray(t.keys)&&Array.from(t.keys).every(he)}function Mn(...t){let e=new Set;for(let r of t)if(r)for(let n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}function Se(t,e){if(t!==void 0)throw new TypeError(`${e} can only be called once`)}function xt(t,e,r){try{return Fr(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function jc(t,e,r){try{return Et(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}function Kn(t,e,r){let n;try{n=JSON.parse(co.decode(Fr(t)))}catch{throw new e(r)}if(!he(n))throw new e(r);return n}function Ls(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);return e===void 0?void 0:new Set(e)}function $c(t,e){let{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function Vr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(s=>typeof s!="string"||s.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let o=r===void 0?e:{__proto__:null,...r,...e};for(let s of n.crit){if(!(s in o))throw new Te(`Extension Header Parameter "${s}" is not recognized`);if(!Object.hasOwn(i,s)||i[s]===void 0)throw new t(`Extension Header Parameter "${s}" is missing`);if(o[s]&&(!Object.hasOwn(n,s)||n[s]===void 0))throw new t(`Extension Header Parameter "${s}" MUST be integrity protected`)}return n.crit}function mo(t,e){if(e.includes("b64")){let r=t.b64;if(typeof r!="boolean")throw new ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function Ii(t,e){let r,n;try{r=JSON.stringify(e),n=JSON.parse(r)}catch(i){throw new t("JOSE Header is not valid JSON",{cause:i})}if(!he(n))throw new t("JOSE Header is not a JSON object");return[n,r]}var fo,Gc,Pe=ne(()=>{Ie();zt();Ft();fo={__proto__:null,b64:!0},Gc={__proto__:null}});async function hr(t,e,r){let{alg:n,secret:i}=t,o=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return e;let s,a;if(he(e)){if(s=Ks(e),typeof s.kty!="string")throw xh(n,e,i);if(!(i?s.kty==="oct"&&typeof s.k=="string":s.kty!=="oct"&&(o?s.kty==="AKP"&&typeof s.priv=="string"||typeof s.d=="string":s.d===void 0&&s.priv===void 0)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${o?"private":"public"} JWK`);if(q_(t,s,r),s.kty==="oct")return Fr(s.k);if(!Object.isFrozen(e)){let{key_ops:u}=e;Array.isArray(u)&&Object.freeze(u),Object.freeze(e)}}else{if(!Hd(e))throw xh(n,e,i);let u=i?"secret":o?"private":"public";if(e.type!==u&&(i||["secret","public","private"].includes(e.type)))throw new TypeError(`${$_(e)} instances must be of type "${u}" for the ${n} algorithm`);if(Br(e))return e;if(a=e,a.type==="secret")return a.export()}Kd||=new WeakMap;let c=e,l=Kd.get(c);if(l?.[n])return l[n];if(l||Kd.set(c,l={}),a&&typeof a.toCryptoKey=="function"){let u=a.type==="public",p=W_[a.asymmetricKeyDetails?.namedCurve],f=t.resolve?.({crv:p,asymmetricKeyType:a.asymmetricKeyType})??t.subtle;return l[n]=a.toCryptoKey(f,u,t.usages[u?0:1])}return s??=a.export({format:"jwk"}),s.alg=n,l[n]=await jr(t,s)}function Wc(t){if(!Br(t))throw new Error("CryptoKey instance expected")}function bh(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}function xh(t,e,r){let n=["CryptoKey","KeyObject","JSON Web Key"];return r&&n.push("Uint8Array"),new TypeError(bh(`Key for the ${t} algorithm must be `,e,...n))}function Fd(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function ho(t,e){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Vd(t,e,r){let n=t.algorithm;if(n.name!==e.name)throw qc(e.name);if(e.hash&&n.hash?.name!==e.hash)throw qc(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw qc(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw qc(e.length,"algorithm.length");Fd(t,r)}function Eo(t){return{__proto__:null,...t}}function Ks(t){let e=Eo(t);if(e.ext!==void 0&&typeof e.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(e.key_ops!==void 0){let r=e.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(i=>typeof i!="string")||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');e.key_ops=n}return e}function Hn(t){if(t!==void 0&&typeof t!="boolean")throw new TypeError('"extractable" option must be a boolean');return t}async function jr(t,e,r){if(!t.kty.includes(e.kty))throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let n=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,i=!!(e.d||e.priv),o={...e,ext:r??e.ext};return o.kty!=="AKP"&&delete o.alg,delete o.use,crypto.subtle.importKey("jwk",o,n,o.ext??!i,e.key_ops??t.usages[i?1:0])}async function yr(t,e,r,n=!1){return t instanceof Uint8Array&&(t=await crypto.subtle.importKey("raw",t,e,n,[r])),Vd(t,e,r),t}var $_,q_,Kd,W_,Br,Ms,Hd,Er,qc,Ct=ne(()=>{Pe();zt();Ie();$_=t=>t[Symbol.toStringTag],q_=(t,e,r)=>{let{alg:n}=t;if(e.use!==void 0){let i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){let i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};W_={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};Br=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},Ms=t=>t?.[Symbol.toStringTag]==="KeyObject",Hd=t=>Br(t)||Ms(t);Er=(t,...e)=>bh("Key must be ",t,...e);qc=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)});function zc(t,e){let r=t.byteLength<<3;if(r!==e)throw new W(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Sh(t,e){if(e.length<<3!==t.ivBits)throw new W("Invalid Initialization Vector length")}async function wh(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Er(e,"Uint8Array"));let n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),o=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,o,n]}async function Nh(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function J_(t,e,r,n,i){let[o,s,a]=await wh(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},o,e)),l=kt(i,n,c,Ld(i.length*8)),u=await Nh(s,l,a);return{ciphertext:c,tag:u,iv:n}}async function Y_(t,e){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function X_(t,e,r,n,i,o){let[s,a,c]=await wh(t,e,"decrypt"),l=kt(o,n,r,Ld(o.length*8)),u=await Nh(a,l,c);try{if(await Y_(i,u))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},s,r))}catch{}throw new sn}async function Jc(t,e,r,n,i){if(!Br(r)&&!(r instanceof Uint8Array))throw new TypeError(Er(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n?Sh(t,n):n=z_(t),r instanceof Uint8Array&&zc(r,t.cekBits),t.cbc)return J_(t,e,r,n,i);let o=await yr(r,t.subtle,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},o,e));return{ciphertext:s.subarray(0,-16),tag:s.subarray(-16),iv:n}}async function Yc(t,e,r,n,i,o){if(!Br(e)&&!(e instanceof Uint8Array))throw new TypeError(Er(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new W("JWE Initialization Vector missing");if(!i)throw new W("JWE Authentication Tag missing");if(!t.cbc&&i.length!==16)throw new W("Invalid Authentication Tag length");if(Sh(t,n),e instanceof Uint8Array&&zc(e,t.cekBits),t.cbc)return X_(t,e,r,n,i,o);let s=await yr(e,t.subtle,"decrypt");try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},s,kt(r,i)))}catch{throw new sn}}var xi,z_,Hs=ne(()=>{Ft();Ct();Ie();xi=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));z_=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3))});function Fs(t){let e={__proto__:null};for(let r in t)e[r]={...t[r],alg:r};return e}var Bd=ne(()=>{});function Xc(t){return{kty:["RSA"],mode:"key-encryption",subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:Q_,ops:["wrapKey","unwrapKey"]}}function Qc(t){return{kty:["EC","OKP"],mode:t,subtle:{name:"ECDH"},resolve:({kty:e,crv:r,asymmetricKeyType:n})=>{if(r==="X25519"||n==="x25519")return{name:"X25519"};if(e==="OKP")throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:r}},usages:Z_,ops:[void 0,"deriveBits"]}}function yo(t,e=!1){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:Zc,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function jd(){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:"PBKDF2"},usages:Zc,ops:["deriveBits","deriveBits"]}}function go(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:Zc,ops:eI,cekBits:t,ivBits:e?128:96,cbc:e}}function Rh(t,e){throw new Te(`Invalid or unsupported "${t}" (JWE ${e}) header value`)}function gr(t){return(typeof t=="string"?an[t]:void 0)??Rh("alg","Algorithm")}function vr(t){return t.mode==="key-wrapping"||t.mode==="key-encryption"||t.mode==="key-agreement-with-key-wrapping"}function bi(t){return(typeof t=="string"?tI[t]:void 0)??Rh("enc","Encryption Algorithm")}var Q_,Z_,Zc,an,eI,tI,Si=ne(()=>{Ie();Bd();Q_=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Z_=[[],["deriveBits"]],Zc=[[],[]];an=Fs({dir:{kty:["oct"],mode:"direct-encryption",secret:!0,subtle:{name:"AES-GCM"},usages:Zc,ops:["encrypt","decrypt"]},"RSA-OAEP":Xc(1),"RSA-OAEP-256":Xc(256),"RSA-OAEP-384":Xc(384),"RSA-OAEP-512":Xc(512),"ECDH-ES":Qc("direct-key-agreement"),"ECDH-ES+A128KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A192KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A256KW":Qc("key-agreement-with-key-wrapping"),A128KW:yo(128),A192KW:yo(192),A256KW:yo(256),A128GCMKW:yo(128,!0),A192GCMKW:yo(192,!0),A256GCMKW:yo(256,!0),"PBES2-HS256+A128KW":jd(),"PBES2-HS384+A192KW":jd(),"PBES2-HS512+A256KW":jd()}),eI=["encrypt","decrypt"];tI=Fs({A128GCM:go(128),A192GCM:go(192),A256GCM:go(256),"A128CBC-HS256":go(256,!0),"A192CBC-HS384":go(384,!0),"A256CBC-HS512":go(512,!0)})});function Oh(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");Fd(t,e)}async function rI(t,e,r){let n=await yr(e,gr(t).subtle,"wrapKey",!0),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function nI(t,e,r){let n=await yr(e,gr(t).subtle,"unwrapKey",!0),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function Ch(t,e,r){Vd(e,gr(t).subtle,r),ho(t,e)}async function Dh(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new W("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new W("PBES2 Count Input must be a positive integer");let i=kt(Et(e),Uint8Array.of(0),t),o=parseInt(e.slice(13,16),10),s={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await yr(n,gr(e).subtle,"deriveBits");return new Uint8Array(await crypto.subtle.deriveBits(s,a,o))}function Gd(t){return kt(Mc(t.length),t)}async function iI(t,e,r){let n=e>>3,i=32,o=Math.ceil(n/i),s=new Uint8Array(o*i);for(let a=1;a<=o;a++){let c=await Fc("sha256",kt(Mc(a),t,r));s.set(c,(a-1)*i)}return s.slice(0,n)}async function Ph(t,e,r,n,i=new Uint8Array,o=new Uint8Array){Oh(t),Oh(e,"deriveBits");let s=kt(Gd(Et(r)),Gd(i),Gd(o),Mc(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return iI(a,n,s)}function Uh(t){Wc(t);let e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new Te("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function el(t,e){let r=t[e];if(r!==void 0){if(typeof r!="string")throw new W(`JOSE Header "${e}" (Agreement Party${e==="apu"?"U":"V"}Info) invalid`);return xt(r,e,W)}}function Lh(t,e){if(!(t===void 0||e===void 0||t.byteLength!==e.byteLength)){for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return;throw new W('JOSE Header "apu" and "apv" values must be distinct')}}function oI(t){if(t===void 0)throw new W("JWE Encrypted Key missing")}function kh(t){if(t!==void 0)throw new W("Encountered unexpected JWE Encrypted Key")}function sI(t){if(t!==void 0&&t!==1/0&&(!Number.isSafeInteger(t)||t<1))throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity")}async function Mh(t,e,r,n,i,o){let{alg:s}=t,a=t.mode;if(a==="direct-encryption")return kh(n),r;let c=a==="direct-key-agreement";switch(c?kh(n):oI(n),t.subtle.name){case"ECDH":{let{epk:l}=i;if(!he(l)||["d","k","p","q","dp","dq","qi","oth","priv"].some(E=>Object.hasOwn(l,E)))throw new W('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');Uh(r);let u=await jr(t,l),p=el(i,"apu"),f=el(i,"apv");Lh(p,f);let m=await Ph(u,r,c?e.alg:s,c?e.cekBits:parseInt(s.slice(-5,-2),10),p,f);if(c)return m;r=m;break}case"RSA-OAEP":return Wc(r),Ch(s,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(typeof i.p2c!="number")throw new W('JOSE Header "p2c" (PBES2 Count) missing or invalid');sI(o);let l=o??1e4;if(i.p2c>l)throw new W('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof i.p2s!="string")throw new W('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let u=xt(i.p2s,"p2s",W);r=await Dh(u,s,i.p2c,r);break}case"AES-GCM":{if(typeof i.iv!="string")throw new W('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new W('JOSE Header "tag" (Authentication Tag) missing or invalid');let l=xt(i.iv,"iv",W),u=xt(i.tag,"tag",W);if(l.byteLength!==12)throw new W("Invalid Initialization Vector length");if(u.byteLength!==16)throw new W("Invalid Authentication Tag length");return Yc(bi(s.slice(0,-2)),r,n,l,u,new Uint8Array)}}return nI(s.slice(-6),r,n)}async function tl(t,e,r,n,i,o={}){let{alg:s,mode:a}=t,c=vr(t);if(i!==void 0&&!c)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${s}`);let l=await hr(a==="direct-encryption"?e:t,r,"encrypt");if(a==="direct-encryption")return[l,void 0,void 0];let u=c?i??xi(e):void 0;u&&zc(u,e.cekBits);let p,f;switch(t.subtle.name){case"ECDH":{Uh(l);let{apu:m,apv:E}=o;m!==void 0&&at(m,'"apu"'),E!==void 0&&at(E,'"apv"');let v=m??el(n,"apu"),N=E??el(n,"apv");Lh(v,N);let S;o.epk!==void 0?S=await hr(t,o.epk,"decrypt"):S=(await crypto.subtle.generateKey(l.algorithm,!0,["deriveBits"])).privateKey;let R=crypto.subtle,M=S;if(!M.extractable){if(typeof R.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');M=await R.getPublicKey(S,[])}let{x:K,y:B,crv:V,kty:$}=await R.exportKey("jwk",M),A=a==="direct-key-agreement",x=await Ph(l,S,A?e.alg:s,A?e.cekBits:parseInt(s.slice(-5,-2),10),v,N),b={x:K,crv:V,kty:$};if($==="EC"&&(b.y=B),f={epk:b},m!==void 0&&(f.apu=De(m)),E!==void 0&&(f.apv=De(E)),A)return[x,void 0,f];l=x;break}case"RSA-OAEP":{Wc(l),Ch(s,l,"encrypt"),p=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",l,u));break}case"PBKDF2":{let{p2c:m=2048,p2s:E=crypto.getRandomValues(new Uint8Array(16))}=o;l=await Dh(E,s,m,l),f={p2c:m,p2s:De(E)};break}case"AES-GCM":{let m=o.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):o.iv;if(!(m instanceof Uint8Array))throw new TypeError('"iv" must be an instance of Uint8Array');let E=await Jc(bi(s.slice(0,-2)),u,l,m,new Uint8Array);p=E.ciphertext,f={iv:De(E.iv),tag:De(E.tag)}}}if(p??=await rI(s.slice(-6),l,u),!(p instanceof Uint8Array)||!p.byteLength)throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");return[u,p,f]}var rl=ne(()=>{zt();Ct();Si();Ie();Pe();Ft();Hs()});function nl(t,e){if(t.zip!==void 0&&t.zip!=="DEF")throw new Te('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(t.zip!==void 0&&!e?.zip)throw new W('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function Kh(t){if(typeof globalThis[t]>"u")throw new Te(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Hh(t,e,r=1/0){let n=t.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let i=[],o=0,s=t.readable.getReader();for(;;){let{value:a,done:c}=await s.read();if(c)break;if(i.push(a),o+=a.byteLength,r!==1/0&&o>r)throw new W("Decompressed plaintext exceeded the configured limit")}return kt(...i)}async function Fh(t){return Kh("CompressionStream"),Hh(new CompressionStream("deflate-raw"),t)}async function Vh(t,e){return Kh("DecompressionStream"),Hh(new DecompressionStream("deflate-raw"),t,e)}var $d=ne(()=>{Ie();Ft()});function il(t){let{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s}=t;if(n!==void 0&&(typeof n!="string"||!n))throw new W("JWE Initialization Vector incorrect type");if(typeof r!="string")throw new W("JWE Ciphertext missing or incorrect type");if(o!==void 0&&(typeof o!="string"||!o))throw new W("JWE Authentication Tag incorrect type");if(i!==void 0&&typeof i!="string")throw new W("JWE Protected Header incorrect type");if(e!==void 0&&(typeof e!="string"||!e))throw new W("JWE AAD incorrect type");if(s!==void 0&&!he(s))throw new W("JWE Shared Unprotected Header incorrect type");return{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s===void 0?void 0:{...s}}}function ol(t){let e,r;try{let{header:n}=t;if(he(n)){r=n.alg;let o=Object.keys(n);o.includes("alg")||(r=void 0),e=Object.fromEntries(o.map(s=>[s,s==="alg"?r:n[s]]))}else e=n;let{encrypted_key:i}=t;return[{encrypted_key:i,header:e},r]}catch(n){return[void 0,r,n]}}function sl(t){let{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new W("JWE Encrypted Key incorrect type");if(r!==void 0&&!he(r))throw new W("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new W("JOSE Header missing")}function qd(t){let{protected:e,ciphertext:r,iv:n,tag:i,aad:o}=t,s;return e!==void 0&&(s=Kn(e,W,"JWE Protected Header is invalid")),[s,xt(r,"ciphertext",W),n!==void 0?xt(n,"iv",W):void 0,i!==void 0?xt(i,"tag",W):void 0,jc((e??"")+(o!==void 0?`.${o}`:""),"aad",W)]}function Fn(t){return[t&&Ls("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&Ls("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t?.crit,t?.maxPBES2Count,t?.maxDecompressedLength]}async function Vs(t,e,r,n=qd(t)){let[i,o,s,a,c]=n,{header:l,unprotected:u,aad:p}=t,f;if(l!==void 0||u!==void 0){if(!Mn(i,l,u))throw new W("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");f={...i,...l,...u}}else f=i??{};let[m,E,v,N,S]=e,{encrypted_key:R}=t;Vr(W,Gc,v,i,f),nl(f,i);let{alg:M,enc:K}=f;if(typeof M!="string"||!M)throw new W("missing JWE Algorithm (alg) in JWE Header");let B=an[M];if(R===""&&(!B||!vr(B)))throw new W("JWE Encrypted Key incorrect type");let V=B?.mode==="integrated-encryption";if(!V&&(typeof K!="string"||!K))throw new W("missing JWE Encryption Algorithm (enc) in JWE Header");if(m&&!m.has(M)||!m&&M.startsWith("PBES2"))throw new Un('"alg" (Algorithm) Header Parameter value not allowed');let $;if(V){if(K!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(s?.byteLength)throw new W("JWE Initialization Vector must be empty for integrated encryption");if(a?.byteLength)throw new W("JWE Authentication Tag must be empty for integrated encryption")}else{if(E&&!E.has(K))throw new Un('"enc" (Encryption Algorithm) Header Parameter value not allowed');$=bi(K)}let A;if(R!==void 0)try{A=xt(R,"encrypted_key",W)}catch(O){if(!B||!vr(B))throw O;A=new Uint8Array}let x=!1;typeof r=="function"&&(r=await r(i,t),x=!0);let b=B??gr(M);vr(b)&&A===void 0&&(A=new Uint8Array);let g=await hr(b.mode==="direct-encryption"?$:b,r,"decrypt"),I;if(b.mode==="integrated-encryption")I=await b.decrypt(g,A,o,c,i,f);else{let O=$,D;try{D=await Mh(b,O,g,A,f,N),vr(b)&&D instanceof Uint8Array&&D.byteLength<<3!==O.cekBits&&(D=xi(O))}catch(k){if(k instanceof TypeError||k instanceof W||k instanceof Te)throw k;D=xi(O)}I=await Yc(O,D,o,s,a,c)}if(f.zip==="DEF"){let O=S??25e4;if(O===0)throw new Te('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(O!==1/0&&(!Number.isSafeInteger(O)||O<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");I=await Vh(I,O).catch(D=>{throw D instanceof W?D:new W("Failed to decompress plaintext",{cause:D})})}return{plaintext:I,...i&&{protectedHeader:i},...p!==void 0&&{additionalAuthenticatedData:xt(p,"aad",W)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...x&&{key:g}}}async function al(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new W("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:o,3:s,4:a,length:c}=t.split(".");if(c!==5)throw new W("Invalid Compact JWE");return Vs({ciphertext:s,iv:o||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}var Bs=ne(()=>{Hs();Pe();Ie();rl();Ft();Ct();Si();$d()});async function Bh(t,e,r){return al(t,Fn(r),e)}var jh=ne(()=>{Bs()});async function Gh(t,e,r){if(!he(t))throw new W("Flattened JWE must be an object");let n=il(t),[i,,o]=ol(t);if(!i)throw o;let s={...n,...i};return sl(s),Vs(s,Fn(r),e)}var $h=ne(()=>{Ie();Pe();Bs()});async function qh(t,e,r){if(!he(t))throw new W("General JWE must be an object");let n=t.recipients;if(!Array.isArray(n))throw new W("JWE Recipients missing or incorrect type");let i=Array.from(n);if(!i.every(he))throw new W("JWE Recipients missing or incorrect type");if(!i.length)throw new W("JWE Recipients has no members");let o,s,a;try{o=Fn(r),s=il(t),a=qd(s)}catch{throw new sn}let c=i.map(l=>ol(l));if(i.length>1)for(let[,l]of c){let u=a[0]?.alg??l??s.unprotected?.alg,p=typeof u=="string"?an[u]:void 0;if(p&&!vr(p))throw new W(`"${u}" alg may only have a single recipient`)}for(let[l]of c)if(l)try{let u={...s,...l};return sl(u),await Vs(u,o,e,a)}catch{}throw new sn}var Wh=ne(()=>{Bs();Ie();Pe();Si()});function cl(t,e,r){if(!Mn(t,e,r))throw new W("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Wd(t,e,r=!1){if(!t[1]&&!t[2]&&!t[3])throw new W("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");e!==void 0&&(t[8]=e?.crit);let[,n,i,o,s,a,c,l,u]=t;if(s!==void 0&&at(s,"JWE Additional Authenticated Data"),a!==void 0&&at(a,"JWE Content Encryption Key"),c!==void 0&&at(c,"JWE Initialization Vector"),!r&&n!==void 0&&(n=Ii(W,n)[0],t[1]=n),i!==void 0&&(i=Ii(W,i)[0],t[2]=i),!r&&o!==void 0&&(o=Ii(W,o)[0],t[3]=o),l!==void 0&&!he(l))throw new TypeError("JWE Key Management Parameters must be an object");cl(n,i,o);let p={...n,...i,...o};$c(W,n),Vr(W,Gc,u,n,p),nl(p,n);let{alg:f,enc:m}=p;if(typeof f!="string"||!f)throw new W('JWE "alg" (Algorithm) Header Parameter missing or invalid');let E=an[f];if(E?.mode==="integrated-encryption"){if(m!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(a!==void 0)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[p,void 0,E]}if(typeof m!="string"||!m)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,bi(m),E]}async function zd(t,e,r){let[n,i,o]=e,[s,a,c,l,u,p,f,m,,E]=t,v=a,N=c,S=o??gr(n.alg),R,M,K;S.mode==="integrated-encryption"?K=await hr(S,r,"encrypt"):[K,R,M]=await tl(S,i,r,n,p,m),M&&(E?N=N?{...N,...M}:M:v=v?{...v,...M}:M,cl(v,N,l));let B=v?De(JSON.stringify(v)):"",V=u?.byteLength?De(u):void 0,$=Et(V?`${B}.${V}`:B),A=s;n.zip==="DEF"&&(A=await Fh(A).catch(O=>{throw new W("Failed to compress plaintext",{cause:O})}));let x,b,g;S.mode==="integrated-encryption"?[R,x]=await S.encrypt(K,A,$,v,n,m):{ciphertext:x,tag:b,iv:g}=await Jc(i,A,K,f,$);let I={ciphertext:De(x)};return g&&(I.iv=De(g)),b&&(I.tag=De(b)),R?.byteLength&&(I.encrypted_key=De(R)),V&&(I.aad=V),v&&(I.protected=B),l&&(I.unprotected=l),N&&(I.header=N),I}async function vo(t,e,r){return zd(t,Wd(t,r),e)}function ll(t){return[t.protected,t.encrypted_key,t.iv,t.ciphertext,t.tag].join(".")}var js=ne(()=>{zt();Hs();rl();Ie();Pe();Ft();Ct();Si();$d()});var Jd,ul,zh=ne(()=>{Pe();Ie();Hs();zt();js();rl();Si();Jd=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return Se(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return Se(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},ul=class{#e;#t=[];#r;#o;#i;constructor(e){this.#e=e}addRecipient(e,r){let n=new Jd(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return Se(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Se(this.#o,"setSharedUnprotectedHeader"),this.#o=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}async encrypt(){if(!this.#t.length)throw new W("at least one recipient must be added");at(this.#e,"plaintext");let e=this.#t.length>1,r,n=this.#r,i=this.#o,o=[];for(let E of this.#t){let[v,N,S,R]=E.state,M=[this.#e,n,v,i,this.#i,void 0,void 0,N,R,e],K=Wd(M,void 0,o.length>0);o.length||(n=M[1],i=M[3]),o.push([M,K,S]);let[{alg:B,enc:V},,$]=K;if(e&&$&&!vr($))throw new W(`"${B}" alg may only have a single recipient`);if(!r)r=V;else if(r!==V)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}for(let[,E]of o)E[2]??=gr(E[0].alg);let[s,a,c]=o[0],l=e?xi(a[1]):void 0;s[5]=l;let{encrypted_key:u,header:p,...f}=await zd(s,a,c),m={...f,recipients:[{}]};u&&(m.recipients[0].encrypted_key=u),p&&(m.recipients[0].header=p);for(let E=1;E<o.length;E++){let[v,[N,S,R],M]=o[E],K=v[2],[,B,V]=await tl(R,S,M,N,l,v[7]),$={encrypted_key:De(B)};if(K||V){let A={...K,...V};V&&cl(v[1],A,v[3]),$.header=A}m.recipients.push($)}return m}}});function Yd(t){let e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:Gs}}function Ao(t,e){let r={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:r,signing:e?{...r,saltLength:e}:r,usages:Gs,minRsaBits:2048}}function Xd(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:Gs}}function Jh(){let t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:Gs}}function Qd(t){let e={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:e,signing:e,usages:Gs}}function To(t){let e=typeof t=="string"?$s[t]:void 0;if(!e)throw new Te(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}var Gs,$s,_o=ne(()=>{Ie();Bd();Gs=[["verify"],["sign"]];$s=Fs({HS256:Yd(256),HS384:Yd(384),HS512:Yd(512),RS256:Ao(256),RS384:Ao(384),RS512:Ao(512),PS256:Ao(256,32),PS384:Ao(384,48),PS512:Ao(512,64),ES256:Xd("P-256",256),ES384:Xd("P-384",384),ES512:Xd("P-521",512),EdDSA:Jh(),Ed25519:Jh(),"ML-DSA-44":Qd(44),"ML-DSA-65":Qd(65),"ML-DSA-87":Qd(87)})});function dl(t,e){let r=t.protected,n=t.header,i=he(n)?{...n}:n,o=e?e[0]:t.payload;!e&&o instanceof Uint8Array&&(o=new Uint8Array(o));let s=t.signature,a={payload:o,signature:s};if(r!==void 0&&(a.protected=r),n!==void 0&&(a.header=i),r===void 0&&i===void 0)throw new ee('Flattened JWS must have either of the "protected" or "header" members');if(r!==void 0&&typeof r!="string")throw new ee("JWS Protected Header incorrect type");if(o===void 0)throw new ee("JWS Payload missing");if(typeof s!="string")throw new ee("JWS Signature missing or incorrect type");if(i!==void 0&&!he(i))throw new ee("JWS Unprotected Header incorrect type");return a}function Vn(t){return[t&&Ls("algorithms",t.algorithms),t?.crit]}function Zd(t){return t===void 0?{}:Kn(t,ee,"JWS Protected Header is invalid")}function pl(t){let e=/[\p{Cs}\p{Cn}]/u.exec(t)?.[0];if(e!==void 0)throw new ee(/\p{Cs}/u.test(e)?"JWS Payload must be a well-formed Unicode string":"JWS Payload must not contain unassigned Unicode code points");return on.encode(t)}function aI(t){try{return Et(t)}catch{throw new ee("JWS Compact Serialization payload must use only ASCII characters")}}async function qs(t,e,r,n,i){let{protected:o,header:s,payload:a}=t,c=i??Zd(o);if(!Mn(c,s))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...c,...s},u=mo(c,Vr(ee,fo,e[1],c,l)),{alg:p}=l;if(typeof p!="string"||!p)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(p))throw new Un('"alg" (Algorithm) Header Parameter value not allowed');if(u){if(typeof a!="string")throw new ee("JWS Payload must be a string")}else if(typeof a!="string"&&!(a instanceof Uint8Array))throw new ee("JWS Payload must be a string or an Uint8Array instance");let f=u||typeof a!="string"?a:n(a),m=!1;typeof r=="function"&&(r=await r(c,t),m=!0);let E=To(p),v=kt(o!==void 0?Et(o):new Uint8Array,Et("."),typeof f=="string"?e[2]??=jc(f,"payload",ee):f),N=xt(t.signature,"signature",ee),S=await hr(E,r,"verify"),R=await yr(S,E.subtle,"verify");E.minRsaBits&&ho(E.alg,R);let M=!1;try{M=await crypto.subtle.verify(E.signing,R,N,v)}catch{}if(!M)throw new Ln;let K={payload:typeof f=="string"?xt(f,"payload",ee):f};return o!==void 0&&(K.protectedHeader=c),s!==void 0&&(K.unprotectedHeader=s),m?[{...K,key:S},u]:[K,u]}async function fl(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:o,length:s}=t.split(".");if(s!==3)throw new ee("Invalid Compact JWS");return qs({payload:i,protected:n,signature:o},e,r,aI)}var Ws=ne(()=>{_o();Ie();Ft();Pe();Ct()});async function Yh(t,e,r){let[n]=await fl(t,Vn(r),e);return n}var Xh=ne(()=>{Ws()});async function Qh(t,e,r){if(!he(t))throw new ee("Flattened JWS must be an object");let n=dl(t),[i]=await qs(n,Vn(r),e,pl);return i}var Zh=ne(()=>{Ie();Pe();Ws()});function cI(t,e){try{let r=dl(t,[e]),n=Zd(r.protected),{b64:i,crit:o}=n;return[r,n,Array.isArray(o)&&o.includes("b64")?typeof i=="boolean"?i?1:2:0:1]}catch{return}}async function eE(t,e,r){if(!he(t))throw new ee("General JWS must be an object");let{signatures:n,payload:i}=t;if(!Array.isArray(n))throw new ee("JWS Signatures missing or incorrect type");let o=Array.from(n);if(!o.every(he))throw new ee("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=Vn(r)}catch{throw new Ln}let a=i instanceof Uint8Array?new Uint8Array(i):i,c=o.map(u=>cI(u,a)).filter(u=>u!==void 0),l=0;for(let[,,u]of c)if(l|=u,l===3)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");for(let u of c)try{let[p]=await qs(u[0],s,e,pl,u[1]);return p}catch{}throw new Ln}var tE=ne(()=>{Ws();Ie();Pe()});function ep(){throw new TypeError("Invalid time period format")}function ml(t){typeof t!="string"&&ep();let e=uI.exec(t);(!e||e[4]&&e[1])&&ep();let r=parseFloat(e[2]),n=Math.round(r*lI[e[3][0].toLowerCase()]);return Number.isFinite(n)||ep(),e[1]==="-"||e[4]==="ago"?-n:n}function xo(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function tp(t,e){if(typeof e!="string")throw new TypeError(`"${t}" claim must be a string`)}function dI(t){if(typeof t!="string"&&(!Array.isArray(t)||Array.from(t).some(e=>typeof e!="string")))throw new TypeError('"aud" claim must be a string or an array of strings')}function rp(t,e){return typeof t=="number"?xo(e,t):t instanceof Date?xo(e,zs(t)):zs(new Date)+ml(t)}function np(t,e,r=!1){let n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new ir(`"${e}" claim must be a number`,t,e,"invalid");return n}}function ip(t,e){throw new ir(`unexpected "${e}" claim value`,t,e,Io)}function bo(t,e,r={}){let n;try{n=JSON.parse(co.decode(e))}catch{}if(!he(n))throw new je("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i!==void 0&&(typeof t.typ!="string"||rE(t.typ)!==rE(i)))throw new ir('unexpected "typ" JWT header value',n,"typ",Io);let{requiredClaims:o=[],issuer:s,subject:a,audience:c,maxTokenAge:l}=r,u=[...o];l!==void 0&&u.push("iat"),c!==void 0&&u.push("aud"),a!==void 0&&u.push("sub"),s!==void 0&&u.push("iss");for(let R of new Set(u.reverse()))if(!Object.hasOwn(n,R))throw new ir(`missing required "${R}" claim`,n,R,"missing");s!==void 0&&!(Array.isArray(s)?s:[s]).includes(n.iss)&&ip(n,"iss"),a!==void 0&&n.sub!==a&&ip(n,"sub"),c!==void 0&&!pI(n.aud,typeof c=="string"?[c]:c)&&ip(n,"aud");let{clockTolerance:p}=r,f=0;if(typeof p=="string")f=ml(p);else if(p!==void 0){if(typeof p!="number")throw new TypeError("Invalid clockTolerance option type");f=p}xo("clockTolerance option",f);let{currentDate:m}=r,E=xo("currentDate option",zs(m===void 0?new Date:m)),v=np(n,"iat",l!==void 0),N=np(n,"nbf");if(N!==void 0&&N>E+f)throw new ir('"nbf" claim timestamp check failed',n,"nbf",Io);let S=np(n,"exp");if(S!==void 0&&S<=E-f)throw new lo('"exp" claim timestamp check failed',n,"exp",Io);if(l!==void 0){let R=E-v,M=xo("maxTokenAge option",typeof l=="number"?l:ml(l));if(R-f>M)throw new lo('"iat" claim timestamp check failed (too far in the past)',n,"iat",Io);if(R<-f)throw new ir('"iat" claim timestamp check failed (it should be in the past)',n,"iat",Io)}return n}function cn(t){return nE.get(t)}function So(t){let e=cn(t);for(let r of["iat","nbf","exp"]){let n=e[r];if(typeof n=="number"&&!Number.isFinite(n))throw new TypeError(`"${r}" claim must be a finite number`)}return on.encode(JSON.stringify(e))}function hl(t,e){return cn(t)[e]}var zs,lI,uI,Io,rE,pI,nE,Bn,wo=ne(()=>{Ie();Ft();Pe();zs=t=>Math.floor(t.getTime()/1e3),lI={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},uI=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Io="check_failed";rE=t=>{let e=t.toLowerCase();return t.includes("/")?e:`application/${e}`},pI=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;Bn=class{constructor(e={}){if(!he(e))throw new TypeError("JWT Claims Set MUST be an object");(nE||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return tp("iss",e),cn(this).iss=e,this}setSubject(e){return tp("sub",e),cn(this).sub=e,this}setAudience(e){return dI(e),cn(this).aud=e,this}setJti(e){return tp("jti",e),cn(this).jti=e,this}setNotBefore(e){return cn(this).nbf=rp(e,"setNotBefore"),this}setExpirationTime(e){return cn(this).exp=rp(e,"setExpirationTime"),this}setIssuedAt(e){let r=cn(this);return e===void 0?r.iat=zs(new Date):typeof e=="string"?r.iat=xo("setIssuedAt",zs(new Date)+ml(e)):r.iat=rp(e,"setIssuedAt"),this}}});async function jn(t,e,r){let[n,i]=await fl(t,Vn(r),e);if(!i)throw new je("JWTs MUST NOT use unencoded payload");let o=bo(n.protectedHeader,n.payload,r);return{...n,payload:o}}var iE=ne(()=>{Ws();wo();Ie()});async function oE(t,e,r){let{plaintext:n,...i}=await al(t,Fn(r),e),{protectedHeader:o}=i,s=bo(o,n,r);for(let a of["iss","sub","aud"])if(o[a]!==void 0&&(a==="aud"?JSON.stringify(o.aud)!==JSON.stringify(s.aud):o[a]!==s[a]))throw new ir(`replicated "${a}" claim header parameter mismatch`,s,a,"mismatch");return{payload:s,...i}}var sE=ne(()=>{Bs();wo();Ie()});var El,aE=ne(()=>{Pe();js();El=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}async encrypt(e,r){return ll(await vo([...this.#e],e,r))}}});var yl,cE=ne(()=>{Pe();js();yl=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setSharedUnprotectedHeader(e){return Se(this.#e[3],"setSharedUnprotectedHeader"),this.#e[3]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}setAdditionalAuthenticatedData(e){return this.#e[4]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}async encrypt(e,r){return vo([...this.#e],e,r)}}});async function Js(t,e,r){let[n,i,o,s]=t,a="";if(i!==void 0){let S=Ii(ee,i);i=S[0],a=De(S[1])}if(o!==void 0&&(o=Ii(ee,o)[0]),!i&&!o)throw new ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Mn(i,o))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let c={...i,...o};$c(ee,i);let l=mo(i,Vr(ee,fo,s,i,c));l||r?.();let{alg:u}=c;if(typeof u!="string"||!u)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let p=To(u),f="",m=n,E;if(l){let S=t[4];S?(f=S[0]??=De(n),m=S[1]??=Et(f)):(f=De(n),E=on.encode(`${a}.${f}`))}E??=kt(Et(a),Et("."),m);let v=await yr(await hr(p,e,"sign"),p.subtle,"sign");p.minRsaBits&&ho(p.alg,v);let N={signature:De(new Uint8Array(await crypto.subtle.sign(p.signing,v,E))),payload:f};return i&&(N.protected=a),o&&(N.header=o),[N,l]}async function gl(t,e,r,n,i){let[o]=await Js([t,e,void 0,r],n,i);return`${o.protected}.${o.payload}.${o.signature}`}var Ys=ne(()=>{zt();_o();Pe();Ie();Ft();Ct()});var vl,lE=ne(()=>{Ys();Pe();vl=class{#e;#t;constructor(e){at(e,"payload"),this.#e=e}setProtectedHeader(e){return Se(this.#t,"setProtectedHeader"),this.#t=e,this}async sign(e,r){return gl(this.#e,this.#t,r?.crit,e,()=>{throw new TypeError("use the flattened module for creating JWS with b64: false")})}}});var Al,uE=ne(()=>{Ys();Pe();Al=class{#e;constructor(e){at(e,"payload"),this.#e=[e]}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}async sign(e,r){let n=[...this.#e];n[3]=r?.crit;let[i]=await Js(n,e);return i}}});var op,Tl,dE=ne(()=>{Ys();Ie();Pe();op=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return Se(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return Se(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Tl=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new op(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new ee("at least one signature must be added");at(this.#e,"payload");let e={signatures:[],payload:""},r=[],n;for(let i of this.#t){let[o,s,a,c]=i.state,[{payload:l,...u},p]=await Js([this.#e,o,s,c,r],a);if(n===void 0)n=p,e.payload=l;else if(n!==p)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(u)}return e}}});var fI,No,pE=ne(()=>{Ys();Ie();wo();Pe();fI=Bn,No=class extends fI{#e;setProtectedHeader(e){return Se(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,r){return gl(So(this),this.#e,r?.crit,e,()=>{throw new je("JWTs MUST NOT use unencoded payload")})}}});var mI,_l,fE=ne(()=>{js();wo();Pe();mI=Bn,_l=class extends mI{#e=[void 0];#t;#r;#o;setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#r=!0,this}replicateAudienceAsHeader(){return this.#o=!0,this}async encrypt(e,r){let n=So(this);this.#e[1]&&(this.#t||this.#r||this.#o)&&(this.#e[1]={...this.#e[1],iss:this.#t?hl(this,"iss"):void 0,sub:this.#r?hl(this,"sub"):void 0,aud:this.#o?hl(this,"aud"):void 0});let i=[...this.#e];return i[0]=n,ll(await vo(i,e,r))}}});function wi(t='JWK "alg" (Algorithm) Parameter'){throw new Te(`Invalid or unsupported ${t} value`)}function Ni(t,e){return(typeof t=="string"?$s[t]??an[t]:void 0)??wi(e)}var Gn,Xs=ne(()=>{Ie();_o();Si();Gn='"alg" (Algorithm)'});function yI(t,e){if($n(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),ln(t),e==="pkcs8"){$n(t,2,"Expected version field");let r=ln(t);t.pos+=r}$n(t,48,"Expected algorithm identifier"),ln(t)}function vI(t){let e=gE(t);$n(e,48,"Invalid certificate structure");let r=ln(e);if(r<0||e.pos+r>e.data.length)throw new Error("Unexpected end of ASN.1 input");$n(e,48,"Invalid tbsCertificate structure"),ln(e),t[e.pos]===160?mE(e,6):mE(e,5);let n=e.pos;$n(e,48,"Invalid SPKI structure");let i=ln(e);return t.subarray(n,n+i+(e.pos-n))}var hI,hE,EE,yE,Qs,gE,sp,ln,mE,$n,vE,EI,gI,ap,cp,AE,TE,_E,lp=ne(()=>{Ct();Ft();Ie();Xs();hI=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
|
|
3
3
|
`);return`-----BEGIN ${e}-----
|
|
4
4
|
${r}
|
|
5
|
-
-----END ${e}-----`},hE=async(t,e,r)=>{if(Ms(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!Br(r))throw new TypeError(Er(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return hI(Kc(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},EE=t=>hE("public","spki",t),yE=t=>hE("private","pkcs8",t),Qs=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},gE=t=>({data:t,pos:0}),sp=t=>{let e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},ln=t=>{let e=sp(t);if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|sp(t);return n}return e},mE=(t,e=1)=>{for(;e-- >0;){t.pos++;let r=ln(t);t.pos+=r}},Gn=(t,e,r)=>{if(sp(t)!==e)throw new Error(r)},vE=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},EI=t=>{Gn(t,6,"Expected algorithm OID");let e=ln(t);return vE(t,e)};gI=t=>{let e=EI(t);if(Qs(e,[43,101,110]))return"X25519";if(!Qs(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Gn(t,6,"Expected curve OID");let r=ln(t),n=vE(t,r);if(Qs(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Qs(n,[43,129,4,0,34]))return"P-384";if(Qs(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},ap=async(t,e,r,n)=>{let i=Kn(n?.extractable),o=Ni(r,jn);o.secret&&wi(jn);let s=t==="spki",a;if(o.resolve)try{let c=gE(e);yI(c,t),a=o.resolve({crv:gI(c)})}catch{throw new Te("Invalid or unsupported key format")}else a=o.subtle;return crypto.subtle.importKey(t,e,a,i??s,o.usages[s?0:1])},cp=(t,e)=>Hc(t.replace(e,"")),AE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return ap("pkcs8",n,e,r)},TE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return ap("spki",n,e,r)};_E=(t,e,r)=>{let n;try{let i=cp(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=vI(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return ap("spki",n,e,r)}});function IE(t){return EE(t)}function xE(t){return yE(t)}async function Il(t){if(Ms(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:Pe(t)};if(!Br(t))throw new TypeError(Er(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let e=await crypto.subtle.exportKey("jwk",t);delete e.ext,delete e.key_ops,delete e.use,e.kty!=="AKP"&&delete e.alg;for(let r of Object.keys(e))e[r]===void 0&&delete e[r];return e}var up=ne(()=>{lp();Ct();zt()});async function dp(t,e){let r;if(he(t)){if(r=Eo(t),typeof r.kty!="string")throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"))}else if(Hd(t))r=Eo(await Il(t));else throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":un(r.alg,'"alg" (Algorithm) Parameter'),un(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":un(r.crv,'"crv" (Curve) Parameter'),un(r.x,'"x" (X Coordinate) Parameter'),un(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":un(r.crv,'"crv" (Subtype of Key Pair) Parameter'),un(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":un(r.e,'"e" (Exponent) Parameter'),un(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!="string")throw new uo('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new Te('"kty" (Key Type) Parameter missing or unsupported')}let i=Et(JSON.stringify(n));return Pe(await Fc(e,i))}async function bE(t,e){e??="sha256";let r=await dp(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var un,SE=ne(()=>{Ft();zt();Ie();Ct();De();up();un=(t,e)=>{if(typeof t!="string"||!t)throw new uo(`${e} missing or invalid`)}});async function wE(t,e){let r={...t,...e?.header};if(!he(r.jwk))throw new ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n;try{n=Ks(r.jwk)}catch(s){throw new ee("Invalid Embedded JWK",{cause:s})}let i=To(r.alg);if(n.use!==void 0&&n.use!=="sig")throw new ee('Invalid Embedded JWK, its "use" must be "sig" when present');if(n.alg!==void 0&&n.alg!==i.alg)throw new ee(`Invalid Embedded JWK, its "alg" must be "${i.alg}" when present`);let o=await jr(i,n,!0);if(o.type!=="public")throw new ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return o}var NE=ne(()=>{Ct();_o();De();Ie()});function AI(t,e,r,n){let{kty:i,key_ops:o,ext:s,kid:a,alg:c,use:l,crv:u}=t;return(s===void 0||typeof s=="boolean")&&(o===void 0||Array.isArray(o)&&o.every((p,f)=>typeof p=="string"&&o.indexOf(p)===f)&&o.includes("verify"))&&e.kty.includes(i)&&(n===void 0||typeof n=="string"&&n===a)&&(c===void 0?i!=="AKP":r===c)&&(l===void 0||l==="sig")&&(!e.crv||u===e.crv)}async function RE(t,e,r){let n=t.get(e)||t.set(e,{}).get(e),{alg:i}=r;if(n[i]===void 0){let o=jr(r,e,!0).then(s=>{if(s.type!=="public")throw new po("JSON Web Key Set members must be public keys");return n[i]=s,s}).catch(s=>{throw n[i]===o&&delete n[i],s});n[i]=o}return n[i]}function Zs(t){let e;try{e=structuredClone(t)}catch{}if(!Bc(e))throw new po("JSON Web Key Set malformed");let r=e.keys.map(i=>{let o=Eo(i);return Array.isArray(o.key_ops)&&(o.key_ops=[...o.key_ops]),o}),n=new WeakMap;return Object.defineProperty(async(i,o)=>{let{alg:s,kid:a}={...i,...o?.header},c=typeof s=="string"?$s[s]:void 0;if(!c||c.secret)throw new Te('Unsupported "alg" value for a JSON Web Key Set');let l=e.keys.filter((f,m)=>AI(r[m],c,s,a)),{0:u,length:p}=l;if(!p)throw new _i;if(p!==1){let f=new Ds;throw f[Symbol.asyncIterator]=async function*(){for(let m of l)try{yield await RE(n,m,c)}catch{}},f}return RE(n,u,c)},"jwks",{value:()=>structuredClone(e)})}var pp=ne(()=>{Ct();_o();Ie();De()});function TI(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function _I(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(o=>{throw o.name==="TimeoutError"?new Us:o});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function ea(t,e){return Number.isFinite(t)&&Date.now()<t+e}function OE(t,e,r){if(Number.isNaN(t))throw new TypeError(`"${r}" option must not be NaN`);return typeof t=="number"?t:e}function kE(t,e){if(!(t instanceof URL))throw new TypeError("url must be an instance of URL");let r=new URL(t.href).href,n=e??{},i=n.timeoutDuration;if(typeof i=="number"&&(!Number.isInteger(i)||i<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let o=typeof i=="number"?i:5e3,s=OE(n.cooldownDuration,3e4,"cooldownDuration"),a=OE(n.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(n.headers);fp&&!c.has("User-Agent")&&c.set("User-Agent",fp),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");let l=n[mp],u=n[hp],p,f,m=0,E=0,v;if(u&&typeof u=="object"){let{uat:S,jwks:R}=u;ea(S,a)&&Bc(R)&&(p=S,v=Zs(R))}let N=async()=>{if(f&&TI()&&(f=void 0),!f){let S=++m,R=f=_I(r,c,AbortSignal.timeout(o),l).then(M=>{let K=Zs(M);if(S<=E)return;v=K;let B=Date.now();u&&(u.uat=B,u.jwks=M),p=B,E=S}).finally(()=>{f===R&&(f=void 0)})}await f};return Object.defineProperties(async(S,R)=>{(!v||!ea(p,a))&&await N();try{return await v(S,R)}catch(M){if(M instanceof _i&&!ea(p,s))return await N(),v(S,R);throw M}},{coolingDown:{get:()=>ea(p,s),enumerable:!0},fresh:{get:()=>ea(p,a),enumerable:!0},reload:{value:N,enumerable:!0},reloading:{get:()=>!!f,enumerable:!0},jwks:{value:()=>v?.jwks(),enumerable:!0}})}var fp,mp,hp,CE=ne(()=>{Ie();pp();De();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(fp="jose/v6.2.12");mp=Symbol();hp=Symbol()});var II,xl,PE=ne(()=>{zt();De();Ie();wo();II=Vn,xl=class extends II{encode(){let e=Pe(JSON.stringify({alg:"none"})),r=Pe(So(this));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new je("Unsecured JWT must be a string");let{0:n,1:i,2:o,length:s}=e.split(".");if(s!==3||o!=="")throw new je("Invalid Unsecured JWT");let a,c;try{a=Mn(n,ee,"JWS Protected Header is invalid");let l=Vr(ee,fo,void 0,a,a);c=mo(a,l)}catch(l){throw l instanceof ee?new je("Invalid Unsecured JWT",{cause:l}):l}if(a.alg!=="none")throw new je("Invalid Unsecured JWT");if(!c)throw new je("JWTs MUST NOT use unencoded payload");return{payload:bo(a,xt(i,"payload",je),r),header:a}}}});async function bl(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return TE(t,e,r)}async function DE(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return _E(t,e,r)}async function ta(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return AE(t,e,r)}async function Vt(t,e,r){if(!he(t))throw new TypeError("JWK must be an object");let n=Ks(t),i=Kn(r?.extractable),{alg:o}=n;if(e??=o,n.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!="string")throw new TypeError('missing "k" (Key Value) Parameter value');return Fr(n.k);case"AKP":{if(typeof o!="string"||!o)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==o)throw new TypeError("JWK alg and alg option value mismatch");return jr(Ni(e),n,i)}case"RSA":case"EC":case"OKP":return jr(Ni(e),n,i);default:throw new Te('Unsupported "kty" (Key Type) Parameter value')}}var UE=ne(()=>{zt();lp();Ct();Xs();Ie();De()});function LE(t){let e;if(typeof t=="string"){let n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Mn(e,TypeError,r)}var ME=ne(()=>{De()});function KE(t){if(typeof t!="string")throw new je("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new je("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new je("Invalid JWT");if(!e)throw new je("JWTs must contain a payload");let n;try{n=Fr(e)}catch{throw new je("Failed to base64url decode the payload")}let i;try{i=JSON.parse(co.decode(n))}catch{throw new je("Failed to parse the decoded payload as JSON")}if(!he(i))throw new je("Invalid JWT Claims Set");return i}var HE=ne(()=>{zt();Ft();De();Ie()});function xI(t){let e=t?.modulusLength??2048;if(typeof e!="number"||!Number.isInteger(e)||e<2048)throw new Te("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function FE(t,e){let r=Kn(e?.extractable),n=Ni(t,jn);n.secret&&wi(jn);let i;if(n.resolve){let o=e?.crv??"P-256";if(!["P-256","P-384","P-521","X25519"].includes(o))throw new Te("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");i=n.resolve({crv:o})}else{if(n.crv!==void 0&&e?.crv!==void 0&&e.crv!==n.crv)throw new Te(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${n.crv}`);i=n.kty[0]==="RSA"?{...n.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:xI(e)}:n.subtle}return crypto.subtle.generateKey(i,r??!1,[...n.usages[1],...n.usages[0]])}var VE=ne(()=>{Ie();Ct();Xs()});async function BE(t,e){let r=Kn(e?.extractable),n,i,o;switch(t){case"HS256":case"HS384":case"HS512":n=+t.slice(-3),i={name:"HMAC",hash:`SHA-${n}`,length:n},o=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return crypto.getRandomValues(new Uint8Array(+t.slice(-3)>>3));case"A128KW":case"A192KW":case"A256KW":n=+t.slice(1,4),i={name:"AES-KW",length:n},o=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=+t.slice(1,4),i={name:"AES-GCM",length:n},o=["encrypt","decrypt"];break;default:wi(jn)}return crypto.subtle.generateKey(i,r??!1,o)}var jE=ne(()=>{Xs();Ct()});var GE={};Cc(GE,{CompactEncrypt:()=>El,CompactSign:()=>vl,EmbeddedJWK:()=>wE,EncryptJWT:()=>_l,FlattenedEncrypt:()=>yl,FlattenedSign:()=>Al,GeneralEncrypt:()=>ul,GeneralSign:()=>Tl,SignJWT:()=>No,UnsecuredJWT:()=>xl,base64url:()=>Vc,calculateJwkThumbprint:()=>dp,calculateJwkThumbprintUri:()=>bE,compactDecrypt:()=>Bh,compactVerify:()=>Yh,createLocalJWKSet:()=>Zs,createRemoteJWKSet:()=>kE,cryptoRuntime:()=>bI,customFetch:()=>mp,decodeJwt:()=>KE,decodeProtectedHeader:()=>LE,errors:()=>Md,exportJWK:()=>Il,exportPKCS8:()=>xE,exportSPKI:()=>IE,flattenedDecrypt:()=>Gh,flattenedVerify:()=>Qh,generalDecrypt:()=>qh,generalVerify:()=>eE,generateKeyPair:()=>FE,generateSecret:()=>BE,importJWK:()=>Vt,importPKCS8:()=>ta,importSPKI:()=>bl,importX509:()=>DE,jwksCache:()=>hp,jwtDecrypt:()=>oE,jwtVerify:()=>Bn});var bI,ra=ne(()=>{jh();$h();Wh();zh();Xh();Zh();tE();iE();sE();aE();cE();lE();uE();dE();pE();fE();SE();NE();pp();CE();PE();up();UE();ME();HE();Ie();VE();jE();zt();bI="WebCryptoAPI"});var Hv=M_((Ga,Lu)=>{(function(t,e){"use strict";var r="",n="?",i="function",o="undefined",s="object",a="string",c="major",l="model",u="name",p="type",f="vendor",m="version",E="architecture",v="console",N="mobile",S="tablet",R="smarttv",M="wearable",K="embedded",B=500,V="Amazon",$="Apple",A="ASUS",x="BlackBerry",b="Browser",g="Chrome",I="Edge",O="Firefox",P="Google",k="Huawei",C="LG",D="Microsoft",L="Motorola",H="Opera",z="Samsung",Y="Sharp",pe="Sony",Oe="Xiaomi",Fe="Zebra",me="Facebook",we="Chromium OS",st="Mac OS",Zi=function(ve,ke){var fe={};for(var He in ve)ke[He]&&ke[He].length%2===0?fe[He]=ke[He].concat(ve[He]):fe[He]=ve[He];return fe},kn=function(ve){for(var ke={},fe=0;fe<ve.length;fe++)ke[ve[fe].toUpperCase()]=ve[fe];return ke},eo=function(ve,ke){return typeof ve===a?_t(ke).indexOf(_t(ve))!==-1:!1},_t=function(ve){return ve.toLowerCase()},yi=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},It=function(ve,ke){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof ke===o?ve:ve.substring(0,B)},Qe=function(ve,ke){for(var fe=0,He,rn,Mr,Re,ie,Kr;fe<ke.length&&!ie;){var Nd=ke[fe],_h=ke[fe+1];for(He=rn=0;He<Nd.length&&!ie&&Nd[He];)if(ie=Nd[He++].exec(ve),ie)for(Mr=0;Mr<_h.length;Mr++)Kr=ie[++rn],Re=_h[Mr],typeof Re===s&&Re.length>0?Re.length===2?typeof Re[1]==i?this[Re[0]]=Re[1].call(this,Kr):this[Re[0]]=Re[1]:Re.length===3?typeof Re[1]===i&&!(Re[1].exec&&Re[1].test)?this[Re[0]]=Kr?Re[1].call(this,Kr,Re[2]):e:this[Re[0]]=Kr?Kr.replace(Re[1],Re[2]):e:Re.length===4&&(this[Re[0]]=Kr?Re[3].call(this,Kr.replace(Re[1],Re[2])):e):this[Re]=Kr||e;fe+=2}},Ke=function(ve,ke){for(var fe in ke)if(typeof ke[fe]===s&&ke[fe].length>0){for(var He=0;He<ke[fe].length;He++)if(eo(ke[fe][He],ve))return fe===n?e:fe}else if(eo(ke[fe],ve))return fe===n?e:fe;return ve},k_={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},Ah={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Th={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[m,[u,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[m,[u,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[u,m],[/opios[\/ ]+([\w\.]+)/i],[m,[u,H+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[m,[u,H+" GX"]],[/\bopr\/([\w\.]+)/i],[m,[u,H]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[m,[u,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[u,m],[/\bddg\/([\w\.]+)/i],[m,[u,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[m,[u,"UC"+b]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[m,[u,"WeChat"]],[/konqueror\/([\w\.]+)/i],[m,[u,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[m,[u,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[m,[u,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[m,[u,"Smart Lenovo "+b]],[/(avast|avg)\/([\w\.]+)/i],[[u,/(.+)/,"$1 Secure "+b],m],[/\bfocus\/([\w\.]+)/i],[m,[u,O+" Focus"]],[/\bopt\/([\w\.]+)/i],[m,[u,H+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[m,[u,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[m,[u,"Dolphin"]],[/coast\/([\w\.]+)/i],[m,[u,H+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[m,[u,"MIUI "+b]],[/fxios\/([-\w\.]+)/i],[m,[u,O]],[/\bqihu|(qi?ho?o?|360)browser/i],[[u,"360 "+b]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[u,/(.+)/,"$1 "+b],m],[/samsungbrowser\/([\w\.]+)/i],[m,[u,z+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[u,/_/g," "],m],[/metasr[\/ ]?([\d\.]+)/i],[m,[u,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[u,"Sogou Mobile"],m],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[u,m],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[u],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[u,me],m],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[u,m],[/\bgsa\/([\w\.]+) .*safari\//i],[m,[u,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[m,[u,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[m,[u,g+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[u,g+" WebView"],m],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[m,[u,"Android "+b]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[u,m],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[m,[u,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[m,u],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[u,[m,Ke,k_]],[/(webkit|khtml)\/([\w\.]+)/i],[u,m],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[u,"Netscape"],m],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[m,[u,O+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[u,m],[/(cobalt)\/([\w\.]+)/i],[u,[m,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[E,"amd64"]],[/(ia32(?=;))/i],[[E,_t]],[/((?:i[346]|x)86)[;\)]/i],[[E,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[E,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[E,"armhf"]],[/windows (ce|mobile); ppc;/i],[[E,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[E,/ower/,r,_t]],[/(sun4\w)[;\)]/i],[[E,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[E,_t]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[f,z],[p,S]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[f,z],[p,N]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[f,$],[p,N]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[f,$],[p,S]],[/(macintosh);/i],[l,[f,$]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[f,Y],[p,N]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[f,k],[p,S]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[f,k],[p,N]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,N]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,S]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[f,"OPPO"],[p,N]],[/\b(opd2\d{3}a?) bui/i],[l,[f,"OPPO"],[p,S]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[f,"Vivo"],[p,N]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[f,"Realme"],[p,N]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[f,L],[p,N]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[f,L],[p,S]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[f,C],[p,S]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[f,C],[p,N]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[f,"Lenovo"],[p,S]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[f,"Nokia"],[p,N]],[/(pixel c)\b/i],[l,[f,P],[p,S]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[f,P],[p,N]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[f,pe],[p,N]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[f,pe],[p,S]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[f,"OnePlus"],[p,N]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[f,V],[p,S]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[f,V],[p,N]],[/(playbook);[-\w\),; ]+(rim)/i],[l,f,[p,S]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[f,x],[p,N]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[f,A],[p,S]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[f,A],[p,N]],[/(nexus 9)/i],[l,[f,"HTC"],[p,S]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[f,[l,/_/g," "],[p,N]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[f,"Acer"],[p,S]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[f,"Meizu"],[p,N]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[f,"Ulefone"],[p,N]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[f,l,[p,N]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[f,l,[p,S]],[/(surface duo)/i],[l,[f,D],[p,S]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[f,"Fairphone"],[p,N]],[/(u304aa)/i],[l,[f,"AT&T"],[p,N]],[/\bsie-(\w*)/i],[l,[f,"Siemens"],[p,N]],[/\b(rct\w+) b/i],[l,[f,"RCA"],[p,S]],[/\b(venue[\d ]{2,7}) b/i],[l,[f,"Dell"],[p,S]],[/\b(q(?:mv|ta)\w+) b/i],[l,[f,"Verizon"],[p,S]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[f,"Barnes & Noble"],[p,S]],[/\b(tm\d{3}\w+) b/i],[l,[f,"NuVision"],[p,S]],[/\b(k88) b/i],[l,[f,"ZTE"],[p,S]],[/\b(nx\d{3}j) b/i],[l,[f,"ZTE"],[p,N]],[/\b(gen\d{3}) b.+49h/i],[l,[f,"Swiss"],[p,N]],[/\b(zur\d{3}) b/i],[l,[f,"Swiss"],[p,S]],[/\b((zeki)?tb.*\b) b/i],[l,[f,"Zeki"],[p,S]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[f,"Dragon Touch"],l,[p,S]],[/\b(ns-?\w{0,9}) b/i],[l,[f,"Insignia"],[p,S]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[f,"NextBook"],[p,S]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[f,"Voice"],l,[p,N]],[/\b(lvtel\-)?(v1[12]) b/i],[[f,"LvTel"],l,[p,N]],[/\b(ph-1) /i],[l,[f,"Essential"],[p,N]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[f,"Envizen"],[p,S]],[/\b(trio[-\w\. ]+) b/i],[l,[f,"MachSpeed"],[p,S]],[/\btu_(1491) b/i],[l,[f,"Rotor"],[p,S]],[/(shield[\w ]+) b/i],[l,[f,"Nvidia"],[p,S]],[/(sprint) (\w+)/i],[f,l,[p,N]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[f,D],[p,N]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[f,Fe],[p,S]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[f,Fe],[p,N]],[/smart-tv.+(samsung)/i],[f,[p,R]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[f,z],[p,R]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[f,C],[p,R]],[/(apple) ?tv/i],[f,[l,$+" TV"],[p,R]],[/crkey/i],[[l,g+"cast"],[f,P],[p,R]],[/droid.+aft(\w+)( bui|\))/i],[l,[f,V],[p,R]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[f,Y],[p,R]],[/(bravia[\w ]+)( bui|\))/i],[l,[f,pe],[p,R]],[/(mitv-\w{5}) bui/i],[l,[f,Oe],[p,R]],[/Hbbtv.*(technisat) (.*);/i],[f,l,[p,R]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[f,It],[l,It],[p,R]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,R]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[f,l,[p,v]],[/droid.+; (shield) bui/i],[l,[f,"Nvidia"],[p,v]],[/(playstation [345portablevi]+)/i],[l,[f,pe],[p,v]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[f,D],[p,v]],[/((pebble))app/i],[f,l,[p,M]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[f,$],[p,M]],[/droid.+; (glass) \d/i],[l,[f,P],[p,M]],[/droid.+; (wt63?0{2,3})\)/i],[l,[f,Fe],[p,M]],[/(quest( \d| pro)?)/i],[l,[f,me],[p,M]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[f,[p,K]],[/(aeobc)\b/i],[l,[f,V],[p,K]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,N]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,S]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,S]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,N]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[f,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[m,[u,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[m,[u,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[u,m],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[m,u]],os:[[/microsoft (windows) (vista|xp)/i],[u,m],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[u,[m,Ke,Ah]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[m,Ke,Ah],[u,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[m,/_/g,"."],[u,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[u,st],[m,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[m,u],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[u,m],[/\(bb(10);/i],[m,[u,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[m,[u,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[m,[u,O+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[m,[u,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[m,[u,"watchOS"]],[/crkey\/([\d\.]+)/i],[m,[u,g+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[u,we],m],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[u,m],[/(sunos) ?([\w\.\d]*)/i],[[u,"Solaris"],m],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[u,m]]},tr=function(ve,ke){if(typeof ve===s&&(ke=ve,ve=e),!(this instanceof tr))return new tr(ve,ke).getResult();var fe=typeof t!==o&&t.navigator?t.navigator:e,He=ve||(fe&&fe.userAgent?fe.userAgent:r),rn=fe&&fe.userAgentData?fe.userAgentData:e,Mr=ke?Zi(Th,ke):Th,Re=fe&&fe.userAgent==He;return this.getBrowser=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.browser),ie[c]=yi(ie[m]),Re&&fe&&fe.brave&&typeof fe.brave.isBrave==i&&(ie[u]="Brave"),ie},this.getCPU=function(){var ie={};return ie[E]=e,Qe.call(ie,He,Mr.cpu),ie},this.getDevice=function(){var ie={};return ie[f]=e,ie[l]=e,ie[p]=e,Qe.call(ie,He,Mr.device),Re&&!ie[p]&&rn&&rn.mobile&&(ie[p]=N),Re&&ie[l]=="Macintosh"&&fe&&typeof fe.standalone!==o&&fe.maxTouchPoints&&fe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=S),ie},this.getEngine=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.engine),ie},this.getOS=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.os),Re&&!ie[u]&&rn&&rn.platform&&rn.platform!="Unknown"&&(ie[u]=rn.platform.replace(/chrome os/i,we).replace(/macos/i,st)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return He},this.setUA=function(ie){return He=typeof ie===a&&ie.length>B?It(ie,B):ie,this},this.setUA(He),this};tr.BROWSER=kn([u,m,c]),tr.CPU=kn([E]),tr.DEVICE=kn([l,f,p,v,N,R,S,M,K]),tr.ENGINE=tr.OS=kn([u,m]),typeof Ga!==o?(typeof Lu!==o&&Lu.exports&&(Ga=Lu.exports=tr),Ga.UAParser=tr):typeof define===i&&define.amd?define(function(){return tr}):typeof t!==o&&(t.UAParser=tr);var to=typeof t!==o&&(t.jQuery||t.Zepto);if(to&&!to.ua){var kc=new tr;to.ua=kc.getResult(),to.ua.get=function(){return kc.getUA()},to.ua.set=function(ve){kc.setUA(ve);var ke=kc.getResult();for(var fe in ke)to.ua[fe]=ke[fe]}}})(typeof window=="object"?window:Ga)});var zT,JT=ne(()=>{zT="x-hono-already-sent"});var YT,XT=ne(()=>{YT=t=>((...e)=>{if(typeof e[0]=="function"){let[r,n]=e;return async function(o,s){let a=await t(o,await r(o),n);if(a)return a;await s()}}else{let[r,n,i]=e;return(async()=>{let o=await t(r,n,i);if(!o)throw new Error("Failed to upgrade WebSocket");return o})()}})});var S_={};Cc(S_,{RequestError:()=>Ur,createAdaptorServer:()=>b_,getRequestListener:()=>T_,serve:()=>Jk,upgradeWebSocket:()=>zk});import{STATUS_CODES as ak,ServerResponse as ck,createServer as lk}from"node:http";import{Http2ServerRequest as hi,constants as uk}from"node:http2";import{Readable as QT}from"node:stream";async function Uk(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function h_(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(s,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function o(){t.read().then(s,i)}function s({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",o);else return t.read().then(s,i)}catch(l){i(l)}}}function o_(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:h_(t.getReader(),e)}var Ur,dk,pk,Td,ZT,e_,hh,c_,Eh,l_,fk,mk,hk,Ek,yk,gk,Ns,u_,vk,Ak,ah,lh,d_,yh,t_,Id,r_,Tk,Ei,Nn,Rs,Rc,p_,f_,wc,uh,dh,mi,_d,On,n_,Nc,xd,Oc,_k,Ik,xk,bk,Sk,wk,Nk,gh,Rk,i_,Ok,tn,kk,Xi,ph,ws,Rn,bd,en,Ck,Pk,Dk,fh,Sd,s_,Lk,Mk,E_,Kk,Hk,Fk,y_,wd,mh,g_,ch,v_,A_,Vk,T_,Bk,jk,Gk,__,I_,$k,x_,a_,qk,Wk,zk,b_,Jk,w_=ne(()=>{JT();XT();Ur=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},dk=new Set(["age","authorization","content-length","content-type","etag","expires","from","host","if-modified-since","if-unmodified-since","last-modified","location","max-forwards","proxy-authorization","referer","retry-after","server","user-agent"]),pk=/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/,Td=t=>t===9||t===10||t===13||t===32,ZT=t=>{if(!Td(t.charCodeAt(0))&&!Td(t.charCodeAt(t.length-1)))return t;let e=0,r=t.length;for(;e<r&&Td(t.charCodeAt(e));)e++;for(;r>e&&Td(t.charCodeAt(r-1));)r--;return t.slice(e,r)},e_=/[\0\r\n]/,hh=globalThis.Headers,c_=(t,e=hh)=>{let r=new e;for(let n=0;n<t.length;n+=2){let i=t[n];i.startsWith(":")||r.append(i,t[n+1])}return r},Eh=class{#e;#t;#r;#o;constructor(t){this.#e=t,t instanceof hi&&(this.#t=t.rawHeaders.slice())}get#i(){return this.#t??=this.#e.rawHeaders.slice()}get#n(){return this.#r||(this.#r=c_(this.#i),this.#t=void 0),this.#r}#c(t){if(typeof t=="string"){if(!pk.test(t))throw new TypeError(`Invalid header name: ${t}`);return t.toLowerCase()}}#s(t){let e=this.#e instanceof hi?void 0:this.#e.headers;if(!e||dk.has(t)||t==="set-cookie"||t==="__proto__")return;if(!Object.hasOwn(e,t))return null;let r=e[t];if(typeof r=="string"){let n=ZT(r);return e_.test(n)?void 0:n}}#a(t,e){let r=e==="cookie"?"; ":", ",n=null;for(let i=0;i<t.length;i+=2){let o=t[i];if(o.length===e.length&&o.toLowerCase()===e){let s=ZT(t[i+1]);if(e_.test(s)){this.#o=!0;return}n=n===null?s:n+r+s}}return n}append(t,e){this.#n.append(t,e)}delete(t){this.#n.delete(t)}get(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r;let n=this.#a(this.#i,e);if(n!==void 0)return n}return this.#n.get(t)}has(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r!==null;let n=this.#a(this.#i,e);if(n!==void 0)return n!==null}return this.#n.has(t)}set(t,e){this.#n.set(t,e)}getSetCookie(){return this.#n.getSetCookie()}keys(){return this.#n.keys()}values(){return this.#n.values()}entries(){return this.#n.entries()}forEach(t,e){this.#n.forEach((r,n)=>{t.call(e,r,n,this)})}[Symbol.iterator](){return this.entries()}};Object.defineProperty(Eh.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Headers (lightweight) ${r(Object.fromEntries(this),{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Eh.prototype,hh.prototype);l_=t=>globalThis.Headers===hh?new Eh(t):c_(t.rawHeaders,globalThis.Headers),fk=/^\/[!#$&-;=?-\[\]_a-z~]*$/,mk=/\/\.\.?(?:[/?#]|$)/,hk=/^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/,Ek=(t,e,r)=>{let n=`${t}://${e}${r}`;if(hk.test(e)){if(r.length===0)return n+"/";if(r.charCodeAt(0)!==47)throw new Ur("Invalid URL");return!fk.test(r)||mk.test(r)?new URL(n).href:n}else{let i=new URL(n);if(i.hostname.length!==e.length&&i.hostname!==(e.includes(":")?e.replace(/:\d+$/,""):e).toLowerCase())throw new Ur("Invalid host header");return i.href}},yk=t=>t instanceof Ur?t:new Ur(t.message,{cause:t}),gk=global.Request,Ns=class extends gk{constructor(t,e){if(typeof t=="object"&&Ei in t){let r=e!==void 0&&"body"in e&&e.body!=null;if(t[On]&&!r)throw new TypeError("Cannot construct a Request with a Request object that has already been used.");t=t[Ei]()}typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},u_=Symbol("wrapBodyStream"),vk=new Set(["latin1","binary","hex","base64","base64url"]),Ak=t=>t===null||vk.has(t),ah=Symbol("bodyBufferedBeforeDisconnect"),lh=Symbol("bodyBufferedLengthBeforeDisconnect"),d_=(t,e)=>Buffer.isBuffer(t)?t:Buffer.from(t,e??"utf8"),yh=t=>!(t instanceof hi)&&!!t.complete&&!!t.readableAborted&&typeof t.read=="function"&&Ak(t.readableEncoding),t_=t=>{if(t.readableDidRead||!yh(t))return;let e=t;e[lh]??=t.readableLength},Id=(t,e)=>{if(t.readableDidRead&&!e||!yh(t))return;let r=t;if(r[ah]!==void 0)return r[ah];let n,i=t.errored;if(i&&i.code!=="ECONNRESET")n=i;else if(r[lh]!==void 0&&t.readableLength!==r[lh])n=xd();else{let o=e??[],s=t.read();s!==null&&o.push(d_(s,t.readableEncoding));let a=o.length===1?o[0]:Buffer.concat(o);n=a;let c=t.headers["content-length"];if(typeof c=="string"&&/^\d+$/.test(c)){let l=Number(c);Number.isSafeInteger(l)&&a.length!==l&&(n=xd())}}return r[ah]=n,n},r_=(t,e)=>{if(e instanceof Error){t.error(e);return}e.length>0&&t.enqueue(e),t.close()},Tk=(t,e,r,n,i)=>{let o={method:t,headers:r,signal:i.signal};if(t==="TRACE"){o.method="GET";let s=new Ns(e,o);return Object.defineProperty(s,"method",{get(){return"TRACE"}}),s}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)o.body=new ReadableStream({start(s){s.enqueue(n.rawBody),s.close()}});else if(n[u_]){let s;o.body=new ReadableStream({async pull(a){try{if(!s){let u=Id(n);if(u!==void 0){r_(a,u);return}}s||=QT.toWeb(n).getReader();let{done:c,value:l}=await s.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else{let s=Id(n);s!==void 0?o.body=new ReadableStream({start(a){r_(a,s)}}):o.body=QT.toWeb(n)}return new Ns(e,o)},Ei=Symbol("getRequestCache"),Nn=Symbol("requestCache"),Rs=Symbol("incomingKey"),Rc=Symbol("urlKey"),p_=Symbol("methodKey"),f_=Symbol("headersKey"),wc=Symbol("abortControllerKey"),uh=Symbol("getAbortController"),dh=Symbol("abortRequest"),mi=Symbol("bodyBuffer"),_d=Symbol("bodyReadPromise"),On=Symbol("bodyConsumedDirectly"),n_=Symbol("bodyLockReader"),Nc=Symbol("abortReason"),xd=()=>new TypeError("Body is unusable"),Oc=()=>Promise.reject(xd()),_k=new TextDecoder,Ik=t=>{if(t[On])return Oc();t[On]=!0},xk=t=>t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength),bk=t=>(t[f_]||=l_(t[Rs])).get("content-type")||"",Sk=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,wk=t=>{if(typeof t!="string"||t.length===0)return"GET";switch(t){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"PATCH":case"POST":case"PUT":case"QUERY":return t}let e=t.toUpperCase();switch(e){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"POST":case"PUT":return e;default:return t}},Nk=t=>{if(!Sk.test(t))return new TypeError(`'${t}' is not a valid HTTP method.`);let e=t.toUpperCase();if(e==="CONNECT"||e==="TRACK"||e==="TRACE"&&t!=="TRACE")return new TypeError(`'${t}' HTTP method is unsupported.`)},gh=(t,e,r)=>{if(t[On])return Oc();let n=t.method;if(n==="GET"||n==="HEAD")return t[Ei]()[e]();let i=Nk(n);if(i)return Promise.reject(i);if(t[Nn]&&n!=="TRACE")return t[Nn][e]();let o=Ik(t);if(o)return o;let s=Rk(t);if(s){let a=Promise.resolve(r(s,t));return t[mi]=void 0,a}return Ok(t).then(a=>{let c=r(a,t);return t[mi]=void 0,c})},Rk=t=>{let e=t[Rs];if("rawBody"in e&&e.rawBody instanceof Buffer)return e.rawBody},i_=(t,e)=>{if(e.errored)return e.errored;let r=t[Nc];return r!==void 0?r instanceof Error?r:new Error(String(r)):new Error("Client connection prematurely closed.")},Ok=t=>{if(t[mi])return Promise.resolve(t[mi]);if(t[_d])return t[_d];let e=t[Rs];if(e.readableDidRead)return Oc();let r=Id(e);if(r!==void 0)return r instanceof Error?Promise.reject(r):(t[mi]=r,Promise.resolve(r));let n=new Promise((i,o)=>{let s=[],a=!1,c=v=>{a||(a=!0,E(),v())},l=v=>{let N=e.errored??v;return!yh(e)||N&&N.code!=="ECONNRESET"?!1:(c(()=>{let S=Id(e,s);S instanceof Error?o(S):S===void 0?o(v??i_(t,e)):(t[mi]=S,i(S))}),!0)},u=v=>{s.push(d_(v,e.readableEncoding))},p=()=>{c(()=>{let v=s.length===1?s[0]:Buffer.concat(s);t[mi]=v,i(v)})},f=v=>{l(v)||c(()=>{o(v)})},m=()=>{if(e.readableEnded){p();return}l()||c(()=>{o(i_(t,e))})},E=()=>{e.off("data",u),e.off("end",p),e.off("error",f),e.off("close",m),t[_d]=void 0};e.on("data",u),e.on("end",p),e.on("error",f),e.on("close",m),queueMicrotask(()=>{a||(e.readableEnded?p():e.errored?f(e.errored):e.destroyed&&m())})});return t[_d]=n,n},tn={get method(){return this[p_]},get url(){return this[Rc]},get headers(){return this[f_]||=l_(this[Rs])},[dh](t){this[Nc]===void 0&&(this[Nc]=t);let e=this[wc];e&&!e.signal.aborted&&e.abort(t)},[uh](){return this[wc]||=new AbortController,this[Nc]!==void 0&&!this[wc].signal.aborted&&this[wc].abort(this[Nc]),this[wc]},[Ei](){let t=this[uh]();if(this[Nn])return this[Nn];let e=this.method;if(this[On]&&!(e==="GET"||e==="HEAD")){this[mi]=void 0;let r={method:e==="TRACE"?"GET":e,headers:this.headers,signal:t.signal};e!=="TRACE"&&(r.body=new ReadableStream({start(i){i.close()}}),r.duplex="half");let n=new Ns(this[Rc],r);return e==="TRACE"&&Object.defineProperty(n,"method",{get(){return"TRACE"}}),this[Nn]=n}return this[Nn]=Tk(this.method,this[Rc],this.headers,this[Rs],t)},get body(){if(!this[On])return this[Ei]().body;let t=this[Ei]();return!this[n_]&&t.body&&(this[n_]=t.body.getReader()),t.body},get bodyUsed(){return this[On]?!0:this[Nn]?this[Nn].bodyUsed:!1}};Object.defineProperty(tn,"signal",{get(){return this[uh]().signal}});["cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","keepalive"].forEach(t=>{Object.defineProperty(tn,t,{get(){return this[Ei]()[t]}})});["clone","formData"].forEach(t=>{Object.defineProperty(tn,t,{value:function(){if(this[On]){if(t==="clone")throw xd();return Oc()}return this[Ei]()[t]()}})});Object.defineProperty(tn,"text",{value:function(){return gh(this,"text",t=>_k.decode(t))}});Object.defineProperty(tn,"arrayBuffer",{value:function(){return gh(this,"arrayBuffer",t=>xk(t))}});Object.defineProperty(tn,"blob",{value:function(){return gh(this,"blob",(t,e)=>{let r=bk(e),n=r?{headers:{"content-type":r}}:void 0;return new Response(t,n).blob()})}});Object.defineProperty(tn,"json",{value:function(){return this[On]?Oc():this.text().then(JSON.parse)}});Object.defineProperty(tn,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Request (lightweight) ${r({method:this.method,url:this.url,headers:this.headers,nativeRequest:this[Nn]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(tn,Ns.prototype);kk=(t,e)=>{let r=Object.create(tn);r[Rs]=t,r[p_]=wk(t.method);let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof hi)throw new Ur("Absolute URL for :path is not allowed in HTTP/2");try{r[Rc]=new URL(n).href}catch(s){throw new Ur("Invalid absolute URL",{cause:s})}return r}let i=(t instanceof hi?t.authority:t.headers.host)||e;if(!i)throw new Ur("Missing host header");let o;if(t instanceof hi){if(o=t.scheme,!(o==="http"||o==="https"))throw new Ur("Unsupported scheme")}else o=t.socket&&t.socket.encrypted?"https":"http";try{r[Rc]=Ek(o,i,n)}catch(s){throw s instanceof Ur?s:new Ur("Invalid URL",{cause:s})}return r},Xi="text/plain; charset=UTF-8",ph=Symbol("responseCache"),ws=Symbol("getResponseCache"),Rn=Symbol("cache"),bd=global.Response,en=class m_{#e;#t;[ws](){let e=this[Rn],r=e&&e[2]instanceof Headers?e[2]:void 0;return delete this[Rn],this[ph]||=new bd(this.#e,r?{status:this.#t?.status,statusText:this.#t?.statusText,headers:r}:this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof bd){let i=r[ph];if(i){this.#t=i,this[ws]();return}this.#t=r instanceof m_?r.#t:r,n=new Headers(r.headers)}else this.#t=r;(e==null||typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[Rn]=[r?.status||200,e??null,n||r?.headers])}get headers(){let e=this[Rn];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||(e[1]===null?void 0:{"content-type":Xi}))),e[2]):this[ws]().headers}get status(){return this[Rn]?.[0]??this[ws]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(en.prototype,t,{get(){return this[ws]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(en.prototype,t,{value:function(){return this[ws]()[t]()}})});Object.defineProperty(en.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Response (lightweight) ${r({status:this.status,headers:this.headers,ok:this.ok,nativeResponse:this[ph]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(en,bd);Object.setPrototypeOf(en.prototype,bd.prototype);Ck=/^https?:\/\/[!#-;=?-[\]_a-z~A-Z]+$/,Pk=t=>t instanceof URL?t.href:Ck.test(t)?t:new URL(t).href,Dk=new Set([301,302,303,307,308]);Object.defineProperty(en,"redirect",{value:function(e,r=302){if(!Dk.has(r))throw new RangeError("Invalid status code");return new en(null,{status:r,headers:{location:Pk(e)}})},writable:!0,configurable:!0});Object.defineProperty(en,"json",{value:function(e,r){let n=JSON.stringify(e);if(n===void 0)throw new TypeError("The data is not JSON serializable");let i=r?.headers,o;return i?(o=new Headers(i),o.has("content-type")||o.set("content-type","application/json")):o={"content-type":"application/json"},new en(n,{status:r?.status??200,statusText:r?.statusText,headers:o})},writable:!0,configurable:!0});fh=(t,e)=>{let r={};if(t instanceof Headers||(t=new Headers(t??void 0)),t.has("set-cookie")){let n=[];for(let[i,o]of t)i==="set-cookie"?n.push(o):r[i]=o;n.length>0&&(r["set-cookie"]=n)}else for(let[n,i]of t)r[n]=i;return e&&(r["content-type"]??=e),r},Sd=Symbol("outgoingEnded"),s_=Symbol("incomingDraining"),Lk=500,Mk=64*1024*1024,E_=t=>{let e=t;if(t.destroyed||e[s_])return;if(e[s_]=!0,t instanceof hi){try{t.stream?.close?.(uk.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(o),t.off("data",s),t.off("end",n),t.off("error",n)},i=()=>{n();let a=t.socket;a&&!a.destroyed&&(typeof a.destroySoon=="function"?a.destroySoon():typeof a.destroy=="function"&&a.destroy())},o=setTimeout(i,Lk);o.unref?.();let s=a=>{r+=a.length,r>Mk&&i()};t.on("data",s),t.on("end",n),t.on("error",n),t.resume()},Kk=(t,e,r,n)=>()=>{e.errored?(t_(e),t[dh](e.errored.toString())):r.writableFinished||(t_(e),t[dh]("Client connection prematurely closed.")),n&&!e.readableEnded&&setTimeout(()=>{e.readableEnded||setTimeout(()=>{E_(e)})})},Hk=t=>{if(!(Rn in t))return!1;let e=t[Rn][1];return e===null||typeof e=="string"||e instanceof Uint8Array},Fk=()=>new Response(null,{status:400}),y_=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),wd=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||(e instanceof ck&&(e._contentLength=null),e.writeHead(500,{"Content-Type":"text/plain"})),e.end(`Error: ${r.message}`),e.destroy(r))},mh=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},g_=(t,e,r)=>{let n=t;return n._contentLength===null&&n._hasBody&&n.useChunkedEncodingByDefault&&!n._removedContLen&&e>=200&&e!==204&&e!==304&&!t.hasHeader("content-length")&&!t.hasHeader("transfer-encoding")&&!t.hasHeader("trailer")?(n._contentLength=r,!0):!1},ch=(t,e,r)=>{g_(t,e,r)?t.writeHead(e,{"Content-Type":Xi}):t.writeHead(e,{"Content-Type":Xi,"Content-Length":r})},v_=async(t,e)=>{let[r,n,i]=t[Rn];if(!i){n===null?(e.writeHead(r),e.end()):typeof n=="string"?(ch(e,r,Buffer.byteLength(n)),e.end(n)):n instanceof Uint8Array?(ch(e,r,n.byteLength),e.end(n)):n instanceof Blob?(ch(e,r,n.size),e.end(new Uint8Array(await n.arrayBuffer()))):(e.writeHead(r,{"Content-Type":Xi}),mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.();return}let o=!1,s=!1,a=!0;if(i instanceof Headers)o=i.has("content-length"),i=fh(i,n===null?void 0:Xi);else if(Array.isArray(i)){let c=new Headers(i);o=c.has("content-length"),i=fh(c,n===null?void 0:Xi)}else{s=!0;for(let c in i){if(c.length===14&&c.toLowerCase()==="content-length"){o=!0;break}(c.length===17&&c.toLowerCase()==="transfer-encoding"||c.length===7&&c.toLowerCase()==="trailer")&&(a=!1)}}if(!o){let c;typeof n=="string"?c=Buffer.byteLength(n):n instanceof Uint8Array?c=n.byteLength:n instanceof Blob&&(c=n.size),c!==void 0&&(!s||!a||!g_(e,r,c))&&(s&&(i={...i}),i["Content-Length"]=c)}e.writeHead(r,i),n==null?e.end():typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.()},A_=t=>typeof t.then=="function",Vk=async(t,e,r={})=>{if(A_(t))if(r.errorHandler)try{t=await t}catch(i){let o=await r.errorHandler(i);if(!o)return;t=o}else t=await t.catch(y_);if(Rn in t)return v_(t,e);let n=fh(t.headers,t.body===null?void 0:Xi);if(t.body){let i=t.body.getReader(),o=[],s=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let u=await Uk(a).catch(p=>{console.error(p),s=!0});if(!u){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,u.value&&o.push(u.value),u.done){s=!0;break}}s&&!("content-length"in n)&&(n["content-length"]=o.reduce((l,u)=>l+u.length,0))}e.writeHead(t.status,n),o.forEach(c=>{e.write(c)}),s?e.end():(o.length===0&&mh(e),await h_(i,e,a))}else n[zT]||(e.writeHead(t.status,n),e.end());e[Sd]?.()},T_=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ns&&(Object.defineProperty(global,"Request",{value:Ns}),Object.defineProperty(global,"Response",{value:en})),async(n,i)=>{let o,s,a=!1,c=!1,l=()=>{!s||c||(c=!0,i.on("close",Kk(s,n,i,a)))};try{if(s=kk(n,e.hostname),a=r&&!(n.method==="GET"||n.method==="HEAD"),a&&(n[u_]=!0,n instanceof hi&&(i[Sd]=()=>{n.readableEnded||setTimeout(()=>{n.readableEnded||setTimeout(()=>{n.destroy(),i.destroy()})})})),o=t(s,{incoming:n,outgoing:i}),!A_(o)&&Hk(o))return a&&!n.readableEnded&&i.once("finish",()=>{n.readableEnded||E_(n)}),v_(o,i);l()}catch(u){if(o)return wd(u,i);if(e.errorHandler){if(l(),o=await e.errorHandler(s?u:yk(u)),!o)return}else s?o=y_(u):o=Fk()}try{return await Vk(o,i,e)}catch(u){return wd(u,i)}}},Bk=globalThis.CloseEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get wasClean(){return this.#e.wasClean??!1}get code(){return this.#e.code??0}get reason(){return this.#e.reason??""}},jk=globalThis.ErrorEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get message(){return this.#e.message??""}get filename(){return this.#e.filename??""}get lineno(){return this.#e.lineno??0}get colno(){return this.#e.colno??0}get error(){return this.#e.error??null}},Gk=()=>Symbol("connection"),__=Symbol("CONNECTION_SYMBOL_KEY"),I_=Symbol("WAIT_FOR_WEBSOCKET_SYMBOL"),$k=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","sec-websocket-accept","sec-websocket-extensions","sec-websocket-protocol"]),x_=(t,e)=>{e&&e.forEach((r,n)=>{$k.has(n.toLowerCase())||t.push(`${n}: ${r}`)})},a_=(t,e,r)=>{let n=["Connection: close","Content-Length: 0"];x_(n,r),t.end(`HTTP/1.1 ${e.toString()} ${ak[e]??""}\r
|
|
5
|
+
-----END ${e}-----`},hE=async(t,e,r)=>{if(Ms(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!Br(r))throw new TypeError(Er(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return hI(Kc(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},EE=t=>hE("public","spki",t),yE=t=>hE("private","pkcs8",t),Qs=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},gE=t=>({data:t,pos:0}),sp=t=>{let e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},ln=t=>{let e=sp(t);if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|sp(t);return n}return e},mE=(t,e=1)=>{for(;e-- >0;){t.pos++;let r=ln(t);t.pos+=r}},$n=(t,e,r)=>{if(sp(t)!==e)throw new Error(r)},vE=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},EI=t=>{$n(t,6,"Expected algorithm OID");let e=ln(t);return vE(t,e)};gI=t=>{let e=EI(t);if(Qs(e,[43,101,110]))return"X25519";if(!Qs(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");$n(t,6,"Expected curve OID");let r=ln(t),n=vE(t,r);if(Qs(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Qs(n,[43,129,4,0,34]))return"P-384";if(Qs(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},ap=async(t,e,r,n)=>{let i=Hn(n?.extractable),o=Ni(r,Gn);o.secret&&wi(Gn);let s=t==="spki",a;if(o.resolve)try{let c=gE(e);yI(c,t),a=o.resolve({crv:gI(c)})}catch{throw new Te("Invalid or unsupported key format")}else a=o.subtle;return crypto.subtle.importKey(t,e,a,i??s,o.usages[s?0:1])},cp=(t,e)=>Hc(t.replace(e,"")),AE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return ap("pkcs8",n,e,r)},TE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return ap("spki",n,e,r)};_E=(t,e,r)=>{let n;try{let i=cp(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=vI(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return ap("spki",n,e,r)}});function IE(t){return EE(t)}function xE(t){return yE(t)}async function Il(t){if(Ms(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!Br(t))throw new TypeError(Er(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let e=await crypto.subtle.exportKey("jwk",t);delete e.ext,delete e.key_ops,delete e.use,e.kty!=="AKP"&&delete e.alg;for(let r of Object.keys(e))e[r]===void 0&&delete e[r];return e}var up=ne(()=>{lp();Ct();zt()});async function dp(t,e){let r;if(he(t)){if(r=Eo(t),typeof r.kty!="string")throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"))}else if(Hd(t))r=Eo(await Il(t));else throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":un(r.alg,'"alg" (Algorithm) Parameter'),un(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":un(r.crv,'"crv" (Curve) Parameter'),un(r.x,'"x" (X Coordinate) Parameter'),un(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":un(r.crv,'"crv" (Subtype of Key Pair) Parameter'),un(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":un(r.e,'"e" (Exponent) Parameter'),un(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!="string")throw new uo('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new Te('"kty" (Key Type) Parameter missing or unsupported')}let i=Et(JSON.stringify(n));return De(await Fc(e,i))}async function bE(t,e){e??="sha256";let r=await dp(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var un,SE=ne(()=>{Ft();zt();Ie();Ct();Pe();up();un=(t,e)=>{if(typeof t!="string"||!t)throw new uo(`${e} missing or invalid`)}});async function wE(t,e){let r={...t,...e?.header};if(!he(r.jwk))throw new ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n;try{n=Ks(r.jwk)}catch(s){throw new ee("Invalid Embedded JWK",{cause:s})}let i=To(r.alg);if(n.use!==void 0&&n.use!=="sig")throw new ee('Invalid Embedded JWK, its "use" must be "sig" when present');if(n.alg!==void 0&&n.alg!==i.alg)throw new ee(`Invalid Embedded JWK, its "alg" must be "${i.alg}" when present`);let o=await jr(i,n,!0);if(o.type!=="public")throw new ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return o}var NE=ne(()=>{Ct();_o();Pe();Ie()});function AI(t,e,r,n){let{kty:i,key_ops:o,ext:s,kid:a,alg:c,use:l,crv:u}=t;return(s===void 0||typeof s=="boolean")&&(o===void 0||Array.isArray(o)&&o.every((p,f)=>typeof p=="string"&&o.indexOf(p)===f)&&o.includes("verify"))&&e.kty.includes(i)&&(n===void 0||typeof n=="string"&&n===a)&&(c===void 0?i!=="AKP":r===c)&&(l===void 0||l==="sig")&&(!e.crv||u===e.crv)}async function RE(t,e,r){let n=t.get(e)||t.set(e,{}).get(e),{alg:i}=r;if(n[i]===void 0){let o=jr(r,e,!0).then(s=>{if(s.type!=="public")throw new po("JSON Web Key Set members must be public keys");return n[i]=s,s}).catch(s=>{throw n[i]===o&&delete n[i],s});n[i]=o}return n[i]}function Zs(t){let e;try{e=structuredClone(t)}catch{}if(!Bc(e))throw new po("JSON Web Key Set malformed");let r=e.keys.map(i=>{let o=Eo(i);return Array.isArray(o.key_ops)&&(o.key_ops=[...o.key_ops]),o}),n=new WeakMap;return Object.defineProperty(async(i,o)=>{let{alg:s,kid:a}={...i,...o?.header},c=typeof s=="string"?$s[s]:void 0;if(!c||c.secret)throw new Te('Unsupported "alg" value for a JSON Web Key Set');let l=e.keys.filter((f,m)=>AI(r[m],c,s,a)),{0:u,length:p}=l;if(!p)throw new _i;if(p!==1){let f=new Ps;throw f[Symbol.asyncIterator]=async function*(){for(let m of l)try{yield await RE(n,m,c)}catch{}},f}return RE(n,u,c)},"jwks",{value:()=>structuredClone(e)})}var pp=ne(()=>{Ct();_o();Ie();Pe()});function TI(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function _I(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(o=>{throw o.name==="TimeoutError"?new Us:o});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function ea(t,e){return Number.isFinite(t)&&Date.now()<t+e}function OE(t,e,r){if(Number.isNaN(t))throw new TypeError(`"${r}" option must not be NaN`);return typeof t=="number"?t:e}function kE(t,e){if(!(t instanceof URL))throw new TypeError("url must be an instance of URL");let r=new URL(t.href).href,n=e??{},i=n.timeoutDuration;if(typeof i=="number"&&(!Number.isInteger(i)||i<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let o=typeof i=="number"?i:5e3,s=OE(n.cooldownDuration,3e4,"cooldownDuration"),a=OE(n.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(n.headers);fp&&!c.has("User-Agent")&&c.set("User-Agent",fp),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");let l=n[mp],u=n[hp],p,f,m=0,E=0,v;if(u&&typeof u=="object"){let{uat:S,jwks:R}=u;ea(S,a)&&Bc(R)&&(p=S,v=Zs(R))}let N=async()=>{if(f&&TI()&&(f=void 0),!f){let S=++m,R=f=_I(r,c,AbortSignal.timeout(o),l).then(M=>{let K=Zs(M);if(S<=E)return;v=K;let B=Date.now();u&&(u.uat=B,u.jwks=M),p=B,E=S}).finally(()=>{f===R&&(f=void 0)})}await f};return Object.defineProperties(async(S,R)=>{(!v||!ea(p,a))&&await N();try{return await v(S,R)}catch(M){if(M instanceof _i&&!ea(p,s))return await N(),v(S,R);throw M}},{coolingDown:{get:()=>ea(p,s),enumerable:!0},fresh:{get:()=>ea(p,a),enumerable:!0},reload:{value:N,enumerable:!0},reloading:{get:()=>!!f,enumerable:!0},jwks:{value:()=>v?.jwks(),enumerable:!0}})}var fp,mp,hp,CE=ne(()=>{Ie();pp();Pe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(fp="jose/v6.2.12");mp=Symbol();hp=Symbol()});var II,xl,DE=ne(()=>{zt();Pe();Ie();wo();II=Bn,xl=class extends II{encode(){let e=De(JSON.stringify({alg:"none"})),r=De(So(this));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new je("Unsecured JWT must be a string");let{0:n,1:i,2:o,length:s}=e.split(".");if(s!==3||o!=="")throw new je("Invalid Unsecured JWT");let a,c;try{a=Kn(n,ee,"JWS Protected Header is invalid");let l=Vr(ee,fo,void 0,a,a);c=mo(a,l)}catch(l){throw l instanceof ee?new je("Invalid Unsecured JWT",{cause:l}):l}if(a.alg!=="none")throw new je("Invalid Unsecured JWT");if(!c)throw new je("JWTs MUST NOT use unencoded payload");return{payload:bo(a,xt(i,"payload",je),r),header:a}}}});async function bl(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return TE(t,e,r)}async function PE(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return _E(t,e,r)}async function ta(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return AE(t,e,r)}async function Vt(t,e,r){if(!he(t))throw new TypeError("JWK must be an object");let n=Ks(t),i=Hn(r?.extractable),{alg:o}=n;if(e??=o,n.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!="string")throw new TypeError('missing "k" (Key Value) Parameter value');return Fr(n.k);case"AKP":{if(typeof o!="string"||!o)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==o)throw new TypeError("JWK alg and alg option value mismatch");return jr(Ni(e),n,i)}case"RSA":case"EC":case"OKP":return jr(Ni(e),n,i);default:throw new Te('Unsupported "kty" (Key Type) Parameter value')}}var UE=ne(()=>{zt();lp();Ct();Xs();Ie();Pe()});function LE(t){let e;if(typeof t=="string"){let n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Kn(e,TypeError,r)}var ME=ne(()=>{Pe()});function KE(t){if(typeof t!="string")throw new je("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new je("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new je("Invalid JWT");if(!e)throw new je("JWTs must contain a payload");let n;try{n=Fr(e)}catch{throw new je("Failed to base64url decode the payload")}let i;try{i=JSON.parse(co.decode(n))}catch{throw new je("Failed to parse the decoded payload as JSON")}if(!he(i))throw new je("Invalid JWT Claims Set");return i}var HE=ne(()=>{zt();Ft();Pe();Ie()});function xI(t){let e=t?.modulusLength??2048;if(typeof e!="number"||!Number.isInteger(e)||e<2048)throw new Te("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function FE(t,e){let r=Hn(e?.extractable),n=Ni(t,Gn);n.secret&&wi(Gn);let i;if(n.resolve){let o=e?.crv??"P-256";if(!["P-256","P-384","P-521","X25519"].includes(o))throw new Te("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");i=n.resolve({crv:o})}else{if(n.crv!==void 0&&e?.crv!==void 0&&e.crv!==n.crv)throw new Te(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${n.crv}`);i=n.kty[0]==="RSA"?{...n.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:xI(e)}:n.subtle}return crypto.subtle.generateKey(i,r??!1,[...n.usages[1],...n.usages[0]])}var VE=ne(()=>{Ie();Ct();Xs()});async function BE(t,e){let r=Hn(e?.extractable),n,i,o;switch(t){case"HS256":case"HS384":case"HS512":n=+t.slice(-3),i={name:"HMAC",hash:`SHA-${n}`,length:n},o=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return crypto.getRandomValues(new Uint8Array(+t.slice(-3)>>3));case"A128KW":case"A192KW":case"A256KW":n=+t.slice(1,4),i={name:"AES-KW",length:n},o=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=+t.slice(1,4),i={name:"AES-GCM",length:n},o=["encrypt","decrypt"];break;default:wi(Gn)}return crypto.subtle.generateKey(i,r??!1,o)}var jE=ne(()=>{Xs();Ct()});var GE={};Cc(GE,{CompactEncrypt:()=>El,CompactSign:()=>vl,EmbeddedJWK:()=>wE,EncryptJWT:()=>_l,FlattenedEncrypt:()=>yl,FlattenedSign:()=>Al,GeneralEncrypt:()=>ul,GeneralSign:()=>Tl,SignJWT:()=>No,UnsecuredJWT:()=>xl,base64url:()=>Vc,calculateJwkThumbprint:()=>dp,calculateJwkThumbprintUri:()=>bE,compactDecrypt:()=>Bh,compactVerify:()=>Yh,createLocalJWKSet:()=>Zs,createRemoteJWKSet:()=>kE,cryptoRuntime:()=>bI,customFetch:()=>mp,decodeJwt:()=>KE,decodeProtectedHeader:()=>LE,errors:()=>Md,exportJWK:()=>Il,exportPKCS8:()=>xE,exportSPKI:()=>IE,flattenedDecrypt:()=>Gh,flattenedVerify:()=>Qh,generalDecrypt:()=>qh,generalVerify:()=>eE,generateKeyPair:()=>FE,generateSecret:()=>BE,importJWK:()=>Vt,importPKCS8:()=>ta,importSPKI:()=>bl,importX509:()=>PE,jwksCache:()=>hp,jwtDecrypt:()=>oE,jwtVerify:()=>jn});var bI,ra=ne(()=>{jh();$h();Wh();zh();Xh();Zh();tE();iE();sE();aE();cE();lE();uE();dE();pE();fE();SE();NE();pp();CE();DE();up();UE();ME();HE();Ie();VE();jE();zt();bI="WebCryptoAPI"});var Hv=M_((Ga,Lu)=>{(function(t,e){"use strict";var r="",n="?",i="function",o="undefined",s="object",a="string",c="major",l="model",u="name",p="type",f="vendor",m="version",E="architecture",v="console",N="mobile",S="tablet",R="smarttv",M="wearable",K="embedded",B=500,V="Amazon",$="Apple",A="ASUS",x="BlackBerry",b="Browser",g="Chrome",I="Edge",O="Firefox",D="Google",k="Huawei",C="LG",P="Microsoft",L="Motorola",H="Opera",z="Samsung",Y="Sharp",pe="Sony",Oe="Xiaomi",Fe="Zebra",me="Facebook",we="Chromium OS",st="Mac OS",Zi=function(ve,ke){var fe={};for(var He in ve)ke[He]&&ke[He].length%2===0?fe[He]=ke[He].concat(ve[He]):fe[He]=ve[He];return fe},Cn=function(ve){for(var ke={},fe=0;fe<ve.length;fe++)ke[ve[fe].toUpperCase()]=ve[fe];return ke},eo=function(ve,ke){return typeof ve===a?_t(ke).indexOf(_t(ve))!==-1:!1},_t=function(ve){return ve.toLowerCase()},yi=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},It=function(ve,ke){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof ke===o?ve:ve.substring(0,B)},Qe=function(ve,ke){for(var fe=0,He,rn,Mr,Re,ie,Kr;fe<ke.length&&!ie;){var Nd=ke[fe],_h=ke[fe+1];for(He=rn=0;He<Nd.length&&!ie&&Nd[He];)if(ie=Nd[He++].exec(ve),ie)for(Mr=0;Mr<_h.length;Mr++)Kr=ie[++rn],Re=_h[Mr],typeof Re===s&&Re.length>0?Re.length===2?typeof Re[1]==i?this[Re[0]]=Re[1].call(this,Kr):this[Re[0]]=Re[1]:Re.length===3?typeof Re[1]===i&&!(Re[1].exec&&Re[1].test)?this[Re[0]]=Kr?Re[1].call(this,Kr,Re[2]):e:this[Re[0]]=Kr?Kr.replace(Re[1],Re[2]):e:Re.length===4&&(this[Re[0]]=Kr?Re[3].call(this,Kr.replace(Re[1],Re[2])):e):this[Re]=Kr||e;fe+=2}},Ke=function(ve,ke){for(var fe in ke)if(typeof ke[fe]===s&&ke[fe].length>0){for(var He=0;He<ke[fe].length;He++)if(eo(ke[fe][He],ve))return fe===n?e:fe}else if(eo(ke[fe],ve))return fe===n?e:fe;return ve},k_={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},Ah={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Th={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[m,[u,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[m,[u,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[u,m],[/opios[\/ ]+([\w\.]+)/i],[m,[u,H+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[m,[u,H+" GX"]],[/\bopr\/([\w\.]+)/i],[m,[u,H]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[m,[u,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[u,m],[/\bddg\/([\w\.]+)/i],[m,[u,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[m,[u,"UC"+b]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[m,[u,"WeChat"]],[/konqueror\/([\w\.]+)/i],[m,[u,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[m,[u,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[m,[u,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[m,[u,"Smart Lenovo "+b]],[/(avast|avg)\/([\w\.]+)/i],[[u,/(.+)/,"$1 Secure "+b],m],[/\bfocus\/([\w\.]+)/i],[m,[u,O+" Focus"]],[/\bopt\/([\w\.]+)/i],[m,[u,H+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[m,[u,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[m,[u,"Dolphin"]],[/coast\/([\w\.]+)/i],[m,[u,H+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[m,[u,"MIUI "+b]],[/fxios\/([-\w\.]+)/i],[m,[u,O]],[/\bqihu|(qi?ho?o?|360)browser/i],[[u,"360 "+b]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[u,/(.+)/,"$1 "+b],m],[/samsungbrowser\/([\w\.]+)/i],[m,[u,z+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[u,/_/g," "],m],[/metasr[\/ ]?([\d\.]+)/i],[m,[u,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[u,"Sogou Mobile"],m],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[u,m],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[u],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[u,me],m],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[u,m],[/\bgsa\/([\w\.]+) .*safari\//i],[m,[u,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[m,[u,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[m,[u,g+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[u,g+" WebView"],m],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[m,[u,"Android "+b]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[u,m],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[m,[u,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[m,u],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[u,[m,Ke,k_]],[/(webkit|khtml)\/([\w\.]+)/i],[u,m],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[u,"Netscape"],m],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[m,[u,O+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[u,m],[/(cobalt)\/([\w\.]+)/i],[u,[m,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[E,"amd64"]],[/(ia32(?=;))/i],[[E,_t]],[/((?:i[346]|x)86)[;\)]/i],[[E,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[E,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[E,"armhf"]],[/windows (ce|mobile); ppc;/i],[[E,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[E,/ower/,r,_t]],[/(sun4\w)[;\)]/i],[[E,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[E,_t]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[f,z],[p,S]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[f,z],[p,N]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[f,$],[p,N]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[f,$],[p,S]],[/(macintosh);/i],[l,[f,$]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[f,Y],[p,N]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[f,k],[p,S]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[f,k],[p,N]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,N]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,S]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[f,"OPPO"],[p,N]],[/\b(opd2\d{3}a?) bui/i],[l,[f,"OPPO"],[p,S]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[f,"Vivo"],[p,N]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[f,"Realme"],[p,N]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[f,L],[p,N]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[f,L],[p,S]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[f,C],[p,S]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[f,C],[p,N]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[f,"Lenovo"],[p,S]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[f,"Nokia"],[p,N]],[/(pixel c)\b/i],[l,[f,D],[p,S]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[f,D],[p,N]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[f,pe],[p,N]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[f,pe],[p,S]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[f,"OnePlus"],[p,N]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[f,V],[p,S]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[f,V],[p,N]],[/(playbook);[-\w\),; ]+(rim)/i],[l,f,[p,S]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[f,x],[p,N]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[f,A],[p,S]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[f,A],[p,N]],[/(nexus 9)/i],[l,[f,"HTC"],[p,S]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[f,[l,/_/g," "],[p,N]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[f,"Acer"],[p,S]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[f,"Meizu"],[p,N]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[f,"Ulefone"],[p,N]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[f,l,[p,N]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[f,l,[p,S]],[/(surface duo)/i],[l,[f,P],[p,S]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[f,"Fairphone"],[p,N]],[/(u304aa)/i],[l,[f,"AT&T"],[p,N]],[/\bsie-(\w*)/i],[l,[f,"Siemens"],[p,N]],[/\b(rct\w+) b/i],[l,[f,"RCA"],[p,S]],[/\b(venue[\d ]{2,7}) b/i],[l,[f,"Dell"],[p,S]],[/\b(q(?:mv|ta)\w+) b/i],[l,[f,"Verizon"],[p,S]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[f,"Barnes & Noble"],[p,S]],[/\b(tm\d{3}\w+) b/i],[l,[f,"NuVision"],[p,S]],[/\b(k88) b/i],[l,[f,"ZTE"],[p,S]],[/\b(nx\d{3}j) b/i],[l,[f,"ZTE"],[p,N]],[/\b(gen\d{3}) b.+49h/i],[l,[f,"Swiss"],[p,N]],[/\b(zur\d{3}) b/i],[l,[f,"Swiss"],[p,S]],[/\b((zeki)?tb.*\b) b/i],[l,[f,"Zeki"],[p,S]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[f,"Dragon Touch"],l,[p,S]],[/\b(ns-?\w{0,9}) b/i],[l,[f,"Insignia"],[p,S]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[f,"NextBook"],[p,S]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[f,"Voice"],l,[p,N]],[/\b(lvtel\-)?(v1[12]) b/i],[[f,"LvTel"],l,[p,N]],[/\b(ph-1) /i],[l,[f,"Essential"],[p,N]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[f,"Envizen"],[p,S]],[/\b(trio[-\w\. ]+) b/i],[l,[f,"MachSpeed"],[p,S]],[/\btu_(1491) b/i],[l,[f,"Rotor"],[p,S]],[/(shield[\w ]+) b/i],[l,[f,"Nvidia"],[p,S]],[/(sprint) (\w+)/i],[f,l,[p,N]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[f,P],[p,N]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[f,Fe],[p,S]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[f,Fe],[p,N]],[/smart-tv.+(samsung)/i],[f,[p,R]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[f,z],[p,R]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[f,C],[p,R]],[/(apple) ?tv/i],[f,[l,$+" TV"],[p,R]],[/crkey/i],[[l,g+"cast"],[f,D],[p,R]],[/droid.+aft(\w+)( bui|\))/i],[l,[f,V],[p,R]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[f,Y],[p,R]],[/(bravia[\w ]+)( bui|\))/i],[l,[f,pe],[p,R]],[/(mitv-\w{5}) bui/i],[l,[f,Oe],[p,R]],[/Hbbtv.*(technisat) (.*);/i],[f,l,[p,R]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[f,It],[l,It],[p,R]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,R]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[f,l,[p,v]],[/droid.+; (shield) bui/i],[l,[f,"Nvidia"],[p,v]],[/(playstation [345portablevi]+)/i],[l,[f,pe],[p,v]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[f,P],[p,v]],[/((pebble))app/i],[f,l,[p,M]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[f,$],[p,M]],[/droid.+; (glass) \d/i],[l,[f,D],[p,M]],[/droid.+; (wt63?0{2,3})\)/i],[l,[f,Fe],[p,M]],[/(quest( \d| pro)?)/i],[l,[f,me],[p,M]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[f,[p,K]],[/(aeobc)\b/i],[l,[f,V],[p,K]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,N]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,S]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,S]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,N]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[f,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[m,[u,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[m,[u,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[u,m],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[m,u]],os:[[/microsoft (windows) (vista|xp)/i],[u,m],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[u,[m,Ke,Ah]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[m,Ke,Ah],[u,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[m,/_/g,"."],[u,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[u,st],[m,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[m,u],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[u,m],[/\(bb(10);/i],[m,[u,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[m,[u,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[m,[u,O+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[m,[u,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[m,[u,"watchOS"]],[/crkey\/([\d\.]+)/i],[m,[u,g+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[u,we],m],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[u,m],[/(sunos) ?([\w\.\d]*)/i],[[u,"Solaris"],m],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[u,m]]},tr=function(ve,ke){if(typeof ve===s&&(ke=ve,ve=e),!(this instanceof tr))return new tr(ve,ke).getResult();var fe=typeof t!==o&&t.navigator?t.navigator:e,He=ve||(fe&&fe.userAgent?fe.userAgent:r),rn=fe&&fe.userAgentData?fe.userAgentData:e,Mr=ke?Zi(Th,ke):Th,Re=fe&&fe.userAgent==He;return this.getBrowser=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.browser),ie[c]=yi(ie[m]),Re&&fe&&fe.brave&&typeof fe.brave.isBrave==i&&(ie[u]="Brave"),ie},this.getCPU=function(){var ie={};return ie[E]=e,Qe.call(ie,He,Mr.cpu),ie},this.getDevice=function(){var ie={};return ie[f]=e,ie[l]=e,ie[p]=e,Qe.call(ie,He,Mr.device),Re&&!ie[p]&&rn&&rn.mobile&&(ie[p]=N),Re&&ie[l]=="Macintosh"&&fe&&typeof fe.standalone!==o&&fe.maxTouchPoints&&fe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=S),ie},this.getEngine=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.engine),ie},this.getOS=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.os),Re&&!ie[u]&&rn&&rn.platform&&rn.platform!="Unknown"&&(ie[u]=rn.platform.replace(/chrome os/i,we).replace(/macos/i,st)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return He},this.setUA=function(ie){return He=typeof ie===a&&ie.length>B?It(ie,B):ie,this},this.setUA(He),this};tr.BROWSER=Cn([u,m,c]),tr.CPU=Cn([E]),tr.DEVICE=Cn([l,f,p,v,N,R,S,M,K]),tr.ENGINE=tr.OS=Cn([u,m]),typeof Ga!==o?(typeof Lu!==o&&Lu.exports&&(Ga=Lu.exports=tr),Ga.UAParser=tr):typeof define===i&&define.amd?define(function(){return tr}):typeof t!==o&&(t.UAParser=tr);var to=typeof t!==o&&(t.jQuery||t.Zepto);if(to&&!to.ua){var kc=new tr;to.ua=kc.getResult(),to.ua.get=function(){return kc.getUA()},to.ua.set=function(ve){kc.setUA(ve);var ke=kc.getResult();for(var fe in ke)to.ua[fe]=ke[fe]}}})(typeof window=="object"?window:Ga)});var zT,JT=ne(()=>{zT="x-hono-already-sent"});var YT,XT=ne(()=>{YT=t=>((...e)=>{if(typeof e[0]=="function"){let[r,n]=e;return async function(o,s){let a=await t(o,await r(o),n);if(a)return a;await s()}}else{let[r,n,i]=e;return(async()=>{let o=await t(r,n,i);if(!o)throw new Error("Failed to upgrade WebSocket");return o})()}})});var S_={};Cc(S_,{RequestError:()=>Ur,createAdaptorServer:()=>b_,getRequestListener:()=>T_,serve:()=>Jk,upgradeWebSocket:()=>zk});import{STATUS_CODES as ak,ServerResponse as ck,createServer as lk}from"node:http";import{Http2ServerRequest as hi,constants as uk}from"node:http2";import{Readable as QT}from"node:stream";async function Uk(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function h_(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(s,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function o(){t.read().then(s,i)}function s({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",o);else return t.read().then(s,i)}catch(l){i(l)}}}function o_(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:h_(t.getReader(),e)}var Ur,dk,pk,Td,ZT,e_,hh,c_,Eh,l_,fk,mk,hk,Ek,yk,gk,Ns,u_,vk,Ak,ah,lh,d_,yh,t_,Id,r_,Tk,Ei,Rn,Rs,Rc,p_,f_,wc,uh,dh,mi,_d,kn,n_,Nc,xd,Oc,_k,Ik,xk,bk,Sk,wk,Nk,gh,Rk,i_,Ok,tn,kk,Xi,ph,ws,On,bd,en,Ck,Dk,Pk,fh,Sd,s_,Lk,Mk,E_,Kk,Hk,Fk,y_,wd,mh,g_,ch,v_,A_,Vk,T_,Bk,jk,Gk,__,I_,$k,x_,a_,qk,Wk,zk,b_,Jk,w_=ne(()=>{JT();XT();Ur=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},dk=new Set(["age","authorization","content-length","content-type","etag","expires","from","host","if-modified-since","if-unmodified-since","last-modified","location","max-forwards","proxy-authorization","referer","retry-after","server","user-agent"]),pk=/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/,Td=t=>t===9||t===10||t===13||t===32,ZT=t=>{if(!Td(t.charCodeAt(0))&&!Td(t.charCodeAt(t.length-1)))return t;let e=0,r=t.length;for(;e<r&&Td(t.charCodeAt(e));)e++;for(;r>e&&Td(t.charCodeAt(r-1));)r--;return t.slice(e,r)},e_=/[\0\r\n]/,hh=globalThis.Headers,c_=(t,e=hh)=>{let r=new e;for(let n=0;n<t.length;n+=2){let i=t[n];i.startsWith(":")||r.append(i,t[n+1])}return r},Eh=class{#e;#t;#r;#o;constructor(t){this.#e=t,t instanceof hi&&(this.#t=t.rawHeaders.slice())}get#i(){return this.#t??=this.#e.rawHeaders.slice()}get#n(){return this.#r||(this.#r=c_(this.#i),this.#t=void 0),this.#r}#c(t){if(typeof t=="string"){if(!pk.test(t))throw new TypeError(`Invalid header name: ${t}`);return t.toLowerCase()}}#s(t){let e=this.#e instanceof hi?void 0:this.#e.headers;if(!e||dk.has(t)||t==="set-cookie"||t==="__proto__")return;if(!Object.hasOwn(e,t))return null;let r=e[t];if(typeof r=="string"){let n=ZT(r);return e_.test(n)?void 0:n}}#a(t,e){let r=e==="cookie"?"; ":", ",n=null;for(let i=0;i<t.length;i+=2){let o=t[i];if(o.length===e.length&&o.toLowerCase()===e){let s=ZT(t[i+1]);if(e_.test(s)){this.#o=!0;return}n=n===null?s:n+r+s}}return n}append(t,e){this.#n.append(t,e)}delete(t){this.#n.delete(t)}get(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r;let n=this.#a(this.#i,e);if(n!==void 0)return n}return this.#n.get(t)}has(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r!==null;let n=this.#a(this.#i,e);if(n!==void 0)return n!==null}return this.#n.has(t)}set(t,e){this.#n.set(t,e)}getSetCookie(){return this.#n.getSetCookie()}keys(){return this.#n.keys()}values(){return this.#n.values()}entries(){return this.#n.entries()}forEach(t,e){this.#n.forEach((r,n)=>{t.call(e,r,n,this)})}[Symbol.iterator](){return this.entries()}};Object.defineProperty(Eh.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Headers (lightweight) ${r(Object.fromEntries(this),{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Eh.prototype,hh.prototype);l_=t=>globalThis.Headers===hh?new Eh(t):c_(t.rawHeaders,globalThis.Headers),fk=/^\/[!#$&-;=?-\[\]_a-z~]*$/,mk=/\/\.\.?(?:[/?#]|$)/,hk=/^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/,Ek=(t,e,r)=>{let n=`${t}://${e}${r}`;if(hk.test(e)){if(r.length===0)return n+"/";if(r.charCodeAt(0)!==47)throw new Ur("Invalid URL");return!fk.test(r)||mk.test(r)?new URL(n).href:n}else{let i=new URL(n);if(i.hostname.length!==e.length&&i.hostname!==(e.includes(":")?e.replace(/:\d+$/,""):e).toLowerCase())throw new Ur("Invalid host header");return i.href}},yk=t=>t instanceof Ur?t:new Ur(t.message,{cause:t}),gk=global.Request,Ns=class extends gk{constructor(t,e){if(typeof t=="object"&&Ei in t){let r=e!==void 0&&"body"in e&&e.body!=null;if(t[kn]&&!r)throw new TypeError("Cannot construct a Request with a Request object that has already been used.");t=t[Ei]()}typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},u_=Symbol("wrapBodyStream"),vk=new Set(["latin1","binary","hex","base64","base64url"]),Ak=t=>t===null||vk.has(t),ah=Symbol("bodyBufferedBeforeDisconnect"),lh=Symbol("bodyBufferedLengthBeforeDisconnect"),d_=(t,e)=>Buffer.isBuffer(t)?t:Buffer.from(t,e??"utf8"),yh=t=>!(t instanceof hi)&&!!t.complete&&!!t.readableAborted&&typeof t.read=="function"&&Ak(t.readableEncoding),t_=t=>{if(t.readableDidRead||!yh(t))return;let e=t;e[lh]??=t.readableLength},Id=(t,e)=>{if(t.readableDidRead&&!e||!yh(t))return;let r=t;if(r[ah]!==void 0)return r[ah];let n,i=t.errored;if(i&&i.code!=="ECONNRESET")n=i;else if(r[lh]!==void 0&&t.readableLength!==r[lh])n=xd();else{let o=e??[],s=t.read();s!==null&&o.push(d_(s,t.readableEncoding));let a=o.length===1?o[0]:Buffer.concat(o);n=a;let c=t.headers["content-length"];if(typeof c=="string"&&/^\d+$/.test(c)){let l=Number(c);Number.isSafeInteger(l)&&a.length!==l&&(n=xd())}}return r[ah]=n,n},r_=(t,e)=>{if(e instanceof Error){t.error(e);return}e.length>0&&t.enqueue(e),t.close()},Tk=(t,e,r,n,i)=>{let o={method:t,headers:r,signal:i.signal};if(t==="TRACE"){o.method="GET";let s=new Ns(e,o);return Object.defineProperty(s,"method",{get(){return"TRACE"}}),s}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)o.body=new ReadableStream({start(s){s.enqueue(n.rawBody),s.close()}});else if(n[u_]){let s;o.body=new ReadableStream({async pull(a){try{if(!s){let u=Id(n);if(u!==void 0){r_(a,u);return}}s||=QT.toWeb(n).getReader();let{done:c,value:l}=await s.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else{let s=Id(n);s!==void 0?o.body=new ReadableStream({start(a){r_(a,s)}}):o.body=QT.toWeb(n)}return new Ns(e,o)},Ei=Symbol("getRequestCache"),Rn=Symbol("requestCache"),Rs=Symbol("incomingKey"),Rc=Symbol("urlKey"),p_=Symbol("methodKey"),f_=Symbol("headersKey"),wc=Symbol("abortControllerKey"),uh=Symbol("getAbortController"),dh=Symbol("abortRequest"),mi=Symbol("bodyBuffer"),_d=Symbol("bodyReadPromise"),kn=Symbol("bodyConsumedDirectly"),n_=Symbol("bodyLockReader"),Nc=Symbol("abortReason"),xd=()=>new TypeError("Body is unusable"),Oc=()=>Promise.reject(xd()),_k=new TextDecoder,Ik=t=>{if(t[kn])return Oc();t[kn]=!0},xk=t=>t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength),bk=t=>(t[f_]||=l_(t[Rs])).get("content-type")||"",Sk=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,wk=t=>{if(typeof t!="string"||t.length===0)return"GET";switch(t){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"PATCH":case"POST":case"PUT":case"QUERY":return t}let e=t.toUpperCase();switch(e){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"POST":case"PUT":return e;default:return t}},Nk=t=>{if(!Sk.test(t))return new TypeError(`'${t}' is not a valid HTTP method.`);let e=t.toUpperCase();if(e==="CONNECT"||e==="TRACK"||e==="TRACE"&&t!=="TRACE")return new TypeError(`'${t}' HTTP method is unsupported.`)},gh=(t,e,r)=>{if(t[kn])return Oc();let n=t.method;if(n==="GET"||n==="HEAD")return t[Ei]()[e]();let i=Nk(n);if(i)return Promise.reject(i);if(t[Rn]&&n!=="TRACE")return t[Rn][e]();let o=Ik(t);if(o)return o;let s=Rk(t);if(s){let a=Promise.resolve(r(s,t));return t[mi]=void 0,a}return Ok(t).then(a=>{let c=r(a,t);return t[mi]=void 0,c})},Rk=t=>{let e=t[Rs];if("rawBody"in e&&e.rawBody instanceof Buffer)return e.rawBody},i_=(t,e)=>{if(e.errored)return e.errored;let r=t[Nc];return r!==void 0?r instanceof Error?r:new Error(String(r)):new Error("Client connection prematurely closed.")},Ok=t=>{if(t[mi])return Promise.resolve(t[mi]);if(t[_d])return t[_d];let e=t[Rs];if(e.readableDidRead)return Oc();let r=Id(e);if(r!==void 0)return r instanceof Error?Promise.reject(r):(t[mi]=r,Promise.resolve(r));let n=new Promise((i,o)=>{let s=[],a=!1,c=v=>{a||(a=!0,E(),v())},l=v=>{let N=e.errored??v;return!yh(e)||N&&N.code!=="ECONNRESET"?!1:(c(()=>{let S=Id(e,s);S instanceof Error?o(S):S===void 0?o(v??i_(t,e)):(t[mi]=S,i(S))}),!0)},u=v=>{s.push(d_(v,e.readableEncoding))},p=()=>{c(()=>{let v=s.length===1?s[0]:Buffer.concat(s);t[mi]=v,i(v)})},f=v=>{l(v)||c(()=>{o(v)})},m=()=>{if(e.readableEnded){p();return}l()||c(()=>{o(i_(t,e))})},E=()=>{e.off("data",u),e.off("end",p),e.off("error",f),e.off("close",m),t[_d]=void 0};e.on("data",u),e.on("end",p),e.on("error",f),e.on("close",m),queueMicrotask(()=>{a||(e.readableEnded?p():e.errored?f(e.errored):e.destroyed&&m())})});return t[_d]=n,n},tn={get method(){return this[p_]},get url(){return this[Rc]},get headers(){return this[f_]||=l_(this[Rs])},[dh](t){this[Nc]===void 0&&(this[Nc]=t);let e=this[wc];e&&!e.signal.aborted&&e.abort(t)},[uh](){return this[wc]||=new AbortController,this[Nc]!==void 0&&!this[wc].signal.aborted&&this[wc].abort(this[Nc]),this[wc]},[Ei](){let t=this[uh]();if(this[Rn])return this[Rn];let e=this.method;if(this[kn]&&!(e==="GET"||e==="HEAD")){this[mi]=void 0;let r={method:e==="TRACE"?"GET":e,headers:this.headers,signal:t.signal};e!=="TRACE"&&(r.body=new ReadableStream({start(i){i.close()}}),r.duplex="half");let n=new Ns(this[Rc],r);return e==="TRACE"&&Object.defineProperty(n,"method",{get(){return"TRACE"}}),this[Rn]=n}return this[Rn]=Tk(this.method,this[Rc],this.headers,this[Rs],t)},get body(){if(!this[kn])return this[Ei]().body;let t=this[Ei]();return!this[n_]&&t.body&&(this[n_]=t.body.getReader()),t.body},get bodyUsed(){return this[kn]?!0:this[Rn]?this[Rn].bodyUsed:!1}};Object.defineProperty(tn,"signal",{get(){return this[uh]().signal}});["cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","keepalive"].forEach(t=>{Object.defineProperty(tn,t,{get(){return this[Ei]()[t]}})});["clone","formData"].forEach(t=>{Object.defineProperty(tn,t,{value:function(){if(this[kn]){if(t==="clone")throw xd();return Oc()}return this[Ei]()[t]()}})});Object.defineProperty(tn,"text",{value:function(){return gh(this,"text",t=>_k.decode(t))}});Object.defineProperty(tn,"arrayBuffer",{value:function(){return gh(this,"arrayBuffer",t=>xk(t))}});Object.defineProperty(tn,"blob",{value:function(){return gh(this,"blob",(t,e)=>{let r=bk(e),n=r?{headers:{"content-type":r}}:void 0;return new Response(t,n).blob()})}});Object.defineProperty(tn,"json",{value:function(){return this[kn]?Oc():this.text().then(JSON.parse)}});Object.defineProperty(tn,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Request (lightweight) ${r({method:this.method,url:this.url,headers:this.headers,nativeRequest:this[Rn]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(tn,Ns.prototype);kk=(t,e)=>{let r=Object.create(tn);r[Rs]=t,r[p_]=wk(t.method);let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof hi)throw new Ur("Absolute URL for :path is not allowed in HTTP/2");try{r[Rc]=new URL(n).href}catch(s){throw new Ur("Invalid absolute URL",{cause:s})}return r}let i=(t instanceof hi?t.authority:t.headers.host)||e;if(!i)throw new Ur("Missing host header");let o;if(t instanceof hi){if(o=t.scheme,!(o==="http"||o==="https"))throw new Ur("Unsupported scheme")}else o=t.socket&&t.socket.encrypted?"https":"http";try{r[Rc]=Ek(o,i,n)}catch(s){throw s instanceof Ur?s:new Ur("Invalid URL",{cause:s})}return r},Xi="text/plain; charset=UTF-8",ph=Symbol("responseCache"),ws=Symbol("getResponseCache"),On=Symbol("cache"),bd=global.Response,en=class m_{#e;#t;[ws](){let e=this[On],r=e&&e[2]instanceof Headers?e[2]:void 0;return delete this[On],this[ph]||=new bd(this.#e,r?{status:this.#t?.status,statusText:this.#t?.statusText,headers:r}:this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof bd){let i=r[ph];if(i){this.#t=i,this[ws]();return}this.#t=r instanceof m_?r.#t:r,n=new Headers(r.headers)}else this.#t=r;(e==null||typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[On]=[r?.status||200,e??null,n||r?.headers])}get headers(){let e=this[On];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||(e[1]===null?void 0:{"content-type":Xi}))),e[2]):this[ws]().headers}get status(){return this[On]?.[0]??this[ws]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(en.prototype,t,{get(){return this[ws]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(en.prototype,t,{value:function(){return this[ws]()[t]()}})});Object.defineProperty(en.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Response (lightweight) ${r({status:this.status,headers:this.headers,ok:this.ok,nativeResponse:this[ph]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(en,bd);Object.setPrototypeOf(en.prototype,bd.prototype);Ck=/^https?:\/\/[!#-;=?-[\]_a-z~A-Z]+$/,Dk=t=>t instanceof URL?t.href:Ck.test(t)?t:new URL(t).href,Pk=new Set([301,302,303,307,308]);Object.defineProperty(en,"redirect",{value:function(e,r=302){if(!Pk.has(r))throw new RangeError("Invalid status code");return new en(null,{status:r,headers:{location:Dk(e)}})},writable:!0,configurable:!0});Object.defineProperty(en,"json",{value:function(e,r){let n=JSON.stringify(e);if(n===void 0)throw new TypeError("The data is not JSON serializable");let i=r?.headers,o;return i?(o=new Headers(i),o.has("content-type")||o.set("content-type","application/json")):o={"content-type":"application/json"},new en(n,{status:r?.status??200,statusText:r?.statusText,headers:o})},writable:!0,configurable:!0});fh=(t,e)=>{let r={};if(t instanceof Headers||(t=new Headers(t??void 0)),t.has("set-cookie")){let n=[];for(let[i,o]of t)i==="set-cookie"?n.push(o):r[i]=o;n.length>0&&(r["set-cookie"]=n)}else for(let[n,i]of t)r[n]=i;return e&&(r["content-type"]??=e),r},Sd=Symbol("outgoingEnded"),s_=Symbol("incomingDraining"),Lk=500,Mk=64*1024*1024,E_=t=>{let e=t;if(t.destroyed||e[s_])return;if(e[s_]=!0,t instanceof hi){try{t.stream?.close?.(uk.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(o),t.off("data",s),t.off("end",n),t.off("error",n)},i=()=>{n();let a=t.socket;a&&!a.destroyed&&(typeof a.destroySoon=="function"?a.destroySoon():typeof a.destroy=="function"&&a.destroy())},o=setTimeout(i,Lk);o.unref?.();let s=a=>{r+=a.length,r>Mk&&i()};t.on("data",s),t.on("end",n),t.on("error",n),t.resume()},Kk=(t,e,r,n)=>()=>{e.errored?(t_(e),t[dh](e.errored.toString())):r.writableFinished||(t_(e),t[dh]("Client connection prematurely closed.")),n&&!e.readableEnded&&setTimeout(()=>{e.readableEnded||setTimeout(()=>{E_(e)})})},Hk=t=>{if(!(On in t))return!1;let e=t[On][1];return e===null||typeof e=="string"||e instanceof Uint8Array},Fk=()=>new Response(null,{status:400}),y_=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),wd=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||(e instanceof ck&&(e._contentLength=null),e.writeHead(500,{"Content-Type":"text/plain"})),e.end(`Error: ${r.message}`),e.destroy(r))},mh=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},g_=(t,e,r)=>{let n=t;return n._contentLength===null&&n._hasBody&&n.useChunkedEncodingByDefault&&!n._removedContLen&&e>=200&&e!==204&&e!==304&&!t.hasHeader("content-length")&&!t.hasHeader("transfer-encoding")&&!t.hasHeader("trailer")?(n._contentLength=r,!0):!1},ch=(t,e,r)=>{g_(t,e,r)?t.writeHead(e,{"Content-Type":Xi}):t.writeHead(e,{"Content-Type":Xi,"Content-Length":r})},v_=async(t,e)=>{let[r,n,i]=t[On];if(!i){n===null?(e.writeHead(r),e.end()):typeof n=="string"?(ch(e,r,Buffer.byteLength(n)),e.end(n)):n instanceof Uint8Array?(ch(e,r,n.byteLength),e.end(n)):n instanceof Blob?(ch(e,r,n.size),e.end(new Uint8Array(await n.arrayBuffer()))):(e.writeHead(r,{"Content-Type":Xi}),mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.();return}let o=!1,s=!1,a=!0;if(i instanceof Headers)o=i.has("content-length"),i=fh(i,n===null?void 0:Xi);else if(Array.isArray(i)){let c=new Headers(i);o=c.has("content-length"),i=fh(c,n===null?void 0:Xi)}else{s=!0;for(let c in i){if(c.length===14&&c.toLowerCase()==="content-length"){o=!0;break}(c.length===17&&c.toLowerCase()==="transfer-encoding"||c.length===7&&c.toLowerCase()==="trailer")&&(a=!1)}}if(!o){let c;typeof n=="string"?c=Buffer.byteLength(n):n instanceof Uint8Array?c=n.byteLength:n instanceof Blob&&(c=n.size),c!==void 0&&(!s||!a||!g_(e,r,c))&&(s&&(i={...i}),i["Content-Length"]=c)}e.writeHead(r,i),n==null?e.end():typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.()},A_=t=>typeof t.then=="function",Vk=async(t,e,r={})=>{if(A_(t))if(r.errorHandler)try{t=await t}catch(i){let o=await r.errorHandler(i);if(!o)return;t=o}else t=await t.catch(y_);if(On in t)return v_(t,e);let n=fh(t.headers,t.body===null?void 0:Xi);if(t.body){let i=t.body.getReader(),o=[],s=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let u=await Uk(a).catch(p=>{console.error(p),s=!0});if(!u){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,u.value&&o.push(u.value),u.done){s=!0;break}}s&&!("content-length"in n)&&(n["content-length"]=o.reduce((l,u)=>l+u.length,0))}e.writeHead(t.status,n),o.forEach(c=>{e.write(c)}),s?e.end():(o.length===0&&mh(e),await h_(i,e,a))}else n[zT]||(e.writeHead(t.status,n),e.end());e[Sd]?.()},T_=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ns&&(Object.defineProperty(global,"Request",{value:Ns}),Object.defineProperty(global,"Response",{value:en})),async(n,i)=>{let o,s,a=!1,c=!1,l=()=>{!s||c||(c=!0,i.on("close",Kk(s,n,i,a)))};try{if(s=kk(n,e.hostname),a=r&&!(n.method==="GET"||n.method==="HEAD"),a&&(n[u_]=!0,n instanceof hi&&(i[Sd]=()=>{n.readableEnded||setTimeout(()=>{n.readableEnded||setTimeout(()=>{n.destroy(),i.destroy()})})})),o=t(s,{incoming:n,outgoing:i}),!A_(o)&&Hk(o))return a&&!n.readableEnded&&i.once("finish",()=>{n.readableEnded||E_(n)}),v_(o,i);l()}catch(u){if(o)return wd(u,i);if(e.errorHandler){if(l(),o=await e.errorHandler(s?u:yk(u)),!o)return}else s?o=y_(u):o=Fk()}try{return await Vk(o,i,e)}catch(u){return wd(u,i)}}},Bk=globalThis.CloseEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get wasClean(){return this.#e.wasClean??!1}get code(){return this.#e.code??0}get reason(){return this.#e.reason??""}},jk=globalThis.ErrorEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get message(){return this.#e.message??""}get filename(){return this.#e.filename??""}get lineno(){return this.#e.lineno??0}get colno(){return this.#e.colno??0}get error(){return this.#e.error??null}},Gk=()=>Symbol("connection"),__=Symbol("CONNECTION_SYMBOL_KEY"),I_=Symbol("WAIT_FOR_WEBSOCKET_SYMBOL"),$k=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","sec-websocket-accept","sec-websocket-extensions","sec-websocket-protocol"]),x_=(t,e)=>{e&&e.forEach((r,n)=>{$k.has(n.toLowerCase())||t.push(`${n}: ${r}`)})},a_=(t,e,r)=>{let n=["Connection: close","Content-Length: 0"];x_(n,r),t.end(`HTTP/1.1 ${e.toString()} ${ak[e]??""}\r
|
|
6
6
|
${n.join(`\r
|
|
7
7
|
`)}\r
|
|
8
8
|
\r
|
|
9
|
-
`)},qk=t=>{let e=t.socket.encrypted?"https":"http",r=new URL(t.url??"/",`${e}://${t.headers.host??"localhost"}`),n=new Headers;for(let i in t.headers){let o=t.headers[i];o&&n.append(i,Array.isArray(o)?o[0]:o)}return new Request(r,{headers:n})},Wk=t=>{let{server:e,fetchCallback:r,wss:n}=t,i=new Map;n.on("connection",(a,c)=>{let l=i.get(c);l&&(l.resolve(a),i.delete(c))});let o=a=>{let c=i.get(a);c&&(i.delete(a),c.reject(new Error("WebSocket handshake aborted")))},s=(a,c)=>new Promise((l,u)=>{i.set(a,{resolve:l,reject:u,connectionSymbol:c})});e.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let u={incoming:a,outgoing:void 0,wss:n,[I_]:s},p=400,f;try{let N=await r(qk(a),u);N instanceof Response&&(p=N.status,f=N.headers)}catch{e.listenerCount("upgrade")===1&&a_(c,500);return}let m=i.get(a);if(!m||m.connectionSymbol!==u[__]){o(a),e.listenerCount("upgrade")===1&&a_(c,p,f);return}let E=N=>{x_(N,f)},v=()=>o(a);c.once("close",v),n.on("headers",E);try{n.handleUpgrade(a,c,l,N=>{c.off("close",v),n.emit("connection",N,a)})}finally{n.off("headers",E)}}),e.on("close",()=>{n.close()})},zk=YT(async(t,e,r)=>{if(t.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=t.env,i=n[I_];if(!i||!n.incoming)return new Response(null,{status:500});let o=Gk();return n[__]=o,(async()=>{let s;try{s=await i(n.incoming,o)}catch{return}let a=[],c=(p,f)=>{a.push([p,f])};s.on("message",c);let l={binaryType:"arraybuffer",close(p,f){s.close(p,f)},protocol:s.protocol,raw:s,get readyState(){return s.readyState},send(p,f){s.send(p,{compress:f?.compress})},url:new URL(t.req.url)};try{e?.onOpen?.(new Event("open"),l)}catch(p){(r?.onError??console.error)(p)}let u=(p,f)=>{let m=Array.isArray(p)?p:[p];for(let E of m)try{e?.onMessage?.(new MessageEvent("message",{data:f?E instanceof ArrayBuffer?E:E.buffer.slice(E.byteOffset,E.byteOffset+E.byteLength):typeof E=="string"?E:Buffer.from(E).toString("utf-8")}),l)}catch(v){(r?.onError??console.error)(v)}};s.off("message",c);for(let p of a)u(...p);s.on("message",(p,f)=>{u(p,f)}),s.on("close",(p,f)=>{try{e?.onClose?.(new Bk("close",{code:p,reason:f.toString()}),l)}catch(m){(r?.onError??console.error)(m)}}),s.on("error",p=>{try{e?.onError?.(new jk("error",{error:p}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),b_=t=>{let e=t.fetch,r=T_(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming}),n=(t.createServer||lk)(t.serverOptions||{},r);if(t.websocket&&t.websocket.server){if(t.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");Wk({server:n,fetchCallback:e,wss:t.websocket.server})}return n},Jk=(t,e)=>{let r=b_(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var ro=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),F_=ro.READ|ro.WRITE|ro.DELETE|ro.APPROVE|ro.EXECUTE,rt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},rr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var V_=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function no(t){return V_?Object.freeze(t):t}function T(t,e){if(arguments.length===0)return no({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),no(r)}function d(t,e){let n={ok:!1,errors:no(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),no(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:s!=null,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c};return T(t,{...r,pagination:l})}function _(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function Q(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let o in r){if(o==="message"||o==="field")continue;let s=r[o];(typeof s=="string"||typeof s=="number")&&(n=n.replace(new RegExp(`\\{${o}\\}`,"g"),String(s)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function io(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=_("AUTH_NOT_AUTHENTICATED","Not authenticated"),nr=_("AUTH_MISSING_CREDENTIALS","Missing credentials"),qt=_("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Hr=_("AUTH_TOKEN_EXPIRED","Token expired"),nn=_("AUTH_TOKEN_MALFORMED","Token malformed"),Wt=_("PERM_DENIED","Permission denied"),Od=Q("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),gi=_("VALIDATION_ERROR","Validation failed"),oo=Q("INVALID_INPUT","Invalid input: {reason}"),Os=_("FORBIDDEN","Access forbidden"),kd=_("NOT_FOUND","Resource not found"),Cd=Q("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),ks=Q("ALREADY_EXISTS","{resource} already exists"),Cs=_("CONFLICT","Resource conflict"),vi=_("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),so=_("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:nr,InvalidCredentials:qt,TokenExpired:Hr,TokenMalformed:nn,PermissionDenied:Wt,BoundaryViolation:Od,Forbidden:Os,ValidationError:gi,InvalidInput:oo,NotFound:kd,ResourceNotFound:Cd,AlreadyExists:ks,Conflict:Cs,RateLimitExceeded:vi,InternalError:so};var Ot={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var
|
|
9
|
+
`)},qk=t=>{let e=t.socket.encrypted?"https":"http",r=new URL(t.url??"/",`${e}://${t.headers.host??"localhost"}`),n=new Headers;for(let i in t.headers){let o=t.headers[i];o&&n.append(i,Array.isArray(o)?o[0]:o)}return new Request(r,{headers:n})},Wk=t=>{let{server:e,fetchCallback:r,wss:n}=t,i=new Map;n.on("connection",(a,c)=>{let l=i.get(c);l&&(l.resolve(a),i.delete(c))});let o=a=>{let c=i.get(a);c&&(i.delete(a),c.reject(new Error("WebSocket handshake aborted")))},s=(a,c)=>new Promise((l,u)=>{i.set(a,{resolve:l,reject:u,connectionSymbol:c})});e.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let u={incoming:a,outgoing:void 0,wss:n,[I_]:s},p=400,f;try{let N=await r(qk(a),u);N instanceof Response&&(p=N.status,f=N.headers)}catch{e.listenerCount("upgrade")===1&&a_(c,500);return}let m=i.get(a);if(!m||m.connectionSymbol!==u[__]){o(a),e.listenerCount("upgrade")===1&&a_(c,p,f);return}let E=N=>{x_(N,f)},v=()=>o(a);c.once("close",v),n.on("headers",E);try{n.handleUpgrade(a,c,l,N=>{c.off("close",v),n.emit("connection",N,a)})}finally{n.off("headers",E)}}),e.on("close",()=>{n.close()})},zk=YT(async(t,e,r)=>{if(t.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=t.env,i=n[I_];if(!i||!n.incoming)return new Response(null,{status:500});let o=Gk();return n[__]=o,(async()=>{let s;try{s=await i(n.incoming,o)}catch{return}let a=[],c=(p,f)=>{a.push([p,f])};s.on("message",c);let l={binaryType:"arraybuffer",close(p,f){s.close(p,f)},protocol:s.protocol,raw:s,get readyState(){return s.readyState},send(p,f){s.send(p,{compress:f?.compress})},url:new URL(t.req.url)};try{e?.onOpen?.(new Event("open"),l)}catch(p){(r?.onError??console.error)(p)}let u=(p,f)=>{let m=Array.isArray(p)?p:[p];for(let E of m)try{e?.onMessage?.(new MessageEvent("message",{data:f?E instanceof ArrayBuffer?E:E.buffer.slice(E.byteOffset,E.byteOffset+E.byteLength):typeof E=="string"?E:Buffer.from(E).toString("utf-8")}),l)}catch(v){(r?.onError??console.error)(v)}};s.off("message",c);for(let p of a)u(...p);s.on("message",(p,f)=>{u(p,f)}),s.on("close",(p,f)=>{try{e?.onClose?.(new Bk("close",{code:p,reason:f.toString()}),l)}catch(m){(r?.onError??console.error)(m)}}),s.on("error",p=>{try{e?.onError?.(new jk("error",{error:p}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),b_=t=>{let e=t.fetch,r=T_(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming}),n=(t.createServer||lk)(t.serverOptions||{},r);if(t.websocket&&t.websocket.server){if(t.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");Wk({server:n,fetchCallback:e,wss:t.websocket.server})}return n},Jk=(t,e)=>{let r=b_(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var ro=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),F_=ro.READ|ro.WRITE|ro.DELETE|ro.APPROVE|ro.EXECUTE,rt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},rr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var V_=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function no(t){return V_?Object.freeze(t):t}function T(t,e){if(arguments.length===0)return no({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),no(r)}function d(t,e){let n={ok:!1,errors:no(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),no(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:s!=null,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c};return T(t,{...r,pagination:l})}function _(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function Q(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let o in r){if(o==="message"||o==="field")continue;let s=r[o];(typeof s=="string"||typeof s=="number")&&(n=n.replace(new RegExp(`\\{${o}\\}`,"g"),String(s)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function io(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=_("AUTH_NOT_AUTHENTICATED","Not authenticated"),nr=_("AUTH_MISSING_CREDENTIALS","Missing credentials"),qt=_("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Hr=_("AUTH_TOKEN_EXPIRED","Token expired"),nn=_("AUTH_TOKEN_MALFORMED","Token malformed"),Wt=_("PERM_DENIED","Permission denied"),Od=Q("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),gi=_("VALIDATION_ERROR","Validation failed"),oo=Q("INVALID_INPUT","Invalid input: {reason}"),Os=_("FORBIDDEN","Access forbidden"),kd=_("NOT_FOUND","Resource not found"),Cd=Q("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),ks=Q("ALREADY_EXISTS","{resource} already exists"),Cs=_("CONFLICT","Resource conflict"),vi=_("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),so=_("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:nr,InvalidCredentials:qt,TokenExpired:Hr,TokenMalformed:nn,PermissionDenied:Wt,BoundaryViolation:Od,Forbidden:Os,ValidationError:gi,InvalidInput:oo,NotFound:kd,ResourceNotFound:Cd,AlreadyExists:ks,Conflict:Cs,RateLimitExceeded:vi,InternalError:so};var Ot={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var Dc=class{getMask(e,r){return Ih(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return d(Wt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return T();let i=this.getMask(e,r.resource),o=this.checkCapability(i,r.action);return o.ok?this.checkBoundary(e,r.boundary,n):o}checkCapability(e,r){return(e&r)!==r?d(Wt()):T()}checkBoundary(e,r,n){if(r===rt.GLOBAL)return T();if(!n)return d(Wt({message:"Resource context required for boundary check"}));let i=n;switch(r){case rt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return d(Wt({message:"Tenant boundary violation"}));break;case rt.OWNER:case rt.SELF:if(i.ownerId!==e.id)return d(Wt({message:"Owner boundary violation"}));break;default:return d(Wt({message:`Unknown boundary type: ${r}`}))}return T()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(o=>(i&o)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(o=>(i&o)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let m=r.requireAllRoles?"ALL":"ANY",E=e.roles??[],v=r.requireAllRoles?r.roles.every(N=>E.includes(N)):r.roles.some(N=>E.includes(N));if(i.push(`Roles (${m}): ${r.roles.join(", ")} \u2014 user has: [${E.join(", ")}]`),!v)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
|
|
10
10
|
`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let m=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),m)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
|
|
11
11
|
`);i.push("Owner bypass: not owner, continuing to perm check")}let o=this.describeBits(r.action);i.push(`Required: ${o} (${r.action})`);let s=e.perms,a=s?.[r.resource],c=s?.["*"],l=a??c??0,u=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${u})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
|
|
12
12
|
`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
|
|
13
13
|
`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(` User tenantId: ${e.tenantId||"undefined"}`),i.push(` Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(` User id: ${e.id}`),i.push(` Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
|
|
14
14
|
`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
|
|
15
|
-
`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function Ai(){return new Pc}function Ih(t,e){return t?.[e]??t?.["*"]??0}var B_="AUTH_INVALID_CREDENTIALS",Dc=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[rr.JWT,rr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return d($t({message:"No auth methods configured"}));for(let i of n){let o=this.methods.get(i);if(!o)continue;let s=await o.authenticate(r);if(s.ok)return T({user:s.data,method:i});if(!s.errors||s.errors.length===0)continue;let a=s.errors[0];if(a?.code===B_)return d(a)}return d($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Ti(t,e={}){return new Dc(t,e)}var Ps={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function Cn(t,e){return{name:rr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return d(nr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return d(nn({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return d(nr({message:"Bearer token is empty"}));let o=await e(i,t);if(!o.ok){let a=o.errors[0];return a?.code===Ps.TOKEN_EXPIRED?d(Hr()):a?.code===Ps.TOKEN_MALFORMED?d(nn()):d(qt())}let s=o.data;return s.exp&&s.exp<Date.now()/1e3?d(Hr()):T({id:s.sub,perms:s.perms,tenantId:s.tid,tenantType:s.tty,roles:s.roles??[]})}}}function Uc(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function Pn(t){return{name:rr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return d(nr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?T({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):d(qt({message:"Invalid API key"}))}}}ra();function Sl(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var SI="x-gateway-auth";function Ro(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??SI;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let o=Sl(e);n=Vt({kty:"OKP",crv:"Ed25519",x:o},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:rr.GATEWAY_JWT,async authenticate(o){if(e!==void 0){let l=o.headers[r];if(!l)return d(nr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return d(qt({message:`${r} must use Bearer scheme`}));let u=l.slice(7);if(!u)return d(nr({message:"Gateway JWT is empty"}));let p;try{let f=await i(),{payload:m}=await Bn(u,f,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=m}catch(f){return f.code==="ERR_JWT_EXPIRED"?d(Hr({message:"Gateway JWT expired"})):d(qt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let f=typeof p.jti=="string"?p.jti:void 0;if(!f)return d(qt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(f))return d(qt({message:"Gateway JWT jti already used (replay)"}))}}let s=Uc(o.headers);if(s===null)return o.headers.authorization??o.headers.Authorization?d(nn({message:"Authorization header must use Bearer scheme"})):d(nr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(s,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Ps.TOKEN_EXPIRED?d(Hr()):l?.code===Ps.TOKEN_MALFORMED?d(nn()):d(qt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?d(Hr()):T({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var bM=globalThis.performance;ra();var jI="TOKEN_EXPIRED",WE="TOKEN_MALFORMED";function GI(t){return"secret"in t}function $I(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function qI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=Sl(t);return Vt({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function zE(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function WI(t){try{let e=atob(t);return zE(e)}catch{return null}}async function zI(t){if(GI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=zE(e);if(n)return Vt(n,r);let i=WI(e);return i?Vt(i,r):r==="EdDSA"&&$I(e)?qI(e):bl(e,r)}function JI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function Ar(t){let e=null;return async(r,n)=>{try{e||(e=zI(t));let i=await e,{payload:o}=await Bn(r,i,JI(t));return T(o)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?d({code:jI,message:"Token has expired"}):d({code:WE,message:i.message}):d({code:WE,message:"JWT verification failed"})}}}function gp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Cn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as YI}from"crypto";async function vp(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??YI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function dn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:io(t)}:{status:e?.error??400,body:io(t)}}var Oo=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function ko(t,e){let r=e?.name;return function(i){if(i.ok)return dn(i);let o=i.errors[0]?.code;if(!o||!(o in t))throw new Oo(o,i,r);let s=t[o];return dn(i,{error:s})}}function Co(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof Oo)return dn(n.result,{error:e});throw n}}}var XI={...Ot},j1=Co(ko(XI),400);var lK=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var QE=Symbol();var ZE=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,r=>r.toLowerCase())}}).formData();var ix=1e4,Ol=t=>"headers"in t,ry=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,i=(Ol(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?ox(t,{all:r,dot:n}):{}};async function ox(t,e){if(!Ol(t)&&t.bodyCache.formData)return ey(await t.bodyCache.formData,e);let r=Ol(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),i=ZE(n,r.get("Content-Type")||"");Ol(t)||(t.bodyCache.formData=i);let o=await i;return o?ey(o,e):{}}function ey(t,e){let r=Object.create(null),n={count:0};return t.forEach((i,o)=>{e.all||o.endsWith("[]")?sx(r,o,i):r[o]=i}),e.dot&&Object.entries(r).forEach(([i,o])=>{i.includes(".")&&(ax(r,i,o,n),delete r[i])}),r}var sx=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},ax=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let i=t,o=e.split(".",34);o.length>33&&ty(),o.forEach((s,a)=>{a===o.length-1?i[s]=r:((!i[s]||typeof i[s]!="object"||Array.isArray(i[s])||i[s]instanceof File)&&(n.count++>=ix&&ty(),i[s]=Object.create(null)),i=i[s])})},ty=()=>{throw new Error("Nesting limit exceeded")};var Tp=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ny=t=>{let{groups:e,path:r}=cx(t),n=Tp(r);return lx(n,e)},cx=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},lx=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},kl={},iy=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return kl[n]||(r[2]?kl[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:kl[n]=[t,r[1],!0]),kl[n]}return null},oy=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},ux=t=>oy(t,decodeURI),_p=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let o=e.indexOf("?",n),s=e.indexOf("#",n),a=o===-1?s===-1?void 0:s:s===-1?o:Math.min(o,s),c=e.slice(r,a);return ux(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var sy=t=>{let e=_p(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},$n=(t,e,...r)=>(r.length&&(e=$n(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Cl=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(i.charCodeAt(i.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let o=i.slice(0,-1);n+="/"+o,r.push(n)}else n+="/"+i}),r.filter((i,o,s)=>s.indexOf(i)===o)},Do=t=>t.indexOf("%")!==-1?oy(t,dx):t,Ap=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Do(t)),ay=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let i;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let a=t.indexOf("?",8);if(a===-1)return;for(t.startsWith(e,a+1)||(a=t.indexOf(`&${e}`,a+1));a!==-1;){let c=t.charCodeAt(a+e.length+1);if(c===61){let l=a+e.length+2,u=t.indexOf("&",l);return Ap(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";a=t.indexOf(`&${e}`,a+1)}if(i=/[%+]/.test(t),!i)return}let o=Object.create(null);i??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let a=t.indexOf("&",s+1),c=t.indexOf("=",s);c>a&&a!==-1&&(c=-1);let l=t.slice(s+1,c===-1?a===-1?void 0:a:c);if(i&&(l=Ap(l)),s=a,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,a===-1?void 0:a),i&&(u=Ap(u))),r?(o[l]&&Array.isArray(o[l])||(o[l]=[]),o[l].push(u)):o[l]??=u}return e?o[e]:o},cy=ay,ly=(t,e)=>ay(t,e,!0),dx=decodeURIComponent;var uy=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r}param(t){return t?this.#r(t):this.#o()}#r(t){let e=this.#t[0][this.routeIndex]?.[1][t],r=this.#i(e);return r&&Do(r)}#o(){let t={},e=Object.keys(this.#t[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#i(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Do(n))}return t}#i(t){return this.#t[1]?this.#t[1][t]:t}query(t){return cy(this.url,t)}queries(t){return ly(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return ry(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let i in e)return e[i].then(o=>{i==="json"&&(o=JSON.stringify(o));let s=i==="formData"?void 0:r.headers.get("content-type");return new Response(o,{headers:s?{"Content-Type":s}:void 0})[t]()});return e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){(this.#e??={})[t]=e}valid(t){return this.#e?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[QE](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var dy={Stringify:1,BeforeStream:2,Stream:3},px=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var Ip=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let o=t.callbacks;if(!o?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let s=Promise.all(o.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Ip(c,e,!1,n,i))).then(()=>i[0]));return r?px(await s,o):s};var fx="text/plain; charset=UTF-8",xp=(t,e)=>({"Content-Type":t,...e}),ia=(t,e)=>new Response(t,e),bp=class{#e;#t;env={};#r;finalized=!1;error;#o;#i;#n;#c;#s;#a;#u;#d;#p;constructor(t,e){this.#e=t,e&&(this.#i=e.executionCtx,this.env=e.env,this.#a=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new uy(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#i&&"respondWith"in this.#i)return this.#i;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#i)return this.#i;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=ia(null,{headers:this.#u??=new Headers})}set res(t){if(this.#n&&t){t=ia(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#s??=e=>this.html(e),this.#s(...t));setLayout=t=>this.#c=t;getLayout=()=>this.#c;setRenderer=t=>{this.#s=t};header=(t,e,r)=>{this.finalized&&(this.#n=ia(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#u??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#o=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#l(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#u;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[o,s]of new Headers(e.headers))o==="set-cookie"?n.append(o,s):n.set(o,s)}if(r){if(!n){let o=0;for(let s in r)if(++o>1||typeof r[s]!="string"){n=new Headers;break}}if(n)for(let o in r){let s=r[o];if(typeof s=="string")n.set(o,s);else{n.delete(o);for(let a of s)n.append(o,a)}}}let i=typeof e=="number"?e:e?.status??this.#o;return ia(t,{status:i,headers:n??r})}newResponse=(...t)=>this.#l(...t);body=(t,e,r)=>this.#l(t,e,r);text=(t,e,r)=>!this.#u&&!this.#o&&!e&&!r&&!this.finalized?new Response(t):this.#l(t,e,xp(fx,r));json=(t,e,r)=>this.#l(JSON.stringify(t),e,xp("application/json",r));html=(t,e,r)=>{let n=i=>this.#l(i,e,xp("text/html; charset=UTF-8",r));return typeof t=="object"?Ip(t,dy.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#a??=()=>ia(),this.#a(this))};var Sp=(t,e,r)=>(n,i)=>{let o=-1;return s(0);async function s(a){if(a<=o)throw new Error("next() called multiple times");o=a;let c,l=!1,u;if(t[a]?(u=t[a][0][0],n.req.routeIndex=a):u=a===t.length&&i||void 0,u)try{c=await u(n,()=>s(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var py=["get","post","put","delete","options","patch","query"],Pl="Can not add a route since the matcher is already built.",Dl=class extends Error{};var fy="__COMPOSED_HANDLER";var mx=t=>t.text("404 Not Found",404),my=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},hy=class Ey{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...py,"all"].forEach(i=>{this[i]=(o,...s)=>{let a=i.toUpperCase();return typeof o=="string"?this.#e=o:this.#o(a,this.#e,o),s.forEach(c=>{this.#o(a,this.#e,c)}),this}}),this.on=(i,o,...s)=>{for(let a of[o].flat()){this.#e=a;for(let c of[i].flat()){let l=c.toUpperCase();for(let u of s)this.#o(l,this.#e,u)}}return this},this.use=(i,...o)=>(typeof i=="string"?this.#e=i:(this.#e="*",o.unshift(i)),o.forEach(s=>{this.#o("ALL",this.#e,s)}),this);let{strict:r,...n}=e;Object.assign(this,n),this.getPath=r??!0?e.getPath??_p:sy}#t(){let e=new Ey({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=mx;errorHandler=my;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let o;r.errorHandler===my?o=i.handler:(o=async(s,a)=>(await Sp([],r.errorHandler)(s,()=>i.handler(s,a))).res,o[fy]=i.handler),n.#o(i.method,i.path,o,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=$n(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,o;n&&(typeof n=="function"?o=n:(o=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let s=o?c=>{let l=o(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=$n(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(i(c.req.raw),...s(c));if(u)return u;await l()};return this.#o("ALL",$n(e,"*"),a),this}#o(e,r,n,i){r=$n(this._basePath,r);let o={basePath:i!==void 0?$n(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,o]),this.routes.push(o)}#i(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let o=this.getPath(e,{env:n}),s=this.router.match(i,o),a=new bp(e,{path:o,matchResult:s,env:n,executionCtx:r,notFoundHandler:this.#r});if(s[0].length===1){let l;try{l=s[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#i(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#i(u,a)):l??this.#r(a)}let c=Sp(s[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#i(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${$n("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var ut=()=>Object.create(null);var Ul=[];function wp(t,e){let r=this.buildAllMatchers(),n=((i,o)=>{let s=r[i]||r.ALL,a=s[2][o];if(a)return a;let c=o.match(s[0]);if(!c)return[[],Ul];let l=c.indexOf("",1);return[s[1][l],c]});return this.match=n,n(t,e)}var Rp="[^/]+";var Op="(?:|/.*)",qn=Symbol(),yy=new Set(".\\+*[^]$()");function hx(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===".*"||t==="(?:|/.*)"?e==="(?:|/.*)"?-1:1:e===".*"||e==="(?:|/.*)"?-1:t==="[^/]+"?1:e==="[^/]+"?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var gy=class Np{#e;#t;#r=ut();insert(e,r,n,i,o){let s=this;for(let a=0,c=e.length;a<c;a++){let l=e[a],u=l.length===1?l==="*"?a===c-1?["","",".*"]:["","",Rp]:null:l==="/*"?["","",Op]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(u){let f=u[1],m=u[2]||"[^/]+";if(f&&u[2]&&(m===".*"||(m=m.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(m))||m.length===1&&yy.has(m)))throw qn;if(p=s.#r[m],!p){if(m!==".*"&&m!=="(?:|/.*)"){for(let E in s.#r)if((m.length>1||E.length>1)&&E!==".*"&&E!=="(?:|/.*)")throw qn}p=s.#r[m]=new Np}f!==""&&(p.#t??=i.varIndex++,n.push([f,p.#t]))}else if(p=s.#r[l],!p){for(let f in s.#r)if(f.length>1&&f!==".*"&&f!=="(?:|/.*)")throw qn;p=s.#r[l]=new Np}s=p}if(s.#e!==void 0)throw qn;s.#e=o?-1:r}buildRegExpStr(){let e=Object.keys(this.#r).sort(hx).map(r=>{let n=this.#r[r],i=n.buildRegExpStr();return i===""?"":(typeof n.#t=="number"?`(${r})@${n.#t}`:yy.has(r)?`\\${r}`:r)+i}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&e.unshift(`#${this.#e}`),e.length===0?"":e.length===1?e[0]:"(?:"+e.join("|")+")"}};var kp=class{#e={varIndex:0};#t=new gy;#r=0;paths=ut();insert(t,e){if(e){this.#t.insert(t.split(""),0,[],this.#e,!0);return}let r=[],n=[],i=t;for(let s=0;;){let a=!1;if(i=i.replace(/\{[^}]+\}/g,c=>{let l=`@\\${s}`;return n[s]=[l,c],s++,a=!0,l}),!a)break}let o=i.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let s=n.length-1;s>=0;s--){let[a]=n[s];for(let c=o.length-1;c>=0;c--)if(o[c].indexOf(a)!==-1){o[c]=o[c].replace(a,n[s][1]);break}}this.#t.insert(o,this.#r,r,this.#e,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,o,s)=>o!==void 0?(r[++e]=Number(o),"$()"):(s!==void 0&&(n[Number(s)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var vy=ut();function Ay(t){return vy[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?Op:e==="*"?".*":`/:${Rp}`)}$`)}function Ll(t,e){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Ay(r).test(e))return[...t[r]]}var Ml=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={ALL:ut()},this.#t={ALL:ut()},this.#r={ALL:new kp}}#o(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===qn?new Dl(e):r}}add(t,e,r){let n=this.#e,i=this.#t;if(!n)throw new Error(Pl);if(!n[t]){this.#r[t]=new kp;for(let a of[n,i]){a[t]=ut();for(let c in a.ALL)a[t][c]=[...a.ALL[c]],this.#o(t,c)}}e==="/*"&&(e="*");let o=t==="ALL"?Object.keys(n):[t];if(/\*$/.test(e)){let a=Ay(e);for(let c of o)n[c][e]||(this.#o(c,e),n[c][e]=Ll(n[c],e)||Ll(n.ALL,e)||[]);for(let c of[n,i])for(let l of o)for(let u in c[l])a.test(u)&&c[l][u].push([r,e]);return}let s=Cl(e)||[e];for(let a of s)for(let c of o)i[c][a]||(this.#o(c,a),i[c][a]=Ll(n[c],a)||Ll(n.ALL,a)||[]),i[c][a].push([r,a])}match=wp;buildAllMatchers(){let t=ut();for(let e of Object.keys(this.#t))t[e]=this.#i(e);return this.#e=this.#t=this.#r=void 0,vy=ut(),t}#i(t){let e=this.#e[t],r=this.#t[t],n=this.#r[t],i=ut(),o=[],[s,a,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let p=l[u],f=n.paths[u];if(!f){i[u]=[p.map(([m])=>[m,ut()]),Ul];continue}o[f[0]]=p.map(([m,E])=>[m,n.paths[E][1].reduceRight((v,[N],S)=>(v[N]=c[f[1][S][1]],v),ut())])}return[s,a.map(l=>o[l]),i]}};var Ty=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Pl);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,o=0,s;for(;o<i;o++){let a=r[o];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);s=a.match(t,e)}catch(c){if(c instanceof Dl)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(o===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,s}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var Cp=ut(),Ex=0,_y=class Iy{#e=[];#t=ut();#r=[];#o;#i=Cp;insert(e,r,n){let i=this,o=ny(r),s=new Set,a=0;for(let c of o){let l=o[++a],u=iy(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),p=Array.isArray(u),f=p?u[0]:u||c,m=i.#t[f]||=new Iy;u&&!m.#o&&(m.#o=u,i.#r.push(m)),i=m,p&&s.add(u[1])}i.#e.push({[e]:{handler:n,possibleKeys:[...s],score:++Ex}})}#n(e,r,n,i,o){for(let s=0,a=r.#e.length;s<a;s++){let c=r.#e[s],l=c[n]||c.ALL;if(l){l.params=ut(),e.push(l);for(let u=0,p=l.possibleKeys.length;u<p;u++){let f=l.possibleKeys[u];l.params[f]=o?.[f]&&!u?o[f]:i[f]??o?.[f]}}}}search(e,r){let n=[];this.#i=Cp;let i=[this],o=Tp(r),s=[],a=o.length,c=null;for(let l=0;l<a;l++){let u=o[l],p=l===a-1,f=[];for(let E=0,v=i.length;E<v;E++){let N=i[E],S=N.#t[u];S&&(S.#i=N.#i,p?(S.#t["*"]&&this.#n(n,S.#t["*"],e,N.#i),this.#n(n,S,e,N.#i)):f.push(S));for(let R of N.#r){let M=R.#o,K=N.#i===Cp?{}:{...N.#i};if(typeof M=="string"){(M==="*"||u.startsWith(M.slice(0,-1)))&&(this.#n(n,R,e,N.#i),M==="*"&&(R.#i=K,f.push(R)));continue}let[,B,V]=M;if(!(!u&&V===!0)){if(V!==!0){if(!c){c=[];let x=r[0]==="/"?1:0;for(let b=0;b<a;b++)c[b]=x,x+=o[b].length+1}let $=r.slice(c[l]),A=V.exec($);if(A){K[B]=A[0],this.#n(n,R,e,N.#i,K),A[0].length===$.length&&R.#t["*"]&&this.#n(n,R.#t["*"],e,N.#i,K);for(let x in R.#t){R.#i=K;let b=A[0].match(/\//g)?.length??0;(s[b]||=[]).push(R);break}continue}}(V===!0||V.test(u))&&(K[B]=u,p?(this.#n(n,R,e,K,N.#i),R.#t["*"]&&this.#n(n,R.#t["*"],e,K,N.#i)):(R.#i=K,f.push(R)))}}}let m=s.shift();i=m?f.concat(m):f}return n[1]&&n.sort((l,u)=>l.score-u.score),[n.map(({handler:l,params:u})=>[l,u])]}};var Pp=class{name="TrieRouter";#e=new _y;add(t,e,r){for(let n of Cl(e)||[e])this.#e.insert(t,n,r)}match(t,e){return this.#e.search(t,e)}};var Gr=class extends hy{constructor(t={}){super(t),this.router=t.router??new Ty({routers:[new Ml,new Pp]})}};function Dp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Cn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}function or(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var Up={...Ot},xy=Co(ko(Up),400);function Lp(t){Up={...Ot,...t},xy=Co(ko(Up),400)}function by(){return xy}function Ge(t,e,r){let{traceId:n,successStatus:i,adapter:o=by()}=r??{},s=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:s}},l=o(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let u=e.ok?T(e.data,a):{...e,meta:a},p=io(u);return t.json(p,l)}async function yx(t){let e={};t.req.raw.headers.forEach((s,a)=>{e[a]=s});let r={},n=t.req.query();for(let[s,a]of Object.entries(n))r[s]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function oa(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,o)=>{let s=or(i);try{let a=await yx(i),c=await e.resolve(n,a);if(!c.ok){if(r){await o();return}return Ge(i,d($t()),{traceId:s})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await o()}catch{if(r){await o();return}return Ge(i,d($t()),{traceId:s})}}}function Mp(t){return async(e,r)=>{let n=or(e),i=e.get("authResult");if(!i)return Ge(e,d($t()),{traceId:n});let{user:o}=i,s;if(t.loadResource){let l=e.req.param(),u=await t.loadResource(l,o);if(u===null)return Ge(e,d(Wt({message:"Resource not found for boundary check"})),{traceId:n});s=u}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(o,a,s);if(!c.ok)return Ge(e,c,{traceId:n});await r()}}function sa(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?d(r.issues.map(n=>{let i=n.path?.map(o=>typeof o=="object"?o.key:o).join(".")??"";return gi({message:i?`${i}: ${n.message}`:n.message})})):T(r.value)}function aa(t){return async(e,r)=>{let n=or(e);try{let i={};if(t.body){let o;try{o=await e.req.json()}catch{return Ge(e,d(oo({reason:"Request body is not valid JSON"})),{traceId:n})}let s=sa(t.body,o);if(!s.ok)return Ge(e,s,{traceId:n});i.body=s.data}if(t.params){let o=sa(t.params,e.req.param());if(!o.ok)return Ge(e,o,{traceId:n});i.params=o.data}if(t.query){let o=sa(t.query,e.req.query());if(!o.ok)return Ge(e,o,{traceId:n});i.query=o.data}if(t.headers){let o={};e.req.raw.headers.forEach((a,c)=>{o[c]=a});let s=sa(t.headers,o);if(!s.ok)return Ge(e,s,{traceId:n});i.headers=s.data}e.set("validatedData",i),await r()}catch(i){let o={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return Ge(e,d(gi(),o),{traceId:n})}}}function ca(t){return t.get("validatedData")?.body}function la(t){return t.get("validatedData")?.params}function ua(t){return t.get("validatedData")?.query}var t2=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function gx(t,e){let r=[...t,e];return async(n,i)=>{let o,s=async a=>{if(o||a>=r.length){!o&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await s(a+1)});l instanceof Response&&(o=l)};return await s(0),o}}function X(t,e){let r=[];if(e.auth!==!1){let o=Array.isArray(e.auth)?e.auth:void 0;r.push(oa({engine:t.auth,methods:o}))}e.permission&&r.push(Mp({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(o,s)=>{let a={body:void 0,query:void 0,params:o,user:s};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(aa({body:e.input.body,query:e.input.query,params:e.input.params}));let i=gx(r,async o=>{let s=or(o);try{let a=o.get("authResult"),c={body:ca(o),query:ua(o),params:la(o),user:a?.user,tenantContext:o.get("tenantContext"),traceId:s},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},u=await e.handler(l),p=e.successStatus??200;return Ge(o,u,{traceId:s,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:s,route:`${e.method} ${e.path}`,error:{message:c}})),Ge(o,d(so()),{traceId:s})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function Kp(t,e){let r=new Gr;for(let n of e){let{method:i,path:o}=n.routeMeta,s=o==="/"?t:`${t}${o}`;switch(i){case"GET":r.get(s,n);break;case"POST":r.post(s,n);break;case"PUT":r.put(s,n);break;case"PATCH":r.patch(s,n);break;case"DELETE":r.delete(s,n);break}}return r}var Sy={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var Kl,vx={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function Ax(t){return!t&&!Kl?vx:{lang:t?.lang??Kl?.lang,message:t?.message,abortEarly:t?.abortEarly??Kl?.abortEarly,abortPipeEarly:t?.abortPipeEarly??Kl?.abortPipeEarly}}var Tx;function _x(t){return Tx?.get(t)}var Ix;function xx(t){return Ix?.get(t)}var bx;function Sx(t,e){return bx?.get(t)?.get(e)}function Ri(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function dt(t,e,r,n,i){let o=i&&"input"in i?i.input:r.value,s=i?.expected??t.expects??null,a=i?.received??Ri(o),c={kind:t.kind,type:t.type,input:o,expected:s,received:a,message:`Invalid ${e}: ${s?`Expected ${s} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",u=i?.message??t.message??Sx(t.reference,c.lang)??(l?xx(c.lang):null)??n.message??_x(c.lang);u!==void 0&&(c.message=typeof u=="function"?u(c):u),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}function wx(t,e){return t===e||Number.isNaN(t)&&Number.isNaN(e)}function Nx(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function Ny(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}function Jt(t){return t["~standard"]={version:1,vendor:"valibot",validate:e=>t["~run"]({value:e},Ax())},t}var Rx=/^[\w+-]+(?:\.[\w+-]+)*@[\da-zA-Z]+(?:[.-][\da-zA-Z]+)*\.[a-zA-Z]{2,}$/u;function Hl(t,e){return{kind:"validation",type:"check",reference:Hl,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&dt(this,"input",r,n),r}}}function pn(t){return{kind:"validation",type:"email",reference:pn,expects:null,async:!1,requirement:Rx,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&dt(this,"email",e,r),e}}}function Wn(t){return{kind:"validation",type:"integer",reference:Wn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&dt(this,"integer",e,r),e}}}function Pt(t,e){return{kind:"validation",type:"max_length",reference:Pt,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Uo(t,e){return{kind:"validation",type:"max_value",reference:Uo,async:!1,expects:`<=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Hp(t,e){return{kind:"validation",type:"min_length",reference:Hp,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Lo(t,e){return{kind:"validation",type:"min_value",reference:Lo,async:!1,expects:`>=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Mo(t){return{kind:"transformation",type:"transform",reference:Mo,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function Ox(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function Fp(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return Jt({kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let o=0;o<i.length;o++){let s=i[o],a=this.item["~run"]({value:s},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:o,value:s};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else dt(this,"type",r,n);return r}})}function yt(t){return Jt({kind:"schema",type:"boolean",reference:yt,expects:"boolean",async:!1,message:t,"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:dt(this,"type",e,r),e}})}function Ko(t,e){return Jt({kind:"schema",type:"literal",reference:Ko,expects:Ri(t),async:!1,literal:t,message:e,"~run"(r,n){return wx(r.value,this.literal)?r.typed=!0:dt(this,"type",r,n),r}})}function Oi(t,e){return Jt({kind:"schema",type:"nullable",reference:Oi,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function qe(t){return Jt({kind:"schema",type:"number",reference:qe,expects:"number",async:!1,message:t,"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:dt(this,"type",e,r),e}})}function F(t,e){return Jt({kind:"schema",type:"object",reference:F,expects:"Object",async:!1,entries:t,message:e,"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let o in this.entries){let s=this.entries[o];if(o in i||(s.type==="exact_optional"||s.type==="optional"||s.type==="nullish")&&s.default!==void 0){let a=o in i?i[o]:Fp(s),c=s["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:o,value:a};for(let u of c.issues)u.path?u.path.unshift(l):u.path=[l],r.issues?.push(u);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[o]=c.value}else if(s.fallback!==void 0)r.value[o]=Ox(s);else if(s.type!=="exact_optional"&&s.type!=="optional"&&s.type!=="nullish"&&(dt(this,"key",r,n,{input:void 0,expected:`"${o}"`,path:[{type:"object",origin:"key",input:i,key:o,value:i[o]}]}),n.abortEarly))break}}else dt(this,"type",r,n);return r}})}function w(t,e){return Jt({kind:"schema",type:"optional",reference:w,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function Yt(t,e){return Jt({kind:"schema",type:"picklist",reference:Yt,expects:Ny(t.map(Ri),"|"),async:!1,options:t,message:e,"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:dt(this,"type",r,n),r}})}function Ee(t,e,r){return Jt({kind:"schema",type:"record",reference:Ee,expects:"Object",async:!1,key:t,value:e,message:r,"~run"(n,i){let o=n.value;if(o&&typeof o=="object"){n.typed=!0,n.value={};for(let s in o)if(Nx(o,s)){let a=o[s],c=this.key["~run"]({value:s},i);if(c.issues){let u={type:"object",origin:"key",input:o,key:s,value:a};for(let p of c.issues)p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let u={type:"object",origin:"value",input:o,key:s,value:a};for(let p of l.issues)p.path?p.path.unshift(u):p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else dt(this,"type",n,i);return n}})}function y(t){return Jt({kind:"schema",type:"string",reference:y,expects:"string",async:!1,message:t,"~run"(e,r){return typeof e.value=="string"?e.typed=!0:dt(this,"type",e,r),e}})}function wy(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function da(t,e){return Jt({kind:"schema",type:"union",reference:da,expects:Ny(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,"~run"(r,n){let i,o,s;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)o?o.push(c):o=[c];else{i=c;break}else s?s.push(c):s=[c]}if(i)return i;if(o){if(o.length===1)return o[0];dt(this,"type",r,n,{issues:wy(o)}),r.typed=!0}else{if(s?.length===1)return s[0];dt(this,"type",r,n,{issues:wy(s)})}return r}})}function ge(){return Jt({kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,"~run"(t){return t.typed=!0,t}})}function Ue(...t){return Jt({...t[0],pipe:t,"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}})}var Vp=F({maskedRecipient:w(y()),expiresAt:y()}),Bp=F({userId:y(),verification:w(F({channel:y(),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y()}))});var Dt=F({message:w(y())}),Ry=F({accessToken:y(),refreshToken:w(y()),expiresAt:qe()}),Oy=F({requiresChallenge:Ko(!0),challenge:F({type:w(y()),phase:w(y()),expiresAt:w(da([y(),qe()])),data:Ee(y(),ge())})}),ky=F({requiresMfa:Ko(!0),mfa:F({phase:w(y()),challengeId:y(),methods:Z(y()),method:w(y()),expiresAt:da([y(),qe()]),userId:y()})}),Cy=F({requiresVerification:Ko(!0),verification:F({channel:Ko("email"),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y(),userId:y()})}),ki=da([Oy,ky,Cy,Ry]),pa=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),username:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:y(),updatedAt:y()}),fa=F({challengeId:y(),expiresAt:y()});var Bt=(t=100)=>Ue(y(),Pt(t)),Fl=Ue(y(),Pt(320)),zn=Ue(y(),Pt(4096)),ma=(t=256)=>Ue(y(),Pt(t)),jp=(t=8192)=>Ue(y(),Pt(t)),ha=Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100));var kx={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:w(zn),metadata:w(Ee(Bt(),ge())),country:w(Bt()),city:w(Bt())}),response:ki},Cx={method:"POST",path:"/auth/register",kind:"data",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:zn,displayName:w(ma()),givenName:w(ma()),familyName:w(ma()),avatarUrl:w(jp(2048)),locale:w(Bt()),metadata:w(Ee(Bt(),ge()))}),response:Bp},Px={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:F({challengeId:y(),code:y()}),response:ki},Dx={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:F({challengeId:y(),method:y(),code:y()}),response:ki},Ux={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:F({challengeId:y(),method:y(),userId:y()}),response:Vp},Lx={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},Mx={method:"POST",path:"/auth/logout",kind:"logout",public:!0},Kx={method:"GET",path:"/auth/me",kind:"data",response:pa},Hx={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:F({tenantId:y()})},Ut={authenticate:kx,register:Cx,completeChallenge:Px,completeMfaChallenge:Dx,issueMfaChallenge:Ux,refresh:Lx,logout:Mx,me:Kx,selectTenant:Hx};var Gp=F({method:y(),data:Ee(y(),ge())}),$p=F({method:y(),verified:yt(),data:Ee(y(),ge())}),Py=F({method:y(),verifiedAt:Oi(y()),createdAt:y(),id:w(y()),label:w(y()),lastUsedAt:w(y())}),qp=F({authenticators:Z(Py),total:qe()});var Fx={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:F({method:y(),data:w(Ee(y(),ge()))}),response:Gp},Vx={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:F({method:y(),data:w(Ee(y(),ge())),authenticatorId:w(y())}),response:$p},Bx={method:"GET",path:"/mfa/authenticators",kind:"data",query:F({method:w(y()),verifiedOnly:w(yt())}),response:qp},jx={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:F({method:y(),authenticatorId:w(y()),password:w(y())}),response:F({message:w(y())})},Gx={method:"PATCH",path:"/mfa/settings",kind:"data",body:F({mfaRequired:w(yt()),mfaMethods:w(Z(y())),password:w(y())}),response:F({mfaRequired:w(yt()),mfaMethods:w(Z(y()))})},Tr={setupAuthenticator:Fx,verifyAuthenticator:Vx,listAuthenticators:Bx,removeAuthenticator:jx,updateMfaSettings:Gx};var Wp=F({state:y()}),Dy=F({provider:y(),providerId:w(y()),email:w(y()),linkedAt:w(y())}),zp=Z(Dy);var $x={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:Wp},qx={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:F({provider:Ue(y(),Pt(100)),code:w(Ue(y(),Pt(8192))),credential:w(Ue(y(),Pt(8192))),state:w(Ue(y(),Pt(1024))),tenantId:w(Ue(y(),Pt(100)))}),response:ki},Wx={method:"POST",path:"/oauth/link",kind:"data",body:F({provider:y(),code:w(y())}),response:Dt},zx={method:"POST",path:"/oauth/unlink",kind:"data",body:F({provider:y()}),response:Dt},Jx={method:"GET",path:"/oauth/providers",kind:"data",response:zp},mn={oauthState:$x,oauthCallback:qx,linkProvider:Wx,unlinkProvider:zx,getProviders:Jx};var Yx={method:"PATCH",path:"/password/change",kind:"data",body:F({currentPassword:zn,newPassword:zn}),response:Dt},Xx={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:F({email:Ue(y(),Pt(320),pn())}),response:fa},Qx={method:"POST",path:"/password/reset",kind:"data",public:!0,body:F({challengeId:Bt(),code:Bt(),newPassword:zn}),response:Dt},hn={changePassword:Yx,forgotPassword:Xx,resetPassword:Qx};var Uy=F({id:y(),tokenId:y(),tenantId:w(y()),deviceLabel:w(y()),country:w(y()),city:w(y()),createdAt:y(),expiresAt:y(),lastUsedAt:y(),revokedAt:w(Oi(y())),metadata:w(Ee(y(),ge())),isCurrent:w(yt())}),Jp=Z(Uy);var Ly=F({id:y(),tenantId:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),status:y(),roles:w(Z(y())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),invitedBy:w(ge()),createdAt:y(),updatedAt:y(),expiresAt:y()}),Yp=Z(Ly),Xp=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),My=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Qp=F({members:Z(My)}),Vl=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),jobTitle:w(y()),contactEmail:w(y()),contactPhone:w(y()),bio:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:w(y()),memberUpdatedAt:w(y()),profileUpdatedAt:w(y())}),Zp=F({tenantId:y(),roles:w(Z(y())),authPerms:Z(y())});var ef=F({userId:y(),identityType:y(),identityValue:y(),verifiedAt:y()});var eb={method:"GET",path:"/sessions",kind:"data",query:F({includeRevoked:w(Yt(["true","false"])),limit:w(ha),cursor:w(y())}),response:Jp},tb={method:"DELETE",path:"/sessions",kind:"data",body:F({sessionId:y()}),response:Dt},rb={method:"POST",path:"/sessions/revoke",kind:"data",body:F({refreshToken:y()}),response:Dt},En={listSessions:eb,deleteSession:tb,revokeToken:rb};var nb={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Vl},ib={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Vl},ob={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:Xp},sb={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:F({status:w(y()),limit:w(ha),cursor:w(y())}),response:Yp},ab={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Zp},cb={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Dt},lb={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:F({inviteId:y()}),response:Dt},ub={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:F({limit:w(ha),cursor:w(y())}),response:Qp},db={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),response:Dt},pb={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y()}),response:Dt},tf={getTenantProfile:nb,updateTenantProfile:ib,createInvite:ob,listInvites:sb,acceptInvite:ab,declineInvite:cb,revokeInvite:lb,listMembers:ub,updateMember:db,removeMember:pb};var fb={method:"PATCH",path:"/users/profile",kind:"data",body:F({email:w(Ue(y(),pn())),phone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge()))}),response:pa},Ea={updateProfile:fb};var mb={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:F({challengeId:y(),code:y()}),response:ef},hb={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:F({channel:Yt(["sms","email"]),identityValue:y(),previousChallengeId:w(y())}),response:fa},Ci={verifyCode:mb,resendVerification:hb};var JV={...Ut,...hn,...Ci,...En,...Tr,...mn,...Ea,...tf};var q={VALIDATION_ERROR:_("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:_("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:_("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:_("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:_("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:_("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:_("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:_("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:_("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:_("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:_("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:_("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:_("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:_("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:_("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function Ho(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function Jn(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:o,device:s}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=s?.deviceLabel,u={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...s?.country&&{country:s.country},...s?.city&&{city:s.city},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},p=await e.plugins.database.sessions.create(u);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d(q.DATABASE_ERROR());let f=p.data,m=Ho(n,e.security),E=await e.plugins.token.signAccessToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}}),v=await e.plugins.token.signRefreshToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i}});return T({accessToken:E.token,refreshToken:v.token,expiresAt:E.expiresAt,...n&&{tenantId:n}})}var ya={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};function Ky(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function ga(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?d(ya.USER_NOT_FOUND()):T(Ky(r.data))}var rf={SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:q.DATABASE_ERROR};async function Bl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return T();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(rf.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?T():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(rf.DATABASE_ERROR()):T():T()}var Yn={INVALID_TOKEN:_("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:_("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_SUSPENDED:q.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var yn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(yn||(yn={}));async function jl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return d(Yn.INVALID_TOKEN());if(r.typ!==yn.Refresh)return d(Yn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(q.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return d(Yn.INVALID_TOKEN());let o=Date.now(),s=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&o-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!s&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(q.DATABASE_ERROR()):d(Yn.INVALID_TOKEN());if(a&&!s){let E=Ho(i.tenantId,e.security),v=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),N=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),T({accessToken:v.token,refreshToken:N.token,expiresAt:v.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:o,expiresAt:new Date(o+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return d(q.DATABASE_ERROR());let u=Ho(i.tenantId,e.security);if(l.data===!1){let E=await e.plugins.database.sessions.get(i.id);if(E.ok===!1)return d(q.DATABASE_ERROR());let v=E.data;if(!v||v.revokedAt)return d(Yn.INVALID_TOKEN());let N=await e.plugins.token.signAccessToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType},...v.perms!==void 0&&{perms:v.perms},...v.roles&&{roles:v.roles}}),S=await e.plugins.token.signRefreshToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType}});return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),f=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),m={accessToken:p.token,refreshToken:f.token,expiresAt:p.expiresAt};return T(m)}var bt={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:_("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:Q("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:Q("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:Q("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:_("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:Q("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var Ve={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},_r={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},xe={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var sr={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function nf(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Gl(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let s=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(s)}var Ze={SMS:"sms",EMAIL:"email"},Pi={PHONE:"phone",EMAIL:"email"},Di={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Xn={type:Ze.EMAIL,purpose:xe.EMAIL_VERIFICATION,identityType:Pi.EMAIL,template:Di.EMAIL_CODE};var Qn={type:Ze.SMS,purpose:xe.PHONE_VERIFICATION,identityType:Pi.PHONE,template:Di.SMS_CODE};var Ne={CHANNEL_NOT_CONFIGURED:_("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:_("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:_("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:_("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:_("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:_("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:_("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function gn(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function $r(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return Eb(n)}async function Fo(t,e){let r=await $r(t);return r.length!==e.length?!1:yb(r,e)}function Eb(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function yb(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function gb(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Vo(t,e){let r=gb(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,o=await e.plugins.database.identities.get(r.identityType,i);if(!o.ok||!o.data)return d(Ne.IDENTITY_NOT_FOUND());let s=o.data;if(s.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let a=s.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,u=t.previousChallengeId===void 0&&l===c;if(!l)return d(Ne.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return d(p.errors,p.meta);let f=p.data;if(f&&(f.status!==Ve.PENDING||f.userId!==s.userId||f.purpose!==r.purpose||f.method!==r.type||f.identityType!==r.identityType||f.identityValue!==i))return d(Ne.CHALLENGE_NOT_FOUND());if(!f&&!u)return d(Ne.CHALLENGE_NOT_FOUND());let m=e.security.verificationResendCooldownSeconds*1e3,E=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(f?.createdAt.getTime()??0)+m;if(m>0&&Date.now()<E)return d(Ne.RESEND_COOLDOWN_ACTIVE());let v=gn(6),N=await $r(v),S=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),R=e.plugins.database.challenges.generateChallengeId(),M=await e.plugins.database.challenges.create({id:R,userId:s.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:N,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:S});if(M.ok===!1)return d(M.errors,M.meta);let K=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,B=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:R,purpose:r.purpose,channel:r.type,expiresAt:S,resendAvailableAt:K}});return B.ok===!1?(await e.plugins.database.challenges.remove(R),d(B.errors,B.meta)):(await vb(t.channel,i,v,r.template,R,S,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(R),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),d(Ne.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:s.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:R,previousChallengeId:l}})]),T({challengeId:R,expiresAt:S}))}async function vb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}function Ab(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Bo(t,e){let r=Ab(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return d(Ne.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let o=i.guards.email_verification;if(o?.lockedUntil&&new Date(o.lockedUntil)>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let s=i.pendingVerification,a=s&&s.purpose===r.purpose&&s.channel===r.type&&s.expiresAt>new Date?s.challengeId:null;if(s?.resendAvailableAt&&s.purpose===r.purpose&&s.channel===r.type&&s.resendAvailableAt>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let c=gn(6),l=await $r(c),u=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),f=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:u});if(f.ok===!1)return d(f.errors,f.meta);let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:u,resendAvailableAt:E}});return v.ok===!1?(await e.plugins.database.challenges.remove(p),d(v.errors,v.meta)):(await Tb(t.channel,t.identityValue,c,r.template,p,u,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:s??null}),d(Ne.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),T({challengeId:p,expiresAt:u}))}async function Tb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}var _b=[xe.PHONE_VERIFICATION,xe.EMAIL_VERIFICATION];async function jo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(Ne.CHALLENGE_NOT_FOUND());let n=r.data;if(!_b.includes(n.purpose))return d(Ne.CHALLENGE_NOT_FOUND());if(n.status!==Ve.PENDING)return d(Ne.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return d(Ne.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?d(Ne.TOO_MANY_ATTEMPTS()):d(i.errors,i.meta);if(!n.codeHash)return d(Ne.INVALID_CODE());if(!await Fo(t.code,n.codeHash))return d(Ne.INVALID_CODE());let s=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:s,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),T({userId:n.userId,identityType:a,identityValue:c,verifiedAt:s})}async function Hy(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:o,codeHash:s,challengeId:a,expiresAt:c,...l}=t.nextStepData,u={id:r,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:_r.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(u.tenantId=t.tenantId),t.deviceLabel!==void 0&&(u.deviceLabel=t.deviceLabel),t.country!==void 0&&(u.country=t.country),t.city!==void 0&&(u.city=t.city),i!==void 0&&(u.codeHash=i),(await e.plugins.database.challenges.create(u)).ok===!1?d([q.DATABASE_ERROR()]):T({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:u.phase})}async function $l(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,o=t.userHasMethods.length===1&&t.deliveryMethods.length===0,s=i?t.deliveryMethods[0]:o?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:s?_r.VERIFY_MFA:_r.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),s!==void 0&&(a.method=s),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return d(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...s!==void 0&&{selectedMethod:s}};return T(l)}var it={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"},va={OWNER:"owner"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var of={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},ql={ACCOUNT_DELETED:q.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:_(of.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:_(of.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_(of.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function qr(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return d(ql.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return d(ql.ACCOUNT_SUSPENDED());let o,s,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return d(ql.NO_ACCESS_TO_TENANT());let u=l.data;if(u.status!==it.ACTIVE)return d(ql.SUSPENDED_IN_TENANT());if(s=u.roles,o=u.isOwner?{"*":-1}:u.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return o!==void 0&&(c.perms=o),s!==void 0&&(c.roles=s),a!==void 0&&(c.tenantType=a),T(c)}function Aa(t,e){return e[t]??null}function Fy(t,e){return e[t]??null}async function Vy(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function By(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,o=r.security.maxFailedAttempts||5,s=i>=o,a=null;if(s){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>o){let u=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*u**(i-o),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function jy(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Ta(t,e){let r=t.tid,n=Aa(t.identityType,e.plugins.identity);if(!n)return d(bt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return d(bt.INVALID_IDENTITY_FORMAT());let o=n.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,o);if(s.ok===!1||!s.data)return d(bt.INVALID_CREDENTIALS());let a=s.data;if(!a.loginEnabled)return d(bt.LOGIN_DISABLED());let c=nf(a,t.credentialType);if(c.locked)return d(bt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=Fy(t.credentialType,e.plugins.credential);if(!l)return d(bt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let u=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=u.ok?u.data:null,f=await l.verify({userId:a.userId,identityValue:o,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(f.ok===!1)return await By(a,t.credentialType,e),d(bt.INVALID_CREDENTIALS());let{userId:m,nextStep:E,intents:v}=f.data;v&&v.length>0&&await Vy(v,e);let N;if(t.userAgent&&e.plugins.deviceParser){let O=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),P=O.browser||"Unknown Browser",k=O.os||"Unknown OS";N=`${P} - ${k}`}if(E){let O={userId:m,credentialType:t.credentialType,identityType:t.identityType,identityValue:o,nextStepData:E.data,nextStepType:E.type};t.tid!==void 0&&(O.tenantId=t.tid),N!==void 0&&(O.deviceLabel=N),t.country!==void 0&&(O.country=t.country),t.city!==void 0&&(O.city=t.city);let P=await Hy(O,e);if(P.ok===!1)return d(P.errors,P.meta);if(!P.ok)return d(bt.INTERNAL_ERROR());let{challengeId:k,expiresAt:C,displayData:D,challengeType:L,phase:H}=P.data;return T({requiresChallenge:!0,challenge:{type:L,phase:H,expiresAt:C,data:{challengeId:k,expiresAt:C,...D}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return d(bt.IDENTITY_NOT_VERIFIED());let O=a.pendingVerification;if(!!O&&O.purpose===xe.EMAIL_VERIFICATION&&O.channel==="email"&&O.expiresAt>new Date&&O)return T({requiresVerification:!0,verification:{channel:"email",challengeId:O.challengeId,expiresAt:O.expiresAt,identityType:t.identityType,identityValue:o,userId:m}});let k=await Bo({channel:"email",identityValue:o,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!k.ok){let C=await e.plugins.database.identities.get(t.identityType,o),D=C.ok&&C.data?C.data.pendingVerification:null;return D&&D.purpose===xe.EMAIL_VERIFICATION&&D.channel==="email"&&D.expiresAt>new Date?T({requiresVerification:!0,verification:{channel:"email",challengeId:D.challengeId,expiresAt:D.expiresAt,identityType:t.identityType,identityValue:o,userId:m}}):d(bt.IDENTITY_NOT_VERIFIED())}return T({requiresVerification:!0,verification:{channel:"email",challengeId:k.data.challengeId,expiresAt:k.data.expiresAt,identityType:t.identityType,identityValue:o,userId:m}})}let S=await e.plugins.database.userAuths.get(m);if(S.ok===!1||!S.data)return d(bt.USER_AUTH_NOT_FOUND());let R=S.data,M={userStatus:R.userStatus,userId:m,...r&&{tenantId:r}},K=await qr(M,e);if(K.ok===!1)return d(K.errors,K.meta);if(!K.ok)return d(q.DATABASE_ERROR());let{perms:B,roles:V,tenantType:$}=K.data;if(R.mfaRequired){let O=R.mfaMethods;if(!(!O||O.length===0)){let P=O.filter(k=>e.plugins.mfa?.[k]);if(P.length!==0){let k=P.filter(me=>e.plugins.mfa?.[me]?.requiresServerDelivery),C=P.filter(me=>!e.plugins.mfa?.[me]?.requiresServerDelivery),D={};N!==void 0&&(D.deviceLabel=N),t.country!==void 0&&(D.country=t.country),t.city!==void 0&&(D.city=t.city);let L={userId:m,availableMethods:P,deliveryMethods:k,userHasMethods:C,device:D};t.tid!==void 0&&(L.tenantId=t.tid);let H=await $l(L,e);if(H.ok===!1)return d(H.errors,H.meta);if(!H.ok)return d(bt.INTERNAL_ERROR());let{challengeId:z,expiresAt:Y,phase:pe,selectedMethod:Oe,availableMethods:Fe}=H.data;return T({requiresMfa:!0,mfa:{phase:pe,challengeId:z,methods:Fe,...Oe&&{method:Oe},expiresAt:Y,userId:m}})}}}let A={userId:m,...r&&{tenantId:r},...$&&{tenantType:$},...B!==void 0||V?{permissions:{...V&&{roles:V},...B!==void 0&&{perms:B}}}:{},...N||t.country||t.city?{device:{...N&&{deviceLabel:N},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await Jn(A,e);if(x.ok===!1)return d(x.errors,x.meta);if(!x.ok)return d(q.DATABASE_ERROR());let{accessToken:b,refreshToken:g,expiresAt:I}=x.data;return await Gl(m,e),await jy(a,t.credentialType,e),T({accessToken:b,refreshToken:g,expiresAt:I})}var gt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:_("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};var Ib={CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function Wy(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:o,device:s}=t;if(!r)return T({requiresMfa:!1});if(!n||n.length===0)return T({requiresMfa:!1});let a=n.filter(S=>e.plugins.mfa?.[S]);if(a.length===0)return T({requiresMfa:!1});let c=a.filter(S=>e.plugins.mfa?.[S]?.requiresServerDelivery),l=a.filter(S=>!e.plugins.mfa?.[S]?.requiresServerDelivery),u={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};o!==void 0&&(u.tenantId=o),s!==void 0&&(u.device=s);let p=await $l(u,e);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d([Ib.CHALLENGE_CREATE_FAILED()]);let{challengeId:f,expiresAt:m,phase:E,selectedMethod:v,availableMethods:N}=p.data;return T({requiresMfa:!0,mfa:{phase:E,challengeId:f,methods:N,...v&&{method:v},expiresAt:m,userId:i}})}async function _a(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return d(gt.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Ve.PENDING)return d(gt.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_CREDENTIAL)return d(gt.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(gt.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(gt.CHALLENGE_EXPIRED());let o=n.method;if(!o)return d(gt.INTERNAL_ERROR());let s=e.plugins.credential[o];if(!s)return d(gt.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Ve.EXPIRED}),d(gt.MAX_ATTEMPTS_EXCEEDED())):d(a.errors,a.meta);if((await s.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return d(gt.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return d(gt.USER_AUTH_NOT_FOUND());let u=l.data,p={userStatus:u.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let f=await qr(p,e);if(f.ok===!1)return d(f.errors,f.meta);if(!f.ok)return d(gt.INTERNAL_ERROR());let{perms:m,roles:E,tenantType:v}=f.data,N=n.deviceLabel,S=n.country,R=n.city,M={};N!==void 0&&(M.deviceLabel=N),S!==void 0&&(M.country=S),R!==void 0&&(M.city=R);let K={mfaRequired:u.mfaRequired,...u.mfaMethods&&{mfaMethods:u.mfaMethods},userId:n.userId,device:M},B=await Wy(K,e);if(B.ok===!1)return d(B.errors,B.meta);if(!B.ok)return d(gt.INTERNAL_ERROR());if(B.data.requiresMfa){let I={requiresMfa:!0,mfa:B.data.mfa};return T(I)}let V={};m!==void 0&&(V.perms=m),E!==void 0&&(V.roles=E);let $={userId:n.userId,permissions:V,device:M};i!==void 0&&($.tenantId=i),v!==void 0&&($.tenantType=v);let A=await Jn($,e);if(A.ok===!1)return d(A.errors,A.meta);if(!A.ok)return d(gt.INTERNAL_ERROR());let{accessToken:x,refreshToken:b,expiresAt:g}=A.data;return T({accessToken:x,refreshToken:b,expiresAt:g})}var ot={MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Ia(t,e){if(!e.plugins.mfa)return d(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,o=n.deviceLabel,s=n.country,a=n.city;if(n.status!==Ve.PENDING)return d(ot.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_MFA)return d(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return d(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return d(ot.MFA_METHOD_NOT_SUPPORTED());let u=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(u.ok===!1)return u.errors.some($=>$.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(ot.TOO_MANY_ATTEMPTS())):d(u.errors,u.meta);if(l.requiresServerDelivery){if(!n.codeHash)return d(ot.INVALID_CHALLENGE_STATE());if(!await Fo(t.code,n.codeHash))return d(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return d(ot.MFA_METHOD_NOT_SUPPORTED());let $=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if($.ok===!1||!$.data)return d(ot.INVALID_MFA_CODE());let A=$.data;if(!A.verifiedAt)return d(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return d(ot.INVALID_MFA_CODE());let b=x.data.data?.usedBackupCodeHash;if(b){let I=(A.data.backupCodeHashes??[]).filter(O=>O!==b);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return d(ot.USER_AUTH_NOT_FOUND());let m={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},E=await qr(m,e);if(E.ok===!1)return d(E.errors,E.meta);if(!E.ok)return d(q.DATABASE_ERROR());let{perms:v,roles:N,tenantType:S}=E.data,R={userId:n.userId,...i&&{tenantId:i},...S&&{tenantType:S},...v!==void 0||N?{permissions:{...N&&{roles:N},...v!==void 0&&{perms:v}}}:{},...o||s||a?{device:{...o&&{deviceLabel:o},...s&&{country:s},...a&&{city:a}}}:{}},M=await Jn(R,e);if(M.ok===!1)return d(M.errors,M.meta);if(!M.ok)return d(q.DATABASE_ERROR());let{accessToken:K,refreshToken:B,expiresAt:V}=M.data;return T({accessToken:K,refreshToken:B,expiresAt:V})}var vt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:Q("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:Q("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:Q("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:Q("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:_("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:_("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:_("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function xa(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(vt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Ve.PENDING)return d(vt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return d(vt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return d(vt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return d(vt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return d(vt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let o=await e.plugins.database.userAuths.get(t.userId);if(!o.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let s=o.data;if(!s)return d(vt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(f=>f.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(vt.TOO_MANY_ISSUES())):d(a.errors,a.meta);if(!i.sendCode)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:s},e);if(!c.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,u=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:_r.VERIFY_MFA,codeHash:l})).ok===!1?d(vt.CHALLENGE_UPDATE_FAILED()):T({maskedRecipient:u,expiresAt:n.expiresAt})}var $e={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:Q("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:Q("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:_("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:_("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:_("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:_("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:_("INTERNAL_ERROR","Internal error occurred during registration")};function xb(t,e){return e[t]}function bb(t,e){return e[t]}async function ba(t,e){let r=xb(t.identityType,e.plugins.identity);if(!r)return d($e.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return d($e.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,i);if(o.ok===!1)return d($e.DATABASE_ERROR());if(o.data)return d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let s=bb(t.credentialType,e.plugins.credential);if(!s)return d($e.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await s.create({value:t.credentialValue});if(a.ok===!1)return d($e.INVALID_CREDENTIAL());if(!a.ok)return d($e.INTERNAL_ERROR());let{value:c,data:l}=a.data,u=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let f={id:u,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===sr.EMAIL&&{contactEmail:t.identityValue},...t.identityType===sr.PHONE&&{contactPhone:t.identityValue},...t.identityType===sr.USERNAME&&{username:t.identityValue}},m={userId:u,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},E={type:t.identityType,value:i,userId:u,loginEnabled:!0,verifiedAt:null,guards:{}},v={userId:u,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===sr.EMAIL&&e.plugins.database.registration){let B=await Sb({profileData:{...f,id:u},userAuthData:m,identityData:E,credentialRepoData:v,identityValue:i},e);return B.ok===!1?B.errors.some(V=>V.code==="UNIQUE_CONSTRAINT_VIOLATION")?d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):d(B.errors,B.meta):B.ok?T({userId:u,verification:{channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}):d($e.INTERNAL_ERROR())}let N=await e.plugins.database.users.create(f);if(N.ok===!1||!N.data)return d($e.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(m)).ok===!1)return await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(E)).ok===!1)return await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let M=await e.plugins.database.credentials.create(v);if(M.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let K;if(t.identityType===sr.EMAIL){let B=await Rb({userId:u,identityType:t.identityType,identityValue:i},e);if(B.ok===!1)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d(B.errors,B.meta);if(!B.ok)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.INTERNAL_ERROR());K={channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}return T({userId:u,...K&&{verification:K}})}async function Sb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await wb(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?d($e.USER_CREATION_FAILED()):((await Nb({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),T({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function wb(t,e,r){let n=gn(6),i=await $r(n),o=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),s=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:s,userId:t,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:sr.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:o},pendingVerification:{challengeId:s,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:o,resendAvailableAt:a}}}async function Nb(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?d($e.VERIFICATION_EMAIL_SEND_FAILED()):T(void 0):d($e.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Rb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=gn(6),n=await $r(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),o=e.plugins.database.challenges.generateChallengeId(),s=await e.plugins.database.challenges.create({id:o,userId:t.userId,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(s.ok===!1)return d(s.errors,s.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:o,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(o),d(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:o,expiresAt:i.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(o),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),d($e.VERIFICATION_EMAIL_SEND_FAILED())):T({challengeId:o,expiresAt:i})}var Zn={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function Sa(t,e){let{sessionId:r,userId:n,tenantId:i}=t,o=await e.plugins.database.sessions.get(r);if(o.ok===!1)return d(o.errors,o.meta);if(!o.data)return d(Zn.SESSION_NOT_FOUND());let s=o.data;if(s.revokedAt)return d(Zn.SESSION_REVOKED());if(s.userId!==n)return d(Zn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return d(a.errors,a.meta);if(!a.data)return d(Zn.USER_NOT_FOUND());let c=a.data,l=await qr({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return d(l.errors,l.meta);if(!l.ok)return d(q.DATABASE_ERROR());let{perms:u,roles:p,tenantType:f}=l.data,m=e.plugins.database.sessions.generateTokenId(),E=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:m,...u!==void 0&&{perms:u},...p&&{roles:p},...f&&{tenantType:f}});if(E.ok===!1)return d(E.errors,E.meta);let v=Ho(i,e.security),N=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f},...u!==void 0&&{perms:u},...p&&{roles:p}}),S=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f}});return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt,tenantId:i})}var Ob=/^[\w!#$%&'*.^`|~+-]+$/,kb=/^[!#-:<>-[\]-~]+$/,Cb=/^[ !#-:<-[\]-~]*$/,zy=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},sf=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let o=i.indexOf("=");if(o===-1)continue;let s=zy(i.substring(0,o));if(e&&e!==s||!kb.test(s)||s in n)continue;let a=zy(i.substring(o+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),Cb.test(a)&&(n[s]=Do(a),e))break}return n};var Pb=(t,e,r={})=>{if(!Ob.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Wl=(t,e,r)=>(e=encodeURIComponent(e),Pb(t,e,r));var af=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let i=e;return r==="secure"?i="__Secure-"+e:r==="host"&&(i="__Host-"+e),sf(n,i)[i]}return n?sf(n):{}};var Db=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Wl("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Wl("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Wl(t,e,{path:"/",...r}),n},wa=(t,e,r,n)=>{let i=Db(e,r,n);t.header("Set-Cookie",i,{append:!0})};var Na=(t,e,r)=>{let n=af(t,e,r?.prefix);return wa(t,e,"",{...r,maxAge:0}),n};function cf(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function zl(t){return t==="cookie"||t==="both"}function Ub(t){let e=t.tokenStrategy;return typeof e=="string"?zl(e):Object.values(e).some(r=>r!==void 0&&zl(r))}function lf(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Lb(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function Jy(t,e,r,n,i){let o=r.refreshTokenCookie??{},s=i??Lb(r,n),a=cf(r,s),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=lf(r,s);Mb(t,c,{...o,name:l})}if(a==="cookie"){let{refreshToken:l,...u}=e;return u}return e}function Yy(t,e,r){if(!(r?zl(cf(e,r)):Ub(e)))return;let i=e.refreshTokenCookie??{},o={path:i.path??"/",...i.domain?{domain:i.domain}:{}},s=e.audienceCookieNames?.cookieNames;if(s&&!r){let c=i.name??"refresh_token",l=new Set([s.customer??c,s.tenant??c,s.system??c]);for(let u of l)Na(t,u,o);return}let a=lf(e,r);Na(t,a,o)}function Jl(t,e,r){let n=cf(e,r);if(!zl(n)||!t)return;let i=lf(e,r);return Kb(t,i)}function Mb(t,e,r){wa(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function Kb(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var Xy=new Set(["customer","tenant","system"]);function Le(t,e){let r=[];if(e.auth!==!1&&r.push(oa({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(aa(a))}let n=async a=>{let c=or(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let u=a.get("authResult"),p={body:ca(a),query:ua(a),params:la(a),user:u?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},f=await e.handler(p),m=e.successStatus;if(f.ok&&f.data!==void 0&&e.tokenMode==="auth"){let E=f.data,v=typeof E.tenantId=="string"?E.tenantId:void 0,N=p.authContextHeader,S=v!==void 0?void 0:typeof N=="string"&&Xy.has(N)?N:void 0,R=Jy(a,E,t,v,S),M={...f,data:R};return Ge(a,M,{traceId:c,...m!==void 0?{successStatus:m}:{}})}if(f.ok&&e.tokenMode==="logout"){let E=p.authContextHeader,v=typeof E=="string"&&Xy.has(E)?E:void 0;Yy(a,t,v)}return Ge(a,f,{traceId:c,...m!==void 0?{successStatus:m}:{}})}catch(l){let u=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:u}})),Ge(a,d(oe.InternalError()),{traceId:c})}},i=[...r,n],s=async(a,c)=>{let l,u=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let f=i[p],m=await f(a,async()=>{await u(p+1)});m instanceof Response&&(l=m)};return await u(0),l};return s.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},s}function Wr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function Qy(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function Zy(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function eg(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function tg(t){return{plugins:{database:t.plugins.database}}}function rg(t){return Le(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Ut.authenticate.body},handler:async e=>{let r=Wr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Ta(n,r)}})}function ng(t){return Le(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeChallenge.body},handler:async e=>{let r=Wr(t.auth);return _a({challengeId:e.body.challengeId,code:e.body.code},r)}})}function ig(t){return Le(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return Ia({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function og(t){return Le(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Ut.issueMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return xa({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function Yl(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var Hb=new Set(["customer","tenant","system"]);function sg(t){return Le(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Hb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=Zy(t.auth);return Bl({refreshToken:a},c)}})}function Fb(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function ei(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=Fb(e);return typeof r?.sid=="string"?r.sid:void 0}function ag(t){return Le(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return d(oe.NotAuthenticated())}let n=tg(t.auth);return ga({userId:e.user.id},n)}})}var Vb=new Set(["customer","tenant","system"]);function cg(t){return Le(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Vb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=eg(t.auth);return jl({refreshToken:a},c)}})}function lg(t){return Le(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Ut.register.body},handler:async e=>{let r=Qy(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),ba(n,r)}})}function ug(t){return Le(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Ut.selectTenant.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(!r)return d(oe.NotAuthenticated());let n=Wr(t.auth);return Sa({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Ra={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Xl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ra.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return d(Ra.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return d(i.errors,i.meta);let o=i.data??[];t.verifiedOnly&&(o=o.filter(a=>a.verifiedAt!==null));let s=o.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return T({authenticators:s,total:s.length})}var vn={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:Q("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:Q("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:Q("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:Q("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:Q("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var An={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Ql(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(vn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(vn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(vn.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok||!i.data)return d(vn.AUTHENTICATOR_NOT_FOUND());let o=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(o.ok===!1)return d(o.errors,o.meta);let s=o.data??[],a=s.filter(v=>v.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return d(vn.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let v=await e.plugins.database.credentials.getByUserIdAndType(t.userId,An.PASSWORD);if(v.ok===!1)return d(v.errors,v.meta);let N=v.data;if(N&&N.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:N.value,data:N.data??{}},credentialValue:t.password})).ok===!1)return d(vn.INVALID_PASSWORD())}let u=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(u.ok===!1)return d(u.errors,u.meta);let f=s.filter(v=>v.method===t.method&&(v.id!==t.authenticatorId||v.method!==t.method)).length,m=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:m,remainingCount:f}});let E={method:t.method,mfaStillEnabled:m,remainingCount:f};return t.authenticatorId!==void 0&&(E.authenticatorId=t.authenticatorId),T(E)}var Tn={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Zl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Tn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Tn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Tn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return d(Tn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return d(Tn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let o=await i.setup({userId:t.userId,data:t.data||{}},e);if(o.ok===!1)return d(o.errors,o.meta);if(!o.ok)return d(Tn.INTERNAL_ERROR());let s=o.data;if(s.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:s.credentialData});if(l.ok===!1)return d(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=s;return T({method:t.method,data:c})}var pt={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:_("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:_("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:_("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:_("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:Q("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:Q("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:_("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:q.INTERNAL_ERROR};var dg=["totp","webauthn","passkey","hardware"],pg=["email","sms","phone"],Bb=new Set([...dg,...pg]);async function eu(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return d(pt.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!Bb.has(i))return d(pt.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return d(pt.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(pt.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(pt.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(pt.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return d(pt.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return d(pt.MFA_NOT_ENABLED());if(!t.password)return d(pt.PASSWORD_REQUIRED());let i=await jb(t.userId,t.password,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await Gb(t.userId,t.mfaMethods,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return d(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),T()}async function jb(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,An.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let o=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return o.ok===!1?d(o.errors,o.meta):T()}async function Gb(t,e,r){let n=e.filter(o=>dg.includes(o)),i=e.filter(o=>pg.includes(o));if(n.length>0){let o=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let o=await r.plugins.database.identities.getByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}return T()}var Ir={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:_("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:_("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function tu(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ir.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Ir.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Ir.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok)return d(Ir.INTERNAL_ERROR());let o=i.data;if(!o)return d(Ir.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return d(Ir.MFA_NOT_AVAILABLE());let s=e.plugins.mfa[t.method];if(!s?.verifyWithCredentials)return d(Ir.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await s.verifyWithCredentials({credentialData:o.data,data:t.data||{}});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(Ir.INTERNAL_ERROR());let c=a.data;if(!c.verified)return T({method:t.method,verified:!1,data:c.data||{}});if(!o.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return d(l.errors,l.meta);let u=n.mfaMethods||[];if(!u.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...u,t.method]);if(p.ok===!1)return d(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),T({method:t.method,verified:!0,data:c.data||{}})}function Oa(t){return{system:{systemId:t.system.system.systemId}}}function fg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function mg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function hg(t){return{plugins:{database:t.plugins.database},system:Oa(t)}}function Eg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function yg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function gg(t){return X(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=hg(t.auth);return Xl({userId:e.user.id},r)}})}function vg(t){return X(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:Tr.removeAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Eg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Ql(n,r)}})}function Ag(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:Tr.setupAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=fg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),Zl(n,r)}})}function Tg(t){return X(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:Tr.updateMfaSettings.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=yg(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),eu(n,r)}})}function _g(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:Tr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=mg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),tu(n,r)}})}var ru={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function nu(t,e){if(!await e.plugins.database.users.getById(t.userId))return d(ru.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(!i)return T([]);let o=i.map(s=>{let a={provider:s.provider,externalId:s.externalId,linkedAt:s.createdAt};return s.externalEmail&&(a.externalEmail=s.externalEmail),s.externalName&&(a.externalName=s.externalName),a});return T(o)}var At={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:_("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:_("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:_("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function $b(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return d(q.DATABASE_ERROR());let u=l.data;if(u.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(u.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let f=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(f.ok===!1)return d(f.errors,f.meta)}return T(c)}let o=null;if(t.email){let c=Aa(sr.EMAIL,e.plugins.identity);if(!c)return d(q.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),u=await e.plugins.database.identities.get(sr.EMAIL,l);if(u.ok===!1)return d(q.DATABASE_ERROR());if(u.data){if(t.emailVerified!==!0)return d(At.EMAIL_NOT_VERIFIED_BY_PROVIDER());o=u.data.userId;let p=await e.plugins.database.userAuths.get(o);if(!p.ok||!p.data)return d(q.DATABASE_ERROR());let f=p.data;if(f.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(f.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED())}}if(!o){if(!t.email)return d(At.EMAIL_REQUIRED());o=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let N=t.name.trim().split(/\s+/);c=N[0]||"",l=N.slice(1).join(" ")||""}let u={id:o,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(u)).ok)return d(q.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:o,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(o),d(q.DATABASE_ERROR());let m=Aa(sr.EMAIL,e.plugins.identity);if(!m)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(q.PLUGIN_NOT_FOUND());let E=m.normalize(t.email),v=await e.plugins.database.identities.create({type:sr.EMAIL,value:E,userId:o,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(v.ok===!1)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(v.errors,v.meta)}let s={userId:o,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(s.externalEmail=t.email),t.name!==void 0&&(s.externalName=t.name),t.avatarUrl!==void 0&&(s.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(s);return a.ok===!1?d(a.errors,a.meta):T(o)}async function iu(t,e){if(!t.provider)return d(At.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return d(At.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return d(At.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return d(At.PROVIDER_NOT_FOUND());let v=await r.verifyCredential(t.credential);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}else if(t.code){let v=await r.exchangeCodeForToken(t.code);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());let N=v.data;if(!N)return d(At.CODE_EXCHANGE_FAILED());i=N.accessToken}if(!n){if(!i)return d(At.INVALID_ACCESS_TOKEN());let v=await r.getUserProfile(i);if(v.ok===!1)return d(At.PROFILE_FETCH_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}let o=await $b(n,e,t);if(!o.ok)return d(o.errors,o.meta);let s=o.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(s);if(!c.ok||!c.data)return d(q.DATABASE_ERROR());let l=await qr({userStatus:c.data.userStatus,userId:s,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return d(l.errors,l.meta);let{perms:u,roles:p,tenantType:f}=l.data,m={userId:s,...t.tenantId&&{tenantId:t.tenantId},...f&&{tenantType:f},...u!==void 0||p?{permissions:{...p&&{roles:p},...u!==void 0&&{perms:u}}}:{}},E=await Jn(m,a);return E.ok===!1?d(E.errors,E.meta):(await _e(e,{event:"oauth_login_success",userId:s,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Gl(s,e),T({accessToken:E.data.accessToken,refreshToken:E.data.refreshToken,expiresAt:E.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),d(At.PROFILE_FETCH_FAILED())}}var Lt={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:_("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:_("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function ou(t,e){if(!t.code)return d(Lt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return d(Lt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return d(Lt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let f=await n.exchangeCodeForToken(t.code);if(f.ok===!1)return d(Lt.CODE_EXCHANGE_FAILED());let m=f.data;if(!m)return d(Lt.CODE_EXCHANGE_FAILED());i=m.accessToken}if(!i)return d(Lt.INVALID_ACCESS_TOKEN());let o=await n.getUserProfile(i);if(o.ok===!1)return d(Lt.PROFILE_FETCH_FAILED());let s=o.data;if(!s)return d(Lt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,s.id);if(a.ok===!1)return d(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?d(Lt.PROVIDER_ALREADY_LINKED()):d(Lt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:s.id,createdAt:new Date};s.email!==void 0&&(l.externalEmail=s.email),s.name!==void 0&&(l.externalName=s.name),s.avatarUrl!==void 0&&(l.externalAvatarUrl=s.avatarUrl);let u=await e.plugins.database.userProviders.create(l);if(u.ok===!1)return d(u.errors,u.meta);let p=u.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:s.id}}),T(p)):d(Lt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),d(Lt.PROFILE_FETCH_FAILED())}}var Go={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:_("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:_("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function su(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return d(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return d(Go.PROVIDER_NOT_LINKED());let i=n.find(s=>s.provider===t.provider);if(!i)return d(Go.PROVIDER_NOT_LINKED());if(n.length<=1){let s=await e.plugins.database.identities.getByUserId(t.userId);if(!(s.ok&&s.data&&s.data.length>0))return d(Go.CANNOT_UNLINK_LAST_PROVIDER())}let o=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return o.ok===!1?d(o.errors,o.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),T())}function Ig(t){return X(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return nu({userId:e.user.id},r)}})}function xg(t){return X(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:mn.linkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),ou(n,r)}})}function bg(t){return Le(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:mn.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),iu(n,r)}})}function Sg(t){return X(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:mn.unlinkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return su({userId:e.user.id,provider:e.body.provider},r)}})}var St={PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:_("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:_("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:_("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:_("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},xr={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:St.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:St.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:St.SAME_PASSWORD},Ui={EMAIL_SYSTEM_NOT_AVAILABLE:St.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:St.SEND_EMAIL_ERROR},jt={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:St.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:St.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:St.CHALLENGE_ALREADY_USED,INVALID_CODE:St.INVALID_CODE,TOO_MANY_ATTEMPTS:St.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:St.AUTH_SCOPE_MISMATCH};async function $o(t,e){if(!e.plugins.credential?.password)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,An.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return d(xr.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return d(xr.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return d(l.errors,l.meta);let u=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return u.ok===!1&&console.error("Failed to revoke sessions after password change:",u.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),T()}async function qo(t,e){if(!e.plugins.emailSystem)return d(Ui.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=gn(6),o=await $r(i),s=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return T({challengeId:`fake_challenge_${Date.now()}`,expiresAt:s});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===xe.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return T({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),u=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:xe.PASSWORD_RESET,status:Ve.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:o,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:s});if(u.ok===!1)return d(u.errors,u.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:s.toISOString(),purpose:xe.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),d(Ui.SEND_EMAIL_ERROR());let f=Math.max(0,e.security.verificationResendCooldownSeconds),m=f>0?new Date(Date.now()+f*1e3):null,E=!c||c.purpose===xe.PASSWORD_RESET;return await Promise.all([E?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:xe.PASSWORD_RESET,channel:"email",expiresAt:s,resendAvailableAt:m}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),T({challengeId:l,expiresAt:s})}async function Wo(t,e){if(!e.plugins.credential?.password)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(jt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==xe.PASSWORD_RESET)return d(jt.CHALLENGE_NOT_FOUND());if(i.status!==Ve.PENDING)return d(jt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return d(jt.CHALLENGE_EXPIRED());let o=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(o.ok===!1)return o.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?d(jt.TOO_MANY_ATTEMPTS()):d(o.errors,o.meta);if(!i.codeHash)return d(jt.INVALID_CODE());if(!await Fo(t.code,i.codeHash))return d(jt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,An.PASSWORD);if(l.ok===!1)return d(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return d(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:An.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return d(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let u=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return u.ok===!1&&console.error("Failed to revoke sessions after password reset:",u.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),T()}var au={NO_CHANGES_PROVIDED:_("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function cu(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return d(au.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return d(q.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return d(q.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let s=await e.plugins.database.users.getById(t.userId);return!s.ok||s.data===null?d(q.NOT_FOUND()):T(s.data)}function zo(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function wg(t){return Le(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:hn.changePassword.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=zo(t.auth),n=e.body,i=ei(e.authorizationHeader);return $o({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function Ng(t){return Le(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:hn.forgotPassword.body},handler:async e=>{let r=zo(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),qo(n,r)}})}function Rg(t){return X(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:hn.resetPassword.body},handler:async e=>{let r=zo(t.auth);return Wo({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var ka={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:_("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to delete session")};async function Ca(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?d(ka.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),T())}var Pa={DATABASE_ERROR:_("DATABASE_ERROR","Failed to retrieve sessions")};async function Da(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return d(Pa.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return T(a,i.meta)}var Jo={INVALID_TOKEN:_("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to revoke token")};async function Ua(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?d(Jo.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),T()):d(Jo.INVALID_TOKEN())}function Og(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function kg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Cg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Pg(t){return X(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:En.deleteSession.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=kg(t.auth);return Ca({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function Dg(t){return Le(t,{method:"GET",path:"/sessions",auth:!0,input:{query:En.listSessions.query},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Og(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Da(n,r);if(!i.ok)return i;let o=ei(e.authorizationHeader);if(o&&i.data){let s=i.data.map(a=>a.id===o?{...a,isCurrent:!0}:a);return T(s,i.meta)}return i}})}function Ug(t){return X(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:En.revokeToken.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Cg(t.auth);return Ua({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},La=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Ma(t,e){return t===void 0?!1:(t&e)===e}var uf={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},Lg=Object.fromEntries(Object.entries(uf).map(([t,e])=>[e,Number(t)]));function Xt(t){return t?Object.entries(uf).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function ti(t){let e=0;for(let r of t){let n=Lg[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Qt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var br={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:_("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","This invite grants permissions the inviter is not entitled to confer"),DATABASE_ERROR:q.DATABASE_ERROR};var qb={IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:_("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:_("IDENTITY_ALREADY_EXISTS","This identity is already registered")},Wb={GUARD_LOCKED:_("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},zb={INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:_("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:_("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:_("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:_("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},Jb={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:_("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:_("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:_("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},Yb={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:_("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:_("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},Xb={MFA_NOT_CONFIGURED:_("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:_("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:_("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:_("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Qb={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:_("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:_("INVALID_SESSION","Invalid session")},Zb={TOKEN_NOT_FOUND:_("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:_("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:_("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:_("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:_("TOKEN_VERIFICATION_FAILED","Token verification failed")},wt={NOT_MEMBER_OF_TENANT:_("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:_("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:_("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:_("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:_("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},wW={...qb,...Wb,...zb,...Jb,...Yb,...Xb,...Qb,...Zb,...wt};async function lu(t,e,r,n={}){let{requireVerified:i=!0}=n;if(t.inviteeUserId)return T(t.inviteeUserId===e?null:"user-mismatch");if(t.inviteeEmail||t.inviteePhone){let o=await r.getByUserId(e);if(!o.ok)return d(o.errors,o.meta);let s=i?o.data.filter(p=>p.verifiedAt!==null):o.data,a=(p,f)=>p==="phone"?f.replace(/[\s()\-.]/g,""):f.trim().toLowerCase(),c=(p,f)=>{let m=a(p,f);return m?s.some(E=>E.type===p&&a(p,E.value)===m):!1},l=t.inviteeEmail?c("email",t.inviteeEmail):!1,u=t.inviteePhone?c("phone",t.inviteePhone):!1;return!l&&!u?T("identity-mismatch"):T(null)}return T("identity-mismatch")}function ri(t,e){let{authPerm:r,roles:n,perms:i}=e;if(t.isOwner)return!1;if(r!==void 0&&(r&~(t.authPerm??0))!==0||r!==void 0&&(r&se.CHANGE_MEMBER_PERMISSION)!==0||n?.some(o=>o.trim().toLowerCase()===va.OWNER))return!0;if(i!==void 0){let o=t.perms??{},s=(c,l)=>c[l]??c["*"]??0,a=new Set([...Object.keys(i),...Object.keys(o),"*"]);for(let c of a)if((s(i,c)&~s(o,c))!==0)return!0}return!1}async function Yo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(br.INVITE_IDENTIFIER_REQUIRED());let s=null,a=!1;if(r){let M=await o.tenantInvites.getById(r);if(!M.ok)return d(M.errors,M.meta);s=M.data}else if(n){let M=await o.tenantInvites.getByToken(n);if(!M.ok)return d(M.errors,M.meta);s=M.data,a=!0}if(!s)return d(br.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(br.INVITE_NOT_PENDING());if(s.expiresAt<new Date)return d(br.INVITE_EXPIRED());let c=await lu(s,i,o.identities,{requireVerified:!a});if(!c.ok)return d(c.errors,c.meta);if(c.data==="user-mismatch")return d(br.INVITE_USER_MISMATCH());if(c.data==="identity-mismatch")return d(br.INVITE_IDENTITY_MISMATCH());let l=await o.tenantMembers.get(s.tenantId,i);if(!l.ok)return d(l.errors,l.meta);if(l.data&&l.data.status!==it.REMOVED)return d(br.ALREADY_MEMBER());let u=await o.tenants.get(s.tenantId);if(!u.ok)return d(u.errors,u.meta);if(s.authPerm!==void 0&&(s.authPerm&La)!==0){if(!u.data)return d(wt.TENANT_NOT_FOUND());if(u.data.type!==Qt.SYSTEM)return d(wt.ACCOUNT_PERMS_SYSTEM_ONLY())}let p={tenantId:s.tenantId,userId:i,status:it.ACTIVE,isOwner:!1,tenantType:s.tenantType};if(u.data?.parentTenantId!==void 0&&(p.parentTenantId=u.data.parentTenantId),s.authPerm!==void 0||s.roles!==void 0||s.perms!==void 0){let M=await o.tenantMembers.get(s.tenantId,s.invitedById);if(!M.ok)return d(M.errors,M.meta);let K=M.data,B=K&&K.status===it.ACTIVE?K:{isOwner:!1,authPerm:0,perms:{}};if(ri(B,{authPerm:s.authPerm,roles:s.roles,perms:s.perms}))return d(br.CANNOT_ESCALATE_PERMISSIONS())}s.roles!==void 0&&(p.roles=s.roles),s.perms!==void 0&&(p.perms=s.perms),s.authPerm!==void 0&&(p.authPerm=s.authPerm);let m=await o.tenantMembers.create(p);if(!m.ok)return d(m.errors,m.meta);let E={tenantId:s.tenantId,userId:i},v=await o.users.getById(i);v.ok&&v.data&&(v.data.contactEmail&&(E.contactEmail=v.data.contactEmail),v.data.contactPhone&&(E.contactPhone=v.data.contactPhone),v.data.displayName&&(E.displayName=v.data.displayName),v.data.givenName&&(E.givenName=v.data.givenName),v.data.familyName&&(E.familyName=v.data.familyName),v.data.avatarUrl&&(E.avatarUrl=v.data.avatarUrl),v.data.locale&&(E.locale=v.data.locale)),s.displayName&&(E.displayName=s.displayName),s.givenName&&(E.givenName=s.givenName),s.familyName&&(E.familyName=s.familyName),s.jobTitle&&(E.jobTitle=s.jobTitle);let N=await o.userTenantProfiles.create(E);if(!N.ok)return d(N.errors,N.meta);let S=await o.tenantInvites.updateStatus(s.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!S.ok)return d(S.errors,S.meta);let R={tenantId:s.tenantId};return s.roles!==void 0&&(R.roles=s.roles),s.perms!==void 0&&(R.perms=s.perms),s.authPerm!==void 0&&(R.authPerm=s.authPerm),T(R)}var Li={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function Mi(t,e,r){if(t===void 0||(t&La)===0)return T(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T(void 0):d(wt.TENANT_NOT_FOUND()):d(n.errors,n.meta)}var uu={NOT_MEMBER:wt.NOT_MEMBER_OF_TENANT,SUSPENDED:wt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:wt.INSUFFICIENT_TENANT_PERMISSIONS};async function lt(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,o=await e.tenantMembers.get(r,n);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(uu.NOT_MEMBER());let s=o.data;return s.status!==it.ACTIVE?d(uu.SUSPENDED()):s.isOwner?T(s):Ma(s.authPerm,i)?T(s):d(uu.INSUFFICIENT_PERMISSIONS())}async function du(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(ri(s.data,{authPerm:t.authPerm,roles:t.roles,perms:t.perms}))return d(Li.CANNOT_ESCALATE_PERMISSIONS());let a=await Mi(t.authPerm,r,o.tenants);if(!a.ok)return d(a.errors,a.meta);let c=await o.users.getById(n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Li.USER_NOT_FOUND());let l=c.data,u=await o.tenantMembers.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(u.data&&u.data.status!==it.REMOVED)return d(Li.ALREADY_MEMBER());let p=await o.tenants.get(r);if(!p.ok)return d(p.errors,p.meta);if(!p.data)return d(Li.TENANT_NOT_FOUND());let f=p.data,m={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!1,tenantType:f.type};f.parentTenantId!==void 0&&(m.parentTenantId=f.parentTenantId),t.roles!==void 0&&(m.roles=t.roles),t.perms!==void 0&&(m.perms=t.perms),t.authPerm!==void 0&&(m.authPerm=t.authPerm);let E=await o.tenantMembers.create(m);if(!E.ok)return d(E.errors,E.meta);let v={tenantId:r,userId:n};l.contactEmail&&(v.contactEmail=l.contactEmail),l.contactPhone&&(v.contactPhone=l.contactPhone),l.displayName&&(v.displayName=l.displayName),l.givenName&&(v.givenName=l.givenName),l.familyName&&(v.familyName=l.familyName),l.avatarUrl&&(v.avatarUrl=l.avatarUrl),l.locale&&(v.locale=l.locale),t.contactEmail!==void 0&&(v.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(v.contactPhone=t.contactPhone),t.displayName!==void 0&&(v.displayName=t.displayName),t.givenName!==void 0&&(v.givenName=t.givenName),t.familyName!==void 0&&(v.familyName=t.familyName),t.avatarUrl!==void 0&&(v.avatarUrl=t.avatarUrl),t.locale!==void 0&&(v.locale=t.locale),t.jobTitle!==void 0&&(v.jobTitle=t.jobTitle),t.bio!==void 0&&(v.bio=t.bio),t.metadata!==void 0&&(v.metadata=t.metadata);let N=await o.userTenantProfiles.create(v);return N.ok?T({tenantId:r,userId:n}):d(N.errors,N.meta)}var Xo={TENANT_ALREADY_HAS_OWNER:_("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:_("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:q.DATABASE_ERROR};async function pu(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:o,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N}=t,S=e.plugins.database,R=i??"org";if(R===Qt.SYSTEM)return d(Xo.SYSTEM_TYPE_FORBIDDEN());let M=await S.users.getById(n);if(!M.ok)return d(M.errors,M.meta);if(!M.data)return d(Xo.USER_NOT_FOUND());let K=await S.tenants.get(r);if(!K.ok)return d(K.errors,K.meta);if(!K.data){let b={id:r,type:R,ownerId:n};o!==void 0&&(b.parentTenantId=o);let g=await S.tenants.create(b);if(!g.ok)return d(g.errors,g.meta)}let B=await S.tenantMembers.hasOwner(r);if(!B.ok)return d(B.errors,B.meta);if(B.data)return d(Xo.TENANT_ALREADY_HAS_OWNER());let V=K.data?.parentTenantId??o,$={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!0,tenantType:R};V!==void 0&&($.parentTenantId=V);let A=await S.tenantMembers.create($);if(!A.ok)return d(A.errors,A.meta);let x=await S.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N});return x.ok?T({tenantId:r,userId:n}):d(x.errors,x.meta)}async function fu(t,e){let{email:r,phone:n}=t,i=e.plugins.database,o=[],s=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}return T({pendingInvites:o})}var ni={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was sent to an identity you do not own"),DATABASE_ERROR:q.DATABASE_ERROR};async function Qo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(ni.INVITE_IDENTIFIER_REQUIRED());let s=null;if(r){let l=await o.tenantInvites.getById(r);if(!l.ok)return d(l.errors,l.meta);s=l.data}else if(n){let l=await o.tenantInvites.getByToken(n);if(!l.ok)return d(l.errors,l.meta);s=l.data}if(!s)return d(ni.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(ni.INVITE_NOT_PENDING());let a=await lu(s,i,o.identities,{requireVerified:!1});if(!a.ok)return d(a.errors,a.meta);if(a.data==="user-mismatch")return d(ni.INVITE_USER_MISMATCH());if(a.data==="identity-mismatch")return d(ni.INVITE_IDENTITY_MISMATCH());let c=await o.tenantInvites.updateStatus(s.id,{status:ar.DECLINED,declinedAt:new Date});return c.ok?T(void 0):d(c.errors,c.meta)}async function Ki(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[o,s]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(wt.NOT_MEMBER_OF_TENANT());if(!s.ok)return d(s.errors,s.meta);let a=o.data,c=s.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),T(l)}var Zt={INVITEE_REQUIRED:_("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:Q("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:_("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:Q("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};function eS(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function Zo(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:o,inviteePhone:s,role:a,perms:c,authPerm:l,displayName:u,givenName:p,familyName:f,jobTitle:m}=t,E=t.roles??(a!==void 0?[a]:void 0),v=e.plugins.database,N=await lt({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!N.ok)return d(N.errors,N.meta);if(ri(N.data,{authPerm:l,roles:E,perms:c}))return d(Zt.CANNOT_ESCALATE_PERMISSIONS());let S=await Mi(l,r,v.tenants);if(!S.ok)return d(S.errors,S.meta);if(!i&&!o&&!s)return d(Zt.INVITEE_REQUIRED());if(i){let k=await v.users.getById(i);if(!k.ok)return d(k.errors,k.meta);if(!k.data)return d(Zt.INVITEE_USER_NOT_FOUND({userId:i}));let C=await v.tenantMembers.get(r,i);if(!C.ok)return d(C.errors,C.meta);if(C.data&&C.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER());let D=await v.tenantInvites.findByTenantAndUserId(r,i);if(!D.ok)return d(D.errors,D.meta);if(D.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(o){let k=await v.identities.get("email",o);if(!k.ok)return d(k.errors,k.meta);if(k.data){let D=await v.tenantMembers.get(r,k.data.userId);if(!D.ok)return d(D.errors,D.meta);if(D.data&&D.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndEmail(r,o);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(s){let k=await v.identities.get("phone",s);if(!k.ok)return d(k.errors,k.meta);if(k.data){let D=await v.tenantMembers.get(r,k.data.userId);if(!D.ok)return d(D.errors,D.meta);if(D.data&&D.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndPhone(r,s);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}let R=await v.tenantInvites.countPendingByTenant(r);if(!R.ok)return d(R.errors,R.meta);if(R.data>=e.security.maxPendingInvitesPerTenant)return d(Zt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let M,K,B,V=await v.users.getById(n);V.ok&&V.data&&(V.data.displayName!==void 0&&(M=V.data.displayName),V.data.contactEmail!==void 0&&(K=V.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(M=$.data.displayName),$.data.jobTitle!==void 0&&(B=$.data.jobTitle));let A=Qt.DEFAULT,x=await v.tenants.get(r);x.ok&&x.data&&(A=x.data.type);let b=v.tenantInvites.generateInviteId(),g=eS(),I=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),O={id:b,tenantId:r,tenantType:A,invitedById:n,status:ar.PENDING,inviteToken:g,expiresAt:I};M!==void 0&&(O.invitedByName=M),K!==void 0&&(O.invitedByEmail=K),B!==void 0&&(O.invitedByJobTitle=B),i!==void 0&&(O.inviteeUserId=i),o!==void 0&&(O.inviteeEmail=o),s!==void 0&&(O.inviteePhone=s),E!==void 0&&(O.roles=E),c!==void 0&&(O.perms=c),l!==void 0&&(O.authPerm=l),u!==void 0&&(O.displayName=u),p!==void 0&&(O.givenName=p),f!==void 0&&(O.familyName=f),m!==void 0&&(O.jobTitle=m);let P=await v.tenantInvites.create(O);return P.ok?T({inviteId:b,inviteToken:g,expiresAt:I}):d(P.errors,P.meta)}async function es(t,e){let{tenantId:r,actorUserId:n,status:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await o.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?T(c.data,c.meta):d(c.errors,c.meta)}async function ts(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,o=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return d(o.errors,o.meta);let s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(s).length>0?s:void 0);return a.ok?T(a.data,a.meta):d(a.errors,a.meta)}async function mu(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let o=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return o.ok?T(o.data,o.meta):d(o.errors,o.meta)}var Hi={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:_("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:_("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:q.DATABASE_ERROR};async function rs(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(i===n)return d(Hi.CANNOT_REMOVE_SELF());let a=await o.tenantMembers.get(r,n);if(!a.ok)return d(a.errors,a.meta);if(!a.data)return d(Hi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!s.data.isOwner)return d(Hi.CANNOT_MODIFY_OWNER());if(c.isOwner){let u=await o.tenantMembers.listByTenant(r);if(!u.ok)return d(u.errors,u.meta);if(u.data.filter(f=>f.isOwner&&f.status===it.ACTIVE).length<=1)return d(Hi.CANNOT_REMOVE_LAST_OWNER())}let l=await o.tenantMembers.remove(r,n);return l.ok?(await o.userTenantProfiles.remove(r,n),T(void 0)):d(l.errors,l.meta)}var Ka={INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:q.DATABASE_ERROR};async function ns(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,o=await i.tenantInvites.getById(r);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(Ka.INVITE_NOT_FOUND());let s=await lt({tenantId:o.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(o.data.status!==ar.PENDING)return d(Ka.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?T(void 0):d(a.errors,a.meta)}var ii={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};async function is(t,e){let{tenantId:r,userId:n,actorUserId:i,role:o,perms:s,authPerm:a}=t,c=t.roles??(o!==void 0?[o]:void 0),l=e.plugins.database,u=await lt({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!u.ok)return d(u.errors,u.meta);let p=u.data;if(i===n)return d(ii.CANNOT_MODIFY_SELF());let f=await l.tenantMembers.get(r,n);if(!f.ok)return d(f.errors,f.meta);if(!f.data)return d(ii.MEMBER_NOT_FOUND());if(f.data.isOwner)return d(ii.CANNOT_MODIFY_OWNER());let m=f.data,E=a===void 0?void 0:a&~(m.authPerm??0),v=V=>V.trim().toLowerCase(),N=new Set(m.roles?.map(v)),S=c?.filter(V=>v(V)===va.OWNER||!N.has(v(V))),R=(V,$)=>V?.[$]??V?.["*"]??0,M=s===void 0?void 0:Object.fromEntries([...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].map(V=>{let $=R(s,V);return[V,$&~R(m.perms,V)]}));if(ri(p,{authPerm:E,roles:S,perms:M}))return d(ii.CANNOT_ESCALATE_PERMISSIONS());if(!p.isOwner){let V=a===void 0?0:(m.authPerm??0)&~a,$=s===void 0?[]:[...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].filter(O=>(R(m.perms,O)&~R(s,O))!==0),A=new Set(p.roles?.map(v)),x=c===void 0?[]:(m.roles??[]).filter(O=>!c.some(P=>v(P)===v(O))),b=(V&~(p.authPerm??0))!==0,g=$.some(O=>(R(m.perms,O)&~R(s,O)&~R(p.perms,O))!==0),I=x.some(O=>!A.has(v(O)));if(b||g||I)return d(ii.CANNOT_ESCALATE_PERMISSIONS())}let K=await Mi(a,r,l.tenants);if(!K.ok)return d(K.errors,K.meta);let B={};if(c!==void 0&&(B.roles=c),s!==void 0&&(B.perms=s),a!==void 0&&(B.authPerm=a),Object.keys(B).length>0){let V=await l.tenantMembers.updatePermissions(r,n,B);if(!V.ok)return d(V.errors,V.meta)}return T(void 0)}var Ha={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:q.DATABASE_ERROR};async function df(t,e){let{tenantId:r,userId:n,actorUserId:i,status:o}=t,s=e.plugins.database,a=await lt({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:s.tenantMembers});if(!a.ok)return d(a.errors,a.meta);if(i===n)return d(Ha.CANNOT_MODIFY_SELF());let c=await s.tenantMembers.get(r,n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Ha.MEMBER_NOT_FOUND());if(c.data.isOwner)return d(Ha.CANNOT_MODIFY_OWNER());let l=await s.tenantMembers.updateStatus(r,n,o);return l.ok?T(void 0):d(l.errors,l.meta)}var hu={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:_("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:q.DATABASE_ERROR};async function os(t,e){let{tenantId:r,userId:n,...i}=t,o=e.plugins.database,s=await o.tenantMembers.get(r,n);if(!s.ok)return d(s.errors,s.meta);if(!s.data)return d(hu.MEMBER_NOT_FOUND());let a=s.data,c=a.isOwner||Ma(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let u=await o.userTenantProfiles.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(!u.data){let f=await o.userTenantProfiles.create({tenantId:r,userId:n,...l});return f.ok?T(void 0):d(f.errors,f.meta)}let p=await o.userTenantProfiles.update(r,n,l);return p.ok?T(void 0):d(p.errors,p.meta)}var tS=10080,rS=100;function nS(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??tS,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??rS}}}var zr=F({tenantId:Ue(y(),Hp(1))}),iS=F({limit:w(Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100))),cursor:w(y())}),oS=Ue(F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),Hl(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),Mg=Ue(F({inviteId:w(y()),inviteToken:w(y())}),Hl(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),sS=F({inviteId:y()}),aS=F({status:w(y()),limit:w(Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100))),cursor:w(y())}),cS=F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),lS=F({userId:y()}),uS=F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))});function Kg(t){let{auth:e,policy:r}=t,n=X(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr},handler:async m=>{let E=await Ki({tenantId:m.params.tenantId,userId:m.user.id},e);if(!E.ok)return E;let v=E.data;if(!v)return T({});let{authPerm:N,...S}=v;return T({...S,authPerms:Xt(N)})}}),i=X(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:uS},handler:async m=>{let E=m.params.tenantId,v=m.user.id,N={tenantId:E,userId:v},S=m.body;S.contactEmail!==void 0&&(N.contactEmail=S.contactEmail),S.contactPhone!==void 0&&(N.contactPhone=S.contactPhone),S.displayName!==void 0&&(N.displayName=S.displayName),S.givenName!==void 0&&(N.givenName=S.givenName),S.familyName!==void 0&&(N.familyName=S.familyName),S.avatarUrl!==void 0&&(N.avatarUrl=S.avatarUrl),S.locale!==void 0&&(N.locale=S.locale),S.bio!==void 0&&(N.bio=S.bio),S.jobTitle!==void 0&&(N.jobTitle=S.jobTitle),S.metadata!==void 0&&(N.metadata=S.metadata);let R=await os(N,e);if(!R.ok)return R;let M=await Ki({tenantId:E,userId:v},e);if(!M.ok)return M;let K=M.data;if(!K)return T({});let{authPerm:B,...V}=K;return T({...V,authPerms:Xt(B)})}}),o=X(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:oS},handler:async m=>{let{inviteeEmail:E,inviteeUserId:v,inviteePhone:N,role:S,roles:R,authPerms:M,displayName:K,givenName:B,familyName:V,jobTitle:$}=m.body,A={tenantId:m.params.tenantId,invitedBy:m.user.id};return E!==void 0&&(A.inviteeEmail=E),v!==void 0&&(A.inviteeUserId=v),N!==void 0&&(A.inviteePhone=N),S!==void 0&&(A.role=S),R!==void 0&&(A.roles=R),M!==void 0&&(A.authPerm=ti(M)),K!==void 0&&(A.displayName=K),B!==void 0&&(A.givenName=B),V!==void 0&&(A.familyName=V),$!==void 0&&(A.jobTitle=$),Zo(A,nS(t))}}),s=X(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:aS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.status!==void 0&&(E.status=m.query.status),m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await es(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T(N,v.meta)}}),a=X(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken);let v=await Yo(E,e);if(!v.ok)return v;let N=v.data;if(!N)return v;let{authPerm:S,...R}=N;return T({...R,authPerms:Xt(S)})}}),c=X(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};return m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken),Qo(E,e)}}),l=X(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:sS},handler:async m=>ns({inviteId:m.body.inviteId,revokedBy:m.user.id},e)}),u=X(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:iS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await ts(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T({members:N},v.meta)}}),p=X(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:cS},handler:async m=>{let E={tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id};return m.body.role!==void 0&&(E.role=m.body.role),m.body.roles!==void 0&&(E.roles=m.body.roles),m.body.authPerms!==void 0&&(E.authPerm=ti(m.body.authPerms)),is(E,e)}}),f=X(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:lS},handler:async m=>rs({tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id},e)});return Kp("/tenants",[n,i,o,s,a,c,l,u,p,f])}function Hg(t){return X(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Ea.updateProfile.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),cu(n,r)}})}function Eu(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function Fg(t){return Le(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:Ci.resendVerification.body},handler:async e=>{let r=Eu(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),Vo(n,r)}})}function Vg(t){return X(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:Ci.verifyCode.body},handler:async e=>{let r=Eu(t.auth);return jo({challengeId:e.body.challengeId,code:e.body.code},r)}})}var pf="oauth_state",dS=600;function Bg(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function jg(t,e,r){wa(t,pf,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:dS})}function pS(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function Gg(t,e){let r=af(t,pf);return Na(t,pf,{path:"/"}),!r||!e?!1:pS(r,e)}function fS(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function mS(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function $g(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:o=[]}=e;return async(s,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=fS(s),u=await mS(s,o),p=[`${i}:ip:${l}`];u&&p.push(`${i}:id:${u}`);for(let f of p){let m=await c.consume(f,{limit:r,windowMs:n});if(!m.allowed){let E=Math.ceil(m.retryAfterMs/1e3);return s.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(E)})}}return a()}}function Me(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function qg(t,e,r={}){let n=Object.keys(r).length===0,i=s=>n||r[s]!==!1;t.get("/health",s=>s.json({ok:!0},200));let o=(s,a)=>t.use(s,$g(e.auth,a));if(o("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),o("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),o("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),o("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),o("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),o("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),o("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),o("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),o("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Me(t,rg(e)),Me(t,lg(e)),Me(t,sg(e)),Me(t,cg(e)),Me(t,ag(e)),Me(t,ug(e)),Me(t,ng(e)),Me(t,ig(e)),Me(t,og(e))),i("password")&&(Me(t,wg(e)),Me(t,Ng(e)),Me(t,Rg(e))),i("verification")&&(Me(t,Vg(e)),Me(t,Fg(e))),i("sessions")&&(Me(t,Dg(e)),Me(t,Pg(e)),Me(t,Ug(e))),i("mfa")&&(Me(t,Ag(e)),Me(t,_g(e)),Me(t,gg(e)),Me(t,vg(e)),Me(t,Tg(e))),i("oauth")){let s=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=Bg();return jg(a,c,s),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let u=await a.req.raw.clone().json();typeof u.state=="string"&&(l=u.state)}catch{l=void 0}return l!==void 0&&!Gg(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Me(t,bg(e)),Me(t,xg(e)),Me(t,Sg(e)),Me(t,Ig(e))}i("users")&&Me(t,Hg(e)),i("tenants")&&t.route("",Kg(e))}function ff(t){Lp(Sy);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:o,features:s}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),o&&o.length>0&&(a.trustedOrigins=o);let c=e.security.tokenAudiences?.cookieNames;if(c){let u={cookieNames:c};e.security.systemTenantId&&(u.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=u}let l=new Gr;return qg(l,a,s),l}var Sr=F({message:w(y())}),Wg=F({message:w(y()),tenantId:y(),userId:y()}),mf={tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))},zg=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),memberUpdatedAt:y(),profileUpdatedAt:w(y())}),hS=F({...mf,createdAt:y(),updatedAt:y()}),ES=F({tenantId:y(),userId:y(),status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y(),tenantProfile:w(hS)}),Jg=Z(ES),Yg=F({tenantId:y(),userId:y()}),yS=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerm:w(qe()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Xg=Z(yS),gS=F({id:y(),name:w(y()),email:w(y()),jobTitle:w(y())}),Qg=F({id:y(),tenantId:y(),invitedBy:gS,inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),status:y(),expiresAt:y(),createdAt:y(),updatedAt:y()}),Zg=Z(Qg),ev=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),tv=F({tenantId:y(),userId:y()}),rv=F({invites:Z(Qg)}),vS=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y()}),nv=Z(vS),iv=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y(),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),username:w(y()),metadata:w(Ee(y(),ge())),mfaRequired:yt(),mfaMethods:Oi(Z(y()))});var yu={limit:w(Ue(qe(),Wn())),cursor:w(y())},AS={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:F({tenantId:y(),userId:y(),tenantType:w(y()),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Wg},TS={method:"POST",path:"/tenant/profile",kind:"data",body:F({tenantId:y(),userId:y()}),response:zg},_S={method:"POST",path:"/tenant/profile/update",kind:"data",body:F({tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},IS={method:"POST",path:"/tenant/members/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),...yu}),response:Jg},xS={method:"POST",path:"/tenant/members/update-status",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),status:Yt(["invited","active","suspended","removed"])}),response:Sr},bS={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y()))}),response:Sr},SS={method:"POST",path:"/tenant/members/remove",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y()}),response:Sr},wS={method:"POST",path:"/tenant/members/add",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Yg},NS={method:"POST",path:"/tenant/invites/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),status:w(Yt(["pending","accepted","declined","revoked","expired"])),...yu}),response:Zg},RS={method:"POST",path:"/tenant/invites/create",kind:"data",body:F({tenantId:y(),invitedBy:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:ev},sv=F({userId:y(),inviteId:w(y()),inviteToken:w(y())}),OS={method:"POST",path:"/tenant/invites/accept",kind:"data",body:sv,response:tv},kS={method:"POST",path:"/tenant/invites/decline",kind:"data",body:sv,response:Sr},CS={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:F({inviteId:y(),revokedBy:y()}),response:Sr},PS={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:F({email:w(y()),phone:w(y())}),response:rv},DS={method:"POST",path:"/user/tenants/list",kind:"data",body:F({userId:y(),tenantType:w(y()),parentTenantId:w(y()),...yu}),response:Xg},ss={actorUserId:y(),systemTenantId:y()},US={method:"POST",path:"/accounts/list",kind:"data",body:F({...ss,status:w(Yt(["active","inactive"])),...yu}),response:nv},LS={method:"POST",path:"/accounts/get",kind:"data",body:F({...ss,userId:y()}),response:iv},MS={method:"POST",path:"/accounts/update-profile",kind:"data",body:F({...ss,userId:y(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),contactEmail:w(y()),contactPhone:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},KS={method:"POST",path:"/accounts/update-status",kind:"data",body:F({...ss,userId:y(),status:Yt(["active","suspended","deleted"])}),response:Sr},HS={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:F({...ss,userId:y(),credentialType:w(y())}),response:Sr},FS={method:"POST",path:"/accounts/remove",kind:"data",body:F({...ss,userId:y()}),response:Sr},Je={bootstrapTenantOwner:AS,getTenantProfile:TS,updateTenantProfile:_S,listTenantMembers:IS,updateTenantMemberStatus:xS,updateTenantMemberPermission:bS,removeTenantMember:SS,addMemberToTenant:wS,listTenantInvites:NS,inviteToTenant:RS,acceptInvite:OS,declineInvite:kS,revokeInvite:CS,checkPendingInvites:PS,listUserTenants:DS,listAccounts:US,getAccount:LS,updateAccountProfile:MS,updateAccountStatus:KS,resetAccountCredentials:HS,removeAccount:FS};async function oi(t,e,r,n){let i=await lt({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return d(i.errors,i.meta);let o=await n.tenants.get(e);return o.ok?o.data?o.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T({actor:i.data}):d(wt.TENANT_NOT_FOUND()):d(o.errors,o.meta)}var _n={CANNOT_REMOVE_ACTIVE_ACCOUNT:_("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:_("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:_("NO_CHANGES","At least one field must be provided")};var VS=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function hf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=t.status??"active",o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let s=await r.users.getByStatus(i,o);if(!s.ok)return d(s.errors,s.meta);let a=[];for(let c of s.data){let l=await r.users.getById(c);if(l.ok&&l.data){let u=l.data,p={id:u.id,status:u.status,createdAt:u.createdAt,updatedAt:u.updatedAt};u.contactEmail!==void 0&&(p.contactEmail=u.contactEmail),u.contactPhone!==void 0&&(p.contactPhone=u.contactPhone),u.displayName!==void 0&&(p.displayName=u.displayName),a.push(p)}}return T(a,s.meta)}async function Ef(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return d(i.errors,i.meta);if(!i.data)return d(q.NOT_FOUND());let o=i.data,s=await r.userAuths.get(t.userId),a={id:o.id,status:o.status,createdAt:o.createdAt,updatedAt:o.updatedAt,mfaRequired:s.ok&&s.data?s.data.mfaRequired:!1,mfaMethods:s.ok&&s.data?s.data.mfaMethods:null};return o.contactEmail!==void 0&&(a.contactEmail=o.contactEmail),o.contactPhone!==void 0&&(a.contactPhone=o.contactPhone),o.displayName!==void 0&&(a.displayName=o.displayName),o.givenName!==void 0&&(a.givenName=o.givenName),o.familyName!==void 0&&(a.familyName=o.familyName),o.avatarUrl!==void 0&&(a.avatarUrl=o.avatarUrl),o.locale!==void 0&&(a.locale=o.locale),o.username!==void 0&&(a.username=o.username),o.metadata!==void 0&&(a.metadata=o.metadata),T(a)}async function yf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return d(_n.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?T(void 0):d(c.errors,c.meta)}async function gf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);if(!VS.has(t.status))return d(_n.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.userAuths.updateStatus(t.userId,t.status);if(!s.ok)return d(s.errors,s.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?T(void 0):d(a.errors,a.meta)}async function vf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.credentials.getByUserId(t.userId);if(!s.ok)return d(s.errors,s.meta);for(let a of s.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return d(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return d(a.errors,a.meta)}return T(void 0)}async function Af(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(o.data.status===ye.ACTIVE)return d(_n.CANNOT_REMOVE_ACTIVE_ACCOUNT());let s=await r.credentials.getByUserId(t.userId);if(s.ok)for(let l of s.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?T(void 0):d(c.errors,c.meta)}var BS=3,jS=10080,GS=100;function $S(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??jS,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??GS}}}function as(t){return{plugins:{database:t.plugins.database}}}function qS(t){return Dp({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Tf(t){let{auth:e,internal:r}=t,n=qS(r),i=new Gr;i.use("/*",async(g,I)=>{let O=g.req.header("Authorization");if(!O){await I();return}let P=O.match(/^Bearer\s+(.+)$/i);if(!P){await I();return}let C=P[1].split(".");if(C.length!==3||!C[1]){await I();return}let D;try{let L=C[1].replace(/-/g,"+").replace(/_/g,"/");D=JSON.parse(atob(L))}catch{await I();return}if(D.typ!==BS)return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let L=D.roles,H=Array.isArray(L)?L:[];if(!r.requiredRoles.some(Y=>H.includes(Y)))return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let o=X(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId};return g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.displayNameSource!==void 0&&(I.displayNameSource=g.body.displayNameSource),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),pu(I,e)}}),s=X(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async g=>{let I=await Ki({tenantId:g.body.tenantId,userId:g.body.userId},e);if(!I.ok)return I;let O=I.data;if(!O)return I;let{authPerm:P,...k}=O;return T({...k,authPerms:Xt(P)})}}),a=X(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async g=>{let{tenantId:I,userId:O,...P}=g.body,k={tenantId:I,userId:O};return P.contactEmail!==void 0&&(k.contactEmail=P.contactEmail),P.contactPhone!==void 0&&(k.contactPhone=P.contactPhone),P.displayName!==void 0&&(k.displayName=P.displayName),P.givenName!==void 0&&(k.givenName=P.givenName),P.familyName!==void 0&&(k.familyName=P.familyName),P.avatarUrl!==void 0&&(k.avatarUrl=P.avatarUrl),P.locale!==void 0&&(k.locale=P.locale),P.bio!==void 0&&(k.bio=P.bio),P.jobTitle!==void 0&&(k.jobTitle=P.jobTitle),P.metadata!==void 0&&(k.metadata=P.metadata),os(k,e)}}),c=X(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await ts(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),l=X(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async g=>df({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId,status:g.body.status},e)}),u=X(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),is(I,e)}}),p=X(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async g=>rs({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId},e)}),f=X(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),du(I,e)}}),m=X(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await es(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),E=X(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,invitedBy:g.body.invitedBy};return g.body.inviteeUserId!==void 0&&(I.inviteeUserId=g.body.inviteeUserId),g.body.inviteeEmail!==void 0&&(I.inviteeEmail=g.body.inviteeEmail),g.body.inviteePhone!==void 0&&(I.inviteePhone=g.body.inviteePhone),g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),Zo(I,$S(e))}}),v=X(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async g=>{let I={userId:g.body.userId};g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken);let O=await Yo(I,e);if(!O.ok)return O;let P=O.data;if(!P)return O;let{authPerm:k,...C}=P;return T({...C,authPerms:Xt(k)})}}),N=X(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async g=>{let I={userId:g.body.userId};return g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken),Qo(I,e)}}),S=X(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async g=>ns({inviteId:g.body.inviteId,revokedBy:g.body.revokedBy},e)}),R=X(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async g=>{let I={};return g.body.email!==void 0&&(I.email=g.body.email),g.body.phone!==void 0&&(I.phone=g.body.phone),fu(I,e)}}),M=X(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async g=>{let I={userId:g.body.userId};g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.parentTenantId!==void 0&&(I.parentTenantId=g.body.parentTenantId),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await mu(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),K=X(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId};return g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor),hf(I,as(e))}}),B=X(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async g=>Ef({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))}),V=X(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async g=>{let{actorUserId:I,systemTenantId:O,userId:P,...k}=g.body,C={actorUserId:I,systemTenantId:O,userId:P};return k.displayName!==void 0&&(C.displayName=k.displayName),k.givenName!==void 0&&(C.givenName=k.givenName),k.familyName!==void 0&&(C.familyName=k.familyName),k.avatarUrl!==void 0&&(C.avatarUrl=k.avatarUrl),k.locale!==void 0&&(C.locale=k.locale),k.contactEmail!==void 0&&(C.contactEmail=k.contactEmail),k.contactPhone!==void 0&&(C.contactPhone=k.contactPhone),k.metadata!==void 0&&(C.metadata=k.metadata),yf(C,as(e))}}),$=X(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async g=>gf({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId,status:g.body.status},as(e))}),A=X(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId};return g.body.credentialType!==void 0&&(I.credentialType=g.body.credentialType),vf(I,as(e))}}),x=X(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async g=>Af({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))});function b(g){let{method:I,path:O}=g.routeMeta,P=I.toLowerCase();i[P](O,g)}return b(o),b(s),b(a),b(c),b(l),b(u),b(p),b(f),b(m),b(E),b(v),b(N),b(S),b(R),b(M),b(K),b(B),b(V),b($),b(A),b(x),i}var av=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},cv=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,o=e.length-1;i<=n;i++,o--)r[i]=e.charCodeAt(i),r[o]=e.charCodeAt(o);return r};function Fa(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var WS=t=>t.requestContext;var _f=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=rw(r),o,s;try{o=i.createRequest(r),s=WS(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(o,{event:r,requestContext:s,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},gu=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=`https://${this.getDomainName(t)}${this.getPath(t)}`,n=e?`${r}?${e}`:r,i=this.getHeaders(t),o={headers:i,method:this.getMethod(t)};if(t.body){let s=t.isBase64Encoded?cv(t.body):new TextEncoder().encode(t.body);o.body=s,i.set("content-length",s.length.toString())}return new Request(n,o)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??lv,o=!!(n&&i(n));if(!o){let a=e.headers.get("content-encoding");o=sw(a)}let s={body:o?av(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:o,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,s),s.multiValueHeaders?e.headers.forEach((a,c)=>{s.multiValueHeaders[c]=[a]}):e.headers.forEach((a,c)=>{s.headers[c]=a}),s}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},zS=class extends gu{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},JS=new zS,YS=class extends gu{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.multiValueHeaders)for(let[r,n]of Object.entries(t.multiValueHeaders))n&&n.forEach(i=>e.append(r,Fa(i)));if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&!e.has(r)&&e.set(r,Fa(n));return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},XS=new YS,QS=class extends gu{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=Fa(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,Fa(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},ZS=new QS,ew=class extends gu{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&n.forEach(i=>e.append(r,Fa(i)));return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},tw=new ew,rw=t=>nw(t)?ZS:iw(t)?JS:ow(t)?tw:XS,nw=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,iw=t=>Object.hasOwn(t,"rawPath")&&Object.hasOwn(t.requestContext??{},"http"),ow=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,lv=t=>/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(t)?!0:!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(t),sw=t=>!!t&&!/^identity$/i.test(t);var uv=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,i=(s=>typeof s=="string"?s==="*"?()=>s:a=>s===a?a:null:typeof s=="function"?s:a=>s.includes(a)?a:null)(e.origin),o=(s=>{if(typeof s=="function")return async(a,c)=>(await s(a,c)).join(",");if(Array.isArray(s)){let a=s.join(",");return()=>a}else return()=>""})(e.allowMethods);return async function(a,c){function l(p,f){a.res.headers.set(p,f)}let u=await i(a.req.header("origin")||"",a);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){e.origin!=="*"&&a.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await o(a.req.header("origin")||"",a);p&&l("Access-Control-Allow-Methods",p);let f=n;if(!f){let m=a.req.header("Access-Control-Request-Headers");m&&(f=m.split(",").map(E=>E.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};var aw={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function Fi(t={}){let e={...aw,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var If={LOW:Fi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:Fi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:Fi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:Fi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var dv={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function xf(t,e={}){return{system:t,policy:{...dv.policy,...e.policy??{}},version:e.version??dv.version,...e.email&&{email:e.email}}}var pv=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],fv=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],bf=[...pv,...fv];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function mv(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function hv(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Ev={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function yv(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",o=typeof r.parseUserAgent=="function";if(!i&&!o)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Ev[e];n&&hv(t,String(e),n)}function Sf(t,e){mv(t,String(e)),yv(t,e)}var gv={debug:0,info:1,warn:2,error:3},vu=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=gv[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&gv[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),o=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${o} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function vv(t){return new vu(t)}var Au=new vu({enabled:!1});function cs(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Vi(t,e){let r=cs(t),n=cs(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Av(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Vi(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&Vi(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Vi(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Vi(t,e.slice(2))>=0:e.startsWith(">")?Vi(t,e.slice(1))>0:e.startsWith("<=")?Vi(t,e.slice(2))<=0:e.startsWith("<")?Vi(t,e.slice(1))<0:!1}function cw(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function lw(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function ls(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())wf(n,i);return t}let e=[];if(cw(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,o]=n;wf(i,o),r.set(i,o)}return r}function wf(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");lw(t,e)}function Nf(t,e){wf(t,e)}function Tu(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function _u(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Rf(t,e={},r,n=Au,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let o=new Map;for(let E of t)o.set(E.name,E);let s=new Map,a=new Map;for(let E of o.keys())s.set(E,0),a.set(E,[]);for(let E of o.values()){let v=E.dependencies??[];for(let N of v){let S=typeof N=="string"?N:N.name,R=typeof N=="string"?void 0:N.version;if(!o.has(S))throw new Error(`Plugin '${String(E.name)}' depends on '${String(S)}' which is not defined`);if(R){let M=o.get(S);if(M.version&&!Av(M.version,R))throw new Error(`Plugin '${String(E.name)}' requires '${String(S)}' ${R}, but version ${M.version} is provided`)}a.get(S).push(E.name),s.set(E.name,(s.get(E.name)??0)+1)}}let c=[];for(let[E,v]of s.entries())v===0&&c.push(E);let l=[];for(;c.length>0;){let E=c.shift();l.push(E);for(let v of a.get(E)??[]){let N=(s.get(v)??0)-1;s.set(v,N),N===0&&c.push(v)}}if(l.length!==o.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let u={},p={get(E){if(!u[E])throw new Error(`Plugin '${String(E)}' not found or not yet initialized`);return u[E]},has(E){return E in u},getRegistry(){return u}};for(let E of l){n.group(`Initializing plugin: ${String(E)}`),n.time(`Plugin: ${String(E)}`);let v=o.get(E),N=e[E],S=null;if(N!==void 0?(n.debug("Using override"),Tu(N)?(n.debug("Creating from factory wrapper"),S=await N.create(p)):_u(N)?(n.debug("Lazy loading plugin"),S=await N.load()):(n.debug("Using direct instance"),S=N)):v.factory?(n.debug("Creating from descriptor factory"),S=await v.factory(p)):v.instance&&(n.debug("Using descriptor instance"),S=v.instance),!S&&v.required)throw new Error(`Required plugin '${String(E)}' is missing`);if(S){if(E==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Sf(S,E),n.debug("Validation passed")}catch(K){throw n.error("Validation failed:",K),new Error(`Plugin '${String(E)}' validation failed: ${K instanceof Error?K.message:String(K)}`)}}u[E]=S;let M=S;M.initialize&&(n.debug("Calling plugin initialize()"),await M.initialize()),n.info(`Plugin '${String(E)}' initialized successfully`)}else n.warn(`Plugin '${String(E)}' is null/undefined`);n.timeEnd(`Plugin: ${String(E)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),u.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),u.credential=e.credential),i.extraEntries&&Object.assign(u,i.extraEntries),!uw(u))throw new Error("Plugin registry is incomplete - missing required plugins");let f=u,m=ls(f.oauthProviders);if(!m){let E=e.oauthProviders;E!==void 0&&!Tu(E)&&!_u(E)?m=ls(E)??new Map:m=new Map}return f.oauthProviders=m,await r?.afterInit?.(f),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),f}function uw(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function Of(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function Va(t){let e=t.debug?vv({enabled:!0,prefix:"[auth-core SDK]"}):Au;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=ls(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Rf(bf,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let o=Fi(t.security??{});e.debug("Security level:",o.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let s=xf({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",s.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:o,system:s,async healthCheck(){let a=[];for(let[l,u]of Object.entries(i)){if(!u||typeof u!="object")continue;let p=u,f={name:String(l),healthy:!0};if(p.health)try{let m=await p.health();f.healthy=m,m||(f.error=`Plugin '${l}' health check failed`)}catch(m){f.healthy=!1,f.error=m instanceof Error?m.message:"Health check threw error"}a.push(f)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await Of(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Nf(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var xu=[];function Ba(t){let e=process.env[t];return e||(xu.push(t),"")}function kf(t,e){return e?Ba(t):process.env[t]??""}function Tv(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function mw(t){let e=Tv(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var hw=process.env.SMTP_MODE==="smtp"?"smtp":"console",Bi=process.env.EMAIL_MODE;if(Bi&&Bi!=="queue"&&Bi!=="smtp"&&Bi!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Bi}`);var us=Bi||hw,Ew=us==="console"?"console":"smtp",Cf=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",bu=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(us==="queue"&&Cf!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Cf}`);if(bu!=="generic"&&bu!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${bu}`);function Iu(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function yw(){let t=Iu(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=Iu(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=Iu(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=Iu(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var ja=yw(),gw=typeof ja=="string"?ja==="cookie"||ja==="both":Object.values(ja).some(t=>t==="cookie"||t==="both"),j={dynamodbTableName:Ba("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:Ba("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:Ba("JWT_PRIVATE_KEY"),jwtPublicKey:Ba("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:kf("SMTP_USER",us==="smtp"),pass:kf("SMTP_PASS",us==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Ew},email:{mode:us,queue:{provider:Cf,url:kf("EMAIL_QUEUE_URL",us==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:bu,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:mw("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Tv("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:ja,...gw?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function _v(){if(xu.length>0){let t=xu.map(e=>` - ${e}`).join(`
|
|
15
|
+
`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function Ai(){return new Dc}function Ih(t,e){return t?.[e]??t?.["*"]??0}var B_="AUTH_INVALID_CREDENTIALS",Pc=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[rr.JWT,rr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return d($t({message:"No auth methods configured"}));for(let i of n){let o=this.methods.get(i);if(!o)continue;let s=await o.authenticate(r);if(s.ok)return T({user:s.data,method:i});if(!s.errors||s.errors.length===0)continue;let a=s.errors[0];if(a?.code===B_)return d(a)}return d($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Ti(t,e={}){return new Pc(t,e)}var Ds={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function Dn(t,e){return{name:rr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return d(nr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return d(nn({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return d(nr({message:"Bearer token is empty"}));let o=await e(i,t);if(!o.ok){let a=o.errors[0];return a?.code===Ds.TOKEN_EXPIRED?d(Hr()):a?.code===Ds.TOKEN_MALFORMED?d(nn()):d(qt())}let s=o.data;return s.exp&&s.exp<Date.now()/1e3?d(Hr()):T({id:s.sub,perms:s.perms,tenantId:s.tid,tenantType:s.tty,roles:s.roles??[]})}}}function Uc(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function Pn(t){return{name:rr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return d(nr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?T({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):d(qt({message:"Invalid API key"}))}}}ra();function Sl(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var SI="x-gateway-auth";function Ro(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??SI;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let o=Sl(e);n=Vt({kty:"OKP",crv:"Ed25519",x:o},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:rr.GATEWAY_JWT,async authenticate(o){if(e!==void 0){let l=o.headers[r];if(!l)return d(nr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return d(qt({message:`${r} must use Bearer scheme`}));let u=l.slice(7);if(!u)return d(nr({message:"Gateway JWT is empty"}));let p;try{let f=await i(),{payload:m}=await jn(u,f,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=m}catch(f){return f.code==="ERR_JWT_EXPIRED"?d(Hr({message:"Gateway JWT expired"})):d(qt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let f=typeof p.jti=="string"?p.jti:void 0;if(!f)return d(qt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(f))return d(qt({message:"Gateway JWT jti already used (replay)"}))}}let s=Uc(o.headers);if(s===null)return o.headers.authorization??o.headers.Authorization?d(nn({message:"Authorization header must use Bearer scheme"})):d(nr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(s,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Ds.TOKEN_EXPIRED?d(Hr()):l?.code===Ds.TOKEN_MALFORMED?d(nn()):d(qt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?d(Hr()):T({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var bM=globalThis.performance;ra();var jI="TOKEN_EXPIRED",WE="TOKEN_MALFORMED";function GI(t){return"secret"in t}function $I(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function qI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=Sl(t);return Vt({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function zE(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function WI(t){try{let e=atob(t);return zE(e)}catch{return null}}async function zI(t){if(GI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=zE(e);if(n)return Vt(n,r);let i=WI(e);return i?Vt(i,r):r==="EdDSA"&&$I(e)?qI(e):bl(e,r)}function JI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function Ar(t){let e=null;return async(r,n)=>{try{e||(e=zI(t));let i=await e,{payload:o}=await jn(r,i,JI(t));return T(o)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?d({code:jI,message:"Token has expired"}):d({code:WE,message:i.message}):d({code:WE,message:"JWT verification failed"})}}}function gp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Dn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as YI}from"crypto";async function vp(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??YI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function dn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:io(t)}:{status:e?.error??400,body:io(t)}}var Oo=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function ko(t,e){let r=e?.name;return function(i){if(i.ok)return dn(i);let o=i.errors[0]?.code;if(!o||!(o in t))throw new Oo(o,i,r);let s=t[o];return dn(i,{error:s})}}function Co(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof Oo)return dn(n.result,{error:e});throw n}}}var XI={...Ot},j1=Co(ko(XI),400);var lK=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var QE=Symbol();var ZE=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,r=>r.toLowerCase())}}).formData();var ix=1e4,Ol=t=>"headers"in t,ry=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,i=(Ol(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?ox(t,{all:r,dot:n}):{}};async function ox(t,e){if(!Ol(t)&&t.bodyCache.formData)return ey(await t.bodyCache.formData,e);let r=Ol(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),i=ZE(n,r.get("Content-Type")||"");Ol(t)||(t.bodyCache.formData=i);let o=await i;return o?ey(o,e):{}}function ey(t,e){let r=Object.create(null),n={count:0};return t.forEach((i,o)=>{e.all||o.endsWith("[]")?sx(r,o,i):r[o]=i}),e.dot&&Object.entries(r).forEach(([i,o])=>{i.includes(".")&&(ax(r,i,o,n),delete r[i])}),r}var sx=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},ax=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let i=t,o=e.split(".",34);o.length>33&&ty(),o.forEach((s,a)=>{a===o.length-1?i[s]=r:((!i[s]||typeof i[s]!="object"||Array.isArray(i[s])||i[s]instanceof File)&&(n.count++>=ix&&ty(),i[s]=Object.create(null)),i=i[s])})},ty=()=>{throw new Error("Nesting limit exceeded")};var Tp=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ny=t=>{let{groups:e,path:r}=cx(t),n=Tp(r);return lx(n,e)},cx=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},lx=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},kl={},iy=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return kl[n]||(r[2]?kl[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:kl[n]=[t,r[1],!0]),kl[n]}return null},oy=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},ux=t=>oy(t,decodeURI),_p=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let o=e.indexOf("?",n),s=e.indexOf("#",n),a=o===-1?s===-1?void 0:s:s===-1?o:Math.min(o,s),c=e.slice(r,a);return ux(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var sy=t=>{let e=_p(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},qn=(t,e,...r)=>(r.length&&(e=qn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Cl=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(i.charCodeAt(i.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let o=i.slice(0,-1);n+="/"+o,r.push(n)}else n+="/"+i}),r.filter((i,o,s)=>s.indexOf(i)===o)},Po=t=>t.indexOf("%")!==-1?oy(t,dx):t,Ap=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Po(t)),ay=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let i;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let a=t.indexOf("?",8);if(a===-1)return;for(t.startsWith(e,a+1)||(a=t.indexOf(`&${e}`,a+1));a!==-1;){let c=t.charCodeAt(a+e.length+1);if(c===61){let l=a+e.length+2,u=t.indexOf("&",l);return Ap(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";a=t.indexOf(`&${e}`,a+1)}if(i=/[%+]/.test(t),!i)return}let o=Object.create(null);i??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let a=t.indexOf("&",s+1),c=t.indexOf("=",s);c>a&&a!==-1&&(c=-1);let l=t.slice(s+1,c===-1?a===-1?void 0:a:c);if(i&&(l=Ap(l)),s=a,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,a===-1?void 0:a),i&&(u=Ap(u))),r?(o[l]&&Array.isArray(o[l])||(o[l]=[]),o[l].push(u)):o[l]??=u}return e?o[e]:o},cy=ay,ly=(t,e)=>ay(t,e,!0),dx=decodeURIComponent;var uy=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r}param(t){return t?this.#r(t):this.#o()}#r(t){let e=this.#t[0][this.routeIndex]?.[1][t],r=this.#i(e);return r&&Po(r)}#o(){let t={},e=Object.keys(this.#t[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#i(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Po(n))}return t}#i(t){return this.#t[1]?this.#t[1][t]:t}query(t){return cy(this.url,t)}queries(t){return ly(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return ry(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let i in e)return e[i].then(o=>{i==="json"&&(o=JSON.stringify(o));let s=i==="formData"?void 0:r.headers.get("content-type");return new Response(o,{headers:s?{"Content-Type":s}:void 0})[t]()});return e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){(this.#e??={})[t]=e}valid(t){return this.#e?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[QE](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var dy={Stringify:1,BeforeStream:2,Stream:3},px=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var Ip=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let o=t.callbacks;if(!o?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let s=Promise.all(o.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Ip(c,e,!1,n,i))).then(()=>i[0]));return r?px(await s,o):s};var fx="text/plain; charset=UTF-8",xp=(t,e)=>({"Content-Type":t,...e}),ia=(t,e)=>new Response(t,e),bp=class{#e;#t;env={};#r;finalized=!1;error;#o;#i;#n;#c;#s;#a;#u;#d;#p;constructor(t,e){this.#e=t,e&&(this.#i=e.executionCtx,this.env=e.env,this.#a=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new uy(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#i&&"respondWith"in this.#i)return this.#i;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#i)return this.#i;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=ia(null,{headers:this.#u??=new Headers})}set res(t){if(this.#n&&t){t=ia(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#s??=e=>this.html(e),this.#s(...t));setLayout=t=>this.#c=t;getLayout=()=>this.#c;setRenderer=t=>{this.#s=t};header=(t,e,r)=>{this.finalized&&(this.#n=ia(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#u??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#o=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#l(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#u;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[o,s]of new Headers(e.headers))o==="set-cookie"?n.append(o,s):n.set(o,s)}if(r){if(!n){let o=0;for(let s in r)if(++o>1||typeof r[s]!="string"){n=new Headers;break}}if(n)for(let o in r){let s=r[o];if(typeof s=="string")n.set(o,s);else{n.delete(o);for(let a of s)n.append(o,a)}}}let i=typeof e=="number"?e:e?.status??this.#o;return ia(t,{status:i,headers:n??r})}newResponse=(...t)=>this.#l(...t);body=(t,e,r)=>this.#l(t,e,r);text=(t,e,r)=>!this.#u&&!this.#o&&!e&&!r&&!this.finalized?new Response(t):this.#l(t,e,xp(fx,r));json=(t,e,r)=>this.#l(JSON.stringify(t),e,xp("application/json",r));html=(t,e,r)=>{let n=i=>this.#l(i,e,xp("text/html; charset=UTF-8",r));return typeof t=="object"?Ip(t,dy.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#a??=()=>ia(),this.#a(this))};var Sp=(t,e,r)=>(n,i)=>{let o=-1;return s(0);async function s(a){if(a<=o)throw new Error("next() called multiple times");o=a;let c,l=!1,u;if(t[a]?(u=t[a][0][0],n.req.routeIndex=a):u=a===t.length&&i||void 0,u)try{c=await u(n,()=>s(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var py=["get","post","put","delete","options","patch","query"],Dl="Can not add a route since the matcher is already built.",Pl=class extends Error{};var fy="__COMPOSED_HANDLER";var mx=t=>t.text("404 Not Found",404),my=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},hy=class Ey{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...py,"all"].forEach(i=>{this[i]=(o,...s)=>{let a=i.toUpperCase();return typeof o=="string"?this.#e=o:this.#o(a,this.#e,o),s.forEach(c=>{this.#o(a,this.#e,c)}),this}}),this.on=(i,o,...s)=>{for(let a of[o].flat()){this.#e=a;for(let c of[i].flat()){let l=c.toUpperCase();for(let u of s)this.#o(l,this.#e,u)}}return this},this.use=(i,...o)=>(typeof i=="string"?this.#e=i:(this.#e="*",o.unshift(i)),o.forEach(s=>{this.#o("ALL",this.#e,s)}),this);let{strict:r,...n}=e;Object.assign(this,n),this.getPath=r??!0?e.getPath??_p:sy}#t(){let e=new Ey({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=mx;errorHandler=my;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let o;r.errorHandler===my?o=i.handler:(o=async(s,a)=>(await Sp([],r.errorHandler)(s,()=>i.handler(s,a))).res,o[fy]=i.handler),n.#o(i.method,i.path,o,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=qn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,o;n&&(typeof n=="function"?o=n:(o=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let s=o?c=>{let l=o(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=qn(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(i(c.req.raw),...s(c));if(u)return u;await l()};return this.#o("ALL",qn(e,"*"),a),this}#o(e,r,n,i){r=qn(this._basePath,r);let o={basePath:i!==void 0?qn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,o]),this.routes.push(o)}#i(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let o=this.getPath(e,{env:n}),s=this.router.match(i,o),a=new bp(e,{path:o,matchResult:s,env:n,executionCtx:r,notFoundHandler:this.#r});if(s[0].length===1){let l;try{l=s[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#i(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#i(u,a)):l??this.#r(a)}let c=Sp(s[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#i(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${qn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var ut=()=>Object.create(null);var Ul=[];function wp(t,e){let r=this.buildAllMatchers(),n=((i,o)=>{let s=r[i]||r.ALL,a=s[2][o];if(a)return a;let c=o.match(s[0]);if(!c)return[[],Ul];let l=c.indexOf("",1);return[s[1][l],c]});return this.match=n,n(t,e)}var Rp="[^/]+";var Op="(?:|/.*)",Wn=Symbol(),yy=new Set(".\\+*[^]$()");function hx(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===".*"||t==="(?:|/.*)"?e==="(?:|/.*)"?-1:1:e===".*"||e==="(?:|/.*)"?-1:t==="[^/]+"?1:e==="[^/]+"?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var gy=class Np{#e;#t;#r=ut();insert(e,r,n,i,o){let s=this;for(let a=0,c=e.length;a<c;a++){let l=e[a],u=l.length===1?l==="*"?a===c-1?["","",".*"]:["","",Rp]:null:l==="/*"?["","",Op]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(u){let f=u[1],m=u[2]||"[^/]+";if(f&&u[2]&&(m===".*"||(m=m.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(m))||m.length===1&&yy.has(m)))throw Wn;if(p=s.#r[m],!p){if(m!==".*"&&m!=="(?:|/.*)"){for(let E in s.#r)if((m.length>1||E.length>1)&&E!==".*"&&E!=="(?:|/.*)")throw Wn}p=s.#r[m]=new Np}f!==""&&(p.#t??=i.varIndex++,n.push([f,p.#t]))}else if(p=s.#r[l],!p){for(let f in s.#r)if(f.length>1&&f!==".*"&&f!=="(?:|/.*)")throw Wn;p=s.#r[l]=new Np}s=p}if(s.#e!==void 0)throw Wn;s.#e=o?-1:r}buildRegExpStr(){let e=Object.keys(this.#r).sort(hx).map(r=>{let n=this.#r[r],i=n.buildRegExpStr();return i===""?"":(typeof n.#t=="number"?`(${r})@${n.#t}`:yy.has(r)?`\\${r}`:r)+i}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&e.unshift(`#${this.#e}`),e.length===0?"":e.length===1?e[0]:"(?:"+e.join("|")+")"}};var kp=class{#e={varIndex:0};#t=new gy;#r=0;paths=ut();insert(t,e){if(e){this.#t.insert(t.split(""),0,[],this.#e,!0);return}let r=[],n=[],i=t;for(let s=0;;){let a=!1;if(i=i.replace(/\{[^}]+\}/g,c=>{let l=`@\\${s}`;return n[s]=[l,c],s++,a=!0,l}),!a)break}let o=i.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let s=n.length-1;s>=0;s--){let[a]=n[s];for(let c=o.length-1;c>=0;c--)if(o[c].indexOf(a)!==-1){o[c]=o[c].replace(a,n[s][1]);break}}this.#t.insert(o,this.#r,r,this.#e,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,o,s)=>o!==void 0?(r[++e]=Number(o),"$()"):(s!==void 0&&(n[Number(s)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var vy=ut();function Ay(t){return vy[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?Op:e==="*"?".*":`/:${Rp}`)}$`)}function Ll(t,e){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Ay(r).test(e))return[...t[r]]}var Ml=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={ALL:ut()},this.#t={ALL:ut()},this.#r={ALL:new kp}}#o(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===Wn?new Pl(e):r}}add(t,e,r){let n=this.#e,i=this.#t;if(!n)throw new Error(Dl);if(!n[t]){this.#r[t]=new kp;for(let a of[n,i]){a[t]=ut();for(let c in a.ALL)a[t][c]=[...a.ALL[c]],this.#o(t,c)}}e==="/*"&&(e="*");let o=t==="ALL"?Object.keys(n):[t];if(/\*$/.test(e)){let a=Ay(e);for(let c of o)n[c][e]||(this.#o(c,e),n[c][e]=Ll(n[c],e)||Ll(n.ALL,e)||[]);for(let c of[n,i])for(let l of o)for(let u in c[l])a.test(u)&&c[l][u].push([r,e]);return}let s=Cl(e)||[e];for(let a of s)for(let c of o)i[c][a]||(this.#o(c,a),i[c][a]=Ll(n[c],a)||Ll(n.ALL,a)||[]),i[c][a].push([r,a])}match=wp;buildAllMatchers(){let t=ut();for(let e of Object.keys(this.#t))t[e]=this.#i(e);return this.#e=this.#t=this.#r=void 0,vy=ut(),t}#i(t){let e=this.#e[t],r=this.#t[t],n=this.#r[t],i=ut(),o=[],[s,a,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let p=l[u],f=n.paths[u];if(!f){i[u]=[p.map(([m])=>[m,ut()]),Ul];continue}o[f[0]]=p.map(([m,E])=>[m,n.paths[E][1].reduceRight((v,[N],S)=>(v[N]=c[f[1][S][1]],v),ut())])}return[s,a.map(l=>o[l]),i]}};var Ty=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Dl);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,o=0,s;for(;o<i;o++){let a=r[o];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);s=a.match(t,e)}catch(c){if(c instanceof Pl)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(o===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,s}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var Cp=ut(),Ex=0,_y=class Iy{#e=[];#t=ut();#r=[];#o;#i=Cp;insert(e,r,n){let i=this,o=ny(r),s=new Set,a=0;for(let c of o){let l=o[++a],u=iy(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),p=Array.isArray(u),f=p?u[0]:u||c,m=i.#t[f]||=new Iy;u&&!m.#o&&(m.#o=u,i.#r.push(m)),i=m,p&&s.add(u[1])}i.#e.push({[e]:{handler:n,possibleKeys:[...s],score:++Ex}})}#n(e,r,n,i,o){for(let s=0,a=r.#e.length;s<a;s++){let c=r.#e[s],l=c[n]||c.ALL;if(l){l.params=ut(),e.push(l);for(let u=0,p=l.possibleKeys.length;u<p;u++){let f=l.possibleKeys[u];l.params[f]=o?.[f]&&!u?o[f]:i[f]??o?.[f]}}}}search(e,r){let n=[];this.#i=Cp;let i=[this],o=Tp(r),s=[],a=o.length,c=null;for(let l=0;l<a;l++){let u=o[l],p=l===a-1,f=[];for(let E=0,v=i.length;E<v;E++){let N=i[E],S=N.#t[u];S&&(S.#i=N.#i,p?(S.#t["*"]&&this.#n(n,S.#t["*"],e,N.#i),this.#n(n,S,e,N.#i)):f.push(S));for(let R of N.#r){let M=R.#o,K=N.#i===Cp?{}:{...N.#i};if(typeof M=="string"){(M==="*"||u.startsWith(M.slice(0,-1)))&&(this.#n(n,R,e,N.#i),M==="*"&&(R.#i=K,f.push(R)));continue}let[,B,V]=M;if(!(!u&&V===!0)){if(V!==!0){if(!c){c=[];let x=r[0]==="/"?1:0;for(let b=0;b<a;b++)c[b]=x,x+=o[b].length+1}let $=r.slice(c[l]),A=V.exec($);if(A){K[B]=A[0],this.#n(n,R,e,N.#i,K),A[0].length===$.length&&R.#t["*"]&&this.#n(n,R.#t["*"],e,N.#i,K);for(let x in R.#t){R.#i=K;let b=A[0].match(/\//g)?.length??0;(s[b]||=[]).push(R);break}continue}}(V===!0||V.test(u))&&(K[B]=u,p?(this.#n(n,R,e,K,N.#i),R.#t["*"]&&this.#n(n,R.#t["*"],e,K,N.#i)):(R.#i=K,f.push(R)))}}}let m=s.shift();i=m?f.concat(m):f}return n[1]&&n.sort((l,u)=>l.score-u.score),[n.map(({handler:l,params:u})=>[l,u])]}};var Dp=class{name="TrieRouter";#e=new _y;add(t,e,r){for(let n of Cl(e)||[e])this.#e.insert(t,n,r)}match(t,e){return this.#e.search(t,e)}};var Gr=class extends hy{constructor(t={}){super(t),this.router=t.router??new Ty({routers:[new Ml,new Dp]})}};function Pp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Dn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}function or(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var Up={...Ot},xy=Co(ko(Up),400);function Lp(t){Up={...Ot,...t},xy=Co(ko(Up),400)}function by(){return xy}function Ge(t,e,r){let{traceId:n,successStatus:i,adapter:o=by()}=r??{},s=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:s}},l=o(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let u=e.ok?T(e.data,a):{...e,meta:a},p=io(u);return t.json(p,l)}async function yx(t){let e={};t.req.raw.headers.forEach((s,a)=>{e[a]=s});let r={},n=t.req.query();for(let[s,a]of Object.entries(n))r[s]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function oa(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,o)=>{let s=or(i);try{let a=await yx(i),c=await e.resolve(n,a);if(!c.ok){if(r){await o();return}return Ge(i,d($t()),{traceId:s})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await o()}catch{if(r){await o();return}return Ge(i,d($t()),{traceId:s})}}}function Mp(t){return async(e,r)=>{let n=or(e),i=e.get("authResult");if(!i)return Ge(e,d($t()),{traceId:n});let{user:o}=i,s;if(t.loadResource){let l=e.req.param(),u=await t.loadResource(l,o);if(u===null)return Ge(e,d(Wt({message:"Resource not found for boundary check"})),{traceId:n});s=u}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(o,a,s);if(!c.ok)return Ge(e,c,{traceId:n});await r()}}function sa(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?d(r.issues.map(n=>{let i=n.path?.map(o=>typeof o=="object"?o.key:o).join(".")??"";return gi({message:i?`${i}: ${n.message}`:n.message})})):T(r.value)}function aa(t){return async(e,r)=>{let n=or(e);try{let i={};if(t.body){let o;try{o=await e.req.json()}catch{return Ge(e,d(oo({reason:"Request body is not valid JSON"})),{traceId:n})}let s=sa(t.body,o);if(!s.ok)return Ge(e,s,{traceId:n});i.body=s.data}if(t.params){let o=sa(t.params,e.req.param());if(!o.ok)return Ge(e,o,{traceId:n});i.params=o.data}if(t.query){let o=sa(t.query,e.req.query());if(!o.ok)return Ge(e,o,{traceId:n});i.query=o.data}if(t.headers){let o={};e.req.raw.headers.forEach((a,c)=>{o[c]=a});let s=sa(t.headers,o);if(!s.ok)return Ge(e,s,{traceId:n});i.headers=s.data}e.set("validatedData",i),await r()}catch(i){let o={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return Ge(e,d(gi(),o),{traceId:n})}}}function ca(t){return t.get("validatedData")?.body}function la(t){return t.get("validatedData")?.params}function ua(t){return t.get("validatedData")?.query}var t2=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function gx(t,e){let r=[...t,e];return async(n,i)=>{let o,s=async a=>{if(o||a>=r.length){!o&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await s(a+1)});l instanceof Response&&(o=l)};return await s(0),o}}function X(t,e){let r=[];if(e.auth!==!1){let o=Array.isArray(e.auth)?e.auth:void 0;r.push(oa({engine:t.auth,methods:o}))}e.permission&&r.push(Mp({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(o,s)=>{let a={body:void 0,query:void 0,params:o,user:s};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(aa({body:e.input.body,query:e.input.query,params:e.input.params}));let i=gx(r,async o=>{let s=or(o);try{let a=o.get("authResult"),c={body:ca(o),query:ua(o),params:la(o),user:a?.user,tenantContext:o.get("tenantContext"),traceId:s},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},u=await e.handler(l),p=e.successStatus??200;return Ge(o,u,{traceId:s,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:s,route:`${e.method} ${e.path}`,error:{message:c}})),Ge(o,d(so()),{traceId:s})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function Kp(t,e){let r=new Gr;for(let n of e){let{method:i,path:o}=n.routeMeta,s=o==="/"?t:`${t}${o}`;switch(i){case"GET":r.get(s,n);break;case"POST":r.post(s,n);break;case"PUT":r.put(s,n);break;case"PATCH":r.patch(s,n);break;case"DELETE":r.delete(s,n);break}}return r}var Sy={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var Kl,vx={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function Ax(t){return!t&&!Kl?vx:{lang:t?.lang??Kl?.lang,message:t?.message,abortEarly:t?.abortEarly??Kl?.abortEarly,abortPipeEarly:t?.abortPipeEarly??Kl?.abortPipeEarly}}var Tx;function _x(t){return Tx?.get(t)}var Ix;function xx(t){return Ix?.get(t)}var bx;function Sx(t,e){return bx?.get(t)?.get(e)}function Ri(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function dt(t,e,r,n,i){let o=i&&"input"in i?i.input:r.value,s=i?.expected??t.expects??null,a=i?.received??Ri(o),c={kind:t.kind,type:t.type,input:o,expected:s,received:a,message:`Invalid ${e}: ${s?`Expected ${s} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",u=i?.message??t.message??Sx(t.reference,c.lang)??(l?xx(c.lang):null)??n.message??_x(c.lang);u!==void 0&&(c.message=typeof u=="function"?u(c):u),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}function wx(t,e){return t===e||Number.isNaN(t)&&Number.isNaN(e)}function Nx(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function Ny(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}function Jt(t){return t["~standard"]={version:1,vendor:"valibot",validate:e=>t["~run"]({value:e},Ax())},t}var Rx=/^[\w+-]+(?:\.[\w+-]+)*@[\da-zA-Z]+(?:[.-][\da-zA-Z]+)*\.[a-zA-Z]{2,}$/u;function Hl(t,e){return{kind:"validation",type:"check",reference:Hl,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&dt(this,"input",r,n),r}}}function pn(t){return{kind:"validation",type:"email",reference:pn,expects:null,async:!1,requirement:Rx,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&dt(this,"email",e,r),e}}}function zn(t){return{kind:"validation",type:"integer",reference:zn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&dt(this,"integer",e,r),e}}}function Dt(t,e){return{kind:"validation",type:"max_length",reference:Dt,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Uo(t,e){return{kind:"validation",type:"max_value",reference:Uo,async:!1,expects:`<=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Hp(t,e){return{kind:"validation",type:"min_length",reference:Hp,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Lo(t,e){return{kind:"validation",type:"min_value",reference:Lo,async:!1,expects:`>=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Mo(t){return{kind:"transformation",type:"transform",reference:Mo,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function Ox(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function Fp(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return Jt({kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let o=0;o<i.length;o++){let s=i[o],a=this.item["~run"]({value:s},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:o,value:s};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else dt(this,"type",r,n);return r}})}function yt(t){return Jt({kind:"schema",type:"boolean",reference:yt,expects:"boolean",async:!1,message:t,"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:dt(this,"type",e,r),e}})}function Ko(t,e){return Jt({kind:"schema",type:"literal",reference:Ko,expects:Ri(t),async:!1,literal:t,message:e,"~run"(r,n){return wx(r.value,this.literal)?r.typed=!0:dt(this,"type",r,n),r}})}function Oi(t,e){return Jt({kind:"schema",type:"nullable",reference:Oi,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function qe(t){return Jt({kind:"schema",type:"number",reference:qe,expects:"number",async:!1,message:t,"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:dt(this,"type",e,r),e}})}function F(t,e){return Jt({kind:"schema",type:"object",reference:F,expects:"Object",async:!1,entries:t,message:e,"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let o in this.entries){let s=this.entries[o];if(o in i||(s.type==="exact_optional"||s.type==="optional"||s.type==="nullish")&&s.default!==void 0){let a=o in i?i[o]:Fp(s),c=s["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:o,value:a};for(let u of c.issues)u.path?u.path.unshift(l):u.path=[l],r.issues?.push(u);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[o]=c.value}else if(s.fallback!==void 0)r.value[o]=Ox(s);else if(s.type!=="exact_optional"&&s.type!=="optional"&&s.type!=="nullish"&&(dt(this,"key",r,n,{input:void 0,expected:`"${o}"`,path:[{type:"object",origin:"key",input:i,key:o,value:i[o]}]}),n.abortEarly))break}}else dt(this,"type",r,n);return r}})}function w(t,e){return Jt({kind:"schema",type:"optional",reference:w,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function Yt(t,e){return Jt({kind:"schema",type:"picklist",reference:Yt,expects:Ny(t.map(Ri),"|"),async:!1,options:t,message:e,"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:dt(this,"type",r,n),r}})}function Ee(t,e,r){return Jt({kind:"schema",type:"record",reference:Ee,expects:"Object",async:!1,key:t,value:e,message:r,"~run"(n,i){let o=n.value;if(o&&typeof o=="object"){n.typed=!0,n.value={};for(let s in o)if(Nx(o,s)){let a=o[s],c=this.key["~run"]({value:s},i);if(c.issues){let u={type:"object",origin:"key",input:o,key:s,value:a};for(let p of c.issues)p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let u={type:"object",origin:"value",input:o,key:s,value:a};for(let p of l.issues)p.path?p.path.unshift(u):p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else dt(this,"type",n,i);return n}})}function y(t){return Jt({kind:"schema",type:"string",reference:y,expects:"string",async:!1,message:t,"~run"(e,r){return typeof e.value=="string"?e.typed=!0:dt(this,"type",e,r),e}})}function wy(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function da(t,e){return Jt({kind:"schema",type:"union",reference:da,expects:Ny(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,"~run"(r,n){let i,o,s;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)o?o.push(c):o=[c];else{i=c;break}else s?s.push(c):s=[c]}if(i)return i;if(o){if(o.length===1)return o[0];dt(this,"type",r,n,{issues:wy(o)}),r.typed=!0}else{if(s?.length===1)return s[0];dt(this,"type",r,n,{issues:wy(s)})}return r}})}function ge(){return Jt({kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,"~run"(t){return t.typed=!0,t}})}function Ue(...t){return Jt({...t[0],pipe:t,"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}})}var Vp=F({maskedRecipient:w(y()),expiresAt:y()}),Bp=F({userId:y(),verification:w(F({channel:y(),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y()}))});var Pt=F({message:w(y())}),Ry=F({accessToken:y(),refreshToken:w(y()),expiresAt:qe()}),Oy=F({requiresChallenge:Ko(!0),challenge:F({type:w(y()),phase:w(y()),expiresAt:w(da([y(),qe()])),data:Ee(y(),ge())})}),ky=F({requiresMfa:Ko(!0),mfa:F({phase:w(y()),challengeId:y(),methods:Z(y()),method:w(y()),expiresAt:da([y(),qe()]),userId:y()})}),Cy=F({requiresVerification:Ko(!0),verification:F({channel:Ko("email"),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y(),userId:y()})}),ki=da([Oy,ky,Cy,Ry]),pa=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),username:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:y(),updatedAt:y()}),fa=F({challengeId:y(),expiresAt:y()});var Bt=(t=100)=>Ue(y(),Dt(t)),Fl=Ue(y(),Dt(320)),Jn=Ue(y(),Dt(4096)),ma=(t=256)=>Ue(y(),Dt(t)),jp=(t=8192)=>Ue(y(),Dt(t)),ha=Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100));var kx={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:w(Jn),metadata:w(Ee(Bt(),ge())),country:w(Bt()),city:w(Bt())}),response:ki},Cx={method:"POST",path:"/auth/register",kind:"data",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:Jn,displayName:w(ma()),givenName:w(ma()),familyName:w(ma()),avatarUrl:w(jp(2048)),locale:w(Bt()),metadata:w(Ee(Bt(),ge()))}),response:Bp},Dx={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:F({challengeId:y(),code:y()}),response:ki},Px={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:F({challengeId:y(),method:y(),code:y()}),response:ki},Ux={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:F({challengeId:y(),method:y(),userId:y()}),response:Vp},Lx={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},Mx={method:"POST",path:"/auth/logout",kind:"logout",public:!0},Kx={method:"GET",path:"/auth/me",kind:"data",response:pa},Hx={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:F({tenantId:y()})},Ut={authenticate:kx,register:Cx,completeChallenge:Dx,completeMfaChallenge:Px,issueMfaChallenge:Ux,refresh:Lx,logout:Mx,me:Kx,selectTenant:Hx};var Gp=F({method:y(),data:Ee(y(),ge())}),$p=F({method:y(),verified:yt(),data:Ee(y(),ge())}),Dy=F({method:y(),verifiedAt:Oi(y()),createdAt:y(),id:w(y()),label:w(y()),lastUsedAt:w(y())}),qp=F({authenticators:Z(Dy),total:qe()});var Fx={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:F({method:y(),data:w(Ee(y(),ge()))}),response:Gp},Vx={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:F({method:y(),data:w(Ee(y(),ge())),authenticatorId:w(y())}),response:$p},Bx={method:"GET",path:"/mfa/authenticators",kind:"data",query:F({method:w(y()),verifiedOnly:w(yt())}),response:qp},jx={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:F({method:y(),authenticatorId:w(y()),password:w(y())}),response:F({message:w(y())})},Gx={method:"PATCH",path:"/mfa/settings",kind:"data",body:F({mfaRequired:w(yt()),mfaMethods:w(Z(y())),password:w(y())}),response:F({mfaRequired:w(yt()),mfaMethods:w(Z(y()))})},Tr={setupAuthenticator:Fx,verifyAuthenticator:Vx,listAuthenticators:Bx,removeAuthenticator:jx,updateMfaSettings:Gx};var Wp=F({state:y()}),Py=F({provider:y(),providerId:w(y()),email:w(y()),linkedAt:w(y())}),zp=Z(Py);var $x={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:Wp},qx={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:F({provider:Ue(y(),Dt(100)),code:w(Ue(y(),Dt(8192))),credential:w(Ue(y(),Dt(8192))),state:w(Ue(y(),Dt(1024))),tenantId:w(Ue(y(),Dt(100)))}),response:ki},Wx={method:"POST",path:"/oauth/link",kind:"data",body:F({provider:y(),code:w(y())}),response:Pt},zx={method:"POST",path:"/oauth/unlink",kind:"data",body:F({provider:y()}),response:Pt},Jx={method:"GET",path:"/oauth/providers",kind:"data",response:zp},mn={oauthState:$x,oauthCallback:qx,linkProvider:Wx,unlinkProvider:zx,getProviders:Jx};var Yx={method:"PATCH",path:"/password/change",kind:"data",body:F({currentPassword:Jn,newPassword:Jn}),response:Pt},Xx={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:F({email:Ue(y(),Dt(320),pn())}),response:fa},Qx={method:"POST",path:"/password/reset",kind:"data",public:!0,body:F({challengeId:Bt(),code:Bt(),newPassword:Jn}),response:Pt},hn={changePassword:Yx,forgotPassword:Xx,resetPassword:Qx};var Uy=F({id:y(),tokenId:y(),tenantId:w(y()),deviceLabel:w(y()),country:w(y()),city:w(y()),createdAt:y(),expiresAt:y(),lastUsedAt:y(),revokedAt:w(Oi(y())),metadata:w(Ee(y(),ge())),isCurrent:w(yt())}),Jp=Z(Uy);var Ly=F({id:y(),tenantId:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),status:y(),roles:w(Z(y())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),invitedBy:w(ge()),createdAt:y(),updatedAt:y(),expiresAt:y()}),Yp=Z(Ly),Xp=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),My=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Qp=F({members:Z(My)}),Vl=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),jobTitle:w(y()),contactEmail:w(y()),contactPhone:w(y()),bio:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:w(y()),memberUpdatedAt:w(y()),profileUpdatedAt:w(y())}),Zp=F({tenantId:y(),roles:w(Z(y())),authPerms:Z(y())});var ef=F({userId:y(),identityType:y(),identityValue:y(),verifiedAt:y()});var eb={method:"GET",path:"/sessions",kind:"data",query:F({includeRevoked:w(Yt(["true","false"])),limit:w(ha),cursor:w(y())}),response:Jp},tb={method:"DELETE",path:"/sessions",kind:"data",body:F({sessionId:y()}),response:Pt},rb={method:"POST",path:"/sessions/revoke",kind:"data",body:F({refreshToken:y()}),response:Pt},En={listSessions:eb,deleteSession:tb,revokeToken:rb};var nb={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Vl},ib={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Vl},ob={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:Xp},sb={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:F({status:w(y()),limit:w(ha),cursor:w(y())}),response:Yp},ab={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Zp},cb={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Pt},lb={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:F({inviteId:y()}),response:Pt},ub={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:F({limit:w(ha),cursor:w(y())}),response:Qp},db={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),response:Pt},pb={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y()}),response:Pt},tf={getTenantProfile:nb,updateTenantProfile:ib,createInvite:ob,listInvites:sb,acceptInvite:ab,declineInvite:cb,revokeInvite:lb,listMembers:ub,updateMember:db,removeMember:pb};var fb={method:"PATCH",path:"/users/profile",kind:"data",body:F({email:w(Ue(y(),pn())),phone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge()))}),response:pa},Ea={updateProfile:fb};var mb={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:F({challengeId:y(),code:y()}),response:ef},hb={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:F({channel:Yt(["sms","email"]),identityValue:y(),previousChallengeId:w(y())}),response:fa},Ci={verifyCode:mb,resendVerification:hb};var JV={...Ut,...hn,...Ci,...En,...Tr,...mn,...Ea,...tf};var q={VALIDATION_ERROR:_("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:_("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:_("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:_("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:_("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:_("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:_("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:_("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:_("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:_("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:_("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:_("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:_("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:_("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:_("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function Ho(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function Yn(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:o,device:s}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=s?.deviceLabel,u={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...s?.country&&{country:s.country},...s?.city&&{city:s.city},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},p=await e.plugins.database.sessions.create(u);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d(q.DATABASE_ERROR());let f=p.data,m=Ho(n,e.security),E=await e.plugins.token.signAccessToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},e.security.accessTokenLifetimeMinutes),v=await e.plugins.token.signRefreshToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:E.token,refreshToken:v.token,expiresAt:E.expiresAt,...n&&{tenantId:n}})}var ya={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};function Ky(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function ga(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?d(ya.USER_NOT_FOUND()):T(Ky(r.data))}var rf={SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:q.DATABASE_ERROR};async function Bl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return T();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(rf.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?T():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(rf.DATABASE_ERROR()):T():T()}var yn={INVALID_TOKEN:_("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:_("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_SUSPENDED:q.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var gn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(gn||(gn={}));async function jl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return d(yn.INVALID_TOKEN());if(r.typ!==gn.Refresh)return d(yn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(q.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return d(yn.INVALID_TOKEN());let o=Date.now();if(i.expiresAt.getTime()<=o)return d(yn.INVALID_TOKEN());let s=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&o-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!s&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(q.DATABASE_ERROR()):d(yn.INVALID_TOKEN());if(a&&!s){let E=Ho(i.tenantId,e.security),v=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}},e.security.accessTokenLifetimeMinutes),N=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}},e.security.refreshTokenLifetimeMinutes);return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),T({accessToken:v.token,refreshToken:N.token,expiresAt:v.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:o,expiresAt:new Date(o+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return d(q.DATABASE_ERROR());let u=Ho(i.tenantId,e.security);if(l.data===!1){let E=await e.plugins.database.sessions.get(i.id);if(E.ok===!1)return d(q.DATABASE_ERROR());let v=E.data;if(!v||v.revokedAt)return d(yn.INVALID_TOKEN());let N=await e.plugins.token.signAccessToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType},...v.perms!==void 0&&{perms:v.perms},...v.roles&&{roles:v.roles}},e.security.accessTokenLifetimeMinutes),S=await e.plugins.token.signRefreshToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}},e.security.accessTokenLifetimeMinutes),f=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}},e.security.refreshTokenLifetimeMinutes),m={accessToken:p.token,refreshToken:f.token,expiresAt:p.expiresAt};return T(m)}var bt={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:_("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:Q("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:Q("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:Q("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:_("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:Q("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var Ve={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},_r={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},xe={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var sr={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function nf(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Gl(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let s=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(s)}var Ze={SMS:"sms",EMAIL:"email"},Di={PHONE:"phone",EMAIL:"email"},Pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Xn={type:Ze.EMAIL,purpose:xe.EMAIL_VERIFICATION,identityType:Di.EMAIL,template:Pi.EMAIL_CODE};var Qn={type:Ze.SMS,purpose:xe.PHONE_VERIFICATION,identityType:Di.PHONE,template:Pi.SMS_CODE};var Ne={CHANNEL_NOT_CONFIGURED:_("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:_("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:_("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:_("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:_("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:_("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:_("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function vn(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function $r(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return Eb(n)}async function Fo(t,e){let r=await $r(t);return r.length!==e.length?!1:yb(r,e)}function Eb(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function yb(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function gb(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Vo(t,e){let r=gb(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,o=await e.plugins.database.identities.get(r.identityType,i);if(!o.ok||!o.data)return d(Ne.IDENTITY_NOT_FOUND());let s=o.data;if(s.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let a=s.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,u=t.previousChallengeId===void 0&&l===c;if(!l)return d(Ne.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return d(p.errors,p.meta);let f=p.data;if(f&&(f.status!==Ve.PENDING||f.userId!==s.userId||f.purpose!==r.purpose||f.method!==r.type||f.identityType!==r.identityType||f.identityValue!==i))return d(Ne.CHALLENGE_NOT_FOUND());if(!f&&!u)return d(Ne.CHALLENGE_NOT_FOUND());let m=e.security.verificationResendCooldownSeconds*1e3,E=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(f?.createdAt.getTime()??0)+m;if(m>0&&Date.now()<E)return d(Ne.RESEND_COOLDOWN_ACTIVE());let v=vn(6),N=await $r(v),S=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),R=e.plugins.database.challenges.generateChallengeId(),M=await e.plugins.database.challenges.create({id:R,userId:s.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:N,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:S});if(M.ok===!1)return d(M.errors,M.meta);let K=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,B=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:R,purpose:r.purpose,channel:r.type,expiresAt:S,resendAvailableAt:K}});return B.ok===!1?(await e.plugins.database.challenges.remove(R),d(B.errors,B.meta)):(await vb(t.channel,i,v,r.template,R,S,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(R),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),d(Ne.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:s.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:R,previousChallengeId:l}})]),T({challengeId:R,expiresAt:S}))}async function vb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}function Ab(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Bo(t,e){let r=Ab(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return d(Ne.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let o=i.guards.email_verification;if(o?.lockedUntil&&new Date(o.lockedUntil)>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let s=i.pendingVerification,a=s&&s.purpose===r.purpose&&s.channel===r.type&&s.expiresAt>new Date?s.challengeId:null;if(s?.resendAvailableAt&&s.purpose===r.purpose&&s.channel===r.type&&s.resendAvailableAt>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let c=vn(6),l=await $r(c),u=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),f=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:u});if(f.ok===!1)return d(f.errors,f.meta);let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:u,resendAvailableAt:E}});return v.ok===!1?(await e.plugins.database.challenges.remove(p),d(v.errors,v.meta)):(await Tb(t.channel,t.identityValue,c,r.template,p,u,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:s??null}),d(Ne.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),T({challengeId:p,expiresAt:u}))}async function Tb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}var _b=[xe.PHONE_VERIFICATION,xe.EMAIL_VERIFICATION];async function jo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(Ne.CHALLENGE_NOT_FOUND());let n=r.data;if(!_b.includes(n.purpose))return d(Ne.CHALLENGE_NOT_FOUND());if(n.status!==Ve.PENDING)return d(Ne.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return d(Ne.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?d(Ne.TOO_MANY_ATTEMPTS()):d(i.errors,i.meta);if(!n.codeHash)return d(Ne.INVALID_CODE());if(!await Fo(t.code,n.codeHash))return d(Ne.INVALID_CODE());let s=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:s,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),T({userId:n.userId,identityType:a,identityValue:c,verifiedAt:s})}async function Hy(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:o,codeHash:s,challengeId:a,expiresAt:c,...l}=t.nextStepData,u={id:r,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:_r.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(u.tenantId=t.tenantId),t.deviceLabel!==void 0&&(u.deviceLabel=t.deviceLabel),t.country!==void 0&&(u.country=t.country),t.city!==void 0&&(u.city=t.city),i!==void 0&&(u.codeHash=i),(await e.plugins.database.challenges.create(u)).ok===!1?d([q.DATABASE_ERROR()]):T({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:u.phase})}async function $l(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,o=t.userHasMethods.length===1&&t.deliveryMethods.length===0,s=i?t.deliveryMethods[0]:o?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:s?_r.VERIFY_MFA:_r.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),s!==void 0&&(a.method=s),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return d(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...s!==void 0&&{selectedMethod:s}};return T(l)}var it={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"},va={OWNER:"owner"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var of={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},ql={ACCOUNT_DELETED:q.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:_(of.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:_(of.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_(of.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function qr(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return d(ql.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return d(ql.ACCOUNT_SUSPENDED());let o,s,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return d(ql.NO_ACCESS_TO_TENANT());let u=l.data;if(u.status!==it.ACTIVE)return d(ql.SUSPENDED_IN_TENANT());if(s=u.roles,o=u.isOwner?{"*":-1}:u.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return o!==void 0&&(c.perms=o),s!==void 0&&(c.roles=s),a!==void 0&&(c.tenantType=a),T(c)}function Aa(t,e){return e[t]??null}function Fy(t,e){return e[t]??null}async function Vy(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function By(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,o=r.security.maxFailedAttempts||5,s=i>=o,a=null;if(s){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>o){let u=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*u**(i-o),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function jy(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Ta(t,e){let r=t.tid,n=Aa(t.identityType,e.plugins.identity);if(!n)return d(bt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return d(bt.INVALID_IDENTITY_FORMAT());let o=n.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,o);if(s.ok===!1||!s.data)return d(bt.INVALID_CREDENTIALS());let a=s.data;if(!a.loginEnabled)return d(bt.LOGIN_DISABLED());let c=nf(a,t.credentialType);if(c.locked)return d(bt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=Fy(t.credentialType,e.plugins.credential);if(!l)return d(bt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let u=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=u.ok?u.data:null,f=await l.verify({userId:a.userId,identityValue:o,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(f.ok===!1)return await By(a,t.credentialType,e),d(bt.INVALID_CREDENTIALS());let{userId:m,nextStep:E,intents:v}=f.data;v&&v.length>0&&await Vy(v,e);let N;if(t.userAgent&&e.plugins.deviceParser){let O=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),D=O.browser||"Unknown Browser",k=O.os||"Unknown OS";N=`${D} - ${k}`}if(E){let O={userId:m,credentialType:t.credentialType,identityType:t.identityType,identityValue:o,nextStepData:E.data,nextStepType:E.type};t.tid!==void 0&&(O.tenantId=t.tid),N!==void 0&&(O.deviceLabel=N),t.country!==void 0&&(O.country=t.country),t.city!==void 0&&(O.city=t.city);let D=await Hy(O,e);if(D.ok===!1)return d(D.errors,D.meta);if(!D.ok)return d(bt.INTERNAL_ERROR());let{challengeId:k,expiresAt:C,displayData:P,challengeType:L,phase:H}=D.data;return T({requiresChallenge:!0,challenge:{type:L,phase:H,expiresAt:C,data:{challengeId:k,expiresAt:C,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return d(bt.IDENTITY_NOT_VERIFIED());let O=a.pendingVerification;if(!!O&&O.purpose===xe.EMAIL_VERIFICATION&&O.channel==="email"&&O.expiresAt>new Date&&O)return T({requiresVerification:!0,verification:{channel:"email",challengeId:O.challengeId,expiresAt:O.expiresAt,identityType:t.identityType,identityValue:o,userId:m}});let k=await Bo({channel:"email",identityValue:o,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!k.ok){let C=await e.plugins.database.identities.get(t.identityType,o),P=C.ok&&C.data?C.data.pendingVerification:null;return P&&P.purpose===xe.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?T({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:o,userId:m}}):d(bt.IDENTITY_NOT_VERIFIED())}return T({requiresVerification:!0,verification:{channel:"email",challengeId:k.data.challengeId,expiresAt:k.data.expiresAt,identityType:t.identityType,identityValue:o,userId:m}})}let S=await e.plugins.database.userAuths.get(m);if(S.ok===!1||!S.data)return d(bt.USER_AUTH_NOT_FOUND());let R=S.data,M={userStatus:R.userStatus,userId:m,...r&&{tenantId:r}},K=await qr(M,e);if(K.ok===!1)return d(K.errors,K.meta);if(!K.ok)return d(q.DATABASE_ERROR());let{perms:B,roles:V,tenantType:$}=K.data;if(R.mfaRequired){let O=R.mfaMethods;if(!(!O||O.length===0)){let D=O.filter(k=>e.plugins.mfa?.[k]);if(D.length!==0){let k=D.filter(me=>e.plugins.mfa?.[me]?.requiresServerDelivery),C=D.filter(me=>!e.plugins.mfa?.[me]?.requiresServerDelivery),P={};N!==void 0&&(P.deviceLabel=N),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let L={userId:m,availableMethods:D,deliveryMethods:k,userHasMethods:C,device:P};t.tid!==void 0&&(L.tenantId=t.tid);let H=await $l(L,e);if(H.ok===!1)return d(H.errors,H.meta);if(!H.ok)return d(bt.INTERNAL_ERROR());let{challengeId:z,expiresAt:Y,phase:pe,selectedMethod:Oe,availableMethods:Fe}=H.data;return T({requiresMfa:!0,mfa:{phase:pe,challengeId:z,methods:Fe,...Oe&&{method:Oe},expiresAt:Y,userId:m}})}}}let A={userId:m,...r&&{tenantId:r},...$&&{tenantType:$},...B!==void 0||V?{permissions:{...V&&{roles:V},...B!==void 0&&{perms:B}}}:{},...N||t.country||t.city?{device:{...N&&{deviceLabel:N},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await Yn(A,e);if(x.ok===!1)return d(x.errors,x.meta);if(!x.ok)return d(q.DATABASE_ERROR());let{accessToken:b,refreshToken:g,expiresAt:I}=x.data;return await Gl(m,e),await jy(a,t.credentialType,e),T({accessToken:b,refreshToken:g,expiresAt:I})}var gt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:_("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};var Ib={CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function Wy(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:o,device:s}=t;if(!r)return T({requiresMfa:!1});if(!n||n.length===0)return T({requiresMfa:!1});let a=n.filter(S=>e.plugins.mfa?.[S]);if(a.length===0)return T({requiresMfa:!1});let c=a.filter(S=>e.plugins.mfa?.[S]?.requiresServerDelivery),l=a.filter(S=>!e.plugins.mfa?.[S]?.requiresServerDelivery),u={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};o!==void 0&&(u.tenantId=o),s!==void 0&&(u.device=s);let p=await $l(u,e);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d([Ib.CHALLENGE_CREATE_FAILED()]);let{challengeId:f,expiresAt:m,phase:E,selectedMethod:v,availableMethods:N}=p.data;return T({requiresMfa:!0,mfa:{phase:E,challengeId:f,methods:N,...v&&{method:v},expiresAt:m,userId:i}})}async function _a(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return d(gt.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Ve.PENDING)return d(gt.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_CREDENTIAL)return d(gt.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(gt.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(gt.CHALLENGE_EXPIRED());let o=n.method;if(!o)return d(gt.INTERNAL_ERROR());let s=e.plugins.credential[o];if(!s)return d(gt.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Ve.EXPIRED}),d(gt.MAX_ATTEMPTS_EXCEEDED())):d(a.errors,a.meta);if((await s.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return d(gt.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return d(gt.USER_AUTH_NOT_FOUND());let u=l.data,p={userStatus:u.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let f=await qr(p,e);if(f.ok===!1)return d(f.errors,f.meta);if(!f.ok)return d(gt.INTERNAL_ERROR());let{perms:m,roles:E,tenantType:v}=f.data,N=n.deviceLabel,S=n.country,R=n.city,M={};N!==void 0&&(M.deviceLabel=N),S!==void 0&&(M.country=S),R!==void 0&&(M.city=R);let K={mfaRequired:u.mfaRequired,...u.mfaMethods&&{mfaMethods:u.mfaMethods},userId:n.userId,device:M},B=await Wy(K,e);if(B.ok===!1)return d(B.errors,B.meta);if(!B.ok)return d(gt.INTERNAL_ERROR());if(B.data.requiresMfa){let I={requiresMfa:!0,mfa:B.data.mfa};return T(I)}let V={};m!==void 0&&(V.perms=m),E!==void 0&&(V.roles=E);let $={userId:n.userId,permissions:V,device:M};i!==void 0&&($.tenantId=i),v!==void 0&&($.tenantType=v);let A=await Yn($,e);if(A.ok===!1)return d(A.errors,A.meta);if(!A.ok)return d(gt.INTERNAL_ERROR());let{accessToken:x,refreshToken:b,expiresAt:g}=A.data;return T({accessToken:x,refreshToken:b,expiresAt:g})}var ot={MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Ia(t,e){if(!e.plugins.mfa)return d(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,o=n.deviceLabel,s=n.country,a=n.city;if(n.status!==Ve.PENDING)return d(ot.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_MFA)return d(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return d(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return d(ot.MFA_METHOD_NOT_SUPPORTED());let u=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(u.ok===!1)return u.errors.some($=>$.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(ot.TOO_MANY_ATTEMPTS())):d(u.errors,u.meta);if(l.requiresServerDelivery){if(!n.codeHash)return d(ot.INVALID_CHALLENGE_STATE());if(!await Fo(t.code,n.codeHash))return d(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return d(ot.MFA_METHOD_NOT_SUPPORTED());let $=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if($.ok===!1||!$.data)return d(ot.INVALID_MFA_CODE());let A=$.data;if(!A.verifiedAt)return d(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return d(ot.INVALID_MFA_CODE());let b=x.data.data?.usedBackupCodeHash;if(b){let I=(A.data.backupCodeHashes??[]).filter(O=>O!==b);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return d(ot.USER_AUTH_NOT_FOUND());let m={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},E=await qr(m,e);if(E.ok===!1)return d(E.errors,E.meta);if(!E.ok)return d(q.DATABASE_ERROR());let{perms:v,roles:N,tenantType:S}=E.data,R={userId:n.userId,...i&&{tenantId:i},...S&&{tenantType:S},...v!==void 0||N?{permissions:{...N&&{roles:N},...v!==void 0&&{perms:v}}}:{},...o||s||a?{device:{...o&&{deviceLabel:o},...s&&{country:s},...a&&{city:a}}}:{}},M=await Yn(R,e);if(M.ok===!1)return d(M.errors,M.meta);if(!M.ok)return d(q.DATABASE_ERROR());let{accessToken:K,refreshToken:B,expiresAt:V}=M.data;return T({accessToken:K,refreshToken:B,expiresAt:V})}var vt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:Q("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:Q("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:Q("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:Q("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:_("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:_("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:_("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function xa(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(vt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Ve.PENDING)return d(vt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return d(vt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return d(vt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return d(vt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return d(vt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let o=await e.plugins.database.userAuths.get(t.userId);if(!o.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let s=o.data;if(!s)return d(vt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(f=>f.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(vt.TOO_MANY_ISSUES())):d(a.errors,a.meta);if(!i.sendCode)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:s},e);if(!c.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,u=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:_r.VERIFY_MFA,codeHash:l})).ok===!1?d(vt.CHALLENGE_UPDATE_FAILED()):T({maskedRecipient:u,expiresAt:n.expiresAt})}var $e={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:Q("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:Q("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:_("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:_("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:_("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:_("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:_("INTERNAL_ERROR","Internal error occurred during registration")};function xb(t,e){return e[t]}function bb(t,e){return e[t]}async function ba(t,e){let r=xb(t.identityType,e.plugins.identity);if(!r)return d($e.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return d($e.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,i);if(o.ok===!1)return d($e.DATABASE_ERROR());if(o.data)return d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let s=bb(t.credentialType,e.plugins.credential);if(!s)return d($e.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await s.create({value:t.credentialValue});if(a.ok===!1)return d($e.INVALID_CREDENTIAL());if(!a.ok)return d($e.INTERNAL_ERROR());let{value:c,data:l}=a.data,u=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let f={id:u,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===sr.EMAIL&&{contactEmail:t.identityValue},...t.identityType===sr.PHONE&&{contactPhone:t.identityValue},...t.identityType===sr.USERNAME&&{username:t.identityValue}},m={userId:u,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},E={type:t.identityType,value:i,userId:u,loginEnabled:!0,verifiedAt:null,guards:{}},v={userId:u,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===sr.EMAIL&&e.plugins.database.registration){let B=await Sb({profileData:{...f,id:u},userAuthData:m,identityData:E,credentialRepoData:v,identityValue:i},e);return B.ok===!1?B.errors.some(V=>V.code==="UNIQUE_CONSTRAINT_VIOLATION")?d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):d(B.errors,B.meta):B.ok?T({userId:u,verification:{channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}):d($e.INTERNAL_ERROR())}let N=await e.plugins.database.users.create(f);if(N.ok===!1||!N.data)return d($e.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(m)).ok===!1)return await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(E)).ok===!1)return await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let M=await e.plugins.database.credentials.create(v);if(M.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let K;if(t.identityType===sr.EMAIL){let B=await Rb({userId:u,identityType:t.identityType,identityValue:i},e);if(B.ok===!1)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d(B.errors,B.meta);if(!B.ok)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.INTERNAL_ERROR());K={channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}return T({userId:u,...K&&{verification:K}})}async function Sb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await wb(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?d($e.USER_CREATION_FAILED()):((await Nb({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),T({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function wb(t,e,r){let n=vn(6),i=await $r(n),o=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),s=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:s,userId:t,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:sr.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:o},pendingVerification:{challengeId:s,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:o,resendAvailableAt:a}}}async function Nb(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?d($e.VERIFICATION_EMAIL_SEND_FAILED()):T(void 0):d($e.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Rb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=vn(6),n=await $r(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),o=e.plugins.database.challenges.generateChallengeId(),s=await e.plugins.database.challenges.create({id:o,userId:t.userId,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(s.ok===!1)return d(s.errors,s.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:o,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(o),d(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:o,expiresAt:i.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(o),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),d($e.VERIFICATION_EMAIL_SEND_FAILED())):T({challengeId:o,expiresAt:i})}var Zn={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function Sa(t,e){let{sessionId:r,userId:n,tenantId:i}=t,o=await e.plugins.database.sessions.get(r);if(o.ok===!1)return d(o.errors,o.meta);if(!o.data)return d(Zn.SESSION_NOT_FOUND());let s=o.data;if(s.revokedAt)return d(Zn.SESSION_REVOKED());if(s.userId!==n)return d(Zn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return d(a.errors,a.meta);if(!a.data)return d(Zn.USER_NOT_FOUND());let c=a.data,l=await qr({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return d(l.errors,l.meta);if(!l.ok)return d(q.DATABASE_ERROR());let{perms:u,roles:p,tenantType:f}=l.data,m=e.plugins.database.sessions.generateTokenId(),E=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:m,...u!==void 0&&{perms:u},...p&&{roles:p},...f&&{tenantType:f}});if(E.ok===!1)return d(E.errors,E.meta);let v=Ho(i,e.security),N=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f},...u!==void 0&&{perms:u},...p&&{roles:p}},e.security.accessTokenLifetimeMinutes),S=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f}},e.security.refreshTokenLifetimeMinutes);return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt,tenantId:i})}var Ob=/^[\w!#$%&'*.^`|~+-]+$/,kb=/^[!#-:<>-[\]-~]+$/,Cb=/^[ !#-:<-[\]-~]*$/,zy=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},sf=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let o=i.indexOf("=");if(o===-1)continue;let s=zy(i.substring(0,o));if(e&&e!==s||!kb.test(s)||s in n)continue;let a=zy(i.substring(o+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),Cb.test(a)&&(n[s]=Po(a),e))break}return n};var Db=(t,e,r={})=>{if(!Ob.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Wl=(t,e,r)=>(e=encodeURIComponent(e),Db(t,e,r));var af=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let i=e;return r==="secure"?i="__Secure-"+e:r==="host"&&(i="__Host-"+e),sf(n,i)[i]}return n?sf(n):{}};var Pb=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Wl("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Wl("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Wl(t,e,{path:"/",...r}),n},wa=(t,e,r,n)=>{let i=Pb(e,r,n);t.header("Set-Cookie",i,{append:!0})};var Na=(t,e,r)=>{let n=af(t,e,r?.prefix);return wa(t,e,"",{...r,maxAge:0}),n};function cf(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function zl(t){return t==="cookie"||t==="both"}function Ub(t){let e=t.tokenStrategy;return typeof e=="string"?zl(e):Object.values(e).some(r=>r!==void 0&&zl(r))}function lf(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Lb(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function Jy(t,e,r,n,i){let o=r.refreshTokenCookie??{},s=i??Lb(r,n),a=cf(r,s),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=lf(r,s);Mb(t,c,{...o,name:l})}if(a==="cookie"){let{refreshToken:l,...u}=e;return u}return e}function Yy(t,e,r){if(!(r?zl(cf(e,r)):Ub(e)))return;let i=e.refreshTokenCookie??{},o={path:i.path??"/",...i.domain?{domain:i.domain}:{}},s=e.audienceCookieNames?.cookieNames;if(s&&!r){let c=i.name??"refresh_token",l=new Set([s.customer??c,s.tenant??c,s.system??c]);for(let u of l)Na(t,u,o);return}let a=lf(e,r);Na(t,a,o)}function Jl(t,e,r){let n=cf(e,r);if(!zl(n)||!t)return;let i=lf(e,r);return Kb(t,i)}function Mb(t,e,r){wa(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function Kb(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var Xy=new Set(["customer","tenant","system"]);function Le(t,e){let r=[];if(e.auth!==!1&&r.push(oa({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(aa(a))}let n=async a=>{let c=or(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let u=a.get("authResult"),p={body:ca(a),query:ua(a),params:la(a),user:u?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},f=await e.handler(p),m=e.successStatus;if(f.ok&&f.data!==void 0&&e.tokenMode==="auth"){let E=f.data,v=typeof E.tenantId=="string"?E.tenantId:void 0,N=p.authContextHeader,S=v!==void 0?void 0:typeof N=="string"&&Xy.has(N)?N:void 0,R=Jy(a,E,t,v,S),M={...f,data:R};return Ge(a,M,{traceId:c,...m!==void 0?{successStatus:m}:{}})}if(f.ok&&e.tokenMode==="logout"){let E=p.authContextHeader,v=typeof E=="string"&&Xy.has(E)?E:void 0;Yy(a,t,v)}return Ge(a,f,{traceId:c,...m!==void 0?{successStatus:m}:{}})}catch(l){let u=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:u}})),Ge(a,d(oe.InternalError()),{traceId:c})}},i=[...r,n],s=async(a,c)=>{let l,u=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let f=i[p],m=await f(a,async()=>{await u(p+1)});m instanceof Response&&(l=m)};return await u(0),l};return s.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},s}function Wr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function Qy(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function Zy(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function eg(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{accessTokenLifetimeMinutes:t.security.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function tg(t){return{plugins:{database:t.plugins.database}}}function rg(t){return Le(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Ut.authenticate.body},handler:async e=>{let r=Wr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Ta(n,r)}})}function ng(t){return Le(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeChallenge.body},handler:async e=>{let r=Wr(t.auth);return _a({challengeId:e.body.challengeId,code:e.body.code},r)}})}function ig(t){return Le(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return Ia({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function og(t){return Le(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Ut.issueMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return xa({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function Yl(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var Hb=new Set(["customer","tenant","system"]);function sg(t){return Le(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Hb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=Zy(t.auth);return Bl({refreshToken:a},c)}})}function Fb(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function ei(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=Fb(e);return typeof r?.sid=="string"?r.sid:void 0}function ag(t){return Le(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return d(oe.NotAuthenticated())}let n=tg(t.auth);return ga({userId:e.user.id},n)}})}var Vb=new Set(["customer","tenant","system"]);function cg(t){return Le(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Vb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=eg(t.auth);return jl({refreshToken:a},c)}})}function lg(t){return Le(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Ut.register.body},handler:async e=>{let r=Qy(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),ba(n,r)}})}function ug(t){return Le(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Ut.selectTenant.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(!r)return d(oe.NotAuthenticated());let n=Wr(t.auth);return Sa({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Ra={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Xl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ra.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return d(Ra.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return d(i.errors,i.meta);let o=i.data??[];t.verifiedOnly&&(o=o.filter(a=>a.verifiedAt!==null));let s=o.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return T({authenticators:s,total:s.length})}var An={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:Q("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:Q("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:Q("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:Q("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:Q("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var Tn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Ql(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(An.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(An.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(An.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok||!i.data)return d(An.AUTHENTICATOR_NOT_FOUND());let o=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(o.ok===!1)return d(o.errors,o.meta);let s=o.data??[],a=s.filter(v=>v.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return d(An.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let v=await e.plugins.database.credentials.getByUserIdAndType(t.userId,Tn.PASSWORD);if(v.ok===!1)return d(v.errors,v.meta);let N=v.data;if(N&&N.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:N.value,data:N.data??{}},credentialValue:t.password})).ok===!1)return d(An.INVALID_PASSWORD())}let u=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(u.ok===!1)return d(u.errors,u.meta);let f=s.filter(v=>v.method===t.method&&(v.id!==t.authenticatorId||v.method!==t.method)).length,m=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:m,remainingCount:f}});let E={method:t.method,mfaStillEnabled:m,remainingCount:f};return t.authenticatorId!==void 0&&(E.authenticatorId=t.authenticatorId),T(E)}var _n={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Zl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(_n.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(_n.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(_n.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return d(_n.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return d(_n.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let o=await i.setup({userId:t.userId,data:t.data||{}},e);if(o.ok===!1)return d(o.errors,o.meta);if(!o.ok)return d(_n.INTERNAL_ERROR());let s=o.data;if(s.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:s.credentialData});if(l.ok===!1)return d(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=s;return T({method:t.method,data:c})}var pt={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:_("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:_("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:_("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:_("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:Q("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:Q("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:_("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:q.INTERNAL_ERROR};var dg=["totp","webauthn","passkey","hardware"],pg=["email","sms","phone"],Bb=new Set([...dg,...pg]);async function eu(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return d(pt.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!Bb.has(i))return d(pt.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return d(pt.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(pt.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(pt.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(pt.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return d(pt.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return d(pt.MFA_NOT_ENABLED());if(!t.password)return d(pt.PASSWORD_REQUIRED());let i=await jb(t.userId,t.password,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await Gb(t.userId,t.mfaMethods,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return d(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),T()}async function jb(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,Tn.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let o=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return o.ok===!1?d(o.errors,o.meta):T()}async function Gb(t,e,r){let n=e.filter(o=>dg.includes(o)),i=e.filter(o=>pg.includes(o));if(n.length>0){let o=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let o=await r.plugins.database.identities.getByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}return T()}var Ir={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:_("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:_("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function tu(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ir.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Ir.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Ir.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok)return d(Ir.INTERNAL_ERROR());let o=i.data;if(!o)return d(Ir.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return d(Ir.MFA_NOT_AVAILABLE());let s=e.plugins.mfa[t.method];if(!s?.verifyWithCredentials)return d(Ir.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await s.verifyWithCredentials({credentialData:o.data,data:t.data||{}});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(Ir.INTERNAL_ERROR());let c=a.data;if(!c.verified)return T({method:t.method,verified:!1,data:c.data||{}});if(!o.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return d(l.errors,l.meta);let u=n.mfaMethods||[];if(!u.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...u,t.method]);if(p.ok===!1)return d(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),T({method:t.method,verified:!0,data:c.data||{}})}function Oa(t){return{system:{systemId:t.system.system.systemId}}}function fg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function mg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function hg(t){return{plugins:{database:t.plugins.database},system:Oa(t)}}function Eg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function yg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function gg(t){return X(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=hg(t.auth);return Xl({userId:e.user.id},r)}})}function vg(t){return X(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:Tr.removeAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Eg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Ql(n,r)}})}function Ag(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:Tr.setupAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=fg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),Zl(n,r)}})}function Tg(t){return X(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:Tr.updateMfaSettings.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=yg(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),eu(n,r)}})}function _g(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:Tr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=mg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),tu(n,r)}})}var ru={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function nu(t,e){if(!await e.plugins.database.users.getById(t.userId))return d(ru.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(!i)return T([]);let o=i.map(s=>{let a={provider:s.provider,externalId:s.externalId,linkedAt:s.createdAt};return s.externalEmail&&(a.externalEmail=s.externalEmail),s.externalName&&(a.externalName=s.externalName),a});return T(o)}var At={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:_("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:_("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:_("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function $b(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return d(q.DATABASE_ERROR());let u=l.data;if(u.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(u.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let f=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(f.ok===!1)return d(f.errors,f.meta)}return T(c)}let o=null;if(t.email){let c=Aa(sr.EMAIL,e.plugins.identity);if(!c)return d(q.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),u=await e.plugins.database.identities.get(sr.EMAIL,l);if(u.ok===!1)return d(q.DATABASE_ERROR());if(u.data){if(t.emailVerified!==!0)return d(At.EMAIL_NOT_VERIFIED_BY_PROVIDER());o=u.data.userId;let p=await e.plugins.database.userAuths.get(o);if(!p.ok||!p.data)return d(q.DATABASE_ERROR());let f=p.data;if(f.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(f.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED())}}if(!o){if(!t.email)return d(At.EMAIL_REQUIRED());o=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let N=t.name.trim().split(/\s+/);c=N[0]||"",l=N.slice(1).join(" ")||""}let u={id:o,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(u)).ok)return d(q.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:o,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(o),d(q.DATABASE_ERROR());let m=Aa(sr.EMAIL,e.plugins.identity);if(!m)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(q.PLUGIN_NOT_FOUND());let E=m.normalize(t.email),v=await e.plugins.database.identities.create({type:sr.EMAIL,value:E,userId:o,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(v.ok===!1)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(v.errors,v.meta)}let s={userId:o,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(s.externalEmail=t.email),t.name!==void 0&&(s.externalName=t.name),t.avatarUrl!==void 0&&(s.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(s);return a.ok===!1?d(a.errors,a.meta):T(o)}async function iu(t,e){if(!t.provider)return d(At.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return d(At.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return d(At.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return d(At.PROVIDER_NOT_FOUND());let v=await r.verifyCredential(t.credential);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}else if(t.code){let v=await r.exchangeCodeForToken(t.code);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());let N=v.data;if(!N)return d(At.CODE_EXCHANGE_FAILED());i=N.accessToken}if(!n){if(!i)return d(At.INVALID_ACCESS_TOKEN());let v=await r.getUserProfile(i);if(v.ok===!1)return d(At.PROFILE_FETCH_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}let o=await $b(n,e,t);if(!o.ok)return d(o.errors,o.meta);let s=o.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(s);if(!c.ok||!c.data)return d(q.DATABASE_ERROR());let l=await qr({userStatus:c.data.userStatus,userId:s,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return d(l.errors,l.meta);let{perms:u,roles:p,tenantType:f}=l.data,m={userId:s,...t.tenantId&&{tenantId:t.tenantId},...f&&{tenantType:f},...u!==void 0||p?{permissions:{...p&&{roles:p},...u!==void 0&&{perms:u}}}:{}},E=await Yn(m,a);return E.ok===!1?d(E.errors,E.meta):(await _e(e,{event:"oauth_login_success",userId:s,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Gl(s,e),T({accessToken:E.data.accessToken,refreshToken:E.data.refreshToken,expiresAt:E.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),d(At.PROFILE_FETCH_FAILED())}}var Lt={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:_("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:_("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function ou(t,e){if(!t.code)return d(Lt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return d(Lt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return d(Lt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let f=await n.exchangeCodeForToken(t.code);if(f.ok===!1)return d(Lt.CODE_EXCHANGE_FAILED());let m=f.data;if(!m)return d(Lt.CODE_EXCHANGE_FAILED());i=m.accessToken}if(!i)return d(Lt.INVALID_ACCESS_TOKEN());let o=await n.getUserProfile(i);if(o.ok===!1)return d(Lt.PROFILE_FETCH_FAILED());let s=o.data;if(!s)return d(Lt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,s.id);if(a.ok===!1)return d(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?d(Lt.PROVIDER_ALREADY_LINKED()):d(Lt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:s.id,createdAt:new Date};s.email!==void 0&&(l.externalEmail=s.email),s.name!==void 0&&(l.externalName=s.name),s.avatarUrl!==void 0&&(l.externalAvatarUrl=s.avatarUrl);let u=await e.plugins.database.userProviders.create(l);if(u.ok===!1)return d(u.errors,u.meta);let p=u.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:s.id}}),T(p)):d(Lt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),d(Lt.PROFILE_FETCH_FAILED())}}var Go={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:_("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:_("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function su(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return d(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return d(Go.PROVIDER_NOT_LINKED());let i=n.find(s=>s.provider===t.provider);if(!i)return d(Go.PROVIDER_NOT_LINKED());if(n.length<=1){let s=await e.plugins.database.identities.getByUserId(t.userId);if(!(s.ok&&s.data&&s.data.length>0))return d(Go.CANNOT_UNLINK_LAST_PROVIDER())}let o=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return o.ok===!1?d(o.errors,o.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),T())}function Ig(t){return X(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return nu({userId:e.user.id},r)}})}function xg(t){return X(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:mn.linkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),ou(n,r)}})}function bg(t){return Le(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:mn.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),iu(n,r)}})}function Sg(t){return X(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:mn.unlinkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return su({userId:e.user.id,provider:e.body.provider},r)}})}var St={PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:_("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:_("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:_("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:_("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},xr={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:St.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:St.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:St.SAME_PASSWORD},Ui={EMAIL_SYSTEM_NOT_AVAILABLE:St.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:St.SEND_EMAIL_ERROR},jt={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:St.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:St.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:St.CHALLENGE_ALREADY_USED,INVALID_CODE:St.INVALID_CODE,TOO_MANY_ATTEMPTS:St.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:St.AUTH_SCOPE_MISMATCH};async function $o(t,e){if(!e.plugins.credential?.password)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,Tn.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return d(xr.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return d(xr.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return d(l.errors,l.meta);let u=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return u.ok===!1&&console.error("Failed to revoke sessions after password change:",u.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),T()}async function qo(t,e){if(!e.plugins.emailSystem)return d(Ui.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=vn(6),o=await $r(i),s=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return T({challengeId:`fake_challenge_${Date.now()}`,expiresAt:s});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===xe.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return T({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),u=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:xe.PASSWORD_RESET,status:Ve.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:o,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:s});if(u.ok===!1)return d(u.errors,u.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:s.toISOString(),purpose:xe.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),d(Ui.SEND_EMAIL_ERROR());let f=Math.max(0,e.security.verificationResendCooldownSeconds),m=f>0?new Date(Date.now()+f*1e3):null,E=!c||c.purpose===xe.PASSWORD_RESET;return await Promise.all([E?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:xe.PASSWORD_RESET,channel:"email",expiresAt:s,resendAvailableAt:m}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),T({challengeId:l,expiresAt:s})}async function Wo(t,e){if(!e.plugins.credential?.password)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(jt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==xe.PASSWORD_RESET)return d(jt.CHALLENGE_NOT_FOUND());if(i.status!==Ve.PENDING)return d(jt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return d(jt.CHALLENGE_EXPIRED());let o=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(o.ok===!1)return o.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?d(jt.TOO_MANY_ATTEMPTS()):d(o.errors,o.meta);if(!i.codeHash)return d(jt.INVALID_CODE());if(!await Fo(t.code,i.codeHash))return d(jt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,Tn.PASSWORD);if(l.ok===!1)return d(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return d(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:Tn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return d(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let u=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return u.ok===!1&&console.error("Failed to revoke sessions after password reset:",u.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),T()}var au={NO_CHANGES_PROVIDED:_("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function cu(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return d(au.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return d(q.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return d(q.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let s=await e.plugins.database.users.getById(t.userId);return!s.ok||s.data===null?d(q.NOT_FOUND()):T(s.data)}function zo(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function wg(t){return Le(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:hn.changePassword.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=zo(t.auth),n=e.body,i=ei(e.authorizationHeader);return $o({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function Ng(t){return Le(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:hn.forgotPassword.body},handler:async e=>{let r=zo(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),qo(n,r)}})}function Rg(t){return X(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:hn.resetPassword.body},handler:async e=>{let r=zo(t.auth);return Wo({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var ka={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:_("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to delete session")};async function Ca(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?d(ka.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),T())}var Da={DATABASE_ERROR:_("DATABASE_ERROR","Failed to retrieve sessions")};async function Pa(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return d(Da.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return T(a,i.meta)}var Jo={INVALID_TOKEN:_("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to revoke token")};async function Ua(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?d(Jo.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),T()):d(Jo.INVALID_TOKEN())}function Og(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function kg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Cg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Dg(t){return X(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:En.deleteSession.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=kg(t.auth);return Ca({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function Pg(t){return Le(t,{method:"GET",path:"/sessions",auth:!0,input:{query:En.listSessions.query},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Og(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Pa(n,r);if(!i.ok)return i;let o=ei(e.authorizationHeader);if(o&&i.data){let s=i.data.map(a=>a.id===o?{...a,isCurrent:!0}:a);return T(s,i.meta)}return i}})}function Ug(t){return X(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:En.revokeToken.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Cg(t.auth);return Ua({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},La=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Ma(t,e){return t===void 0?!1:(t&e)===e}var uf={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},Lg=Object.fromEntries(Object.entries(uf).map(([t,e])=>[e,Number(t)]));function Xt(t){return t?Object.entries(uf).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function ti(t){let e=0;for(let r of t){let n=Lg[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Qt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var br={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:_("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","This invite grants permissions the inviter is not entitled to confer"),DATABASE_ERROR:q.DATABASE_ERROR};var qb={IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:_("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:_("IDENTITY_ALREADY_EXISTS","This identity is already registered")},Wb={GUARD_LOCKED:_("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},zb={INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:_("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:_("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:_("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:_("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},Jb={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:_("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:_("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:_("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},Yb={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:_("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:_("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},Xb={MFA_NOT_CONFIGURED:_("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:_("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:_("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:_("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Qb={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:_("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:_("INVALID_SESSION","Invalid session")},Zb={TOKEN_NOT_FOUND:_("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:_("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:_("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:_("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:_("TOKEN_VERIFICATION_FAILED","Token verification failed")},wt={NOT_MEMBER_OF_TENANT:_("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:_("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:_("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:_("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:_("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},wW={...qb,...Wb,...zb,...Jb,...Yb,...Xb,...Qb,...Zb,...wt};async function lu(t,e,r,n={}){let{requireVerified:i=!0}=n;if(t.inviteeUserId)return T(t.inviteeUserId===e?null:"user-mismatch");if(t.inviteeEmail||t.inviteePhone){let o=await r.getByUserId(e);if(!o.ok)return d(o.errors,o.meta);let s=i?o.data.filter(p=>p.verifiedAt!==null):o.data,a=(p,f)=>p==="phone"?f.replace(/[\s()\-.]/g,""):f.trim().toLowerCase(),c=(p,f)=>{let m=a(p,f);return m?s.some(E=>E.type===p&&a(p,E.value)===m):!1},l=t.inviteeEmail?c("email",t.inviteeEmail):!1,u=t.inviteePhone?c("phone",t.inviteePhone):!1;return!l&&!u?T("identity-mismatch"):T(null)}return T("identity-mismatch")}function ri(t,e){let{authPerm:r,roles:n,perms:i}=e;if(t.isOwner)return!1;if(r!==void 0&&(r&~(t.authPerm??0))!==0||r!==void 0&&(r&se.CHANGE_MEMBER_PERMISSION)!==0||n?.some(o=>o.trim().toLowerCase()===va.OWNER))return!0;if(i!==void 0){let o=t.perms??{},s=(c,l)=>c[l]??c["*"]??0,a=new Set([...Object.keys(i),...Object.keys(o),"*"]);for(let c of a)if((s(i,c)&~s(o,c))!==0)return!0}return!1}async function Yo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(br.INVITE_IDENTIFIER_REQUIRED());let s=null,a=!1;if(r){let M=await o.tenantInvites.getById(r);if(!M.ok)return d(M.errors,M.meta);s=M.data}else if(n){let M=await o.tenantInvites.getByToken(n);if(!M.ok)return d(M.errors,M.meta);s=M.data,a=!0}if(!s)return d(br.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(br.INVITE_NOT_PENDING());if(s.expiresAt<new Date)return d(br.INVITE_EXPIRED());let c=await lu(s,i,o.identities,{requireVerified:!a});if(!c.ok)return d(c.errors,c.meta);if(c.data==="user-mismatch")return d(br.INVITE_USER_MISMATCH());if(c.data==="identity-mismatch")return d(br.INVITE_IDENTITY_MISMATCH());let l=await o.tenantMembers.get(s.tenantId,i);if(!l.ok)return d(l.errors,l.meta);if(l.data&&l.data.status!==it.REMOVED)return d(br.ALREADY_MEMBER());let u=await o.tenants.get(s.tenantId);if(!u.ok)return d(u.errors,u.meta);if(s.authPerm!==void 0&&(s.authPerm&La)!==0){if(!u.data)return d(wt.TENANT_NOT_FOUND());if(u.data.type!==Qt.SYSTEM)return d(wt.ACCOUNT_PERMS_SYSTEM_ONLY())}let p={tenantId:s.tenantId,userId:i,status:it.ACTIVE,isOwner:!1,tenantType:s.tenantType};if(u.data?.parentTenantId!==void 0&&(p.parentTenantId=u.data.parentTenantId),s.authPerm!==void 0||s.roles!==void 0||s.perms!==void 0){let M=await o.tenantMembers.get(s.tenantId,s.invitedById);if(!M.ok)return d(M.errors,M.meta);let K=M.data,B=K&&K.status===it.ACTIVE?K:{isOwner:!1,authPerm:0,perms:{}};if(ri(B,{authPerm:s.authPerm,roles:s.roles,perms:s.perms}))return d(br.CANNOT_ESCALATE_PERMISSIONS())}s.roles!==void 0&&(p.roles=s.roles),s.perms!==void 0&&(p.perms=s.perms),s.authPerm!==void 0&&(p.authPerm=s.authPerm);let m=await o.tenantMembers.create(p);if(!m.ok)return d(m.errors,m.meta);let E={tenantId:s.tenantId,userId:i},v=await o.users.getById(i);v.ok&&v.data&&(v.data.contactEmail&&(E.contactEmail=v.data.contactEmail),v.data.contactPhone&&(E.contactPhone=v.data.contactPhone),v.data.displayName&&(E.displayName=v.data.displayName),v.data.givenName&&(E.givenName=v.data.givenName),v.data.familyName&&(E.familyName=v.data.familyName),v.data.avatarUrl&&(E.avatarUrl=v.data.avatarUrl),v.data.locale&&(E.locale=v.data.locale)),s.displayName&&(E.displayName=s.displayName),s.givenName&&(E.givenName=s.givenName),s.familyName&&(E.familyName=s.familyName),s.jobTitle&&(E.jobTitle=s.jobTitle);let N=await o.userTenantProfiles.create(E);if(!N.ok)return d(N.errors,N.meta);let S=await o.tenantInvites.updateStatus(s.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!S.ok)return d(S.errors,S.meta);let R={tenantId:s.tenantId};return s.roles!==void 0&&(R.roles=s.roles),s.perms!==void 0&&(R.perms=s.perms),s.authPerm!==void 0&&(R.authPerm=s.authPerm),T(R)}var Li={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function Mi(t,e,r){if(t===void 0||(t&La)===0)return T(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T(void 0):d(wt.TENANT_NOT_FOUND()):d(n.errors,n.meta)}var uu={NOT_MEMBER:wt.NOT_MEMBER_OF_TENANT,SUSPENDED:wt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:wt.INSUFFICIENT_TENANT_PERMISSIONS};async function lt(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,o=await e.tenantMembers.get(r,n);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(uu.NOT_MEMBER());let s=o.data;return s.status!==it.ACTIVE?d(uu.SUSPENDED()):s.isOwner?T(s):Ma(s.authPerm,i)?T(s):d(uu.INSUFFICIENT_PERMISSIONS())}async function du(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(ri(s.data,{authPerm:t.authPerm,roles:t.roles,perms:t.perms}))return d(Li.CANNOT_ESCALATE_PERMISSIONS());let a=await Mi(t.authPerm,r,o.tenants);if(!a.ok)return d(a.errors,a.meta);let c=await o.users.getById(n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Li.USER_NOT_FOUND());let l=c.data,u=await o.tenantMembers.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(u.data&&u.data.status!==it.REMOVED)return d(Li.ALREADY_MEMBER());let p=await o.tenants.get(r);if(!p.ok)return d(p.errors,p.meta);if(!p.data)return d(Li.TENANT_NOT_FOUND());let f=p.data,m={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!1,tenantType:f.type};f.parentTenantId!==void 0&&(m.parentTenantId=f.parentTenantId),t.roles!==void 0&&(m.roles=t.roles),t.perms!==void 0&&(m.perms=t.perms),t.authPerm!==void 0&&(m.authPerm=t.authPerm);let E=await o.tenantMembers.create(m);if(!E.ok)return d(E.errors,E.meta);let v={tenantId:r,userId:n};l.contactEmail&&(v.contactEmail=l.contactEmail),l.contactPhone&&(v.contactPhone=l.contactPhone),l.displayName&&(v.displayName=l.displayName),l.givenName&&(v.givenName=l.givenName),l.familyName&&(v.familyName=l.familyName),l.avatarUrl&&(v.avatarUrl=l.avatarUrl),l.locale&&(v.locale=l.locale),t.contactEmail!==void 0&&(v.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(v.contactPhone=t.contactPhone),t.displayName!==void 0&&(v.displayName=t.displayName),t.givenName!==void 0&&(v.givenName=t.givenName),t.familyName!==void 0&&(v.familyName=t.familyName),t.avatarUrl!==void 0&&(v.avatarUrl=t.avatarUrl),t.locale!==void 0&&(v.locale=t.locale),t.jobTitle!==void 0&&(v.jobTitle=t.jobTitle),t.bio!==void 0&&(v.bio=t.bio),t.metadata!==void 0&&(v.metadata=t.metadata);let N=await o.userTenantProfiles.create(v);return N.ok?T({tenantId:r,userId:n}):d(N.errors,N.meta)}var Xo={TENANT_ALREADY_HAS_OWNER:_("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:_("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:q.DATABASE_ERROR};async function pu(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:o,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N}=t,S=e.plugins.database,R=i??"org";if(R===Qt.SYSTEM)return d(Xo.SYSTEM_TYPE_FORBIDDEN());let M=await S.users.getById(n);if(!M.ok)return d(M.errors,M.meta);if(!M.data)return d(Xo.USER_NOT_FOUND());let K=await S.tenants.get(r);if(!K.ok)return d(K.errors,K.meta);if(!K.data){let b={id:r,type:R,ownerId:n};o!==void 0&&(b.parentTenantId=o);let g=await S.tenants.create(b);if(!g.ok)return d(g.errors,g.meta)}let B=await S.tenantMembers.hasOwner(r);if(!B.ok)return d(B.errors,B.meta);if(B.data)return d(Xo.TENANT_ALREADY_HAS_OWNER());let V=K.data?.parentTenantId??o,$={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!0,tenantType:R};V!==void 0&&($.parentTenantId=V);let A=await S.tenantMembers.create($);if(!A.ok)return d(A.errors,A.meta);let x=await S.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N});return x.ok?T({tenantId:r,userId:n}):d(x.errors,x.meta)}async function fu(t,e){let{email:r,phone:n}=t,i=e.plugins.database,o=[],s=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}return T({pendingInvites:o})}var ni={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was sent to an identity you do not own"),DATABASE_ERROR:q.DATABASE_ERROR};async function Qo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(ni.INVITE_IDENTIFIER_REQUIRED());let s=null;if(r){let l=await o.tenantInvites.getById(r);if(!l.ok)return d(l.errors,l.meta);s=l.data}else if(n){let l=await o.tenantInvites.getByToken(n);if(!l.ok)return d(l.errors,l.meta);s=l.data}if(!s)return d(ni.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(ni.INVITE_NOT_PENDING());let a=await lu(s,i,o.identities,{requireVerified:!1});if(!a.ok)return d(a.errors,a.meta);if(a.data==="user-mismatch")return d(ni.INVITE_USER_MISMATCH());if(a.data==="identity-mismatch")return d(ni.INVITE_IDENTITY_MISMATCH());let c=await o.tenantInvites.updateStatus(s.id,{status:ar.DECLINED,declinedAt:new Date});return c.ok?T(void 0):d(c.errors,c.meta)}async function Ki(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[o,s]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(wt.NOT_MEMBER_OF_TENANT());if(!s.ok)return d(s.errors,s.meta);let a=o.data,c=s.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),T(l)}var Zt={INVITEE_REQUIRED:_("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:Q("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:_("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:Q("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};function eS(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function Zo(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:o,inviteePhone:s,role:a,perms:c,authPerm:l,displayName:u,givenName:p,familyName:f,jobTitle:m}=t,E=t.roles??(a!==void 0?[a]:void 0),v=e.plugins.database,N=await lt({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!N.ok)return d(N.errors,N.meta);if(ri(N.data,{authPerm:l,roles:E,perms:c}))return d(Zt.CANNOT_ESCALATE_PERMISSIONS());let S=await Mi(l,r,v.tenants);if(!S.ok)return d(S.errors,S.meta);if(!i&&!o&&!s)return d(Zt.INVITEE_REQUIRED());if(i){let k=await v.users.getById(i);if(!k.ok)return d(k.errors,k.meta);if(!k.data)return d(Zt.INVITEE_USER_NOT_FOUND({userId:i}));let C=await v.tenantMembers.get(r,i);if(!C.ok)return d(C.errors,C.meta);if(C.data&&C.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER());let P=await v.tenantInvites.findByTenantAndUserId(r,i);if(!P.ok)return d(P.errors,P.meta);if(P.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(o){let k=await v.identities.get("email",o);if(!k.ok)return d(k.errors,k.meta);if(k.data){let P=await v.tenantMembers.get(r,k.data.userId);if(!P.ok)return d(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndEmail(r,o);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(s){let k=await v.identities.get("phone",s);if(!k.ok)return d(k.errors,k.meta);if(k.data){let P=await v.tenantMembers.get(r,k.data.userId);if(!P.ok)return d(P.errors,P.meta);if(P.data&&P.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndPhone(r,s);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}let R=await v.tenantInvites.countPendingByTenant(r);if(!R.ok)return d(R.errors,R.meta);if(R.data>=e.security.maxPendingInvitesPerTenant)return d(Zt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let M,K,B,V=await v.users.getById(n);V.ok&&V.data&&(V.data.displayName!==void 0&&(M=V.data.displayName),V.data.contactEmail!==void 0&&(K=V.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(M=$.data.displayName),$.data.jobTitle!==void 0&&(B=$.data.jobTitle));let A=Qt.DEFAULT,x=await v.tenants.get(r);x.ok&&x.data&&(A=x.data.type);let b=v.tenantInvites.generateInviteId(),g=eS(),I=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),O={id:b,tenantId:r,tenantType:A,invitedById:n,status:ar.PENDING,inviteToken:g,expiresAt:I};M!==void 0&&(O.invitedByName=M),K!==void 0&&(O.invitedByEmail=K),B!==void 0&&(O.invitedByJobTitle=B),i!==void 0&&(O.inviteeUserId=i),o!==void 0&&(O.inviteeEmail=o),s!==void 0&&(O.inviteePhone=s),E!==void 0&&(O.roles=E),c!==void 0&&(O.perms=c),l!==void 0&&(O.authPerm=l),u!==void 0&&(O.displayName=u),p!==void 0&&(O.givenName=p),f!==void 0&&(O.familyName=f),m!==void 0&&(O.jobTitle=m);let D=await v.tenantInvites.create(O);return D.ok?T({inviteId:b,inviteToken:g,expiresAt:I}):d(D.errors,D.meta)}async function es(t,e){let{tenantId:r,actorUserId:n,status:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await o.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?T(c.data,c.meta):d(c.errors,c.meta)}async function ts(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,o=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return d(o.errors,o.meta);let s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(s).length>0?s:void 0);return a.ok?T(a.data,a.meta):d(a.errors,a.meta)}async function mu(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let o=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return o.ok?T(o.data,o.meta):d(o.errors,o.meta)}var Hi={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:_("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:_("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:q.DATABASE_ERROR};async function rs(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(i===n)return d(Hi.CANNOT_REMOVE_SELF());let a=await o.tenantMembers.get(r,n);if(!a.ok)return d(a.errors,a.meta);if(!a.data)return d(Hi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!s.data.isOwner)return d(Hi.CANNOT_MODIFY_OWNER());if(c.isOwner){let u=await o.tenantMembers.listByTenant(r);if(!u.ok)return d(u.errors,u.meta);if(u.data.filter(f=>f.isOwner&&f.status===it.ACTIVE).length<=1)return d(Hi.CANNOT_REMOVE_LAST_OWNER())}let l=await o.tenantMembers.remove(r,n);return l.ok?(await o.userTenantProfiles.remove(r,n),T(void 0)):d(l.errors,l.meta)}var Ka={INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:q.DATABASE_ERROR};async function ns(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,o=await i.tenantInvites.getById(r);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(Ka.INVITE_NOT_FOUND());let s=await lt({tenantId:o.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(o.data.status!==ar.PENDING)return d(Ka.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?T(void 0):d(a.errors,a.meta)}var ii={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};async function is(t,e){let{tenantId:r,userId:n,actorUserId:i,role:o,perms:s,authPerm:a}=t,c=t.roles??(o!==void 0?[o]:void 0),l=e.plugins.database,u=await lt({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!u.ok)return d(u.errors,u.meta);let p=u.data;if(i===n)return d(ii.CANNOT_MODIFY_SELF());let f=await l.tenantMembers.get(r,n);if(!f.ok)return d(f.errors,f.meta);if(!f.data)return d(ii.MEMBER_NOT_FOUND());if(f.data.isOwner)return d(ii.CANNOT_MODIFY_OWNER());let m=f.data,E=a===void 0?void 0:a&~(m.authPerm??0),v=V=>V.trim().toLowerCase(),N=new Set(m.roles?.map(v)),S=c?.filter(V=>v(V)===va.OWNER||!N.has(v(V))),R=(V,$)=>V?.[$]??V?.["*"]??0,M=s===void 0?void 0:Object.fromEntries([...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].map(V=>{let $=R(s,V);return[V,$&~R(m.perms,V)]}));if(ri(p,{authPerm:E,roles:S,perms:M}))return d(ii.CANNOT_ESCALATE_PERMISSIONS());if(!p.isOwner){let V=a===void 0?0:(m.authPerm??0)&~a,$=s===void 0?[]:[...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].filter(O=>(R(m.perms,O)&~R(s,O))!==0),A=new Set(p.roles?.map(v)),x=c===void 0?[]:(m.roles??[]).filter(O=>!c.some(D=>v(D)===v(O))),b=(V&~(p.authPerm??0))!==0,g=$.some(O=>(R(m.perms,O)&~R(s,O)&~R(p.perms,O))!==0),I=x.some(O=>!A.has(v(O)));if(b||g||I)return d(ii.CANNOT_ESCALATE_PERMISSIONS())}let K=await Mi(a,r,l.tenants);if(!K.ok)return d(K.errors,K.meta);let B={};if(c!==void 0&&(B.roles=c),s!==void 0&&(B.perms=s),a!==void 0&&(B.authPerm=a),Object.keys(B).length>0){let V=await l.tenantMembers.updatePermissions(r,n,B);if(!V.ok)return d(V.errors,V.meta)}return T(void 0)}var Ha={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:q.DATABASE_ERROR};async function df(t,e){let{tenantId:r,userId:n,actorUserId:i,status:o}=t,s=e.plugins.database,a=await lt({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:s.tenantMembers});if(!a.ok)return d(a.errors,a.meta);if(i===n)return d(Ha.CANNOT_MODIFY_SELF());let c=await s.tenantMembers.get(r,n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Ha.MEMBER_NOT_FOUND());if(c.data.isOwner)return d(Ha.CANNOT_MODIFY_OWNER());let l=await s.tenantMembers.updateStatus(r,n,o);return l.ok?T(void 0):d(l.errors,l.meta)}var hu={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:_("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:q.DATABASE_ERROR};async function os(t,e){let{tenantId:r,userId:n,...i}=t,o=e.plugins.database,s=await o.tenantMembers.get(r,n);if(!s.ok)return d(s.errors,s.meta);if(!s.data)return d(hu.MEMBER_NOT_FOUND());let a=s.data,c=a.isOwner||Ma(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let u=await o.userTenantProfiles.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(!u.data){let f=await o.userTenantProfiles.create({tenantId:r,userId:n,...l});return f.ok?T(void 0):d(f.errors,f.meta)}let p=await o.userTenantProfiles.update(r,n,l);return p.ok?T(void 0):d(p.errors,p.meta)}var tS=10080,rS=100;function nS(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??tS,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??rS}}}var zr=F({tenantId:Ue(y(),Hp(1))}),iS=F({limit:w(Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100))),cursor:w(y())}),oS=Ue(F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),Hl(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),Mg=Ue(F({inviteId:w(y()),inviteToken:w(y())}),Hl(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),sS=F({inviteId:y()}),aS=F({status:w(y()),limit:w(Ue(ge(),Mo(Number),qe(),zn(),Lo(1),Uo(100))),cursor:w(y())}),cS=F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),lS=F({userId:y()}),uS=F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))});function Kg(t){let{auth:e,policy:r}=t,n=X(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr},handler:async m=>{let E=await Ki({tenantId:m.params.tenantId,userId:m.user.id},e);if(!E.ok)return E;let v=E.data;if(!v)return T({});let{authPerm:N,...S}=v;return T({...S,authPerms:Xt(N)})}}),i=X(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:uS},handler:async m=>{let E=m.params.tenantId,v=m.user.id,N={tenantId:E,userId:v},S=m.body;S.contactEmail!==void 0&&(N.contactEmail=S.contactEmail),S.contactPhone!==void 0&&(N.contactPhone=S.contactPhone),S.displayName!==void 0&&(N.displayName=S.displayName),S.givenName!==void 0&&(N.givenName=S.givenName),S.familyName!==void 0&&(N.familyName=S.familyName),S.avatarUrl!==void 0&&(N.avatarUrl=S.avatarUrl),S.locale!==void 0&&(N.locale=S.locale),S.bio!==void 0&&(N.bio=S.bio),S.jobTitle!==void 0&&(N.jobTitle=S.jobTitle),S.metadata!==void 0&&(N.metadata=S.metadata);let R=await os(N,e);if(!R.ok)return R;let M=await Ki({tenantId:E,userId:v},e);if(!M.ok)return M;let K=M.data;if(!K)return T({});let{authPerm:B,...V}=K;return T({...V,authPerms:Xt(B)})}}),o=X(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:oS},handler:async m=>{let{inviteeEmail:E,inviteeUserId:v,inviteePhone:N,role:S,roles:R,authPerms:M,displayName:K,givenName:B,familyName:V,jobTitle:$}=m.body,A={tenantId:m.params.tenantId,invitedBy:m.user.id};return E!==void 0&&(A.inviteeEmail=E),v!==void 0&&(A.inviteeUserId=v),N!==void 0&&(A.inviteePhone=N),S!==void 0&&(A.role=S),R!==void 0&&(A.roles=R),M!==void 0&&(A.authPerm=ti(M)),K!==void 0&&(A.displayName=K),B!==void 0&&(A.givenName=B),V!==void 0&&(A.familyName=V),$!==void 0&&(A.jobTitle=$),Zo(A,nS(t))}}),s=X(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:aS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.status!==void 0&&(E.status=m.query.status),m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await es(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T(N,v.meta)}}),a=X(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken);let v=await Yo(E,e);if(!v.ok)return v;let N=v.data;if(!N)return v;let{authPerm:S,...R}=N;return T({...R,authPerms:Xt(S)})}}),c=X(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};return m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken),Qo(E,e)}}),l=X(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:sS},handler:async m=>ns({inviteId:m.body.inviteId,revokedBy:m.user.id},e)}),u=X(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:iS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await ts(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T({members:N},v.meta)}}),p=X(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:cS},handler:async m=>{let E={tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id};return m.body.role!==void 0&&(E.role=m.body.role),m.body.roles!==void 0&&(E.roles=m.body.roles),m.body.authPerms!==void 0&&(E.authPerm=ti(m.body.authPerms)),is(E,e)}}),f=X(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:lS},handler:async m=>rs({tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id},e)});return Kp("/tenants",[n,i,o,s,a,c,l,u,p,f])}function Hg(t){return X(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Ea.updateProfile.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),cu(n,r)}})}function Eu(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function Fg(t){return Le(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:Ci.resendVerification.body},handler:async e=>{let r=Eu(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),Vo(n,r)}})}function Vg(t){return X(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:Ci.verifyCode.body},handler:async e=>{let r=Eu(t.auth);return jo({challengeId:e.body.challengeId,code:e.body.code},r)}})}var pf="oauth_state",dS=600;function Bg(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function jg(t,e,r){wa(t,pf,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:dS})}function pS(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function Gg(t,e){let r=af(t,pf);return Na(t,pf,{path:"/"}),!r||!e?!1:pS(r,e)}function fS(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function mS(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function $g(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:o=[]}=e;return async(s,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=fS(s),u=await mS(s,o),p=[`${i}:ip:${l}`];u&&p.push(`${i}:id:${u}`);for(let f of p){let m=await c.consume(f,{limit:r,windowMs:n});if(!m.allowed){let E=Math.ceil(m.retryAfterMs/1e3);return s.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(E)})}}return a()}}function Me(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function qg(t,e,r={}){let n=Object.keys(r).length===0,i=s=>n||r[s]!==!1;t.get("/health",s=>s.json({ok:!0},200));let o=(s,a)=>t.use(s,$g(e.auth,a));if(o("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),o("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),o("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),o("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),o("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),o("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),o("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),o("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),o("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Me(t,rg(e)),Me(t,lg(e)),Me(t,sg(e)),Me(t,cg(e)),Me(t,ag(e)),Me(t,ug(e)),Me(t,ng(e)),Me(t,ig(e)),Me(t,og(e))),i("password")&&(Me(t,wg(e)),Me(t,Ng(e)),Me(t,Rg(e))),i("verification")&&(Me(t,Vg(e)),Me(t,Fg(e))),i("sessions")&&(Me(t,Pg(e)),Me(t,Dg(e)),Me(t,Ug(e))),i("mfa")&&(Me(t,Ag(e)),Me(t,_g(e)),Me(t,gg(e)),Me(t,vg(e)),Me(t,Tg(e))),i("oauth")){let s=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=Bg();return jg(a,c,s),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let u=await a.req.raw.clone().json();typeof u.state=="string"&&(l=u.state)}catch{l=void 0}return l!==void 0&&!Gg(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Me(t,bg(e)),Me(t,xg(e)),Me(t,Sg(e)),Me(t,Ig(e))}i("users")&&Me(t,Hg(e)),i("tenants")&&t.route("",Kg(e))}function ff(t){Lp(Sy);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:o,features:s}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),o&&o.length>0&&(a.trustedOrigins=o);let c=e.security.tokenAudiences?.cookieNames;if(c){let u={cookieNames:c};e.security.systemTenantId&&(u.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=u}let l=new Gr;return qg(l,a,s),l}var Sr=F({message:w(y())}),Wg=F({message:w(y()),tenantId:y(),userId:y()}),mf={tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))},zg=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),memberUpdatedAt:y(),profileUpdatedAt:w(y())}),hS=F({...mf,createdAt:y(),updatedAt:y()}),ES=F({tenantId:y(),userId:y(),status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y(),tenantProfile:w(hS)}),Jg=Z(ES),Yg=F({tenantId:y(),userId:y()}),yS=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerm:w(qe()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Xg=Z(yS),gS=F({id:y(),name:w(y()),email:w(y()),jobTitle:w(y())}),Qg=F({id:y(),tenantId:y(),invitedBy:gS,inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),status:y(),expiresAt:y(),createdAt:y(),updatedAt:y()}),Zg=Z(Qg),ev=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),tv=F({tenantId:y(),userId:y()}),rv=F({invites:Z(Qg)}),vS=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y()}),nv=Z(vS),iv=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y(),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),username:w(y()),metadata:w(Ee(y(),ge())),mfaRequired:yt(),mfaMethods:Oi(Z(y()))});var yu={limit:w(Ue(qe(),zn())),cursor:w(y())},AS={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:F({tenantId:y(),userId:y(),tenantType:w(y()),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Wg},TS={method:"POST",path:"/tenant/profile",kind:"data",body:F({tenantId:y(),userId:y()}),response:zg},_S={method:"POST",path:"/tenant/profile/update",kind:"data",body:F({tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},IS={method:"POST",path:"/tenant/members/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),...yu}),response:Jg},xS={method:"POST",path:"/tenant/members/update-status",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),status:Yt(["invited","active","suspended","removed"])}),response:Sr},bS={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y()))}),response:Sr},SS={method:"POST",path:"/tenant/members/remove",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y()}),response:Sr},wS={method:"POST",path:"/tenant/members/add",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Yg},NS={method:"POST",path:"/tenant/invites/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),status:w(Yt(["pending","accepted","declined","revoked","expired"])),...yu}),response:Zg},RS={method:"POST",path:"/tenant/invites/create",kind:"data",body:F({tenantId:y(),invitedBy:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:ev},sv=F({userId:y(),inviteId:w(y()),inviteToken:w(y())}),OS={method:"POST",path:"/tenant/invites/accept",kind:"data",body:sv,response:tv},kS={method:"POST",path:"/tenant/invites/decline",kind:"data",body:sv,response:Sr},CS={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:F({inviteId:y(),revokedBy:y()}),response:Sr},DS={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:F({email:w(y()),phone:w(y())}),response:rv},PS={method:"POST",path:"/user/tenants/list",kind:"data",body:F({userId:y(),tenantType:w(y()),parentTenantId:w(y()),...yu}),response:Xg},ss={actorUserId:y(),systemTenantId:y()},US={method:"POST",path:"/accounts/list",kind:"data",body:F({...ss,status:w(Yt(["active","inactive"])),...yu}),response:nv},LS={method:"POST",path:"/accounts/get",kind:"data",body:F({...ss,userId:y()}),response:iv},MS={method:"POST",path:"/accounts/update-profile",kind:"data",body:F({...ss,userId:y(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),contactEmail:w(y()),contactPhone:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},KS={method:"POST",path:"/accounts/update-status",kind:"data",body:F({...ss,userId:y(),status:Yt(["active","suspended","deleted"])}),response:Sr},HS={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:F({...ss,userId:y(),credentialType:w(y())}),response:Sr},FS={method:"POST",path:"/accounts/remove",kind:"data",body:F({...ss,userId:y()}),response:Sr},Je={bootstrapTenantOwner:AS,getTenantProfile:TS,updateTenantProfile:_S,listTenantMembers:IS,updateTenantMemberStatus:xS,updateTenantMemberPermission:bS,removeTenantMember:SS,addMemberToTenant:wS,listTenantInvites:NS,inviteToTenant:RS,acceptInvite:OS,declineInvite:kS,revokeInvite:CS,checkPendingInvites:DS,listUserTenants:PS,listAccounts:US,getAccount:LS,updateAccountProfile:MS,updateAccountStatus:KS,resetAccountCredentials:HS,removeAccount:FS};async function oi(t,e,r,n){let i=await lt({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return d(i.errors,i.meta);let o=await n.tenants.get(e);return o.ok?o.data?o.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T({actor:i.data}):d(wt.TENANT_NOT_FOUND()):d(o.errors,o.meta)}var In={CANNOT_REMOVE_ACTIVE_ACCOUNT:_("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:_("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:_("NO_CHANGES","At least one field must be provided")};var VS=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function hf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=t.status??"active",o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let s=await r.users.getByStatus(i,o);if(!s.ok)return d(s.errors,s.meta);let a=[];for(let c of s.data){let l=await r.users.getById(c);if(l.ok&&l.data){let u=l.data,p={id:u.id,status:u.status,createdAt:u.createdAt,updatedAt:u.updatedAt};u.contactEmail!==void 0&&(p.contactEmail=u.contactEmail),u.contactPhone!==void 0&&(p.contactPhone=u.contactPhone),u.displayName!==void 0&&(p.displayName=u.displayName),a.push(p)}}return T(a,s.meta)}async function Ef(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return d(i.errors,i.meta);if(!i.data)return d(q.NOT_FOUND());let o=i.data,s=await r.userAuths.get(t.userId),a={id:o.id,status:o.status,createdAt:o.createdAt,updatedAt:o.updatedAt,mfaRequired:s.ok&&s.data?s.data.mfaRequired:!1,mfaMethods:s.ok&&s.data?s.data.mfaMethods:null};return o.contactEmail!==void 0&&(a.contactEmail=o.contactEmail),o.contactPhone!==void 0&&(a.contactPhone=o.contactPhone),o.displayName!==void 0&&(a.displayName=o.displayName),o.givenName!==void 0&&(a.givenName=o.givenName),o.familyName!==void 0&&(a.familyName=o.familyName),o.avatarUrl!==void 0&&(a.avatarUrl=o.avatarUrl),o.locale!==void 0&&(a.locale=o.locale),o.username!==void 0&&(a.username=o.username),o.metadata!==void 0&&(a.metadata=o.metadata),T(a)}async function yf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return d(In.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?T(void 0):d(c.errors,c.meta)}async function gf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);if(!VS.has(t.status))return d(In.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.userAuths.updateStatus(t.userId,t.status);if(!s.ok)return d(s.errors,s.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?T(void 0):d(a.errors,a.meta)}async function vf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.credentials.getByUserId(t.userId);if(!s.ok)return d(s.errors,s.meta);for(let a of s.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return d(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return d(a.errors,a.meta)}return T(void 0)}async function Af(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(In.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(o.data.status===ye.ACTIVE)return d(In.CANNOT_REMOVE_ACTIVE_ACCOUNT());let s=await r.credentials.getByUserId(t.userId);if(s.ok)for(let l of s.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?T(void 0):d(c.errors,c.meta)}var BS=3,jS=10080,GS=100;function $S(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??jS,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??GS}}}function as(t){return{plugins:{database:t.plugins.database}}}function qS(t){return Pp({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Tf(t){let{auth:e,internal:r}=t,n=qS(r),i=new Gr;i.use("/*",async(g,I)=>{let O=g.req.header("Authorization");if(!O){await I();return}let D=O.match(/^Bearer\s+(.+)$/i);if(!D){await I();return}let C=D[1].split(".");if(C.length!==3||!C[1]){await I();return}let P;try{let L=C[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(L))}catch{await I();return}if(P.typ!==BS)return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let L=P.roles,H=Array.isArray(L)?L:[];if(!r.requiredRoles.some(Y=>H.includes(Y)))return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let o=X(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId};return g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.displayNameSource!==void 0&&(I.displayNameSource=g.body.displayNameSource),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),pu(I,e)}}),s=X(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async g=>{let I=await Ki({tenantId:g.body.tenantId,userId:g.body.userId},e);if(!I.ok)return I;let O=I.data;if(!O)return I;let{authPerm:D,...k}=O;return T({...k,authPerms:Xt(D)})}}),a=X(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async g=>{let{tenantId:I,userId:O,...D}=g.body,k={tenantId:I,userId:O};return D.contactEmail!==void 0&&(k.contactEmail=D.contactEmail),D.contactPhone!==void 0&&(k.contactPhone=D.contactPhone),D.displayName!==void 0&&(k.displayName=D.displayName),D.givenName!==void 0&&(k.givenName=D.givenName),D.familyName!==void 0&&(k.familyName=D.familyName),D.avatarUrl!==void 0&&(k.avatarUrl=D.avatarUrl),D.locale!==void 0&&(k.locale=D.locale),D.bio!==void 0&&(k.bio=D.bio),D.jobTitle!==void 0&&(k.jobTitle=D.jobTitle),D.metadata!==void 0&&(k.metadata=D.metadata),os(k,e)}}),c=X(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await ts(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),l=X(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async g=>df({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId,status:g.body.status},e)}),u=X(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),is(I,e)}}),p=X(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async g=>rs({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId},e)}),f=X(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),du(I,e)}}),m=X(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await es(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),E=X(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,invitedBy:g.body.invitedBy};return g.body.inviteeUserId!==void 0&&(I.inviteeUserId=g.body.inviteeUserId),g.body.inviteeEmail!==void 0&&(I.inviteeEmail=g.body.inviteeEmail),g.body.inviteePhone!==void 0&&(I.inviteePhone=g.body.inviteePhone),g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),Zo(I,$S(e))}}),v=X(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async g=>{let I={userId:g.body.userId};g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken);let O=await Yo(I,e);if(!O.ok)return O;let D=O.data;if(!D)return O;let{authPerm:k,...C}=D;return T({...C,authPerms:Xt(k)})}}),N=X(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async g=>{let I={userId:g.body.userId};return g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken),Qo(I,e)}}),S=X(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async g=>ns({inviteId:g.body.inviteId,revokedBy:g.body.revokedBy},e)}),R=X(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async g=>{let I={};return g.body.email!==void 0&&(I.email=g.body.email),g.body.phone!==void 0&&(I.phone=g.body.phone),fu(I,e)}}),M=X(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async g=>{let I={userId:g.body.userId};g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.parentTenantId!==void 0&&(I.parentTenantId=g.body.parentTenantId),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await mu(I,e);if(!O.ok)return O;let D=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(D,O.meta)}}),K=X(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId};return g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor),hf(I,as(e))}}),B=X(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async g=>Ef({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))}),V=X(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async g=>{let{actorUserId:I,systemTenantId:O,userId:D,...k}=g.body,C={actorUserId:I,systemTenantId:O,userId:D};return k.displayName!==void 0&&(C.displayName=k.displayName),k.givenName!==void 0&&(C.givenName=k.givenName),k.familyName!==void 0&&(C.familyName=k.familyName),k.avatarUrl!==void 0&&(C.avatarUrl=k.avatarUrl),k.locale!==void 0&&(C.locale=k.locale),k.contactEmail!==void 0&&(C.contactEmail=k.contactEmail),k.contactPhone!==void 0&&(C.contactPhone=k.contactPhone),k.metadata!==void 0&&(C.metadata=k.metadata),yf(C,as(e))}}),$=X(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async g=>gf({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId,status:g.body.status},as(e))}),A=X(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId};return g.body.credentialType!==void 0&&(I.credentialType=g.body.credentialType),vf(I,as(e))}}),x=X(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async g=>Af({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))});function b(g){let{method:I,path:O}=g.routeMeta,D=I.toLowerCase();i[D](O,g)}return b(o),b(s),b(a),b(c),b(l),b(u),b(p),b(f),b(m),b(E),b(v),b(N),b(S),b(R),b(M),b(K),b(B),b(V),b($),b(A),b(x),i}var av=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},cv=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,o=e.length-1;i<=n;i++,o--)r[i]=e.charCodeAt(i),r[o]=e.charCodeAt(o);return r};function Fa(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var WS=t=>t.requestContext;var _f=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=rw(r),o,s;try{o=i.createRequest(r),s=WS(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(o,{event:r,requestContext:s,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},gu=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=`https://${this.getDomainName(t)}${this.getPath(t)}`,n=e?`${r}?${e}`:r,i=this.getHeaders(t),o={headers:i,method:this.getMethod(t)};if(t.body){let s=t.isBase64Encoded?cv(t.body):new TextEncoder().encode(t.body);o.body=s,i.set("content-length",s.length.toString())}return new Request(n,o)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??lv,o=!!(n&&i(n));if(!o){let a=e.headers.get("content-encoding");o=sw(a)}let s={body:o?av(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:o,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,s),s.multiValueHeaders?e.headers.forEach((a,c)=>{s.multiValueHeaders[c]=[a]}):e.headers.forEach((a,c)=>{s.headers[c]=a}),s}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},zS=class extends gu{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},JS=new zS,YS=class extends gu{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.multiValueHeaders)for(let[r,n]of Object.entries(t.multiValueHeaders))n&&n.forEach(i=>e.append(r,Fa(i)));if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&!e.has(r)&&e.set(r,Fa(n));return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},XS=new YS,QS=class extends gu{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=Fa(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,Fa(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},ZS=new QS,ew=class extends gu{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&n.forEach(i=>e.append(r,Fa(i)));return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},tw=new ew,rw=t=>nw(t)?ZS:iw(t)?JS:ow(t)?tw:XS,nw=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,iw=t=>Object.hasOwn(t,"rawPath")&&Object.hasOwn(t.requestContext??{},"http"),ow=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,lv=t=>/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(t)?!0:!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(t),sw=t=>!!t&&!/^identity$/i.test(t);var uv=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,i=(s=>typeof s=="string"?s==="*"?()=>s:a=>s===a?a:null:typeof s=="function"?s:a=>s.includes(a)?a:null)(e.origin),o=(s=>{if(typeof s=="function")return async(a,c)=>(await s(a,c)).join(",");if(Array.isArray(s)){let a=s.join(",");return()=>a}else return()=>""})(e.allowMethods);return async function(a,c){function l(p,f){a.res.headers.set(p,f)}let u=await i(a.req.header("origin")||"",a);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){e.origin!=="*"&&a.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await o(a.req.header("origin")||"",a);p&&l("Access-Control-Allow-Methods",p);let f=n;if(!f){let m=a.req.header("Access-Control-Request-Headers");m&&(f=m.split(",").map(E=>E.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};var aw={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function Fi(t={}){let e={...aw,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var If={LOW:Fi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:Fi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:Fi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:Fi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var dv={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function xf(t,e={}){return{system:t,policy:{...dv.policy,...e.policy??{}},version:e.version??dv.version,...e.email&&{email:e.email}}}var pv=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],fv=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],bf=[...pv,...fv];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function mv(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function hv(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Ev={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function yv(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",o=typeof r.parseUserAgent=="function";if(!i&&!o)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Ev[e];n&&hv(t,String(e),n)}function Sf(t,e){mv(t,String(e)),yv(t,e)}var gv={debug:0,info:1,warn:2,error:3},vu=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=gv[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&gv[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),o=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${o} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function vv(t){return new vu(t)}var Au=new vu({enabled:!1});function cs(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Vi(t,e){let r=cs(t),n=cs(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Av(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Vi(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&Vi(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Vi(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Vi(t,e.slice(2))>=0:e.startsWith(">")?Vi(t,e.slice(1))>0:e.startsWith("<=")?Vi(t,e.slice(2))<=0:e.startsWith("<")?Vi(t,e.slice(1))<0:!1}function cw(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function lw(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function ls(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())wf(n,i);return t}let e=[];if(cw(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,o]=n;wf(i,o),r.set(i,o)}return r}function wf(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");lw(t,e)}function Nf(t,e){wf(t,e)}function Tu(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function _u(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Rf(t,e={},r,n=Au,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let o=new Map;for(let E of t)o.set(E.name,E);let s=new Map,a=new Map;for(let E of o.keys())s.set(E,0),a.set(E,[]);for(let E of o.values()){let v=E.dependencies??[];for(let N of v){let S=typeof N=="string"?N:N.name,R=typeof N=="string"?void 0:N.version;if(!o.has(S))throw new Error(`Plugin '${String(E.name)}' depends on '${String(S)}' which is not defined`);if(R){let M=o.get(S);if(M.version&&!Av(M.version,R))throw new Error(`Plugin '${String(E.name)}' requires '${String(S)}' ${R}, but version ${M.version} is provided`)}a.get(S).push(E.name),s.set(E.name,(s.get(E.name)??0)+1)}}let c=[];for(let[E,v]of s.entries())v===0&&c.push(E);let l=[];for(;c.length>0;){let E=c.shift();l.push(E);for(let v of a.get(E)??[]){let N=(s.get(v)??0)-1;s.set(v,N),N===0&&c.push(v)}}if(l.length!==o.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let u={},p={get(E){if(!u[E])throw new Error(`Plugin '${String(E)}' not found or not yet initialized`);return u[E]},has(E){return E in u},getRegistry(){return u}};for(let E of l){n.group(`Initializing plugin: ${String(E)}`),n.time(`Plugin: ${String(E)}`);let v=o.get(E),N=e[E],S=null;if(N!==void 0?(n.debug("Using override"),Tu(N)?(n.debug("Creating from factory wrapper"),S=await N.create(p)):_u(N)?(n.debug("Lazy loading plugin"),S=await N.load()):(n.debug("Using direct instance"),S=N)):v.factory?(n.debug("Creating from descriptor factory"),S=await v.factory(p)):v.instance&&(n.debug("Using descriptor instance"),S=v.instance),!S&&v.required)throw new Error(`Required plugin '${String(E)}' is missing`);if(S){if(E==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Sf(S,E),n.debug("Validation passed")}catch(K){throw n.error("Validation failed:",K),new Error(`Plugin '${String(E)}' validation failed: ${K instanceof Error?K.message:String(K)}`)}}u[E]=S;let M=S;M.initialize&&(n.debug("Calling plugin initialize()"),await M.initialize()),n.info(`Plugin '${String(E)}' initialized successfully`)}else n.warn(`Plugin '${String(E)}' is null/undefined`);n.timeEnd(`Plugin: ${String(E)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),u.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),u.credential=e.credential),i.extraEntries&&Object.assign(u,i.extraEntries),!uw(u))throw new Error("Plugin registry is incomplete - missing required plugins");let f=u,m=ls(f.oauthProviders);if(!m){let E=e.oauthProviders;E!==void 0&&!Tu(E)&&!_u(E)?m=ls(E)??new Map:m=new Map}return f.oauthProviders=m,await r?.afterInit?.(f),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),f}function uw(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function Of(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function Va(t){let e=t.debug?vv({enabled:!0,prefix:"[auth-core SDK]"}):Au;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=ls(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Rf(bf,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let o=Fi(t.security??{});e.debug("Security level:",o.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let s=xf({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",s.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:o,system:s,async healthCheck(){let a=[];for(let[l,u]of Object.entries(i)){if(!u||typeof u!="object")continue;let p=u,f={name:String(l),healthy:!0};if(p.health)try{let m=await p.health();f.healthy=m,m||(f.error=`Plugin '${l}' health check failed`)}catch(m){f.healthy=!1,f.error=m instanceof Error?m.message:"Health check threw error"}a.push(f)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await Of(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Nf(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var xu=[];function Ba(t){let e=process.env[t];return e||(xu.push(t),"")}function kf(t,e){return e?Ba(t):process.env[t]??""}function Tv(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function mw(t){let e=Tv(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var hw=process.env.SMTP_MODE==="smtp"?"smtp":"console",Bi=process.env.EMAIL_MODE;if(Bi&&Bi!=="queue"&&Bi!=="smtp"&&Bi!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Bi}`);var us=Bi||hw,Ew=us==="console"?"console":"smtp",Cf=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",bu=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(us==="queue"&&Cf!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Cf}`);if(bu!=="generic"&&bu!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${bu}`);function Iu(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function yw(){let t=Iu(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=Iu(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=Iu(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=Iu(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var ja=yw(),gw=typeof ja=="string"?ja==="cookie"||ja==="both":Object.values(ja).some(t=>t==="cookie"||t==="both"),j={dynamodbTableName:Ba("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:Ba("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:Ba("JWT_PRIVATE_KEY"),jwtPublicKey:Ba("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:kf("SMTP_USER",us==="smtp"),pass:kf("SMTP_PASS",us==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Ew},email:{mode:us,queue:{provider:Cf,url:kf("EMAIL_QUEUE_URL",us==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:bu,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:mw("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Tv("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:ja,...gw?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function _v(){if(xu.length>0){let t=xu.map(e=>` - ${e}`).join(`
|
|
16
16
|
`);throw new Error(`Missing required environment variables (${xu.length}):
|
|
17
|
-
${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Pf(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function vw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Su(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return vw(r)}async function Df(t,e){let r=await Su(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Aw="otp",Iv={INVALID_CODE:_("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:_("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Tw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function xv(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Aw,challengeType:"verification-code",async create(){return T({value:"",data:null})},async update(){return T({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let s=Pf(e),a=await Su(s),c=new Date(Date.now()+r*60*1e3);return T({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:s,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Tw(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Df(n.credentialValue,i)?T({userId:n.userId,intents:[]}):d(Iv.INVALID_CODE()):d(Iv.MISSING_CHALLENGE_CONTEXT())}}}function bv(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var wu=t=>t?`"${t}" `:"";function Ye(t,e=""){if(typeof t!="number")throw new TypeError(wu(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(wu(e)+"expected integer >= 0, got "+t);return t}function wv(t,e=""){if(typeof t!="boolean")throw new TypeError(wu(e)+"expected boolean, got type="+typeof t);return t}function In(t,e,r=""){if(bv(t)&&(e===void 0||t.length===e))return t;e!==void 0&&Ye(e,"length");let n=bv(t),i=e!==void 0?` of length ${e}`:"",o=n?`length=${t.length}`:`type=${typeof t}`,s=wu(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}function Nu(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("expected hash wrapped by utils.createHasher");if(Ye(t.outputLen),Ye(t.blockLen),t.outputLen<1||t.blockLen<1)throw new Error("hash blockLen / outputLen must be >= 1")}var _w=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},Sv=(t,e)=>{_w(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function xn(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function ds(t,e){In(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function ji(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Nt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function ps(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function wr(t,e){return t<<32-e|t>>>e}function be(t,e){return t<<e|t>>>32-e>>>0}var Iw=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function xw(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function bw(t){for(let e=0;e<t.length;e++)t[e]=xw(t[e]);return t}var fs=Iw?t=>t:bw;function Sw(t){if(typeof t!="string")throw new TypeError("string expected");let e=new TextEncoder().encode(t);try{return new Uint8Array(e)}finally{Nt(e)}}function Uf(t,e=""){return typeof t=="string"?Sw(t):In(t,void 0,e)}function ms(t,e,r="opts"){return Sv(t,"defaults"),e!==void 0&&Sv(e,r),Object.assign(Object.create(null),t,e)}function Ru(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=ms({},e,"info");let r=(i,o)=>t(o).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function Lf(t=32){Ye(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var Ou=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var ku=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(Nu(e),In(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("expected Hash instance");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let o=0;o<i.length;o++)i[o]^=54;this.iHash.update(i),this.oHash=e.create();for(let o=0;o<i.length;o++)i[o]^=106;this.oHash.update(i),Nt(i)}update(e){return xn(this),this.iHash.update(e),this}digestInto(e){xn(this),ds(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:o,blockLen:s,outputLen:a,canXOF:c}=this;return e=e,e.finished=i,e.destroyed=o,e.blockLen=s,e.outputLen=a,e.canXOF=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Nv=(()=>{let t=((e,r,n)=>new ku(e,r).update(n).digest());return t.create=(e,r)=>new ku(e,r),t})();function Nw(t,e,r,n){Nu(t);let i=ms({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if(Ye(o,"c"),Ye(s,"dkLen"),Ye(a,"asyncTick"),o<1)throw new Error('"c" (iterations) must be >= 1');if(s<1)throw new Error('"dkLen" must be >= 1');if(s>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Uf(e,"password");try{let l=Uf(r,"salt");try{let u=new Uint8Array(s),{iHash:p,oHash:f,outputLen:m}=Nv.create(t,c),E=new Uint8Array(m),v=Rw(p,f,l,E);return{c:o,dkLen:s,asyncTick:a,DK:u,outputLen:m,eng:v}}finally{typeof r=="string"&&Nt(l)}}finally{typeof e=="string"&&Nt(c)}}function Rw(t,e,r,n){let i=new Uint8Array(4),o=ps(i),s=t._cloneInto().update(r),a=e._cloneInto(),c=t._cloneInto,l=e._cloneInto;return{u1:(u,p)=>{o.setInt32(0,u,!1),s._cloneInto(a).update(i).digestInto(n),e._cloneInto(a).update(n).digestInto(n),p.set(n.subarray(0,p.length))},rounds:(u,p)=>{for(let f=1;f<u;f++){c.call(t,a).update(n).digestInto(n),l.call(e,a).update(n).digestInto(n);for(let m=0;m<p.length;m++)p[m]^=n[m]}},output:u=>(t.destroy(),e.destroy(),s.destroy(),a.destroy(),Nt(n),u)}}function Mf(t,e,r,n){let{c:i,dkLen:o,DK:s,outputLen:a,eng:c}=Nw(t,e,r,n);for(let l=1,u=0;u<o;l++,u+=a){let p=s.subarray(u,u+a);c.u1(l,p),c.rounds(i,p)}return c.output(s)}var Cu=BigInt(4294967295),Rv=BigInt(32);function Ow(t,e=!1){return e?{h:Number(t&Cu),l:Number(t>>Rv&Cu)}:{h:Number(t>>Rv&Cu)|0,l:Number(t&Cu)|0}}function Ov(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=Ow(t[o],e);[n[o],i[o]]=[s,a]}return[n,i]}var kw=t=>t/2**32|0,Cw=t=>t>>>0;function kv(t,e,r,n){let i=kw(r),o=Cw(r);t.setUint32(e,n?o:i,n),t.setUint32(e+4,n?i:o,n)}function Cv(t,e,r){return t&e^~t&r}function Pv(t,e,r){return t&e^t&r^e&r}var Pu=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=ps(this.buffer)}update(e){xn(this),In(e);let{view:r,buffer:n,blockLen:i}=this,o=e.length,s=!1;for(let a=0;a<o;){let c=Math.min(i-this.pos,o-a);if(c===i){let l=ps(e);for(;i<=o-a;a+=i)this.process(l,a);s=!0;continue}n.set(a===0&&c===o?e:e.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===i&&(this.process(r,0),this.pos=0,s=!0)}return this.length+=e.length,s&&this.roundClean(),this}digestInto(e){xn(this),ds(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:o}=this,{pos:s}=this;r[s++]=128,r.fill(0,s),this.padOffset>i-s&&(this.process(n,0),r.fill(0)),kv(n,i-8,this.length*8,o),this.process(n,0),this.roundClean();let a=e===r?n:ps(e),c=this.outputLen,l=c/4,u=this.get();if(c%4||l>u.length)throw new Error("invalid outputLen");for(let p=0;p<l;p++)a.setUint32(4*p,u[p],o)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:i,destroyed:o,pos:s}=this;return e.destroyed=o,e.finished=i,e.length=n,e.pos=s,s&&e.buffer.set(r),e}clone(){return this._cloneInto()}},Dv=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Pw=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),si=new Uint32Array(64),Kf=class extends Pu{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,r){super(64,e,8,!1),this.A=r[0]|0,this.B=r[1]|0,this.C=r[2]|0,this.D=r[3]|0,this.E=r[4]|0,this.F=r[5]|0,this.G=r[6]|0,this.H=r[7]|0}get(){let{A:e,B:r,C:n,D:i,E:o,F:s,G:a,H:c}=this;return[e,r,n,i,o,s,a,c]}set(e,r,n,i,o,s,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=o|0,this.F=s|0,this.G=a|0,this.H=c|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,r){for(let p=0;p<16;p++,r+=4)si[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let f=si[p-15],m=si[p-2],E=wr(f,7)^wr(f,18)^f>>>3,v=wr(m,17)^wr(m,19)^m>>>10;si[p]=v+si[p-7]+E+si[p-16]|0}let{A:n,B:i,C:o,D:s,E:a,F:c,G:l,H:u}=this;for(let p=0;p<64;p++){let f=wr(a,6)^wr(a,11)^wr(a,25),m=u+f+Cv(a,c,l)+Pw[p]+si[p]|0,v=(wr(n,2)^wr(n,13)^wr(n,22))+Pv(n,i,o)|0;u=l,l=c,c=a,a=s+m|0,s=o,o=i,i=n,n=m+v|0}n=n+this.A|0,i=i+this.B|0,o=o+this.C|0,s=s+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,u=u+this.H|0,this.set(n,i,o,s,a,c,l,u)}roundClean(){Nt(si)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Nt(this.buffer)}},Hf=class extends Kf{constructor(){super(32,Dv)}};var Ff=Ru(()=>new Hf,Ou(1));function Uv(t,e,r,n,i,o){let s=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],u=t[e++]^r[n++],p=t[e++]^r[n++],f=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],N=t[e++]^r[n++],S=t[e++]^r[n++],R=t[e++]^r[n++],M=t[e++]^r[n++],K=t[e++]^r[n++],B=t[e++]^r[n++],V=s,$=a,A=c,x=l,b=u,g=p,I=f,O=m,P=E,k=v,C=N,D=S,L=R,H=M,z=K,Y=B;for(let pe=0;pe<8;pe+=2)b^=be(V+L|0,7),P^=be(b+V|0,9),L^=be(P+b|0,13),V^=be(L+P|0,18),k^=be(g+$|0,7),H^=be(k+g|0,9),$^=be(H+k|0,13),g^=be($+H|0,18),z^=be(C+I|0,7),A^=be(z+C|0,9),I^=be(A+z|0,13),C^=be(I+A|0,18),x^=be(Y+D|0,7),O^=be(x+Y|0,9),D^=be(O+x|0,13),Y^=be(D+O|0,18),$^=be(V+x|0,7),A^=be($+V|0,9),x^=be(A+$|0,13),V^=be(x+A|0,18),I^=be(g+b|0,7),O^=be(I+g|0,9),b^=be(O+I|0,13),g^=be(b+O|0,18),D^=be(C+k|0,7),P^=be(D+C|0,9),k^=be(P+D|0,13),C^=be(k+P|0,18),L^=be(Y+z|0,7),H^=be(L+Y|0,9),z^=be(H+L|0,13),Y^=be(z+H|0,18);i[o++]=s+V|0,i[o++]=a+$|0,i[o++]=c+A|0,i[o++]=l+x|0,i[o++]=u+b|0,i[o++]=p+g|0,i[o++]=f+I|0,i[o++]=m+O|0,i[o++]=E+P|0,i[o++]=v+k|0,i[o++]=N+C|0,i[o++]=S+D|0,i[o++]=R+L|0,i[o++]=M+H|0,i[o++]=K+z|0,i[o++]=B+Y|0}function Vf(t,e,r,n,i){let o=n+0,s=n+16*i;for(let a=0;a<16;a++)r[s+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,o+=16,e+=16)Uv(r,s,t,e,r,o),a>0&&(s+=16),Uv(r,o,t,e+=16,r,s)}var Dw=1024*(2**20+1+1);function Uw(t,e,r){let n=ms({dkLen:32,asyncTick:10,maxmem:Dw},r),{N:i,r:o,p:s,dkLen:a,asyncTick:c,maxmem:l,onProgress:u}=n;if(Ye(i,"N"),Ye(o,"r"),Ye(s,"p"),Ye(a,"dkLen"),Ye(c,"asyncTick"),Ye(l,"maxmem"),u!==void 0&&typeof u!="function")throw new Error('"onProgress" must be a function');if(o<1)throw new Error('"r" expected integer >= 1');let p=128*o,f=p/4,m=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>m)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(s<1||s>(m-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(m-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let E=p*(i+s+1);if(E>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+E+", maxmem="+l);let v=Mf(Ff,t,e,{c:1,dkLen:p*s}),N=ji(v),S=ji(new Uint8Array(p*i)),R=ji(new Uint8Array(p)),M=()=>{};if(u){let K=2*i*s,B=Math.max(Math.floor(K/1e4),1),V=0;M=()=>{if(V++,u&&(!(V%B)||V===K))try{u(V/K)}catch($){throw Nt(v,S,R),$}}}return{N:i,r:o,p:s,dkLen:a,blockSize32:f,V:S,B32:N,B:v,tmp:R,blockMixCb:M,asyncTick:c}}function Lw(t,e,r,n,i){let o=Mf(Ff,t,r,{c:1,dkLen:e});return Nt(r,n,i),o}function Du(t,e,r){let{N:n,r:i,p:o,dkLen:s,blockSize32:a,V:c,B32:l,B:u,tmp:p,blockMixCb:f}=Uw(t,e,r);fs(l);for(let m=0;m<o;m++){let E=a*m;for(let v=0;v<a;v++)c[v]=l[E+v];for(let v=0,N=0;v<n-1;v++)Vf(c,N,c,N+=a,i),f();Vf(c,(n-1)*a,l,E,i),f();for(let v=0;v<n;v++){let N=(l[E+a-16]&n-1)>>>0;for(let S=0;S<a;S++)p[S]=l[E+S]^c[N*a+S];Vf(p,0,l,E,i),f()}}return fs(l),Lw(t,s,u,c,p)}var Mw={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Kw={N:2**14,r:8,p:1};function Lv(t,e,r){return`${t.N}.${t.r}.${t.p}.${Mv(e)}.${Mv(r)}`}function Hw(t){let e=t.split(".");if(e.length===5){let[r,n,i,o,s]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Uu(o),expected:Uu(s)}}if(e.length===2){let[r,n]=e;return{params:Kw,salt:Uu(r),expected:Uu(n)}}return null}function Mv(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Uu(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Kv(t={}){let e={...Mw,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=Lf(e.saltLength),o=await Du(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),s=Lv({N:e.N,r:e.r,p:e.p},i,o);return T({value:s,data:n.metadata??null})}catch(i){let o=i instanceof Error?i.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async update(n,i){if(!n.value)return T({});try{if(typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let o=Lf(e.saltLength),s=await Du(r.encode(n.value),o,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Lv({N:e.N,r:e.r,p:e.p},o,s);return T({value:a,...n.data&&{data:n.data}})}catch(o){let s=o instanceof Error?o.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async verify(n){try{if(!n.credential?.value)return d([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return d([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Hw(n.credential.value);if(!i)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:o,salt:s,expected:a}=i;if(s.length!==e.saltLength||a.length!==e.dkLen)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Du(r.encode(n.credentialValue),s,{N:o.N,r:o.r,p:o.p,dkLen:e.dkLen});if(c.length!==a.length)return d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?T({userId:n.userId,credentialId:"password"}):d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),d([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var Fv=H_(Hv(),1);function Vv(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new Fv.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let o=r.browser.name??"",s=r.os.name??"";return{deviceName:i,browser:o,os:s,browserName:o,osName:s}}}}import{createHash as Fw}from"node:crypto";import{SendMessageCommand as Vw,SQSClient as Bw}from"@aws-sdk/client-sqs";var jw={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Mu=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new Bw(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Vw({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:Gw(n)})}return T(void 0)}catch(r){return d({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},o=this.config.eventTypeMap?.[e.template]??jw[e.template]??e.template,s=Gi(i.eventId)??Gi(i.challengeId)??crypto.randomUUID(),a=n?`${s}:${$w(r)}`:s,c=Gi(i.locale),l=Gi(i.traceId)??a,u=qw(this.config.defaultMetadata,i),p=Ww(i);if(this.config.envelope==="snapshot-auth-v1"){let f=Gi(u?.tenantId),m=Gi(u?.tenantType),E=Gi(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:o,to:r,...E?{userId:E}:{},...f?{tenantId:f}:{},...m?{tenantType:m}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:o,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...u?{metadata:u}:{},data:p}}};function Gi(t){return typeof t=="string"&&t.length>0?t:void 0}function Gw(t){return t.split("@")[1]||"(unknown)"}function $w(t){return Fw("sha256").update(t).digest("hex").slice(0,16)}function qw(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function Ww(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var $a=class t{static createAwsSqs(e){return new Mu(e)}static create(e){return t.createAwsSqs(e.sqs)}};import{EventEmitter as SR}from"node:events";import nN from"node:net";import Wf from"node:url";var zw=/^xn--/,Jw=/[^\0-\x7F]/,Yw=/[\x2E\u3002\uFF0E\uFF61]/g,Xw={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},Bf=35,Jr=Math.floor,jf=String.fromCharCode;function ai(t){throw new RangeError(Xw[t])}function Qw(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function jv(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(Yw,".");let i=t.split("."),o=Qw(i,e).join(".");return n+o}function Zw(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let o=t.charCodeAt(r++);(o&64512)==56320?e.push(((i&1023)<<10)+(o&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var eN=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Bv=function(t,e){return t+22+75*+(t<26)-(+(e!=0)<<5)},Gv=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>Bf*26>>1;n+=36)t=Jr(t/Bf);return Jr(n+(Bf+1)*t/(t+38))},tN=function(t){let e=[],r=t.length,n=0,i=128,o=72,s=t.lastIndexOf("-");s<0&&(s=0);for(let a=0;a<s;++a)t.charCodeAt(a)>=128&&ai("not-basic"),e.push(t.charCodeAt(a));for(let a=s>0?s+1:0;a<r;){let c=n;for(let u=1,p=36;;p+=36){a>=r&&ai("invalid-input");let f=eN(t.charCodeAt(a++));f>=36&&ai("invalid-input"),f>Jr((2147483647-n)/u)&&ai("overflow"),n+=f*u;let m=p<=o?1:p>=o+26?26:p-o;if(f<m)break;let E=36-m;u>Jr(2147483647/E)&&ai("overflow"),u*=E}let l=e.length+1;o=Gv(n-c,l,c==0),Jr(n/l)>2147483647-i&&ai("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},rN=function(t){let e=[],r=Zw(t),n=r.length,i=128,o=0,s=72;for(let l of r)l<128&&e.push(jf(l));let a=e.length,c=a;for(a&&e.push("-");c<n;){let l=2147483647;for(let p of r)p>=i&&p<l&&(l=p);let u=c+1;l-i>Jr((2147483647-o)/u)&&ai("overflow"),o+=(l-i)*u,i=l;for(let p of r)if(p<i&&++o>2147483647&&ai("overflow"),p===i){let f=o;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(f<E)break;let v=f-E,N=36-E;e.push(jf(Bv(E+v%N,0))),f=Jr(v/N)}e.push(jf(Bv(f,0))),s=Gv(o,u,c===a),o=0,++c}++o,++i}return e.join("")},$v=function(t){return jv(t,function(e){return zw.test(e)?tN(e.slice(4).toLowerCase()):e})},hs=function(t){return jv(t,function(e){return Jw.test(e)?"xn--"+rN(e):e})};var iN=/^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/,oN=/^[\x00-\x20]+|[\x00-\x20]+$/g,sN=/^[\x00-\x20\u00a0\ufeff]+/,aN=/^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/,cN=/[\x00-\x20#/:<>?@[\\\]^|\x7f]/,lN=/[\x00-\x1f\x7f]/;function uN(t){let e=new TypeError("Invalid URL");return e.code="ERR_INVALID_URL",e.input=t,e}function $f(t,e,r,n){let i=Wf.parse(t,e,n),o=aN.exec(t.replace(sN,""));if(o&&(o[1]||i.hostname!==null)){let c=o[2].slice(o[2].lastIndexOf("@")+1);if(!c||lN.test(c)||(i.host||"").toLowerCase()!==hs(c.toLowerCase())||c.charAt(0)==="["&&!nN.isIPv6(c.slice(1,c.indexOf("]"))))throw r}else if(i.hostname!==null)throw r;let s=i.auth===null||i.auth===void 0?null:i.auth.split(":"),a=i;return a.username=s?s.shift():null,a.password=s&&s.length?s.join(":"):null,a}function qf(t){try{return decodeURIComponent(t)}catch{return t}}function dN(t,e){let r=t||"";if(!r)return"";if(r.charAt(0)==="["&&r.charAt(r.length-1)==="]")return r.slice(1,-1);let n=qf(r),i=cN.test(n)?"":Wf.domainToASCII(n);if(!i)throw uN(e);return i}var Nr=(t,e)=>{t=(t||"").replace(oN,"");let r=iN.exec(t),n=r?r[1]+"//"+r[2]:t,i;try{i=new URL(n)}catch(m){return $f(n,e,m)}let o=dN(i.hostname,i.href),s=i.port||null,a=i.pathname||null,c=i.search||null,l=null,u=null,p=null;(i.username||i.password)&&(u=qf(i.username),p=i.password?qf(i.password):null,l=u+(p!==null?":"+p:""));let f;if(e){let m=Object.create(null);i.searchParams.forEach((E,v)=>{if(Object.prototype.hasOwnProperty.call(m,v)){let N=m[v];Array.isArray(N)?N.push(E):m[v]=[N,E]}else m[v]=E}),f=m}else f=c?c.slice(1):null;return{protocol:i.protocol||null,host:i.host||null,hostname:o,port:s,pathname:a,search:c,path:(a||"")+(c||"")||null,href:i.href,auth:l,username:u,password:p,query:f}},qv=(t,e)=>{try{return new URL(e,t).href}catch(r){return $f(t,!1,r,!0),$f(e,!1,r,!0),Wf.resolve(t,e)}};import _N from"node:util";import IN from"node:fs";import mN from"node:http";import hN from"node:https";import EN from"node:zlib";import{PassThrough as yN}from"node:stream";import pN from"node:net";var Wv=1800,zf=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=Nr(r||""),i=this.parse(e),o;return i.domain?(o=i.domain.replace(/^\./,""),(n.hostname.length<o.length||o.indexOf(".")<0||o.endsWith(".")||pN.isIP(n.hostname)||!("."+n.hostname).endsWith("."+o))&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||Wv)||Wv)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={},n=!1;return(e||"").toString().split(";").forEach(i=>{if(!i.trim())return;let o=i.split("="),s=o.shift().trim(),a=o.join("=").trim(),c;if(!n){n=!0,s&&(r.name=s,r.value=a);return}switch(s.toLowerCase()){case"expires":{let l=new Date(a);l.toString()!=="Invalid Date"&&(r.expires=l);break}case"path":r.path=a;break;case"domain":c=a.toLowerCase(),c.length&&c.charAt(0)!=="."&&(c="."+c),r.domain=c;break;case"max-age":r.expires=new Date(Date.now()+(Number(a)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break}}),r}match(e,r){let n=Nr(r||"");if(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain))return!1;let i=n.pathname||"/",o=e.path;return!(!(i===o||i.startsWith(o)&&(o.endsWith("/")||i.charAt(o.length)==="/"))||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");r.pop();let n=r.join("/").trim();return n.charAt(0)!=="/"?"/":n}},Jf=zf;var Ku="nodemailer",Xe="10.1.0",zv="https://nodemailer.com/";import gN from"node:net";var Hu="ECONNECTION",Yf="ETIMEDOUT",fN="ESOCKET";var Jv="EENVELOPE",Yv="EMESSAGE",Fu="ESTREAM";var Vu="ENOAUTH",ci="EOAUTH2",Bu="EMAXLIMIT",Xv="EMAXRECIPIENTS",ju="ESENDMAIL",Qv="ESES",Es="ECONFIG",li="EPROXY",Gu="EFILEACCESS",$u="EURLACCESS",qu="EFETCH",Wa=t=>t.responseCode===421||t.code===Hu||t.code===fN||t.code===Yf,Wu="ERR_ACCESS_DENIED";var Rr=t=>t==="__proto__",et=(t,e,r)=>(Object.keys(e||{}).forEach(n=>{Rr(n)||r&&r(n)||(t[n]=e[n])}),t);var vN=5,eA=60*1e3,AN=64*1024*1024,TN=["ALPNProtocols","ca","cert","checkServerIdentity","ciphers","crl","dhparam","ecdhCurve","honorCipherOrder","key","maxVersion","minVersion","passphrase","pfx","rejectUnauthorized","secureContext","secureOptions","secureProtocol","servername","sessionIdContext","sigalgs"];function Xf(t){t.code!==Wu&&(t.code=qu)}function Zv(t){let e;try{e=Nr(t)}catch{return!1}return e.protocol!=="http:"&&e.protocol!=="https:"?!1:e}function zu(t,e){e=e||{},e.fetchRes=e.fetchRes||new yN,e.cookies=e.cookies||new Jf,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?vN:e.maxRedirects;let r=e.fetchRes,n=Zv(t);if(!n)return e.body&&typeof e.body.destroy=="function"&&(e.body.on("error",()=>!1),e.body.destroy()),setImmediate(()=>{let E=new Error("Unsupported protocol for URL "+t);E.code=qu,E.sourceUrl=t,r.emit("error",E)}),r;e.cookie&&([].concat(e.cookie||[]).forEach(E=>{e.cookies.set(E,t)}),e.cookie=!1);let i=(e.method||"").toString().trim().toUpperCase()||"GET",o=!1,s,a,c=n.protocol==="https:"?hN:mN,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+Xe};if(Object.keys(e.headers||{}).forEach(E=>{Rr(E.toLowerCase().trim())||(l[E.toLowerCase().trim()]=e.headers[E])}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(s=e.cookies.get(t))&&(l.cookie=s),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",E=>{o||(o=!0,Xf(E),E.sourceUrl=t,r.emit("error",E))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(E=>{let v=e.body[E].toString().trim();return encodeURIComponent(E)+"="+encodeURIComponent(v)}).join("&"))}catch(E){return o=!0,E.code=qu,E.sourceUrl=t,setImmediate(()=>r.emit("error",E)),r}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let u,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!0,agent:!1};e.tls&&Object.keys(e.tls).forEach(E=>{TN.includes(E)&&(p[E]=e.tls[E])}),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!gN.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{u=c.request(p)}catch(E){return o=!0,setImmediate(()=>{Xf(E),E.sourceUrl=t,r.emit("error",E)}),r}let f=(E,v=t)=>{o||(o=!0,Xf(E),E.sourceUrl=v,r.emit("error",E),u.abort())},m=typeof e.timeout=="number"&&e.timeout>=0?e.timeout:eA;return m&&u.setTimeout(m,()=>f(new Error("Request Timeout"))),u.on("error",E=>f(E)),r.once("close",()=>{o||r.readableEnded||(o=!0,u.destroy())}),u.on("response",E=>{let v;if(o)return;switch(E.headers["content-encoding"]){case"gzip":case"deflate":v=EN.createUnzip();break}if(E.headers["set-cookie"]&&[].concat(E.headers["set-cookie"]||[]).forEach(M=>{e.cookies.set(M,t)}),[301,302,303,307,308].includes(E.statusCode)&&E.headers.location){if(e.redirects++,e.redirects>e.maxRedirects)return f(new Error("Maximum redirect count exceeded"));e.method="GET",e.body=!1;let M;try{M=qv(t,E.headers.location)}catch{M=E.headers.location}let K=Zv(M);if(!K)return f(new Error("Unsupported protocol for URL "+M),M);let B=K.hostname!==n.hostname,V=n.protocol==="https:"&&K.protocol==="http:";if(e.headers&&(B||V)){let $=["authorization","cookie","proxy-authorization"];Object.keys(e.headers).forEach(A=>{$.includes(A.toLowerCase())&&delete e.headers[A]})}return o=!0,E.resume(),u.abort(),zu(M,e)}if(r.statusCode=E.statusCode,r.headers=E.headers,E.statusCode>=300&&!e.allowErrorResponse)return f(new Error("Invalid status code "+E.statusCode));E.on("error",M=>f(M));let N=typeof e.maxBytes=="number"&&e.maxBytes>0?e.maxBytes:AN,S=v||E,R=0;S.on("data",M=>{R+=M.length,!(R<=N||o)&&(S.unpipe(r),f(new Error("Response size exceeds the allowed "+N+" bytes")))}),v?(E.pipe(v).pipe(r),v.on("error",M=>f(M))):E.pipe(r)}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(u);u.write(a)}catch(E){return f(E)}u.end()}),r}zu.Cookies=Jf;zu.DEFAULT_TIMEOUT=eA;var ui=zu;import lr from"node:dns";import xN from"node:net";import bN from"node:os";import{finished as SN}from"node:stream";var Qf=300*1e3,wN=30*1e3,tA=1e3,rA=0;var nA,iA=!1,NN=()=>{if(!iA){iA=!0;try{nA=bN.networkInterfaces()}catch{}}return nA},oA=(t,e)=>{let r=Object.values(NN()||{}).flat();return r.length?r.filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},RN=(t,e,r,n)=>{if(r=r||{},!oA(t,r.allowInternalNetworkInterfaces))return n(null,[]),null;let i=lr.Resolver?new lr.Resolver(r):lr;return i["resolve"+t](e,(o,s)=>{if(o){switch(o.code){case lr.NODATA:case lr.NOTFOUND:case lr.NOTIMP:case lr.SERVFAIL:case lr.CONNREFUSED:case lr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(o)}return n(null,Array.isArray(s)?s:[].concat(s||[]))}),lr.Resolver?i:null},Xr=new Map,ys=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({host:n,_addresses:r},e||{})},sA=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||xN.isIP(t.host)){let S={addresses:[t.host]};return e(null,ys(S,{servername:t.servername||!1,cached:!1}))}let r=t.host,n=t.servername||r,i;if(Xr.has(t.host)){i=Xr.get(t.host);let S=Date.now();if(S-rA>wN){rA=S;for(let[R,M]of Xr.entries())M.expires&&M.expires<S&&Xr.delete(R);if(Xr.size>tA){let R=Math.floor(tA*.1);Array.from(Xr.keys()).slice(0,R).forEach(K=>Xr.delete(K))}}if(!i.expires||i.expires>=S)return e(null,ys(i.value,{servername:n,cached:!0}))}let o=!1,s,a=(S,R)=>{o||(o=!0,clearTimeout(s),e(S,R))},c=S=>i?(Xr.set(r,{value:i.value,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(i.value,{servername:n,cached:!0,error:S})),!0):!1,l=[],u=Number(t.timeout)||0;u>0&&(s=setTimeout(()=>{for(let R of l)typeof R.cancel=="function"&&R.cancel();let S=new Error("DNS lookup for "+r+" timed out");S.code=lr.TIMEOUT,c(S)||a(S)},u));let p=[],f=[],m=null,E=null,v=2,N=()=>{if(--v||o)return;let S=p.concat(f);if(S.length){let R={addresses:S};return Xr.set(r,{value:R,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(R,{servername:n,cached:!1}))}if(!(m&&E&&c(m)))try{lr.lookup(r,{all:!0},(R,M)=>{if(R)return c(R)?void 0:a(R);let K=M?M.filter(V=>oA(V.family)).map(V=>V.address):[];if(M&&M.length&&!K.length&&console.warn(`Failed to resolve IPv${M[0].family} addresses with current network`),!K.length&&i)return a(null,ys(i.value,{servername:n,cached:!0}));let B={addresses:K.length?K:[r]};return Xr.set(r,{value:B,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(B,{servername:n,cached:!1}))})}catch(R){return c(R)?void 0:a(m||E||R)}};for(let S of[4,6]){let R=RN(S,r,t,(M,K)=>{S===4?(m=M,p=K||[]):(E=M,f=K||[]),N()});R&&l.push(R)}},gs=t=>{t=t||"";let e={},r=Nr(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}return!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),(r.username||r.password)&&(e.auth={user:r.username||"",pass:r.password||""}),Object.keys(r.query||{}).forEach(n=>{let i=e,o=n,s=r.query[n];switch(isNaN(s)||(s=Number(s)),s){case"true":s=!0;break;case"false":s=!1;break}if(n.indexOf("tls.")===0)o=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;!Rr(o)&&!(o in i)&&(i[o]=s)}),e},ON=(t,e,r,n,i,...o)=>{let s=Object.assign({},r||{},n||{});delete s.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](s,i,...o)},ft=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(o=>{r[o]=()=>!1}),r;let i=t.logger===!0?CN(n):t.logger;return n.forEach(o=>{r[o]=(...s)=>{let a=typeof s[0]=="string"?void 0:s.shift();ON(i,o,e,a,...s)}}),r},Mt=(t,e)=>function(...r){let n=r.shift();n?e(n):t(...r)},em=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,o=n.split(";");if(o.length>0){let l=o[o.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,o.pop())}let s=o.length>0?o.shift():"application/octet-stream",a={};for(let l=0;l<o.length;l++){let u=o[l],p=u.indexOf("=");if(p>0){let f=u.substring(0,p).trim(),m=u.substring(p+1).trim();f&&!Rr(f)&&(a[f]=m)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:s||"application/octet-stream",params:a}};function tm(t,e,r,n){!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;return n||(i=new Promise((o,s)=>{n=Mt(o,s)})),kN(t,e,r,n),i}function kN(t,e,r,n){let i=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!i)return n(null,i);if(typeof i=="object"){if(typeof i.pipe=="function")return za(i,(s,a)=>{if(s)return n(s);t[e].content?t[e].content=a:t[e]=a,n(null,a)});if(/^data:/i.test(i.path||i.href)){let s=em(i.path||i.href);return n(null,s&&s.data?s.data:Buffer.alloc(0))}else if(i.href||/^https?:\/\//i.test(i.path)){let s=i.href||i.path;if(r.disableUrlAccess){setImmediate(()=>{let a=new Error("Url access rejected for "+s);a.code=$u,n(a)});return}return za(ui(s,{headers:i.httpHeaders,tls:i.tls}),n)}else if(i.path){if(r.disableFileAccess){setImmediate(()=>{let s=new Error("File access rejected for "+i.path);s.code=Gu,n(s)});return}return za(IN.createReadStream(i.path),n)}}typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(i=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,i))}var Or=function(...t){let e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{Rr(n)||(["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=et(e[n]||{},r[n]):e[n]=r[n])})}),e},Ja=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let o=e[n];o<33||o>126||o===43||o===61?r+="+"+(o<16?"0":"")+o.toString(16).toUpperCase():r+=String.fromCharCode(o)}return r},Zf=new WeakMap;function rm(t){t.on("error",e=>{Zf.has(t)||Zf.set(t,e)})}function $i(t){let e=t;e&&typeof e.pipe=="function"&&typeof e.destroy=="function"&&!e.destroyed&&e.destroy()}function nm(t){let e=Zf.get(t)||t.errored;if(e)return e;if(t.readableEnded||t.destroyed){let r=new Error("Content stream was already read or destroyed");return r.code=Fu,r}return null}function za(t,e){let r=!1,n=(a,c)=>{r||(r=!0,e(a,c))},i=nm(t);if(i){t.on("error",()=>!1),setImmediate(()=>n(i));return}let o=[],s=0;t.on("data",a=>{typeof a=="string"&&(a=Buffer.from(a)),o.push(a),s+=a.length}),SN(t,{writable:!1},a=>{if(a)return n(a);let c;try{c=Buffer.concat(o,s)}catch(l){return n(l)}n(null,c)})}function CN(t){let e=t.reduce((o,s)=>Math.max(o,s.length),0),r=new Map;t.forEach(o=>{let s=o.toUpperCase();s.length<e&&(s+=" ".repeat(e-s.length)),r.set(o,s)});let n=(o,s,a,...c)=>{let l="";s&&(s.tnx==="server"?l="S: ":s.tnx==="client"&&(l="C: "),s.sid&&(l="["+s.sid+"] "+l),s.cid&&(l="[#"+s.cid+"] "+l)),a=_N.format(a,...c),a.split(/\r?\n/).forEach(u=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(o),l+u)})},i={};return t.forEach(o=>{i[o]=n.bind(null,o)}),i}import PN from"node:path";var aA="application/octet-stream",DN="bin",cA=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),lA=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);function uA(t){if(!t)return aA;let e=PN.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=lA.has(r)?lA.get(r):aA;return Array.isArray(n)?n[0]:n}function Ju(t){if(!t)return DN;let e=t.toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(cA.has(r+"/"+n)){let i=cA.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}import um from"node:crypto";import aR from"node:fs";import{PassThrough as Za,finished as td,pipeline as dm}from"node:stream";import rd from"node:url";import{Transform as UN}from"node:stream";function qi(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function LN(t){let e=Math.floor(Number(t));return Number.isFinite(e)&&e>=1?e:76}function MN(t,e,r){let n=Math.ceil(t.length/e),i=Math.max(n-1,0),o=t.length-i*e,s=Buffer.allocUnsafe(i*(e+2)+(r?o:0)),a=0;for(let c=0;c<i*e;c+=e)t.copy(s,a,c,c+e),a+=e,s[a++]=13,s[a++]=10;if(r&&(a+=t.copy(s,a,i*e),o=0),a!==s.length)throw new Error("Unexpected wrapped length");return{output:s,rest:o}}var Yu=class extends UN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=LN(this.options.lineLength)),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_emit(e,r){let n=Buffer.from(this._curLine+e,"latin1");if(!n.length)return;let i=n;if(this.options.lineLength){let o=MN(n,this.options.lineLength,r);i=o.output,this._curLine=o.rest?n.toString("latin1",n.length-o.rest):""}else this._curLine="";i.length&&(this.outputBytes+=i.length,this.push(i))}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length%3;o&&(this._remainingBytes=i.subarray(i.length-o),i=i.subarray(0,i.length-o)),this._emit(qi(i),!1),n()}_flush(e){this._emit(this._remainingBytes?qi(this._remainingBytes):"",!0),this._remainingBytes=!1,e()}};import{Transform as KN}from"node:stream";var HN=4,FN=[[9],[10],[13],[32,60],[62,126]],mA=new Uint8Array(256);for(let t=0;t<256;t++)mA[t]=BN(t,FN)?1:0;var fA=Buffer.from("0123456789ABCDEF","latin1"),hA=t=>t===32||t===9;function EA(t){return om(typeof t=="string"?Buffer.from(t,"utf-8"):t)}function om(t,e,r,n){let i=t.length,o=Buffer.allocUnsafe(i*3),s=0;for(let a=0;a<i;a++){let c=t[a],l=a+1<i?t[a+1]:e,u=r&&(c===13||c===10)?c===13?l===10:(a>0?t[a-1]:n)===13:!0;if(mA[c]&&u&&!(hA(c)&&(l===void 0||l===10||l===13))){o[s++]=c;continue}o[s++]=61,o[s++]=fA[Math.floor(c/16)],o[s++]=fA[c%16]}return o.toString("latin1",0,s)}function VN(t,e){if(t=(t||"").toString(),e=Math.max(Number(e)||76,HN),t.length<=e)return t;let r=0,n=t.length,i,o,s,a=Math.floor(e/3),c="";for(;r<n;){if(s=t.substr(r,e),i=s.match(/\r\n/)){s=s.substr(0,i.index+i[0].length),c+=s,r+=s.length;continue}if(s.substr(-1)===`
|
|
17
|
+
${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Df(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function vw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Su(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return vw(r)}async function Pf(t,e){let r=await Su(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Aw="otp",Iv={INVALID_CODE:_("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:_("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Tw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function xv(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Aw,challengeType:"verification-code",async create(){return T({value:"",data:null})},async update(){return T({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let s=Df(e),a=await Su(s),c=new Date(Date.now()+r*60*1e3);return T({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:s,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Tw(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Pf(n.credentialValue,i)?T({userId:n.userId,intents:[]}):d(Iv.INVALID_CODE()):d(Iv.MISSING_CHALLENGE_CONTEXT())}}}function bv(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var wu=t=>t?`"${t}" `:"";function Ye(t,e=""){if(typeof t!="number")throw new TypeError(wu(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(wu(e)+"expected integer >= 0, got "+t);return t}function wv(t,e=""){if(typeof t!="boolean")throw new TypeError(wu(e)+"expected boolean, got type="+typeof t);return t}function xn(t,e,r=""){if(bv(t)&&(e===void 0||t.length===e))return t;e!==void 0&&Ye(e,"length");let n=bv(t),i=e!==void 0?` of length ${e}`:"",o=n?`length=${t.length}`:`type=${typeof t}`,s=wu(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}function Nu(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("expected hash wrapped by utils.createHasher");if(Ye(t.outputLen),Ye(t.blockLen),t.outputLen<1||t.blockLen<1)throw new Error("hash blockLen / outputLen must be >= 1")}var _w=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},Sv=(t,e)=>{_w(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function bn(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function ds(t,e){xn(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function ji(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Nt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function ps(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function wr(t,e){return t<<32-e|t>>>e}function be(t,e){return t<<e|t>>>32-e>>>0}var Iw=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function xw(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function bw(t){for(let e=0;e<t.length;e++)t[e]=xw(t[e]);return t}var fs=Iw?t=>t:bw;function Sw(t){if(typeof t!="string")throw new TypeError("string expected");let e=new TextEncoder().encode(t);try{return new Uint8Array(e)}finally{Nt(e)}}function Uf(t,e=""){return typeof t=="string"?Sw(t):xn(t,void 0,e)}function ms(t,e,r="opts"){return Sv(t,"defaults"),e!==void 0&&Sv(e,r),Object.assign(Object.create(null),t,e)}function Ru(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=ms({},e,"info");let r=(i,o)=>t(o).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function Lf(t=32){Ye(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var Ou=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var ku=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(Nu(e),xn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("expected Hash instance");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let o=0;o<i.length;o++)i[o]^=54;this.iHash.update(i),this.oHash=e.create();for(let o=0;o<i.length;o++)i[o]^=106;this.oHash.update(i),Nt(i)}update(e){return bn(this),this.iHash.update(e),this}digestInto(e){bn(this),ds(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:o,blockLen:s,outputLen:a,canXOF:c}=this;return e=e,e.finished=i,e.destroyed=o,e.blockLen=s,e.outputLen=a,e.canXOF=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Nv=(()=>{let t=((e,r,n)=>new ku(e,r).update(n).digest());return t.create=(e,r)=>new ku(e,r),t})();function Nw(t,e,r,n){Nu(t);let i=ms({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if(Ye(o,"c"),Ye(s,"dkLen"),Ye(a,"asyncTick"),o<1)throw new Error('"c" (iterations) must be >= 1');if(s<1)throw new Error('"dkLen" must be >= 1');if(s>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Uf(e,"password");try{let l=Uf(r,"salt");try{let u=new Uint8Array(s),{iHash:p,oHash:f,outputLen:m}=Nv.create(t,c),E=new Uint8Array(m),v=Rw(p,f,l,E);return{c:o,dkLen:s,asyncTick:a,DK:u,outputLen:m,eng:v}}finally{typeof r=="string"&&Nt(l)}}finally{typeof e=="string"&&Nt(c)}}function Rw(t,e,r,n){let i=new Uint8Array(4),o=ps(i),s=t._cloneInto().update(r),a=e._cloneInto(),c=t._cloneInto,l=e._cloneInto;return{u1:(u,p)=>{o.setInt32(0,u,!1),s._cloneInto(a).update(i).digestInto(n),e._cloneInto(a).update(n).digestInto(n),p.set(n.subarray(0,p.length))},rounds:(u,p)=>{for(let f=1;f<u;f++){c.call(t,a).update(n).digestInto(n),l.call(e,a).update(n).digestInto(n);for(let m=0;m<p.length;m++)p[m]^=n[m]}},output:u=>(t.destroy(),e.destroy(),s.destroy(),a.destroy(),Nt(n),u)}}function Mf(t,e,r,n){let{c:i,dkLen:o,DK:s,outputLen:a,eng:c}=Nw(t,e,r,n);for(let l=1,u=0;u<o;l++,u+=a){let p=s.subarray(u,u+a);c.u1(l,p),c.rounds(i,p)}return c.output(s)}var Cu=BigInt(4294967295),Rv=BigInt(32);function Ow(t,e=!1){return e?{h:Number(t&Cu),l:Number(t>>Rv&Cu)}:{h:Number(t>>Rv&Cu)|0,l:Number(t&Cu)|0}}function Ov(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=Ow(t[o],e);[n[o],i[o]]=[s,a]}return[n,i]}var kw=t=>t/2**32|0,Cw=t=>t>>>0;function kv(t,e,r,n){let i=kw(r),o=Cw(r);t.setUint32(e,n?o:i,n),t.setUint32(e+4,n?i:o,n)}function Cv(t,e,r){return t&e^~t&r}function Dv(t,e,r){return t&e^t&r^e&r}var Du=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=ps(this.buffer)}update(e){bn(this),xn(e);let{view:r,buffer:n,blockLen:i}=this,o=e.length,s=!1;for(let a=0;a<o;){let c=Math.min(i-this.pos,o-a);if(c===i){let l=ps(e);for(;i<=o-a;a+=i)this.process(l,a);s=!0;continue}n.set(a===0&&c===o?e:e.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===i&&(this.process(r,0),this.pos=0,s=!0)}return this.length+=e.length,s&&this.roundClean(),this}digestInto(e){bn(this),ds(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:o}=this,{pos:s}=this;r[s++]=128,r.fill(0,s),this.padOffset>i-s&&(this.process(n,0),r.fill(0)),kv(n,i-8,this.length*8,o),this.process(n,0),this.roundClean();let a=e===r?n:ps(e),c=this.outputLen,l=c/4,u=this.get();if(c%4||l>u.length)throw new Error("invalid outputLen");for(let p=0;p<l;p++)a.setUint32(4*p,u[p],o)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:i,destroyed:o,pos:s}=this;return e.destroyed=o,e.finished=i,e.length=n,e.pos=s,s&&e.buffer.set(r),e}clone(){return this._cloneInto()}},Pv=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Dw=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),si=new Uint32Array(64),Kf=class extends Du{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,r){super(64,e,8,!1),this.A=r[0]|0,this.B=r[1]|0,this.C=r[2]|0,this.D=r[3]|0,this.E=r[4]|0,this.F=r[5]|0,this.G=r[6]|0,this.H=r[7]|0}get(){let{A:e,B:r,C:n,D:i,E:o,F:s,G:a,H:c}=this;return[e,r,n,i,o,s,a,c]}set(e,r,n,i,o,s,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=o|0,this.F=s|0,this.G=a|0,this.H=c|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,r){for(let p=0;p<16;p++,r+=4)si[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let f=si[p-15],m=si[p-2],E=wr(f,7)^wr(f,18)^f>>>3,v=wr(m,17)^wr(m,19)^m>>>10;si[p]=v+si[p-7]+E+si[p-16]|0}let{A:n,B:i,C:o,D:s,E:a,F:c,G:l,H:u}=this;for(let p=0;p<64;p++){let f=wr(a,6)^wr(a,11)^wr(a,25),m=u+f+Cv(a,c,l)+Dw[p]+si[p]|0,v=(wr(n,2)^wr(n,13)^wr(n,22))+Dv(n,i,o)|0;u=l,l=c,c=a,a=s+m|0,s=o,o=i,i=n,n=m+v|0}n=n+this.A|0,i=i+this.B|0,o=o+this.C|0,s=s+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,u=u+this.H|0,this.set(n,i,o,s,a,c,l,u)}roundClean(){Nt(si)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Nt(this.buffer)}},Hf=class extends Kf{constructor(){super(32,Pv)}};var Ff=Ru(()=>new Hf,Ou(1));function Uv(t,e,r,n,i,o){let s=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],u=t[e++]^r[n++],p=t[e++]^r[n++],f=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],N=t[e++]^r[n++],S=t[e++]^r[n++],R=t[e++]^r[n++],M=t[e++]^r[n++],K=t[e++]^r[n++],B=t[e++]^r[n++],V=s,$=a,A=c,x=l,b=u,g=p,I=f,O=m,D=E,k=v,C=N,P=S,L=R,H=M,z=K,Y=B;for(let pe=0;pe<8;pe+=2)b^=be(V+L|0,7),D^=be(b+V|0,9),L^=be(D+b|0,13),V^=be(L+D|0,18),k^=be(g+$|0,7),H^=be(k+g|0,9),$^=be(H+k|0,13),g^=be($+H|0,18),z^=be(C+I|0,7),A^=be(z+C|0,9),I^=be(A+z|0,13),C^=be(I+A|0,18),x^=be(Y+P|0,7),O^=be(x+Y|0,9),P^=be(O+x|0,13),Y^=be(P+O|0,18),$^=be(V+x|0,7),A^=be($+V|0,9),x^=be(A+$|0,13),V^=be(x+A|0,18),I^=be(g+b|0,7),O^=be(I+g|0,9),b^=be(O+I|0,13),g^=be(b+O|0,18),P^=be(C+k|0,7),D^=be(P+C|0,9),k^=be(D+P|0,13),C^=be(k+D|0,18),L^=be(Y+z|0,7),H^=be(L+Y|0,9),z^=be(H+L|0,13),Y^=be(z+H|0,18);i[o++]=s+V|0,i[o++]=a+$|0,i[o++]=c+A|0,i[o++]=l+x|0,i[o++]=u+b|0,i[o++]=p+g|0,i[o++]=f+I|0,i[o++]=m+O|0,i[o++]=E+D|0,i[o++]=v+k|0,i[o++]=N+C|0,i[o++]=S+P|0,i[o++]=R+L|0,i[o++]=M+H|0,i[o++]=K+z|0,i[o++]=B+Y|0}function Vf(t,e,r,n,i){let o=n+0,s=n+16*i;for(let a=0;a<16;a++)r[s+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,o+=16,e+=16)Uv(r,s,t,e,r,o),a>0&&(s+=16),Uv(r,o,t,e+=16,r,s)}var Pw=1024*(2**20+1+1);function Uw(t,e,r){let n=ms({dkLen:32,asyncTick:10,maxmem:Pw},r),{N:i,r:o,p:s,dkLen:a,asyncTick:c,maxmem:l,onProgress:u}=n;if(Ye(i,"N"),Ye(o,"r"),Ye(s,"p"),Ye(a,"dkLen"),Ye(c,"asyncTick"),Ye(l,"maxmem"),u!==void 0&&typeof u!="function")throw new Error('"onProgress" must be a function');if(o<1)throw new Error('"r" expected integer >= 1');let p=128*o,f=p/4,m=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>m)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(s<1||s>(m-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(m-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let E=p*(i+s+1);if(E>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+E+", maxmem="+l);let v=Mf(Ff,t,e,{c:1,dkLen:p*s}),N=ji(v),S=ji(new Uint8Array(p*i)),R=ji(new Uint8Array(p)),M=()=>{};if(u){let K=2*i*s,B=Math.max(Math.floor(K/1e4),1),V=0;M=()=>{if(V++,u&&(!(V%B)||V===K))try{u(V/K)}catch($){throw Nt(v,S,R),$}}}return{N:i,r:o,p:s,dkLen:a,blockSize32:f,V:S,B32:N,B:v,tmp:R,blockMixCb:M,asyncTick:c}}function Lw(t,e,r,n,i){let o=Mf(Ff,t,r,{c:1,dkLen:e});return Nt(r,n,i),o}function Pu(t,e,r){let{N:n,r:i,p:o,dkLen:s,blockSize32:a,V:c,B32:l,B:u,tmp:p,blockMixCb:f}=Uw(t,e,r);fs(l);for(let m=0;m<o;m++){let E=a*m;for(let v=0;v<a;v++)c[v]=l[E+v];for(let v=0,N=0;v<n-1;v++)Vf(c,N,c,N+=a,i),f();Vf(c,(n-1)*a,l,E,i),f();for(let v=0;v<n;v++){let N=(l[E+a-16]&n-1)>>>0;for(let S=0;S<a;S++)p[S]=l[E+S]^c[N*a+S];Vf(p,0,l,E,i),f()}}return fs(l),Lw(t,s,u,c,p)}var Mw={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Kw={N:2**14,r:8,p:1};function Lv(t,e,r){return`${t.N}.${t.r}.${t.p}.${Mv(e)}.${Mv(r)}`}function Hw(t){let e=t.split(".");if(e.length===5){let[r,n,i,o,s]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Uu(o),expected:Uu(s)}}if(e.length===2){let[r,n]=e;return{params:Kw,salt:Uu(r),expected:Uu(n)}}return null}function Mv(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Uu(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Kv(t={}){let e={...Mw,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=Lf(e.saltLength),o=await Pu(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),s=Lv({N:e.N,r:e.r,p:e.p},i,o);return T({value:s,data:n.metadata??null})}catch(i){let o=i instanceof Error?i.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async update(n,i){if(!n.value)return T({});try{if(typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let o=Lf(e.saltLength),s=await Pu(r.encode(n.value),o,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Lv({N:e.N,r:e.r,p:e.p},o,s);return T({value:a,...n.data&&{data:n.data}})}catch(o){let s=o instanceof Error?o.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async verify(n){try{if(!n.credential?.value)return d([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return d([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Hw(n.credential.value);if(!i)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:o,salt:s,expected:a}=i;if(s.length!==e.saltLength||a.length!==e.dkLen)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Pu(r.encode(n.credentialValue),s,{N:o.N,r:o.r,p:o.p,dkLen:e.dkLen});if(c.length!==a.length)return d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?T({userId:n.userId,credentialId:"password"}):d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),d([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var Fv=H_(Hv(),1);function Vv(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new Fv.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let o=r.browser.name??"",s=r.os.name??"";return{deviceName:i,browser:o,os:s,browserName:o,osName:s}}}}import{createHash as Fw}from"node:crypto";import{SendMessageCommand as Vw,SQSClient as Bw}from"@aws-sdk/client-sqs";var jw={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Mu=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new Bw(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Vw({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:Gw(n)})}return T(void 0)}catch(r){return d({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},o=this.config.eventTypeMap?.[e.template]??jw[e.template]??e.template,s=Gi(i.eventId)??Gi(i.challengeId)??crypto.randomUUID(),a=n?`${s}:${$w(r)}`:s,c=Gi(i.locale),l=Gi(i.traceId)??a,u=qw(this.config.defaultMetadata,i),p=Ww(i);if(this.config.envelope==="snapshot-auth-v1"){let f=Gi(u?.tenantId),m=Gi(u?.tenantType),E=Gi(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:o,to:r,...E?{userId:E}:{},...f?{tenantId:f}:{},...m?{tenantType:m}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:o,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...u?{metadata:u}:{},data:p}}};function Gi(t){return typeof t=="string"&&t.length>0?t:void 0}function Gw(t){return t.split("@")[1]||"(unknown)"}function $w(t){return Fw("sha256").update(t).digest("hex").slice(0,16)}function qw(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function Ww(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var $a=class t{static createAwsSqs(e){return new Mu(e)}static create(e){return t.createAwsSqs(e.sqs)}};import{EventEmitter as SR}from"node:events";import nN from"node:net";import Wf from"node:url";var zw=/^xn--/,Jw=/[^\0-\x7F]/,Yw=/[\x2E\u3002\uFF0E\uFF61]/g,Xw={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},Bf=35,Jr=Math.floor,jf=String.fromCharCode;function ai(t){throw new RangeError(Xw[t])}function Qw(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function jv(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(Yw,".");let i=t.split("."),o=Qw(i,e).join(".");return n+o}function Zw(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let o=t.charCodeAt(r++);(o&64512)==56320?e.push(((i&1023)<<10)+(o&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var eN=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Bv=function(t,e){return t+22+75*+(t<26)-(+(e!=0)<<5)},Gv=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>Bf*26>>1;n+=36)t=Jr(t/Bf);return Jr(n+(Bf+1)*t/(t+38))},tN=function(t){let e=[],r=t.length,n=0,i=128,o=72,s=t.lastIndexOf("-");s<0&&(s=0);for(let a=0;a<s;++a)t.charCodeAt(a)>=128&&ai("not-basic"),e.push(t.charCodeAt(a));for(let a=s>0?s+1:0;a<r;){let c=n;for(let u=1,p=36;;p+=36){a>=r&&ai("invalid-input");let f=eN(t.charCodeAt(a++));f>=36&&ai("invalid-input"),f>Jr((2147483647-n)/u)&&ai("overflow"),n+=f*u;let m=p<=o?1:p>=o+26?26:p-o;if(f<m)break;let E=36-m;u>Jr(2147483647/E)&&ai("overflow"),u*=E}let l=e.length+1;o=Gv(n-c,l,c==0),Jr(n/l)>2147483647-i&&ai("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},rN=function(t){let e=[],r=Zw(t),n=r.length,i=128,o=0,s=72;for(let l of r)l<128&&e.push(jf(l));let a=e.length,c=a;for(a&&e.push("-");c<n;){let l=2147483647;for(let p of r)p>=i&&p<l&&(l=p);let u=c+1;l-i>Jr((2147483647-o)/u)&&ai("overflow"),o+=(l-i)*u,i=l;for(let p of r)if(p<i&&++o>2147483647&&ai("overflow"),p===i){let f=o;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(f<E)break;let v=f-E,N=36-E;e.push(jf(Bv(E+v%N,0))),f=Jr(v/N)}e.push(jf(Bv(f,0))),s=Gv(o,u,c===a),o=0,++c}++o,++i}return e.join("")},$v=function(t){return jv(t,function(e){return zw.test(e)?tN(e.slice(4).toLowerCase()):e})},hs=function(t){return jv(t,function(e){return Jw.test(e)?"xn--"+rN(e):e})};var iN=/^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/,oN=/^[\x00-\x20]+|[\x00-\x20]+$/g,sN=/^[\x00-\x20\u00a0\ufeff]+/,aN=/^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/,cN=/[\x00-\x20#/:<>?@[\\\]^|\x7f]/,lN=/[\x00-\x1f\x7f]/;function uN(t){let e=new TypeError("Invalid URL");return e.code="ERR_INVALID_URL",e.input=t,e}function $f(t,e,r,n){let i=Wf.parse(t,e,n),o=aN.exec(t.replace(sN,""));if(o&&(o[1]||i.hostname!==null)){let c=o[2].slice(o[2].lastIndexOf("@")+1);if(!c||lN.test(c)||(i.host||"").toLowerCase()!==hs(c.toLowerCase())||c.charAt(0)==="["&&!nN.isIPv6(c.slice(1,c.indexOf("]"))))throw r}else if(i.hostname!==null)throw r;let s=i.auth===null||i.auth===void 0?null:i.auth.split(":"),a=i;return a.username=s?s.shift():null,a.password=s&&s.length?s.join(":"):null,a}function qf(t){try{return decodeURIComponent(t)}catch{return t}}function dN(t,e){let r=t||"";if(!r)return"";if(r.charAt(0)==="["&&r.charAt(r.length-1)==="]")return r.slice(1,-1);let n=qf(r),i=cN.test(n)?"":Wf.domainToASCII(n);if(!i)throw uN(e);return i}var Nr=(t,e)=>{t=(t||"").replace(oN,"");let r=iN.exec(t),n=r?r[1]+"//"+r[2]:t,i;try{i=new URL(n)}catch(m){return $f(n,e,m)}let o=dN(i.hostname,i.href),s=i.port||null,a=i.pathname||null,c=i.search||null,l=null,u=null,p=null;(i.username||i.password)&&(u=qf(i.username),p=i.password?qf(i.password):null,l=u+(p!==null?":"+p:""));let f;if(e){let m=Object.create(null);i.searchParams.forEach((E,v)=>{if(Object.prototype.hasOwnProperty.call(m,v)){let N=m[v];Array.isArray(N)?N.push(E):m[v]=[N,E]}else m[v]=E}),f=m}else f=c?c.slice(1):null;return{protocol:i.protocol||null,host:i.host||null,hostname:o,port:s,pathname:a,search:c,path:(a||"")+(c||"")||null,href:i.href,auth:l,username:u,password:p,query:f}},qv=(t,e)=>{try{return new URL(e,t).href}catch(r){return $f(t,!1,r,!0),$f(e,!1,r,!0),Wf.resolve(t,e)}};import _N from"node:util";import IN from"node:fs";import mN from"node:http";import hN from"node:https";import EN from"node:zlib";import{PassThrough as yN}from"node:stream";import pN from"node:net";var Wv=1800,zf=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=Nr(r||""),i=this.parse(e),o;return i.domain?(o=i.domain.replace(/^\./,""),(n.hostname.length<o.length||o.indexOf(".")<0||o.endsWith(".")||pN.isIP(n.hostname)||!("."+n.hostname).endsWith("."+o))&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||Wv)||Wv)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={},n=!1;return(e||"").toString().split(";").forEach(i=>{if(!i.trim())return;let o=i.split("="),s=o.shift().trim(),a=o.join("=").trim(),c;if(!n){n=!0,s&&(r.name=s,r.value=a);return}switch(s.toLowerCase()){case"expires":{let l=new Date(a);l.toString()!=="Invalid Date"&&(r.expires=l);break}case"path":r.path=a;break;case"domain":c=a.toLowerCase(),c.length&&c.charAt(0)!=="."&&(c="."+c),r.domain=c;break;case"max-age":r.expires=new Date(Date.now()+(Number(a)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break}}),r}match(e,r){let n=Nr(r||"");if(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain))return!1;let i=n.pathname||"/",o=e.path;return!(!(i===o||i.startsWith(o)&&(o.endsWith("/")||i.charAt(o.length)==="/"))||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");r.pop();let n=r.join("/").trim();return n.charAt(0)!=="/"?"/":n}},Jf=zf;var Ku="nodemailer",Xe="10.1.0",zv="https://nodemailer.com/";import gN from"node:net";var Hu="ECONNECTION",Yf="ETIMEDOUT",fN="ESOCKET";var Jv="EENVELOPE",Yv="EMESSAGE",Fu="ESTREAM";var Vu="ENOAUTH",ci="EOAUTH2",Bu="EMAXLIMIT",Xv="EMAXRECIPIENTS",ju="ESENDMAIL",Qv="ESES",Es="ECONFIG",li="EPROXY",Gu="EFILEACCESS",$u="EURLACCESS",qu="EFETCH",Wa=t=>t.responseCode===421||t.code===Hu||t.code===fN||t.code===Yf,Wu="ERR_ACCESS_DENIED";var Rr=t=>t==="__proto__",et=(t,e,r)=>(Object.keys(e||{}).forEach(n=>{Rr(n)||r&&r(n)||(t[n]=e[n])}),t);var vN=5,eA=60*1e3,AN=64*1024*1024,TN=["ALPNProtocols","ca","cert","checkServerIdentity","ciphers","crl","dhparam","ecdhCurve","honorCipherOrder","key","maxVersion","minVersion","passphrase","pfx","rejectUnauthorized","secureContext","secureOptions","secureProtocol","servername","sessionIdContext","sigalgs"];function Xf(t){t.code!==Wu&&(t.code=qu)}function Zv(t){let e;try{e=Nr(t)}catch{return!1}return e.protocol!=="http:"&&e.protocol!=="https:"?!1:e}function zu(t,e){e=e||{},e.fetchRes=e.fetchRes||new yN,e.cookies=e.cookies||new Jf,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?vN:e.maxRedirects;let r=e.fetchRes,n=Zv(t);if(!n)return e.body&&typeof e.body.destroy=="function"&&(e.body.on("error",()=>!1),e.body.destroy()),setImmediate(()=>{let E=new Error("Unsupported protocol for URL "+t);E.code=qu,E.sourceUrl=t,r.emit("error",E)}),r;e.cookie&&([].concat(e.cookie||[]).forEach(E=>{e.cookies.set(E,t)}),e.cookie=!1);let i=(e.method||"").toString().trim().toUpperCase()||"GET",o=!1,s,a,c=n.protocol==="https:"?hN:mN,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+Xe};if(Object.keys(e.headers||{}).forEach(E=>{Rr(E.toLowerCase().trim())||(l[E.toLowerCase().trim()]=e.headers[E])}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(s=e.cookies.get(t))&&(l.cookie=s),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",E=>{o||(o=!0,Xf(E),E.sourceUrl=t,r.emit("error",E))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(E=>{let v=e.body[E].toString().trim();return encodeURIComponent(E)+"="+encodeURIComponent(v)}).join("&"))}catch(E){return o=!0,E.code=qu,E.sourceUrl=t,setImmediate(()=>r.emit("error",E)),r}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let u,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!0,agent:!1};e.tls&&Object.keys(e.tls).forEach(E=>{TN.includes(E)&&(p[E]=e.tls[E])}),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!gN.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{u=c.request(p)}catch(E){return o=!0,setImmediate(()=>{Xf(E),E.sourceUrl=t,r.emit("error",E)}),r}let f=(E,v=t)=>{o||(o=!0,Xf(E),E.sourceUrl=v,r.emit("error",E),u.abort())},m=typeof e.timeout=="number"&&e.timeout>=0?e.timeout:eA;return m&&u.setTimeout(m,()=>f(new Error("Request Timeout"))),u.on("error",E=>f(E)),r.once("close",()=>{o||r.readableEnded||(o=!0,u.destroy())}),u.on("response",E=>{let v;if(o)return;switch(E.headers["content-encoding"]){case"gzip":case"deflate":v=EN.createUnzip();break}if(E.headers["set-cookie"]&&[].concat(E.headers["set-cookie"]||[]).forEach(M=>{e.cookies.set(M,t)}),[301,302,303,307,308].includes(E.statusCode)&&E.headers.location){if(e.redirects++,e.redirects>e.maxRedirects)return f(new Error("Maximum redirect count exceeded"));e.method="GET",e.body=!1;let M;try{M=qv(t,E.headers.location)}catch{M=E.headers.location}let K=Zv(M);if(!K)return f(new Error("Unsupported protocol for URL "+M),M);let B=K.hostname!==n.hostname,V=n.protocol==="https:"&&K.protocol==="http:";if(e.headers&&(B||V)){let $=["authorization","cookie","proxy-authorization"];Object.keys(e.headers).forEach(A=>{$.includes(A.toLowerCase())&&delete e.headers[A]})}return o=!0,E.resume(),u.abort(),zu(M,e)}if(r.statusCode=E.statusCode,r.headers=E.headers,E.statusCode>=300&&!e.allowErrorResponse)return f(new Error("Invalid status code "+E.statusCode));E.on("error",M=>f(M));let N=typeof e.maxBytes=="number"&&e.maxBytes>0?e.maxBytes:AN,S=v||E,R=0;S.on("data",M=>{R+=M.length,!(R<=N||o)&&(S.unpipe(r),f(new Error("Response size exceeds the allowed "+N+" bytes")))}),v?(E.pipe(v).pipe(r),v.on("error",M=>f(M))):E.pipe(r)}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(u);u.write(a)}catch(E){return f(E)}u.end()}),r}zu.Cookies=Jf;zu.DEFAULT_TIMEOUT=eA;var ui=zu;import lr from"node:dns";import xN from"node:net";import bN from"node:os";import{finished as SN}from"node:stream";var Qf=300*1e3,wN=30*1e3,tA=1e3,rA=0;var nA,iA=!1,NN=()=>{if(!iA){iA=!0;try{nA=bN.networkInterfaces()}catch{}}return nA},oA=(t,e)=>{let r=Object.values(NN()||{}).flat();return r.length?r.filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},RN=(t,e,r,n)=>{if(r=r||{},!oA(t,r.allowInternalNetworkInterfaces))return n(null,[]),null;let i=lr.Resolver?new lr.Resolver(r):lr;return i["resolve"+t](e,(o,s)=>{if(o){switch(o.code){case lr.NODATA:case lr.NOTFOUND:case lr.NOTIMP:case lr.SERVFAIL:case lr.CONNREFUSED:case lr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(o)}return n(null,Array.isArray(s)?s:[].concat(s||[]))}),lr.Resolver?i:null},Xr=new Map,ys=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({host:n,_addresses:r},e||{})},sA=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||xN.isIP(t.host)){let S={addresses:[t.host]};return e(null,ys(S,{servername:t.servername||!1,cached:!1}))}let r=t.host,n=t.servername||r,i;if(Xr.has(t.host)){i=Xr.get(t.host);let S=Date.now();if(S-rA>wN){rA=S;for(let[R,M]of Xr.entries())M.expires&&M.expires<S&&Xr.delete(R);if(Xr.size>tA){let R=Math.floor(tA*.1);Array.from(Xr.keys()).slice(0,R).forEach(K=>Xr.delete(K))}}if(!i.expires||i.expires>=S)return e(null,ys(i.value,{servername:n,cached:!0}))}let o=!1,s,a=(S,R)=>{o||(o=!0,clearTimeout(s),e(S,R))},c=S=>i?(Xr.set(r,{value:i.value,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(i.value,{servername:n,cached:!0,error:S})),!0):!1,l=[],u=Number(t.timeout)||0;u>0&&(s=setTimeout(()=>{for(let R of l)typeof R.cancel=="function"&&R.cancel();let S=new Error("DNS lookup for "+r+" timed out");S.code=lr.TIMEOUT,c(S)||a(S)},u));let p=[],f=[],m=null,E=null,v=2,N=()=>{if(--v||o)return;let S=p.concat(f);if(S.length){let R={addresses:S};return Xr.set(r,{value:R,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(R,{servername:n,cached:!1}))}if(!(m&&E&&c(m)))try{lr.lookup(r,{all:!0},(R,M)=>{if(R)return c(R)?void 0:a(R);let K=M?M.filter(V=>oA(V.family)).map(V=>V.address):[];if(M&&M.length&&!K.length&&console.warn(`Failed to resolve IPv${M[0].family} addresses with current network`),!K.length&&i)return a(null,ys(i.value,{servername:n,cached:!0}));let B={addresses:K.length?K:[r]};return Xr.set(r,{value:B,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(B,{servername:n,cached:!1}))})}catch(R){return c(R)?void 0:a(m||E||R)}};for(let S of[4,6]){let R=RN(S,r,t,(M,K)=>{S===4?(m=M,p=K||[]):(E=M,f=K||[]),N()});R&&l.push(R)}},gs=t=>{t=t||"";let e={},r=Nr(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}return!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),(r.username||r.password)&&(e.auth={user:r.username||"",pass:r.password||""}),Object.keys(r.query||{}).forEach(n=>{let i=e,o=n,s=r.query[n];switch(isNaN(s)||(s=Number(s)),s){case"true":s=!0;break;case"false":s=!1;break}if(n.indexOf("tls.")===0)o=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;!Rr(o)&&!(o in i)&&(i[o]=s)}),e},ON=(t,e,r,n,i,...o)=>{let s=Object.assign({},r||{},n||{});delete s.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](s,i,...o)},ft=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(o=>{r[o]=()=>!1}),r;let i=t.logger===!0?CN(n):t.logger;return n.forEach(o=>{r[o]=(...s)=>{let a=typeof s[0]=="string"?void 0:s.shift();ON(i,o,e,a,...s)}}),r},Mt=(t,e)=>function(...r){let n=r.shift();n?e(n):t(...r)},em=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,o=n.split(";");if(o.length>0){let l=o[o.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,o.pop())}let s=o.length>0?o.shift():"application/octet-stream",a={};for(let l=0;l<o.length;l++){let u=o[l],p=u.indexOf("=");if(p>0){let f=u.substring(0,p).trim(),m=u.substring(p+1).trim();f&&!Rr(f)&&(a[f]=m)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:s||"application/octet-stream",params:a}};function tm(t,e,r,n){!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;return n||(i=new Promise((o,s)=>{n=Mt(o,s)})),kN(t,e,r,n),i}function kN(t,e,r,n){let i=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!i)return n(null,i);if(typeof i=="object"){if(typeof i.pipe=="function")return za(i,(s,a)=>{if(s)return n(s);t[e].content?t[e].content=a:t[e]=a,n(null,a)});if(/^data:/i.test(i.path||i.href)){let s=em(i.path||i.href);return n(null,s&&s.data?s.data:Buffer.alloc(0))}else if(i.href||/^https?:\/\//i.test(i.path)){let s=i.href||i.path;if(r.disableUrlAccess){setImmediate(()=>{let a=new Error("Url access rejected for "+s);a.code=$u,n(a)});return}return za(ui(s,{headers:i.httpHeaders,tls:i.tls}),n)}else if(i.path){if(r.disableFileAccess){setImmediate(()=>{let s=new Error("File access rejected for "+i.path);s.code=Gu,n(s)});return}return za(IN.createReadStream(i.path),n)}}typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(i=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,i))}var Or=function(...t){let e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{Rr(n)||(["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=et(e[n]||{},r[n]):e[n]=r[n])})}),e},Ja=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let o=e[n];o<33||o>126||o===43||o===61?r+="+"+(o<16?"0":"")+o.toString(16).toUpperCase():r+=String.fromCharCode(o)}return r},Zf=new WeakMap;function rm(t){t.on("error",e=>{Zf.has(t)||Zf.set(t,e)})}function $i(t){let e=t;e&&typeof e.pipe=="function"&&typeof e.destroy=="function"&&!e.destroyed&&e.destroy()}function nm(t){let e=Zf.get(t)||t.errored;if(e)return e;if(t.readableEnded||t.destroyed){let r=new Error("Content stream was already read or destroyed");return r.code=Fu,r}return null}function za(t,e){let r=!1,n=(a,c)=>{r||(r=!0,e(a,c))},i=nm(t);if(i){t.on("error",()=>!1),setImmediate(()=>n(i));return}let o=[],s=0;t.on("data",a=>{typeof a=="string"&&(a=Buffer.from(a)),o.push(a),s+=a.length}),SN(t,{writable:!1},a=>{if(a)return n(a);let c;try{c=Buffer.concat(o,s)}catch(l){return n(l)}n(null,c)})}function CN(t){let e=t.reduce((o,s)=>Math.max(o,s.length),0),r=new Map;t.forEach(o=>{let s=o.toUpperCase();s.length<e&&(s+=" ".repeat(e-s.length)),r.set(o,s)});let n=(o,s,a,...c)=>{let l="";s&&(s.tnx==="server"?l="S: ":s.tnx==="client"&&(l="C: "),s.sid&&(l="["+s.sid+"] "+l),s.cid&&(l="[#"+s.cid+"] "+l)),a=_N.format(a,...c),a.split(/\r?\n/).forEach(u=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(o),l+u)})},i={};return t.forEach(o=>{i[o]=n.bind(null,o)}),i}import DN from"node:path";var aA="application/octet-stream",PN="bin",cA=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),lA=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);function uA(t){if(!t)return aA;let e=DN.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=lA.has(r)?lA.get(r):aA;return Array.isArray(n)?n[0]:n}function Ju(t){if(!t)return PN;let e=t.toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(cA.has(r+"/"+n)){let i=cA.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}import um from"node:crypto";import aR from"node:fs";import{PassThrough as Za,finished as td,pipeline as dm}from"node:stream";import rd from"node:url";import{Transform as UN}from"node:stream";function qi(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function LN(t){let e=Math.floor(Number(t));return Number.isFinite(e)&&e>=1?e:76}function MN(t,e,r){let n=Math.ceil(t.length/e),i=Math.max(n-1,0),o=t.length-i*e,s=Buffer.allocUnsafe(i*(e+2)+(r?o:0)),a=0;for(let c=0;c<i*e;c+=e)t.copy(s,a,c,c+e),a+=e,s[a++]=13,s[a++]=10;if(r&&(a+=t.copy(s,a,i*e),o=0),a!==s.length)throw new Error("Unexpected wrapped length");return{output:s,rest:o}}var Yu=class extends UN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=LN(this.options.lineLength)),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_emit(e,r){let n=Buffer.from(this._curLine+e,"latin1");if(!n.length)return;let i=n;if(this.options.lineLength){let o=MN(n,this.options.lineLength,r);i=o.output,this._curLine=o.rest?n.toString("latin1",n.length-o.rest):""}else this._curLine="";i.length&&(this.outputBytes+=i.length,this.push(i))}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length%3;o&&(this._remainingBytes=i.subarray(i.length-o),i=i.subarray(0,i.length-o)),this._emit(qi(i),!1),n()}_flush(e){this._emit(this._remainingBytes?qi(this._remainingBytes):"",!0),this._remainingBytes=!1,e()}};import{Transform as KN}from"node:stream";var HN=4,FN=[[9],[10],[13],[32,60],[62,126]],mA=new Uint8Array(256);for(let t=0;t<256;t++)mA[t]=BN(t,FN)?1:0;var fA=Buffer.from("0123456789ABCDEF","latin1"),hA=t=>t===32||t===9;function EA(t){return om(typeof t=="string"?Buffer.from(t,"utf-8"):t)}function om(t,e,r,n){let i=t.length,o=Buffer.allocUnsafe(i*3),s=0;for(let a=0;a<i;a++){let c=t[a],l=a+1<i?t[a+1]:e,u=r&&(c===13||c===10)?c===13?l===10:(a>0?t[a-1]:n)===13:!0;if(mA[c]&&u&&!(hA(c)&&(l===void 0||l===10||l===13))){o[s++]=c;continue}o[s++]=61,o[s++]=fA[Math.floor(c/16)],o[s++]=fA[c%16]}return o.toString("latin1",0,s)}function VN(t,e){if(t=(t||"").toString(),e=Math.max(Number(e)||76,HN),t.length<=e)return t;let r=0,n=t.length,i,o,s,a=Math.floor(e/3),c="";for(;r<n;){if(s=t.substr(r,e),i=s.match(/\r\n/)){s=s.substr(0,i.index+i[0].length),c+=s,r+=s.length;continue}if(s.substr(-1)===`
|
|
18
18
|
`){c+=s,r+=s.length;continue}if(i=s.substr(-a).match(/\n.*?$/)){s=s.substr(0,s.length-(i[0].length-1)),c+=s,r+=s.length;continue}if(s.length>e-a&&(i=s.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))s=s.substr(0,s.length-(i[0].length-1));else if(s.match(/[=][\da-f]{0,2}$/i))for((i=s.match(/[=][\da-f]{0,1}$/i))&&(s=s.substr(0,s.length-i[0].length));s.length>3&&s.length<n-r&&!s.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=s.match(/[=][\da-f]{2}$/gi))&&(o=parseInt(i[0].substr(1,2),16),!(o<128||(s=s.substr(0,s.length-3),o>=192))););s.length||(s=t.substr(r,e)),r+s.length<n&&s.substr(-1)!==`
|
|
19
19
|
`?(s.length===e&&s.match(/[=][\da-f]{2}$/i)?s=s.substr(0,s.length-3):s.length===e&&(s=s.substr(0,s.length-1)),r+=s.length,s+=`=\r
|
|
20
20
|
`):r+=s.length,c+=s}return c}function BN(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var im=64*1024,Xu=class extends KN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this._lastByte=void 0,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length;for(;o>0&&(hA(i[o-1])||this.options.binary&&i[o-1]===13);)o--;i.length-o<=im&&(this._remainingBytes=o<i.length?Buffer.from(i.subarray(o)):!1,i=i.subarray(0,o)),this._encodeSlices(i),n()}_flush(e){this._remainingBytes&&(this._encodeSlices(this._remainingBytes),this._remainingBytes=!1),this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii"),this._curLine=""),e()}_encodeSlices(e){for(let r=0;r<e.length;r+=im){let n=Math.min(r+im,e.length);this._encodeSlice(e.subarray(r,n),n<e.length?e[n]:void 0),this._lastByte=e[n-1]}}_encodeSlice(e,r){let n;if(this.options.lineLength){n=VN(this._curLine+om(e,r,this.options.binary,this._lastByte),this.options.lineLength);let i=n.lastIndexOf(`
|
|
21
|
-
`);this._curLine=n.substring(i+1),n=n.substring(0,i+1),n&&(this.outputBytes+=n.length,this.push(n,"ascii"))}else n=om(e,r,this.options.binary,this._lastByte),this.outputBytes+=n.length,this.push(n,"ascii")}};function vs(t,e){return typeof t=="string"&&!(e?/[\x00-\x1f\x7f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)}function Ya(t){return'"'+(t||"").toString().replace(/["\\]/g,"\\$&")+'"'}function vA(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)}function
|
|
21
|
+
`);this._curLine=n.substring(i+1),n=n.substring(0,i+1),n&&(this.outputBytes+=n.length,this.push(n,"ascii"))}else n=om(e,r,this.options.binary,this._lastByte),this.outputBytes+=n.length,this.push(n,"ascii")}};function vs(t,e){return typeof t=="string"&&!(e?/[\x00-\x1f\x7f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)}function Ya(t){return'"'+(t||"").toString().replace(/["\\]/g,"\\$&")+'"'}function vA(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)}function Sn(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=EA(t).replace(/[^a-z0-9!*+\-/=]/gi,o=>{let s=o.charCodeAt(0).toString(16).toUpperCase();return o===" "?"_":"="+(s.length===1?"0"+s:s)}):e==="B"&&(n=typeof t=="string"?t:t.toString("utf-8"),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:qi(t)).length>r)if(e==="Q")n=qN(n,r).join("?= =?"+i+"?"+e+"?");else{let o=[],s="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud800-\udbff]/.test(l)&&/[\udc00-\udfff]/.test(n.charAt(a+1))&&(l+=n.charAt(++a)),Buffer.byteLength(s+l)<=r||a===0?s+=l:(o.push(qi(s)),s=l)}s&&o.push(qi(s)),o.length>1?n=o.join("?= =?"+i+"?"+e+"?"):n=o.join("")}else e==="B"&&(n=qi(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")}function AA(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return Sn(t,e,r);let o=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!o)return t;let s=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=o.index+(o[1]||"").length;return(s?t.substr(0,s):"")+Sn(t.substring(s,a),e||"Q",r)+(a<t.length?t.substr(a):"")}function sm(t){let e=[];return Object.keys(t.params||{}).forEach(n=>{let i=t.params[n],o=n.replace(/[\x00-\x1f\x7f]/g,"");!vs(i,!0)||i.length>=75?jN(o,i,50).forEach(s=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(s.value)||s.key.substr(-1)==="*"?e.push(s.key+"="+s.value):e.push(s.key+"="+JSON.stringify(s.value))}):!i.length||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(i)?e.push(o+"="+JSON.stringify(i)):e.push(o+"="+i)}),(typeof t.value=="string"?t.value.replace(/[\x00-\x1f\x7f]/g,""):t.value)+(e.length?"; "+e.join("; "):"")}function jN(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),o,s,a=0,c,l;if(r=r||50,vs(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),u=>(n.push({line:u}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let p=[];for(c=0,l=i.length;c<l;c++)o=i.charAt(c),/[\ud800-\udbff]/.test(o)&&/[\udc00-\udfff]/.test(i.charAt(c+1))?(o+=i.charAt(c+1),p.push(o),c++):p.push(o);i=p}s="utf-8''";let u=!0;for(a=0,c=0,l=i.length;c<l;c++){if(o=i[c],u)o=Qu(o);else if(o=o===" "?o:Qu(o),o!==i[c])if((Qu(s)+o).length>=r)n.push({line:s,encoded:u}),s="",u=!0;else{u=!0,c=a,s="";continue}(s+o).length>=r?(n.push({line:s,encoded:u}),s=o=i[c]===" "?" ":Qu(i[c]),o===i[c]?(u=!1,a=c-1):u=!0):s+=o}s&&n.push({line:s,encoded:u})}return n.map((u,p)=>({key:t+"*"+p+(u.encoded?"*":""),value:u.line}))}var GN=/^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;function gA(t){return!!t&&!Rr(t)}function am(t){let e={value:"",params:{}},r=(S,R)=>{S=S.toLowerCase(),gA(S)&&!Object.prototype.hasOwnProperty.call(e.params,S)&&(e.params[S]=R)},n=!1,i="",o="value",s=!1,a=!1,c,l="",u=!1,p=()=>{i.length&&(i+=l),l=""},f=S=>{p(),i+=S},m=()=>{let S=i;return i="",l="",u=!1,S},E=()=>{let S=m();n===!1?e.value=S:r(n,S)},v=()=>{r(m().trim(),"")};for(let S=0,R=t.length;S<R;S++)if(c=t.charAt(S),o==="key"){if(c==="="){n=m().trim(),o="value";continue}if(c===";"){v();continue}i+=c}else{if(u&&c!==";"){a=!1;continue}if(a)f(c);else if(s&&c==="\\"){a=!0;continue}else s&&c===s?(s=!1,u=!0):!s&&c==='"'?(s=c,p()):!s&&c===";"?(E(),o="key"):!s&&(c===" "||c===" ")?l+=c:f(c);a=!1}o==="value"?E():v();let N=new Map;return Object.keys(e.params).forEach(S=>{let R=S.match(/(\*(\d+)|\*(\d+)\*|\*)$/);if(!R)return;let M=S.substr(0,R.index),K=Number(R[2]||R[3])||0,B=R[0].substr(-1)==="*",V=e.params[S];if(delete e.params[S],!gA(M))return;let $=N.get(M);$||($={charset:!1,sections:[]},N.set(M,$));let A=K===0&&B?V.match(/^([^']*)'[^']*'(.*)$/):null;A&&($.charset=GN.test(A[1])?A[1]:"iso-8859-1",V=A[2]),$.sections.push({nr:K,value:V,encoded:B})}),N.forEach((S,R)=>{if(!Object.prototype.hasOwnProperty.call(e.params,R)){if(S.sections.sort((M,K)=>M.nr-K.nr),!S.charset){e.params[R]=S.sections.map(M=>M.value).join("");return}e.params[R]="=?"+S.charset+"?Q?"+S.sections.map($N).join("")+"?="}}),e}function $N(t){let e=t.encoded?/[=?_\s]/g:/[=?_\s%]/g;return t.value.replace(e,r=>{let n=r.charCodeAt(0).toString(16);return r===" "?"_":"%"+(n.length<2?"0":"")+n}).replace(/%/g,"=")}function Zu(t){return Ju(t)}function Wi(t){return uA(t)}function Xa(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,o="",s,a;for(;n<i;){if(s=t.substr(n,e),s.length<e){o+=s;break}if(a=s.match(/^[^\n\r]*(\r?\n|\r)/)){s=a[0],o+=s,n+=s.length;continue}else(a=s.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<s.length?s=s.substr(0,s.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+s.length).match(/^[^\s]+(\s*)/))&&(s=s+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));o+=s,n+=s.length,n<i&&(o+=`\r
|
|
22
22
|
`)}return o}function qN(t,e){let r=[],n,i,o,s,a;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(o=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,o.index)),i=n.length?n:t.substr(0,e),a=!1;!a&&n.length;)a=!0,(o=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(o[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),a=!1));n.length||(n=i),r.push(n),t=t.substr(n.length)}return r}function WN(t){let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e}function Qu(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{t=encodeURIComponent(Buffer.from(t,"utf-8").toString("utf-8"))}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>WN(e))}function zN(t){let e=t.lastIndexOf("@");if(e<0)return t;let r=t.substr(0,e);return/^[^\s"(),:;<>@[\\\]]+$/.test(r)||/^"(?:[^"\\]|\\[\s\S])*"$/.test(r)?t:'"'+r.replace(/["\\]/g,"\\$&")+'"@'+t.substr(e+1)}var JN=/\s/,YN=/^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/,bA=/^[^@\s]+@[^@\s]+$/,XN=/^[^@\s]+@\S+$/,TA=/\s*\b[^@\s]+@[^\s]+\b\s*/y;function cm(t){return t===32||t>=9&&t<=13||t===160||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288||t===65279}function _A(t){return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===95}function IA(t,e){return _A(t.charCodeAt(e-1))!==_A(t.charCodeAt(e))}function xA(t,e,r){for(let n=e;n<r;n++)if(t.charCodeAt(n)===64)return n;return-1}function QN(t){let e=t.length,r=0;for(;r<e;){for(;r<e&&cm(t.charCodeAt(r));)r++;if(r>=e)break;let n=r,i=r;for(;i<e&&!cm(t.charCodeAt(i));)i++;let o=xA(t,n,i);if(o>=0){let s=-1;for(let c=i;c>n;c--)if(IA(t,c)){s=c;break}let a=n;for(;s>=0&&o>=0;){if(o>a&&i>o+1&&s>o+1){for(let c=a;c<o;c++)if(IA(t,c)){if(c>n)return c;let l=n;for(;l>0&&cm(t.charCodeAt(l-1));)l--;return l}}a=o+1,o=xA(t,a,i)}}r=i}return-1}function ZN(t){if(!JN.test(t.address))return;let e,r,n=t.address.match(YN);if(n){if(!n[2])return;e=n[1],r=[n[2]]}else{if(t.address.indexOf('"')>=0)return;let i=t.address.split(/\s+/),o=i.findIndex(s=>bA.test(s));if(o<0&&(o=i.findIndex(s=>XN.test(s))),o<0)return;e=i.splice(o,1)[0],r=i}t.address=e,t.text=[t.text].concat(r).filter(i=>i).join(" ")}function eR(t){let e=[],r="",n="",i=0,o="",s="";for(let a=0,c=t.length;a<c;a++){let l=t.charAt(a);if(i){l==="\\"&&a<c-1?n+=t.charAt(++a):l==="("?(i++,n+=l):l===")"&&!--i?(e.push(n.trim()),n="",s!=="@"&&t.charAt(a+1)!=="@"&&(r+=" ",s=" ")):n+=l;continue}if(o){if(l==="\\"&&o==='"'&&a<c-1){r+=l+t.charAt(++a),s=t.charAt(a);continue}l===o&&(o="")}else if(l==='"')o='"';else if(l==="[")o="]";else if(l==="("){i=1;continue}r+=l,s=l}return i&&e.push(n.trim()),{address:r.trim(),comments:e.filter(a=>a)}}function tR(t,e){let r=!1,n="text",i=[],o={address:[],comment:[],group:[],text:[],textWasQuoted:[]},s=!1,a={address:"",comment:"",group:"",text:""};for(let c=0,l=t.length;c<l;c++){let u=t[c],p=c?t[c-1]:null;if(u.type==="operator")switch(u.value){case"<":n="address",s=!1;break;case"(":n="comment",s=!1;break;case":":n="group",r=!0,s=!1;break;case'"':s=!s,n="text";break;default:n="text",s=!1;break}else if(u.value){let f=c>1?t[c-2]:null,m=p?.type==="operator"&&p.value==='"'&&!!p.noBreak&&f?.type==="operator"&&f.value==='"';n==="address"&&(u.value=u.value.replace(/^[^<]*<\s*/,""));let E=o[n];p&&p.noBreak&&E.length&&(p.value!==")"||a[n]==="@"||u.value.charAt(0)==="@")?(o[n][o[n].length-1]+=u.value,u.value&&(a[n]=u.value.charAt(u.value.length-1)),n==="text"&&s&&(o.textWasQuoted[o.textWasQuoted.length-1]=!0)):(o[n].push(u.value),a[n]=u.value.charAt(u.value.length-1),n==="text"&&o.textWasQuoted.push(s||m))}}if(!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),r){o.text=o.text.join(" ");let c=[];o.group.length&&SA(o.group.join(","),e+1).forEach(u=>{u.group?c=c.concat(u.group):c.push(u)}),i.push({name:o.text||"",group:c})}else{let c=[],l=[];for(let f of o.address){if(f.indexOf("(")<0){l.push(f);continue}let m=eR(f);for(let E of m.comments)c.push(E);m.address&&l.push(m.address)}if(o.address=l,!o.address.length&&o.text.length){for(let f=o.text.length-1;f>=0;f--)if(!o.textWasQuoted[f]&&bA.test(o.text[f])){o.address=o.text.splice(f,1),o.textWasQuoted.splice(f,1);break}if(!o.address.length){let f=!1;for(let m=o.text.length-1;m>=0;m--)if(!o.textWasQuoted[m]){let E=o.text[m],v=E,N=QN(E);if(N>=0){TA.lastIndex=N;let S=TA.exec(E);S&&(o.address=[S[0].trim()],f=!0,v=E.slice(0,N)+" "+E.slice(N+S[0].length))}if(o.text[m]=v.trim(),f)break}}}!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),o.address.length>1&&(o.text=o.text.concat(o.address.splice(1)));let u=!o.address.length&&o.textWasQuoted.some(f=>f);o.text=o.text.join(" "),o.address=o.address.join(" "),u&&o.text.indexOf("@")>=0&&(o.address=zN(o.text),o.text=""),ZN(o),!o.text&&c.length&&(o.text=c.join(" "));let p={address:o.address||o.text||"",name:o.text||o.address||""};p.address===p.name&&(/@/.test(p.address||"")?p.name="":p.address=""),i.push(p)}return i}var lm=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.inDomainLiteral=!1,this.afterAt=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),o=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,o)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped&&!this.operatorExpecting&&(!this.inDomainLiteral&&e==="["&&this.afterAt?this.inDomainLiteral=!0:this.inDomainLiteral&&(e==="]"||e===","||e===";")&&(this.inDomainLiteral=!1)),!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" "," ","\r",`
|
|
23
23
|
`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,e!==")"&&(this.afterAt=!1),this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&!(this.inDomainLiteral&&e===":")&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,e!=="("&&(this.afterAt=!1),this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'",")"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
|
|
24
24
|
`&&(e=" "),(e.charCodeAt(0)>=33||[" "," "].includes(e))&&(this.node.value+=e,!this.operatorExpecting&&e!==" "&&e!==" "&&(this.afterAt=e==="@")),this.escaped=!1}},rR=50;function SA(t,e){if(e>rR)return[];let n=new lm(t).tokenize(),i=[],o=[],s=[];n.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&i.push(o),o=[]):o.push(c)}),o.length&&i.push(o),i.forEach(c=>{let l=tR(c,e);for(let u=0;u<l.length;u++)s.push(l[u])});let a=[];for(let c=s.length-1;c>=0;c--){let l=s[c],u=a.length?a[a.length-1]:null;u&&l.address===""&&l.name&&!l.group&&u.address&&u.name?u.name=l.name+", "+u.name:a.push(l)}return a.reverse(),a}function nR(t,e){let r=SA(t,0);if(e?.flatten){let n=[],i=o=>{o.forEach(s=>{if(s.group)return i(s.group);n.push(s)})};return i(r),n}return r}var wA=nR;import{Transform as iR}from"node:stream";var Qa=class extends iR{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
|
|
25
25
|
`)),e()):(this.push(Buffer.from(`\r
|
|
26
26
|
`)),e())}};import{Transform as oR}from"node:stream";var kr=class extends oR{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===10&&(s&&e[s-1]!==13||!s&&this.lastByte!==13)&&(s>o&&(i=e.slice(o,s),this.push(i)),this.push(Buffer.from(`\r
|
|
27
|
-
`)),o=s+1);o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),this.lastByte=e[e.length-1],n()}};import{Transform as sR}from"node:stream";var
|
|
27
|
+
`)),o=s+1);o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),this.lastByte=e[e.length-1],n()}};import{Transform as sR}from"node:stream";var wn=class extends sR{constructor(e){super(e)}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===13&&(i=e.slice(o,s),o=s+1,this.push(i));o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),n()}};var cR=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],NA="[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]",lR=new RegExp("^"+NA+"+(?:\\."+NA+"+)*$"),uR=/^"(?:[^"\\]|\\[\s\S])*"$/,dR=/^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/,pR=/[/\\?#%\x00-\x20\x7F]/,RA=()=>!1;function OA(){let t=new Error("Message stream was closed before the message was generated");return t.code=Fu,t}function fR(t,e){if(typeof rd.domainToASCII=="function"&&typeof rd.domainToUnicode=="function"&&!pR.test(t)){let r=rd.domainToASCII(t),n=r&&e?rd.domainToUnicode(r):r;if(n)return n}return e?$v(t):hs(t)}function ec(t){return t.replace(/[\x00-\x1f\x7f]+/g,"")}var pm=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=ec(r.baseBoundary||um.randomBytes(8).toString("hex")),this.boundaryPrefix=ec(r.boundaryPrefix||"--_NmP"),this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Wi(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.parentNode&&e.parentNode!==this&&e.remove(),e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(o=>{this.setHeader(o.key,o.value)}):Object.keys(e).forEach(o=>{this.setHeader(o,e[o])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let o=0,s=this._headers.length;o<s;o++)this._headers[o].key===e&&(n?(this._headers.splice(o,1),o--,s--):(this._headers[o]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?rm(this.content):typeof this.content=="string"&&(this._isPlainText=vs(this.content),this._isPlainText&&vA(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((c,l)=>{e=Mt(c,l)}));let n=e,i=this.createReadStream(),o=[],s=0,a=!1;return i.on("readable",()=>{let c;for(;(c=i.read())!==null;)o.push(c),s+=c.length}),i.once("error",c=>{if(!a)return a=!0,n(c)}),i.once("end",c=>{if(!a)return a=!0,c&&c.length&&(o.push(c),s+=c.length),n(null,Buffer.concat(o,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,o=n.value,s,a,c={};if(!(o&&typeof o=="object"&&!cR.includes(i)&&(et(c,o,u=>u==="value"),o=(o.value||"").toString(),!o.trim()))){if(c.prepared){c.foldLines?r.push(Xa(i+": "+o)):r.push(i+": "+o);return}switch(n.key){case"Content-Disposition":s=am(o),this.filename&&(s.params.filename=this.filename),o=sm(s);break;case"Content-Type":s=am(o),s.value=(s.value||"").toString().replace(/[\x00-\x1f\x7f]/g,""),this._handleContentType(s),s.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(s.params.charset="utf-8"),o=sm(s),this.filename&&(a=/[\x00-\x1f\x7f]/.test(this.filename)?Sn(this.filename,this._getTextEncoding(this.filename),52):this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a=JSON.stringify(a)),o+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(o=this._encodeHeaderValue(i,o),!!(o||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let u=this.normalizeHeaderKey(i,o),p=typeof u=="string"?u.replace(/[\x00-\x1f\x7f]/g,""):"";p&&(i=p)}r.push(Xa(i+": "+o,76))}}}),r.join(`\r
|
|
28
28
|
`)}createReadStream(e){e=e||{};let r=new Za(e);this.stream(r,e,o=>{if(o){r.destroy(o);return}r.end()}),r.once("close",()=>{r.writableFinished||this._destroyContentStreams()});let n=[r];for(let o of this._transforms)n.push(typeof o=="function"?o():o);n.push(new Qa);let i=dm(n,RA);for(let o of this._processFuncs){let s=i;i=o(s),i!==s&&td(i,a=>{a&&s.destroy()})}if(this.newline){let o=["win","windows","dos",`\r
|
|
29
|
-
`].includes(this.newline.toString().toLowerCase());i=dm(i,o?new kr:new
|
|
29
|
+
`].includes(this.newline.toString().toLowerCase());i=dm(i,o?new kr:new wn,RA)}return i}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),o=[],s=!1,a=m=>{s||(s=!0,e.removeListener("close",c),n(m))};function c(){for(let m of o)m.destroy();return a(OA())}let l=(...m)=>{o.length||e.once("close",c),o=m},u=()=>e.destroyed?(a(OA()),!0):!1,p=()=>{let m=0,E=()=>{if(u())return;if(m>=this.childNodes.length)return e.write(`\r
|
|
30
30
|
--`+this.boundary+`--\r
|
|
31
31
|
`),a();let v=this.childNodes[m++];e.write((m>1?`\r
|
|
32
32
|
`:"")+"--"+this.boundary+`\r
|
|
33
33
|
`),v.stream(e,r,N=>{if(N)return a(N);setImmediate(E)})};if(this.multipart)setImmediate(E);else return a()},f=()=>{if(u())return;if(!this.content)return setImmediate(p);let m=()=>{if(u())return;let E=this._takeStreamContent(this.content);if(E)return a(E);let v=this._getStream(this.content);if(["quoted-printable","base64"].includes(i)){let N=i==="base64"?new Yu(r):new Xu(Object.assign({},r,{binary:!/^text\//i.test(this.contentType||"")}));l(v,N),N.pipe(e,{end:!1}),dm(v,N,S=>S&&a(S)),td(N,{writable:!1},S=>S?a(S):p())}else l(v),v.pipe(e,{end:!1}),td(v,{writable:!1},N=>N?a(N):p())};if(this.content._resolve){let E=this._getStream(this.content);l(E),za(E,(v,N)=>{if(v)return a(v);s||(this.content._resolve=!1,this.content._resolvedValue=N,setImmediate(m))})}else setImmediate(m)};this._raw?setImmediate(()=>{if(u())return;let m=this._takeStreamContent(this._raw);if(m)return a(m);let E=this._getStream(this._raw);l(E),E.pipe(e,{end:!1}),td(E,{writable:!1},v=>v?a(v):p())}):(e.write(this.buildHeaders()+`\r
|
|
34
34
|
\r
|
|
35
|
-
`),setImmediate(f))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseEnvelopeAddresses(e.from),r),r=r.filter(s=>s&&s.address),r.length&&r[0]&&(this._envelope.from=r[0].address));let n=new Set,i=[];["to","cc","bcc"].forEach(s=>{e[s]&&this._convertAddresses(this._parseEnvelopeAddresses(e[s]),i,n)}),this._envelope.to=i.map(s=>s.address).filter(s=>s);let o=["to","cc","bcc","from"];return et(this._envelope,e,s=>o.includes(s)),this}getAddresses(){let e={},r=new Map;return this._headers.forEach(n=>{let i=n.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(i)&&(Array.isArray(e[i])||(e[i]=[],r.set(i,new Set)),this._convertAddresses(this._parseAddresses(n.value),e[i],r.get(i)))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]},r=new Set,n=[];return this._headers.forEach(i=>{let o=[];i.key==="From"||!e.from&&["Reply-To","Sender"].includes(i.key)?(this._convertAddresses(this._parseAddresses(i.value),o),o.length&&o[0]&&(e.from=o[0].address)):["To","Cc","Bcc"].includes(i.key)&&this._convertAddresses(this._parseAddresses(i.value),n,r)}),e.to=n.map(i=>i.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&rm(this._raw),this}_accessDisabled(e){let r=this;for(;r;){if(r[e])return!0;r=r.parentNode}return!1}_destroyContentStreams(){$i(this.content),$i(this._raw);for(let e of this.childNodes)e._destroyContentStreams()}_takeStreamContent(e){return Object.prototype.toString.call(e)==="[object Error]"?e:!e||typeof e.pipe!="function"||e._resolvedValue?null:nm(e)}_getStream(e){let r;return e._resolvedValue?(r=new Za,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this._accessDisabled("disableFileAccess")?(r=new Za,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Gu,r.emit("error",n)}),r):aR.createReadStream(e.path):e&&typeof e.href=="string"?this._accessDisabled("disableUrlAccess")?(r=new Za,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=$u,r.emit("error",n)}),r):ui(e.href,{headers:e.httpHeaders,tls:e.tls}):(r=new Za,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){let r=[],n=new WeakSet,i=[],o=s=>{n.has(s)||(n.add(s),i.push({list:s,pos:0}))};for(o(Array.isArray(e)?e:[e]);i.length;){let s=i[i.length-1];if(s.pos>=s.list.length){i.pop();continue}let a=s.list[s.pos++];if(Array.isArray(a)){o(a);continue}if(a&&a.address){let l=this._normalizeAddress(a.address);if(l===a.address&&typeof a.name=="string"){r.push(a);continue}let u=et({},a);u.address=l,u.name=a.name||"",r.push(u);continue}let c=this._normalizeParsedAddresses(wA(a));for(let l=0;l<c.length;l++)r.push(c[l])}return r}_normalizeParsedAddresses(e){return e.forEach(r=>{r.address?r.address=this._normalizeAddress(r.address):r.group&&this._normalizeParsedAddresses(r.group)}),e}_parseEnvelopeAddresses(e){return this._parseAddresses(e).map(r=>r.address||r.group||!r.name||/[\s@]/.test(r.name)?r:{address:this._normalizeAddress(r.name),name:""})}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x1f\x7f]/g,"").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){if(this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart){let r=ec(e.params.boundary||this.boundary||"");this.boundary=e.params.boundary=r||ec(this._generateBoundary())}else this.boundary=!1}_generateBoundary(){return ec(this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary)+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,""),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r)}}_convertAddresses(e,r,n){let i=[];if(r=r||[],!n){n=new Set;for(let o=0;o<r.length;o++)n.add(r[o].address)}return[].concat(e||[]).forEach(o=>{if(o.address)o.address=this._normalizeAddress(o.address),o.name?i.push(`${this._encodeAddressName(o.name)} <${o.address}>`):i.push(dR.test(o.address)?o.address:`<${o.address}>`),n.has(o.address)||(n.add(o.address),r.push(o));else if(o.group){let s=(o.group.length?this._convertAddresses(o.group,r,n):"").trim();i.push(`${this._encodeAddressName(o.name)}:${s};`)}}),i.join(", ")}_normalizeAddress(e){if(e=(e||"").toString().replace(/[\x00-\x1F\x7F<>]+/g," ").trim(),!e)return e;let r=e.lastIndexOf("@");if(r<0)return this._normalizeLocalPart(e);let n=e.substr(0,r),i=e.substr(r+1),o=i,s=/[\x80-\uFFFF]/.test(n);try{o=fR(i.toLowerCase(),s)}catch{}return`${this._normalizeLocalPart(n)}@${o}`}_normalizeLocalPart(e){return lR.test(e)||uR.test(e)?e:Ya(e)}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?Ya(e):bn(e,this._getTextEncoding(e),52)}_encodeHeaderText(e){return/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(e)?bn(e,this._getTextEncoding(e),52):this._encodeWords(e)}_encodeWords(e){return AA(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,o=e.length;i<o;i++){let s=e.charCodeAt(i);s>=0&&s<=8||s===11||s===12||s>=14&&s<=31||s>=128?r++:(s>=65&&s<=90||s>=97&&s<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+um.randomBytes(r).toString("hex"),um.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}},Qr=pm;function tc(t){let e=t;return typeof t=="object"&&!!(e.content||e.path||e.href||e.raw)}var fm=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new Qr("message/rfc822",{newline:this.mail.newline,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n=[].concat(this.mail.attachments||[]).map((i,o)=>{/^data:/i.test(i.path||i.href)&&(i=this._processDataUrl(i));let s=i.contentType||Wi(i.filename||i.path||i.href||"bin"),a=/^image\//i.test(s),c=/^message\//i.test(s),l=i.contentDisposition||(c||a&&i.cid?"inline":"attachment"),u;"contentTransferEncoding"in i?u=i.contentTransferEncoding:c?u="8bit":u="base64";let p={contentType:s,contentDisposition:l,contentTransferEncoding:u};return i.filename?p.filename=i.filename:!c&&i.filename!==!1&&(p.filename=(i.path||i.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(o+1),p.filename.indexOf(".")<0&&(p.filename+="."+Zu(p.contentType))),/^https?:\/\//i.test(i.path)&&(i.href=i.path,i.path=void 0),i.cid&&(p.cid=i.cid),i.raw?p.raw=i.raw:i.path?p.content={path:i.path}:i.href?p.content={href:i.href,httpHeaders:i.httpHeaders,tls:i.tls}:p.content=i.content||"",i.encoding&&(p.encoding=i.encoding),i.headers&&(p.headers=i.headers),p});return this.mail.icalEvent&&(r=Object.assign({},this._getIcalEvent()),r.contentType="application/ics",r.headers||(r.headers={}),r.filename=r.filename||"invite.ics",r.headers["Content-Disposition"]="attachment",r.headers["Content-Transfer-Encoding"]="base64"),e?{attached:n.filter(i=>!i.cid).concat(r||[]),related:n.filter(i=>!!i.cid)}:{attached:n.concat(r||[]),related:[]}}_getIcalEvent(){if(!this._icalEvent){let e;tc(this.mail.icalEvent)?e=et({},this.mail.icalEvent):e={content:this.mail.icalEvent},/^data:/i.test(e.path||e.href)&&(e=this._processDataUrl(e)),/^https?:\/\//i.test(e.path)&&(e.href=e.path,e.path=void 0),e.raw||(e.path?(e.content={path:e.path},e.path=void 0):e.href&&(e.content={href:e.href,httpHeaders:e.httpHeaders,tls:e.tls},e.href=void 0)),e.content&&typeof e.content=="object"&&(e.content._resolve=!0),this._icalEvent=e}return this._icalEvent}getAlternatives(){let e=[],r,n,i,o,s;return this.mail.text&&(tc(this.mail.text)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(tc(this.mail.watchHtml)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(tc(this.mail.amp)?o=this.mail.amp:o={content:this.mail.amp},o.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(s=Object.assign({},this._getIcalEvent()),s.filename=!1,s.contentType="text/calendar; charset=utf-8; method="+(s.method||"PUBLISH").toString().trim().toUpperCase(),s.headers||(s.headers={})),this.mail.html&&(tc(this.mail.html)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(o||[]).concat(n||[]).concat(s||[]).concat(this.mail.alternatives||[]).forEach(a=>{/^data:/i.test(a.path||a.href)&&(a=this._processDataUrl(a));let c={contentType:a.contentType||Wi(a.filename||a.path||a.href||"txt"),contentTransferEncoding:a.contentTransferEncoding};a.filename&&(c.filename=a.filename),/^https?:\/\//i.test(a.path)&&(a.href=a.path,a.path=void 0),a.raw?c.raw=a.raw:a.path?c.content={path:a.path}:a.href?c.content={href:a.href,httpHeaders:a.httpHeaders,tls:a.tls}:c.content=a.content||"",a.encoding&&(c.encoding=a.encoding),a.headers&&(c.headers=a.headers),e.push(c)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",o=r.indexOf(",");if(o>0&&o<200){let a=r.substring(5,o).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign(et({},e),{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=em(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}},kA=fm;import{Transform as mR}from"node:stream";function hR(t){let e=0,r=t.length;for(;e<r&&(t.charCodeAt(e)===32||t.charCodeAt(e)===9);)e++;for(;r>e&&(t.charCodeAt(r-1)===32||t.charCodeAt(r-1)===9);)r--;return t.slice(e,r)}var mm=class extends mR{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,o=r-n;i<o;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,o=this.lastBytes.length+e.length;i<o;i++){let s;if(i<r?s=this.lastBytes[i]:s=e[i-r],s===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length>n){let i=e.slice(n);this.bodySize+=i.length,this.push(i)}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(o){return n(o)}i&&(this.bodySize+=e.length,this.push(e)),n()}_flush(e){this.headerChunks&&(this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders())),e()}parseHeaders(){let e=(this.rawHeaders||Buffer.alloc(0)).toString("binary").split(/\r?\n/),r=[];for(let n of e)r.length&&/^[ \t]/.test(n)?r[r.length-1]+=`
|
|
36
|
-
`+n:r.push(n);return r.filter(n=>/[^ \t\r]/.test(n)).map(n=>({key:hR(n.substr(0,n.indexOf(":"))).toLowerCase(),line:n}))}},CA=mm;import{Transform as ER}from"node:stream";import yR from"node:crypto";var nd=13,
|
|
37
|
-
`),UA=Buffer.alloc(4096,LA),hm=class extends ER{constructor(e){super(),e=e||{},this.bodyHash=yR.createHash(e.hashAlgo||"sha256"),this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1,this._lineHasContent=!1,this._pendingWsp=!1,this._pendingCr=!1,this._pendingEmptyLines=0}_hashCanonical(e){e.length&&(this.bodyHash.update(e),this._debugBody&&this._debugBody.push(Buffer.from(e)))}_hashEmptyLines(){for(;this._pendingEmptyLines>0;){let e=Math.min(this._pendingEmptyLines,UA.length/2);this._hashCanonical(UA.subarray(0,e*2)),this._pendingEmptyLines-=e}}_emitContent(e,r,n){return this._lineHasContent||(this._pendingEmptyLines&&(this._hashCanonical(e.subarray(0,r)),r=0,this._hashEmptyLines()),this._lineHasContent=!0),this._pendingWsp&&(e[r++]=
|
|
35
|
+
`),setImmediate(f))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseEnvelopeAddresses(e.from),r),r=r.filter(s=>s&&s.address),r.length&&r[0]&&(this._envelope.from=r[0].address));let n=new Set,i=[];["to","cc","bcc"].forEach(s=>{e[s]&&this._convertAddresses(this._parseEnvelopeAddresses(e[s]),i,n)}),this._envelope.to=i.map(s=>s.address).filter(s=>s);let o=["to","cc","bcc","from"];return et(this._envelope,e,s=>o.includes(s)),this}getAddresses(){let e={},r=new Map;return this._headers.forEach(n=>{let i=n.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(i)&&(Array.isArray(e[i])||(e[i]=[],r.set(i,new Set)),this._convertAddresses(this._parseAddresses(n.value),e[i],r.get(i)))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]},r=new Set,n=[];return this._headers.forEach(i=>{let o=[];i.key==="From"||!e.from&&["Reply-To","Sender"].includes(i.key)?(this._convertAddresses(this._parseAddresses(i.value),o),o.length&&o[0]&&(e.from=o[0].address)):["To","Cc","Bcc"].includes(i.key)&&this._convertAddresses(this._parseAddresses(i.value),n,r)}),e.to=n.map(i=>i.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&rm(this._raw),this}_accessDisabled(e){let r=this;for(;r;){if(r[e])return!0;r=r.parentNode}return!1}_destroyContentStreams(){$i(this.content),$i(this._raw);for(let e of this.childNodes)e._destroyContentStreams()}_takeStreamContent(e){return Object.prototype.toString.call(e)==="[object Error]"?e:!e||typeof e.pipe!="function"||e._resolvedValue?null:nm(e)}_getStream(e){let r;return e._resolvedValue?(r=new Za,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this._accessDisabled("disableFileAccess")?(r=new Za,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Gu,r.emit("error",n)}),r):aR.createReadStream(e.path):e&&typeof e.href=="string"?this._accessDisabled("disableUrlAccess")?(r=new Za,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=$u,r.emit("error",n)}),r):ui(e.href,{headers:e.httpHeaders,tls:e.tls}):(r=new Za,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){let r=[],n=new WeakSet,i=[],o=s=>{n.has(s)||(n.add(s),i.push({list:s,pos:0}))};for(o(Array.isArray(e)?e:[e]);i.length;){let s=i[i.length-1];if(s.pos>=s.list.length){i.pop();continue}let a=s.list[s.pos++];if(Array.isArray(a)){o(a);continue}if(a&&a.address){let l=this._normalizeAddress(a.address);if(l===a.address&&typeof a.name=="string"){r.push(a);continue}let u=et({},a);u.address=l,u.name=a.name||"",r.push(u);continue}let c=this._normalizeParsedAddresses(wA(a));for(let l=0;l<c.length;l++)r.push(c[l])}return r}_normalizeParsedAddresses(e){return e.forEach(r=>{r.address?r.address=this._normalizeAddress(r.address):r.group&&this._normalizeParsedAddresses(r.group)}),e}_parseEnvelopeAddresses(e){return this._parseAddresses(e).map(r=>r.address||r.group||!r.name||/[\s@]/.test(r.name)?r:{address:this._normalizeAddress(r.name),name:""})}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x1f\x7f]/g,"").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){if(this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart){let r=ec(e.params.boundary||this.boundary||"");this.boundary=e.params.boundary=r||ec(this._generateBoundary())}else this.boundary=!1}_generateBoundary(){return ec(this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary)+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,""),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r)}}_convertAddresses(e,r,n){let i=[];if(r=r||[],!n){n=new Set;for(let o=0;o<r.length;o++)n.add(r[o].address)}return[].concat(e||[]).forEach(o=>{if(o.address)o.address=this._normalizeAddress(o.address),o.name?i.push(`${this._encodeAddressName(o.name)} <${o.address}>`):i.push(dR.test(o.address)?o.address:`<${o.address}>`),n.has(o.address)||(n.add(o.address),r.push(o));else if(o.group){let s=(o.group.length?this._convertAddresses(o.group,r,n):"").trim();i.push(`${this._encodeAddressName(o.name)}:${s};`)}}),i.join(", ")}_normalizeAddress(e){if(e=(e||"").toString().replace(/[\x00-\x1F\x7F<>]+/g," ").trim(),!e)return e;let r=e.lastIndexOf("@");if(r<0)return this._normalizeLocalPart(e);let n=e.substr(0,r),i=e.substr(r+1),o=i,s=/[\x80-\uFFFF]/.test(n);try{o=fR(i.toLowerCase(),s)}catch{}return`${this._normalizeLocalPart(n)}@${o}`}_normalizeLocalPart(e){return lR.test(e)||uR.test(e)?e:Ya(e)}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?Ya(e):Sn(e,this._getTextEncoding(e),52)}_encodeHeaderText(e){return/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(e)?Sn(e,this._getTextEncoding(e),52):this._encodeWords(e)}_encodeWords(e){return AA(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,o=e.length;i<o;i++){let s=e.charCodeAt(i);s>=0&&s<=8||s===11||s===12||s>=14&&s<=31||s>=128?r++:(s>=65&&s<=90||s>=97&&s<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+um.randomBytes(r).toString("hex"),um.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}},Qr=pm;function tc(t){let e=t;return typeof t=="object"&&!!(e.content||e.path||e.href||e.raw)}var fm=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new Qr("message/rfc822",{newline:this.mail.newline,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n=[].concat(this.mail.attachments||[]).map((i,o)=>{/^data:/i.test(i.path||i.href)&&(i=this._processDataUrl(i));let s=i.contentType||Wi(i.filename||i.path||i.href||"bin"),a=/^image\//i.test(s),c=/^message\//i.test(s),l=i.contentDisposition||(c||a&&i.cid?"inline":"attachment"),u;"contentTransferEncoding"in i?u=i.contentTransferEncoding:c?u="8bit":u="base64";let p={contentType:s,contentDisposition:l,contentTransferEncoding:u};return i.filename?p.filename=i.filename:!c&&i.filename!==!1&&(p.filename=(i.path||i.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(o+1),p.filename.indexOf(".")<0&&(p.filename+="."+Zu(p.contentType))),/^https?:\/\//i.test(i.path)&&(i.href=i.path,i.path=void 0),i.cid&&(p.cid=i.cid),i.raw?p.raw=i.raw:i.path?p.content={path:i.path}:i.href?p.content={href:i.href,httpHeaders:i.httpHeaders,tls:i.tls}:p.content=i.content||"",i.encoding&&(p.encoding=i.encoding),i.headers&&(p.headers=i.headers),p});return this.mail.icalEvent&&(r=Object.assign({},this._getIcalEvent()),r.contentType="application/ics",r.headers||(r.headers={}),r.filename=r.filename||"invite.ics",r.headers["Content-Disposition"]="attachment",r.headers["Content-Transfer-Encoding"]="base64"),e?{attached:n.filter(i=>!i.cid).concat(r||[]),related:n.filter(i=>!!i.cid)}:{attached:n.concat(r||[]),related:[]}}_getIcalEvent(){if(!this._icalEvent){let e;tc(this.mail.icalEvent)?e=et({},this.mail.icalEvent):e={content:this.mail.icalEvent},/^data:/i.test(e.path||e.href)&&(e=this._processDataUrl(e)),/^https?:\/\//i.test(e.path)&&(e.href=e.path,e.path=void 0),e.raw||(e.path?(e.content={path:e.path},e.path=void 0):e.href&&(e.content={href:e.href,httpHeaders:e.httpHeaders,tls:e.tls},e.href=void 0)),e.content&&typeof e.content=="object"&&(e.content._resolve=!0),this._icalEvent=e}return this._icalEvent}getAlternatives(){let e=[],r,n,i,o,s;return this.mail.text&&(tc(this.mail.text)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(tc(this.mail.watchHtml)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(tc(this.mail.amp)?o=this.mail.amp:o={content:this.mail.amp},o.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(s=Object.assign({},this._getIcalEvent()),s.filename=!1,s.contentType="text/calendar; charset=utf-8; method="+(s.method||"PUBLISH").toString().trim().toUpperCase(),s.headers||(s.headers={})),this.mail.html&&(tc(this.mail.html)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(o||[]).concat(n||[]).concat(s||[]).concat(this.mail.alternatives||[]).forEach(a=>{/^data:/i.test(a.path||a.href)&&(a=this._processDataUrl(a));let c={contentType:a.contentType||Wi(a.filename||a.path||a.href||"txt"),contentTransferEncoding:a.contentTransferEncoding};a.filename&&(c.filename=a.filename),/^https?:\/\//i.test(a.path)&&(a.href=a.path,a.path=void 0),a.raw?c.raw=a.raw:a.path?c.content={path:a.path}:a.href?c.content={href:a.href,httpHeaders:a.httpHeaders,tls:a.tls}:c.content=a.content||"",a.encoding&&(c.encoding=a.encoding),a.headers&&(c.headers=a.headers),e.push(c)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",o=r.indexOf(",");if(o>0&&o<200){let a=r.substring(5,o).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign(et({},e),{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=em(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}},kA=fm;import{Transform as mR}from"node:stream";function hR(t){let e=0,r=t.length;for(;e<r&&(t.charCodeAt(e)===32||t.charCodeAt(e)===9);)e++;for(;r>e&&(t.charCodeAt(r-1)===32||t.charCodeAt(r-1)===9);)r--;return t.slice(e,r)}var mm=class extends mR{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,o=r-n;i<o;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,o=this.lastBytes.length+e.length;i<o;i++){let s;if(i<r?s=this.lastBytes[i]:s=e[i-r],s===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length>n){let i=e.slice(n);this.bodySize+=i.length,this.push(i)}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(o){return n(o)}i&&(this.bodySize+=e.length,this.push(e)),n()}_flush(e){this.headerChunks&&(this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders())),e()}parseHeaders(){let e=(this.rawHeaders||Buffer.alloc(0)).toString("binary").split(/\r?\n/),r=[];for(let n of e)r.length&&/^[ \t]/.test(n)?r[r.length-1]+=`
|
|
36
|
+
`+n:r.push(n);return r.filter(n=>/[^ \t\r]/.test(n)).map(n=>({key:hR(n.substr(0,n.indexOf(":"))).toLowerCase(),line:n}))}},CA=mm;import{Transform as ER}from"node:stream";import yR from"node:crypto";var nd=13,DA=10,PA=32,gR=9,LA=Buffer.from(`\r
|
|
37
|
+
`),UA=Buffer.alloc(4096,LA),hm=class extends ER{constructor(e){super(),e=e||{},this.bodyHash=yR.createHash(e.hashAlgo||"sha256"),this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1,this._lineHasContent=!1,this._pendingWsp=!1,this._pendingCr=!1,this._pendingEmptyLines=0}_hashCanonical(e){e.length&&(this.bodyHash.update(e),this._debugBody&&this._debugBody.push(Buffer.from(e)))}_hashEmptyLines(){for(;this._pendingEmptyLines>0;){let e=Math.min(this._pendingEmptyLines,UA.length/2);this._hashCanonical(UA.subarray(0,e*2)),this._pendingEmptyLines-=e}}_emitContent(e,r,n){return this._lineHasContent||(this._pendingEmptyLines&&(this._hashCanonical(e.subarray(0,r)),r=0,this._hashEmptyLines()),this._lineHasContent=!0),this._pendingWsp&&(e[r++]=PA,this._pendingWsp=!1),e[r++]=n,r}updateHash(e,r){let n=Buffer.allocUnsafe(e.length*2+2),i=0;for(let o=0;o<e.length;o++){let s=e[o];if(s===DA){this._lineHasContent?(n[i++]=nd,n[i++]=DA,this._lineHasContent=!1):this._pendingEmptyLines++,this._pendingWsp=!1,this._pendingCr=!1;continue}this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),s===nd?this._pendingCr=!0:s===PA||s===gR?this._pendingWsp=!0:i=this._emitContent(n,i,s)}r&&this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),this._hashCanonical(n.subarray(0,i))}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){this.updateHash(Buffer.alloc(0),!0),this._lineHasContent&&this._hashCanonical(LA),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}},MA=hm;import vR from"node:crypto";function KA(t){let e=new Error('Unsupported DKIM hash algorithm "'+t+'"');return e.code=Es,e}function Em(t,e,r,n){n=n||{};let o=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",s=HA(t,o,n.skipFields),a=AR(n.domainName,n.keySelector,s.fieldNames,e,r);s.headers+="dkim-signature:"+FA(a);let c;try{c=vR.createSign(("rsa-"+e).toUpperCase())}catch{throw KA(e)}c.update(s.headers,"latin1");let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
|
|
38
38
|
`).trim()}Em.relaxedHeaders=HA;Em.unsupportedHashAlgoError=KA;var ym=Em;function AR(t,e,r,n,i){let o=a=>(a||"").toString().replace(/[\x00-\x1f\x7f;=]/g,""),s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+hs(o(t)),"q=dns/txt","s="+o(e),"bh="+i,"h="+o(r)].join("; ");return Xa("DKIM-Signature: "+s,76)+`;\r
|
|
39
39
|
b=`}function HA(t,e,r){let n=new Set,i=new Set,o=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!o.has(l.key)&&o.set(l.key,FA(l.line))}let s=[],a=[];return n.forEach(c=>{o.has(c)&&(a.push(c),s.push(c+":"+o.get(c)))}),{headers:s.join(`\r
|
|
40
40
|
`)+`\r
|
|
@@ -45,9 +45,9 @@ ${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SE
|
|
|
45
45
|
`+Object.keys(B).map(V=>V+": "+B[V]).join(`\r
|
|
46
46
|
`)+`\r
|
|
47
47
|
\r
|
|
48
|
-
`),p.on("data",K)}),m=setTimeout(()=>{let B=new Error("Proxy socket timed out");B.code=Yf,v(B)},u),p.once("error",v),p.once("close",N)}var GA=jA;import wR from"node:util";var xm=(t,e)=>Object.prototype.hasOwnProperty.call(t,e),rc=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};et(this.data,r),this.data.headers=this.data.headers||{},et(this.data,i,o=>xm(this.data,o)),et(this.data.headers,i.headers,o=>xm(this.data.headers,o)),["disableFileAccess","disableUrlAccess","normalizeHeaderKey","maxRecipients"].forEach(o=>{o in n&&(this.data[o]=n[o])}),["disableFileAccess","disableUrlAccess"].forEach(o=>{!(o in n)&&xm(i,o)&&(this.data[o]=this.data[o]||i[o])})}resolveContent(e,r,n,i){!i&&typeof n=="function"&&(i=n,n=!1),n=n||{};let o={disableFileAccess:this.data.disableFileAccess||n.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess||n.disableUrlAccess};return tm(e,r,o,i)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Zu(c.contentType))),c.contentType||(c.contentType=Wi(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new Qr;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let s=0,a=()=>{if(s>=r.length)return e(null,this.data);let c=r[s++];if(!c[0]||!c[0][c[1]])return a();tm(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,u)=>{if(l)return e(l);let p={content:u};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&et(p,c[0][c[1]],f=>f in p||["content","path","href","raw"].includes(f)),c[0][c[1]]=p,a()})};setImmediate(()=>a())}releaseStreams(){let e=this.data,r=[e.html,e.text,e.watchHtml,e.amp,e.raw,e.icalEvent];for(let n of["attachments","alternatives"])Array.isArray(e[n])&&r.push(...e[n]);for(let n of r)n&&typeof n=="object"&&($i(n),$i(n.content),$i(n.raw))}normalize(e){let r=this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,o)=>i?e(i):(o.envelope=r,o.messageId=n,["html","text","watchHtml","amp"].forEach(s=>{o[s]&&o[s].content&&(typeof o[s].content=="string"?o[s]=o[s].content:Buffer.isBuffer(o[s].content)&&(o[s]=o[s].content.toString()))}),o.icalEvent&&Buffer.isBuffer(o.icalEvent.content)&&(o.icalEvent.content=o.icalEvent.content.toString("base64"),o.icalEvent.encoding="base64"),o.alternatives&&o.alternatives.length&&o.alternatives.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.attachments&&o.attachments.length&&o.attachments.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.normalizedHeaders={},Object.keys(o.headers||{}).forEach(s=>{if(Rr(s))return;let a=[].concat(o.headers[s]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(s)&&(a=this.message._encodeHeaderValue(s,a)),o.normalizedHeaders[s]=a)}),o.list&&typeof o.list=="object"&&this._getListHeaders(o.list).forEach(a=>{o.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),o.references&&(o.normalizedHeaders.references=this.message._encodeHeaderValue("references",o.references)),o.inReplyTo&&(o.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",o.inReplyTo)),e(null,o)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," "),s=!vs(o)||/\x7f/.test(o);return r.toLowerCase().trim()==="id"?(o=s?bn(o):Ya(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+:\/{0,2}/,"<")):(o=s?bn(o):o.replace(/[()\\]/g,"\\$&"),this._formatListUrl(i.url)+(i.comment?" ("+o+")":""))}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};import NR from"node:net";import RR from"node:dns";import OR from"node:crypto";var kR=1e5,bm=class extends SR{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new _m(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=ft(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...o)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...o)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((a,c)=>{r=Mt(a,c)}));let i=r;typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let o=new rc(this,e),s=a=>{o.releaseStreams(),i(a)};return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",o,a=>{if(a)return this.logger.error({err:a,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",a.message),s(a);let c;try{o.message=new kA(o.data).compile(),o.setMailerHeader(),o.setPriorityHeaders(),o.setListHeaders(),c=o.message.getEnvelope().to.length}catch(u){return this.logger.error({err:u,tnx:"transport",action:"send"},"Compile Error: %s",u.message),s(u)}let l=o.data.maxRecipients===void 0?kR:o.data.maxRecipients;if(l&&c>l){let u=new Error(`Message has ${c} recipients, which is over the ${l} allowed by maxRecipients`);return u.code=Xv,this.logger.error({err:u,tnx:"transport",action:"send"},"Send Error: %s",u.message),s(u)}this._processPlugins("stream",o,u=>{if(u)return this.logger.error({err:u,tnx:"plugin",action:"stream"},"PluginStream Error: %s",u.message),s(u);(o.data.dkim||this.dkim)&&o.message.processFunc(p=>{let f=o.data.dkim?new _m(o.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:o.message.messageId(),dkimDomains:f.keys.map(m=>m.keySelector+"."+m.domainName).join(", ")},"Signing outgoing message with %s keys",f.keys.length),f.sign(p,o.data._dkim)}),this.transporter.send(o,(...p)=>{p[0]&&(o.releaseStreams(),this.logger.error({err:p[0],tnx:"transport",action:"send"},"Send Error: %s",p[0].message)),i(...p)})})}),n}getVersionString(){return wR.format("%s (%s; +%s; %s/%s)",Ku,Xe,zv,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],o=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+o.length===0)return n();let s=0,a="default",c=()=>{let l=a==="default"?o:i;if(s>=l.length)if(a==="default"&&i.length)a="user",s=0,l=i;else return n();let u=l[s++];u(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=Nr(e);this.getSocket=(n,i)=>{let o=r.protocol.replace(/:$/,"").toLowerCase(),s=Number(this.options.connectionTimeout)||0,a=Number(n.connectStartedAt)||Date.now(),c=s?Math.max(a+s-Date.now(),1):void 0;if(this.meta.has("proxy_handler_"+o))return this.meta.get("proxy_handler_"+o)(r,n,i);switch(o){case"http":case"https":GA(r.href,n.port,n.host,c?Object.assign({},this.options.tls,{timeout:c}):this.options.tls||{},(u,p)=>u?i(u):i(null,{connection:p}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let p=new Error("Socks module not loaded");return p.code=li,i(p)}let u=p=>{let f=!!this.meta.get("proxy_socks_module").SocksClient,m=f?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),E=Number(r.protocol.replace(/\D/g,""))||5,v={proxy:{ipaddress:p,port:Number(r.port),type:E},[f?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(c&&(v.timeout=c),r.username||r.password){let N=r.username||"",S=r.password||"";f?(v.proxy.userId=N,v.proxy.password=S):E===4?v.userid=N:v.authentication={username:N,password:S}}m.createConnection(v,(N,S)=>N?i(N):i(null,{connection:S.socket||S}))};return NR.isIP(r.hostname)?u(r.hostname):RR.lookup(r.hostname,(p,f)=>{if(p)return i(p);u(f)})}}let l=new Error("Unknown proxy configuration");l.code=li,i(l)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let o=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(s,a,c,l)=>{let u=OR.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:u,filename:"image-"+ ++o+"."+Ju(l)}),a+"cid:"+u}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}},$A=bm;import{EventEmitter as XR}from"node:events";import{EventEmitter as MR}from"node:events";import di from"node:net";import qA from"node:tls";import KR from"node:os";import WA from"node:crypto";import{Transform as CR}from"node:stream";var PR=Buffer.from(`
|
|
49
|
-
`),
|
|
50
|
-
.`),UR=Buffer.from("\r"),LR=Buffer.from("."),nc=class extends CR{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],o=0,s,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,s=0,a=e.length;s<a;s++){let u=e[s],p=s?e[s-1]:this.lastByte,f=!1;p===13&&u!==10?f=u===46?DR:
|
|
48
|
+
`),p.on("data",K)}),m=setTimeout(()=>{let B=new Error("Proxy socket timed out");B.code=Yf,v(B)},u),p.once("error",v),p.once("close",N)}var GA=jA;import wR from"node:util";var xm=(t,e)=>Object.prototype.hasOwnProperty.call(t,e),rc=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};et(this.data,r),this.data.headers=this.data.headers||{},et(this.data,i,o=>xm(this.data,o)),et(this.data.headers,i.headers,o=>xm(this.data.headers,o)),["disableFileAccess","disableUrlAccess","normalizeHeaderKey","maxRecipients"].forEach(o=>{o in n&&(this.data[o]=n[o])}),["disableFileAccess","disableUrlAccess"].forEach(o=>{!(o in n)&&xm(i,o)&&(this.data[o]=this.data[o]||i[o])})}resolveContent(e,r,n,i){!i&&typeof n=="function"&&(i=n,n=!1),n=n||{};let o={disableFileAccess:this.data.disableFileAccess||n.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess||n.disableUrlAccess};return tm(e,r,o,i)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Zu(c.contentType))),c.contentType||(c.contentType=Wi(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new Qr;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let s=0,a=()=>{if(s>=r.length)return e(null,this.data);let c=r[s++];if(!c[0]||!c[0][c[1]])return a();tm(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,u)=>{if(l)return e(l);let p={content:u};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&et(p,c[0][c[1]],f=>f in p||["content","path","href","raw"].includes(f)),c[0][c[1]]=p,a()})};setImmediate(()=>a())}releaseStreams(){let e=this.data,r=[e.html,e.text,e.watchHtml,e.amp,e.raw,e.icalEvent];for(let n of["attachments","alternatives"])Array.isArray(e[n])&&r.push(...e[n]);for(let n of r)n&&typeof n=="object"&&($i(n),$i(n.content),$i(n.raw))}normalize(e){let r=this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,o)=>i?e(i):(o.envelope=r,o.messageId=n,["html","text","watchHtml","amp"].forEach(s=>{o[s]&&o[s].content&&(typeof o[s].content=="string"?o[s]=o[s].content:Buffer.isBuffer(o[s].content)&&(o[s]=o[s].content.toString()))}),o.icalEvent&&Buffer.isBuffer(o.icalEvent.content)&&(o.icalEvent.content=o.icalEvent.content.toString("base64"),o.icalEvent.encoding="base64"),o.alternatives&&o.alternatives.length&&o.alternatives.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.attachments&&o.attachments.length&&o.attachments.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.normalizedHeaders={},Object.keys(o.headers||{}).forEach(s=>{if(Rr(s))return;let a=[].concat(o.headers[s]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(s)&&(a=this.message._encodeHeaderValue(s,a)),o.normalizedHeaders[s]=a)}),o.list&&typeof o.list=="object"&&this._getListHeaders(o.list).forEach(a=>{o.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),o.references&&(o.normalizedHeaders.references=this.message._encodeHeaderValue("references",o.references)),o.inReplyTo&&(o.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",o.inReplyTo)),e(null,o)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," "),s=!vs(o)||/\x7f/.test(o);return r.toLowerCase().trim()==="id"?(o=s?Sn(o):Ya(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+:\/{0,2}/,"<")):(o=s?Sn(o):o.replace(/[()\\]/g,"\\$&"),this._formatListUrl(i.url)+(i.comment?" ("+o+")":""))}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};import NR from"node:net";import RR from"node:dns";import OR from"node:crypto";var kR=1e5,bm=class extends SR{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new _m(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=ft(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...o)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...o)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((a,c)=>{r=Mt(a,c)}));let i=r;typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let o=new rc(this,e),s=a=>{o.releaseStreams(),i(a)};return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",o,a=>{if(a)return this.logger.error({err:a,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",a.message),s(a);let c;try{o.message=new kA(o.data).compile(),o.setMailerHeader(),o.setPriorityHeaders(),o.setListHeaders(),c=o.message.getEnvelope().to.length}catch(u){return this.logger.error({err:u,tnx:"transport",action:"send"},"Compile Error: %s",u.message),s(u)}let l=o.data.maxRecipients===void 0?kR:o.data.maxRecipients;if(l&&c>l){let u=new Error(`Message has ${c} recipients, which is over the ${l} allowed by maxRecipients`);return u.code=Xv,this.logger.error({err:u,tnx:"transport",action:"send"},"Send Error: %s",u.message),s(u)}this._processPlugins("stream",o,u=>{if(u)return this.logger.error({err:u,tnx:"plugin",action:"stream"},"PluginStream Error: %s",u.message),s(u);(o.data.dkim||this.dkim)&&o.message.processFunc(p=>{let f=o.data.dkim?new _m(o.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:o.message.messageId(),dkimDomains:f.keys.map(m=>m.keySelector+"."+m.domainName).join(", ")},"Signing outgoing message with %s keys",f.keys.length),f.sign(p,o.data._dkim)}),this.transporter.send(o,(...p)=>{p[0]&&(o.releaseStreams(),this.logger.error({err:p[0],tnx:"transport",action:"send"},"Send Error: %s",p[0].message)),i(...p)})})}),n}getVersionString(){return wR.format("%s (%s; +%s; %s/%s)",Ku,Xe,zv,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],o=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+o.length===0)return n();let s=0,a="default",c=()=>{let l=a==="default"?o:i;if(s>=l.length)if(a==="default"&&i.length)a="user",s=0,l=i;else return n();let u=l[s++];u(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=Nr(e);this.getSocket=(n,i)=>{let o=r.protocol.replace(/:$/,"").toLowerCase(),s=Number(this.options.connectionTimeout)||0,a=Number(n.connectStartedAt)||Date.now(),c=s?Math.max(a+s-Date.now(),1):void 0;if(this.meta.has("proxy_handler_"+o))return this.meta.get("proxy_handler_"+o)(r,n,i);switch(o){case"http":case"https":GA(r.href,n.port,n.host,c?Object.assign({},this.options.tls,{timeout:c}):this.options.tls||{},(u,p)=>u?i(u):i(null,{connection:p}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let p=new Error("Socks module not loaded");return p.code=li,i(p)}let u=p=>{let f=!!this.meta.get("proxy_socks_module").SocksClient,m=f?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),E=Number(r.protocol.replace(/\D/g,""))||5,v={proxy:{ipaddress:p,port:Number(r.port),type:E},[f?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(c&&(v.timeout=c),r.username||r.password){let N=r.username||"",S=r.password||"";f?(v.proxy.userId=N,v.proxy.password=S):E===4?v.userid=N:v.authentication={username:N,password:S}}m.createConnection(v,(N,S)=>N?i(N):i(null,{connection:S.socket||S}))};return NR.isIP(r.hostname)?u(r.hostname):RR.lookup(r.hostname,(p,f)=>{if(p)return i(p);u(f)})}}let l=new Error("Unknown proxy configuration");l.code=li,i(l)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let o=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(s,a,c,l)=>{let u=OR.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:u,filename:"image-"+ ++o+"."+Ju(l)}),a+"cid:"+u}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}},$A=bm;import{EventEmitter as XR}from"node:events";import{EventEmitter as MR}from"node:events";import di from"node:net";import qA from"node:tls";import KR from"node:os";import WA from"node:crypto";import{Transform as CR}from"node:stream";var DR=Buffer.from(`
|
|
49
|
+
`),PR=Buffer.from(`
|
|
50
|
+
.`),UR=Buffer.from("\r"),LR=Buffer.from("."),nc=class extends CR{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],o=0,s,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,s=0,a=e.length;s<a;s++){let u=e[s],p=s?e[s-1]:this.lastByte,f=!1;p===13&&u!==10?f=u===46?PR:DR:u===10&&p!==13?f=UR:u===46&&(p===10||p===!1)&&(f=LR),f&&(s>c&&(l=e.slice(c,s),i.push(l),o+=l.length),i.push(f),o+=f.length,c=s)}i.length?(c<e.length&&(l=e.slice(c),i.push(l),o+=l.length),this.outByteCount+=o,this.push(Buffer.concat(i,o))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
|
|
51
51
|
`):this.lastByte===13?r=Buffer.from(`
|
|
52
52
|
.\r
|
|
53
53
|
`):r=Buffer.from(`\r
|
|
@@ -57,8 +57,8 @@ ${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SE
|
|
|
57
57
|
`))return this._remainder+=n,this._remainder.length>r?this._onResponseTooLarge():void 0;let i=(this._remainder+n).split(/\r?\n/);this._remainder=i.pop();for(let o=0,s=i.length;o<s;o++)if(this._responsePartial?this._responseQueue[this._responseQueue.length-1]+=`
|
|
58
58
|
`+i[o]:this._responseQueue.push(i[o]),this._responsePartial=QA(i[o]),this._responsePartial&&this._responseQueue[this._responseQueue.length-1].length>r)return this._onResponseTooLarge();if(this._remainder.length>r)return this._onResponseTooLarge();this._responsePartial||this._processResponse()}_onResponseTooLarge(){this._remainder="",this._responseQueue=[],this._responsePartial=!1,this._onError(new Error("Server response exceeds maximum allowed size"),"EPROTOCOL",!1,"CONN")}_onError(e,r,n,i){if(this._clearPhase(),this._destroyed)return;e=this._formatError(e,r,n,i),Wa(e)?this.logger.warn({tnx:"smtp",err:e},"%s",e.message):this.logger.error({tnx:"smtp",err:e},"%s",e.message);let o=this._pendingSend;this.emit("error",e),this.close(),o&&o.callback(e)}_formatError(e,r,n,i){let o;/Error\]$/i.test(Object.prototype.toString.call(e))?o=e:o=new Error(e),r&&r!=="Error"&&o.code!==Wu&&(o.code&&o.code!==r&&!o.originalCode&&(o.originalCode=o.code),o.code=r),n&&(o.response=n,o.message+=": "+n);let s=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return s&&(o.responseCode=s),i&&(o.command=i),o}_onClose(){let e=!1;this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=XA(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed");let r=typeof e=="string"&&/^[45]\d{2}[ -]/.test(e)?e:!1;if(this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",r,"CONN");if(!r&&this._responseActions[0]===this._actionGreeting&&this._connectCallback&&!this._destroyed){let n=this._connectCallback;this._connectCallback=!1;let i=this._formatError(new Error("Connection closed unexpectedly"),"ECONNECTION",!1,"CONN");this.logger.warn({tnx:"network"},i.message),n(i),this.close();return}if(!r&&this.stage==="connected"&&!this._responseActions.length&&!this._pendingSend&&!this._destroyed&&!this._closing)return this.logger.info({tnx:"network"},"Server closed the idle connection"),this._destroy();if(r||this._responseActions[0]!==this.close&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",r,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(id("Timeout","SOCKET_TIMEOUT"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.destroyed=!0,this._clearPhase(),this.emit("end"))}_upgradeConnection(e){let r=this._remainder.length+this._responseQueue.reduce((s,a)=>s+a.length,0);r&&this.logger.warn({tnx:"smtp",discarded:r},"Discarded %s bytes received in plaintext after the STARTTLS response",r),this._plaintextEhlo=!1,this._remainder="",this._responseQueue=[],this._responsePartial=!1;let n=this._socket;n.removeListener("data",this._onSocketData),n.removeListener("timeout",this._onSocketTimeout),n.setTimeout(0);let i=Object.assign({socket:n,host:this.host},this.options.tls||{});this.servername&&!i.servername&&(i.servername=this.servername);let o=()=>{n.removeListener("close",this._onSocketClose),n.removeListener("end",this._onSocketEnd),n.removeListener("error",this._onSocketError),n.removeListener("error",this._onConnectionSocketError)};this.upgrading=!0,this._startPhase(this._remainingSetupTime(),id("TLS handshake timed out","UPGRADE_TIMEOUT"));try{this._socket=qA.connect(i,()=>(this._clearPhase(),this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),o(),e(null,!0)))}catch(s){return this._clearPhase(),o(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||zA),this._socket.on("timeout",this._onSocketTimeout),n.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=(this._responseQueue.shift()||"").toString();if(!e.trim()){setImmediate(()=>this._processResponse());return}if(qR(e)){this._responseQueue.unshift(e);return}let r=this.lastServerResponse=XA(e);(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},r.replace(/\r?\n$/,""));let n=this._responseActions.shift(),i=/^421[ -]/.test(r);if(typeof n=="function"){if(n.call(this,r),i)return this._onServerClosing(r);setImmediate(()=>this._processResponse())}else if(i&&!this._pendingSend&&this.stage==="connected")this.logger.info({tnx:"smtp"},"Server closed the idle connection: %s",r),this.close();else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",r,"CONN")}_sendCommand(e,r){if(this._destroyed)return;let n=this._socket;if(n.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),n.write(Buffer.from(e+`\r
|
|
59
59
|
`,"utf-8"))}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(a=>(a&&a.address||a||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let a=0,c=this._envelope.to.length;a<c;a++){if(!this._envelope.to[a]||/[\r\n<>]/.test(this._envelope.to[a]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[a]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[a])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(a){return r(this._formatError("Invalid DSN "+a.message,"EENVELOPE",!1,"API"))}if(this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"))}if(this._envelope.pipelined=this._supportedExtensions.includes("PIPELINING"),this._responseActions.push(a=>{this._actionMAIL(a,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let a=Number(this._envelope.size)||0;a>0&&n.push("SIZE="+a)}this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Ja(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Ja(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled&&n.push("REQUIRETLS");let o="MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):"");if(this._recipientQueue=[],!this._envelope.pipelined){this._sendCommand(o);return}let s=this._socket;for(s.cork(),this._sendCommand(o);this._envelope.rcptQueue.length;)this._sendRcpt(this._envelope.rcptQueue.shift(),r);this._responseActions.push(a=>{this._actionDATA(a,r)}),this._sendCommand("DATA"),s.uncork()}_sendRcpt(e,r){this._recipientQueue.push(e),this._responseActions.push(n=>{this._actionRCPT(n,r)}),this._sendCommand("RCPT TO:<"+e+">"+this._getDsnRcptToArgs())}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let s=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!s.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let o=(e.recipient||e.orcpt||"").toString()||null;return o&&o.indexOf(";")<0&&(o="rfc822;"+o),{ret:r,envid:n,notify:i,orcpt:o}}_getDsnRcptToArgs(){let e=this._envelope,r=[];return e.dsn&&this._supportedExtensions.includes("DSN")&&(e.dsn.notify&&r.push("NOTIFY="+Ja(e.dsn.notify)),e.dsn.orcpt&&r.push("ORCPT="+Ja(e.dsn.orcpt))),r.length?" "+r.join(" "):""}_createSendStream(e){let r=this._envelope,n=new nc;if(this.options.lmtp?r.accepted.forEach((i,o)=>{let s=o===r.accepted.length-1;this._responseActions.push(a=>{this._actionLMTPStream(i,s,a,e)})}):this._responseActions.push(i=>{this._actionSMTPStream(i,e)}),this._currentDataStream=n,n.pipe(this._socket,{end:!1}),this.options.debug){let i=new HR;i.on("readable",()=>{let o;for(;o=i.read();)this.logger.debug({tnx:"message"},o.toString("binary").replace(/\r?\n$/,""))}),n.pipe(i)}return n.once("end",()=>{this._currentDataStream===n&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:n.inByteCount,outByteCount:n.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",n.outByteCount,n.inByteCount)}),n}_actionGreeting(e){if(this._clearPhase(),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._plaintextEhlo=e,this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}this._parseEhloExtensions(e),this.emit("connect")}_parseEhloExtensions(e){let r;this._ehloLines=e.split(/\r?\n/).map(i=>i.replace(/^\d+[ -]/,"").trim()).filter(i=>i).slice(1),/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0);let n=new Set;for(let i of this._ehloLines){let o=/^AUTH[\s=](.*)/i.exec(i);if(o)for(let s of o[1].split(/[\s=]+/))n.add(s.toUpperCase())}for(let i of["PLAIN","LOGIN","CRAM-MD5","XOAUTH2"])n.has(i)&&this._supportedAuth.push(i);(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0)}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS){this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this._plaintextEhlo&&(this._parseEhloExtensions(this._plaintextEhlo),this._plaintextEhlo=!1,this.allowsAuth=!1,this._supportedAuth=[]),this.emit("connect");return}this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),o=WA.createHmac("md5",this._auth.credentials.pass);o.update(i);let s=this._auth.credentials.user+" "+o.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(s).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){let n=this._envelope;if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(n.from)?"Internationalized mailbox name not allowed":"Mail command failed";n.mailError=this._formatError(i,"EENVELOPE",e,"MAIL FROM")}this._advanceEnvelope(e,r)}_actionRCPT(e,r){let n=this._envelope,i,o=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(o)?"Internationalized mailbox name not allowed":"Recipient command failed";n.rejected.push(o),i=this._formatError(s,"EENVELOPE",e,"RCPT TO"),i.recipient=o,n.rejectedErrors.push(i)}else n.accepted.push(o);this._advanceEnvelope(e,r)}_advanceEnvelope(e,r){let n=this._envelope;if(n.pipelined)return;if(n.mailError)return r(n.mailError);if(n.rcptQueue.length)return this._sendRcpt(n.rcptQueue.shift(),r);if(this._recipientQueue.length)return;let i=this._envelopeError(e);if(i)return r(i);this._responseActions.push(o=>{this._actionDATA(o,r)}),this._sendCommand("DATA")}_envelopeError(e){let r=this._envelope;if(r.mailError)return r.mailError;if(r.accepted.length)return null;let n=r.rejectedErrors.find(a=>a.responseCode&&a.responseCode<500),i=r.rejectedErrors[r.rejectedErrors.length-1],o=n?.response??(r.pipelined&&i?i.response:e),s=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",o,"RCPT TO");return s.rejected=r.rejected,s.rejectedErrors=r.rejectedErrors,s}_actionDATA(e,r){let n=this._envelope;if(n.pipelined){let o=this._envelopeError(e);if(o){if(/^3/.test(e)){if(n.mailError)return this.close(),r(o);this._responseActions.push(()=>r(o)),this._sendCommand(".");return}return r(o)}}if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let i={accepted:n.accepted,rejected:n.rejected};this._ehloLines&&this._ehloLines.length&&(i.ehlo=this._ehloLines),n.rejectedErrors.length&&(i.rejectedErrors=n.rejectedErrors),r(null,i)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let o=this._envelope,s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,o.rejected.push(e),o.rejectedErrors.push(s);for(let a=0,c=o.accepted.length;a<c;a++)o.accepted[a]===e&&o.accepted.splice(a,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(o=>{this._actionAUTHComplete(o,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KR.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}},zi=Sm;import{Stream as WR}from"node:stream";import zR from"node:crypto";var wm=class extends WR{constructor(e,r){if(super(),this.options=e||{},this.configError=!1,e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=ci,this.configError=i}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=ft({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){let n=r;if(this.configError)return n(this.configError);if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let o=new Error("Can't create new access token for user");return o.code=ci,n(o)}if(this.renewing){this.renewalQueue.push({renew:e,callback:n});return}this.renewing=!0;let i=(o,s)=>{this.renewalQueue.forEach(a=>a.callback(o,s)),this.renewalQueue=[],this.renewing=!1,o?this.logger.error({err:o,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),n(o,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(o,s,a)=>{!o&&s&&(this.accessToken=s,this.expires=a||0),i(o,s)}):this.generateToken(i)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r=e,n,i;if(this.options.serviceClient){let o=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:o,exp:o+this.options.serviceRequestTimeout},a;try{a=this.jwtSignRS256(s)}catch{let l=new Error("Can't generate token. Check your auth options");return l.code=ci,r(l)}n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:a},i={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let o=new Error("Can't create new access token for user");return o.code=ci,r(o)}n={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},i={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(n,this.options.customParams),Object.assign(i,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(i)),this.postRequest(this.options.accessUrl,n,this.options,(o,s)=>{let a;if(o)return r(o);try{a=JSON.parse(s.toString())}catch(u){return r(u)}if(!a||typeof a!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let u=new Error("Invalid authentication response");return u.code=ci,r(u)}let c=Object.assign({},a);if(c.access_token&&(c.access_token=(c.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(c)),a.error){let u=a.error;a.error_description&&(u+=": "+a.error_description),a.error_uri&&(u+=" ("+a.error_uri+")");let p=new Error(u);return p.code=ci,r(p)}if(a.access_token)return this.updateToken(a.access_token,a.expires_in),e(null,this.accessToken);let l=new Error("No access token");return l.code=ci,r(l)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join(""),"utf-8").toString("base64")}postRequest(e,r,n,i){let o=!1,s=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0,timeout:n.requestTimeout};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=ui(e,c);l.on("readable",()=>{let u;for(;(u=l.read())!==null;)s.push(u),a+=u.length}),l.once("error",u=>{if(!o)return o=!0,i(u)}),l.once("end",()=>{if(!o)return o=!0,i(null,Buffer.concat(s,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){let r=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(i=>this.toBase64URL(i)).join("."),n=zR.createSign("RSA-SHA256").update(r).sign(this.options.privateKey);return r+"."+this.toBase64URL(n)}},od=wm;import{EventEmitter as JR}from"node:events";var As=class extends JR{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new od(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this._fail(n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0,this._failed=!1,this._sending=!1,this._idleTimer=!1}_fail(e){this._failed||(this._failed=!0,this.emit("error",e))}connect(e){let r=Date.now();this.pool.getSocket(Object.assign({},this.options,{connectStartedAt:r}),(n,i)=>{if(n)return this._fail(n),e(n);let o=!1,s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Or(!1,s),i)),this.connection=new zi(s),this.connection._connectStartedAt=r,this.connection.on("error",a=>{if(!this._sending){if(this._connected&&Wa(a)){this.logger.info({tnx:"pool",cid:this.id},"Connection #%s was closed by the server: %s",this.id,a.message);return}if(this._fail(a),!o)return o=!0,e(a)}}),this.connection.once("end",()=>{this.close(),o=!0}),this.connection.connect(a=>{if(!o){if(a){o=!0;return}if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,c=>{if(!o){if(o=!0,c)return this.connection.close(),this._fail(c),e(c);this._connected=!0,e(null,!0)}});else return o=!0,this._connected=!0,e(null,!0)}})})}send(e,r){if(!this._connected)return this.connect(c=>c?r(c):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,o.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this._sending=!0;let s=this.messages>0,a=e.message.createReadStream();this.connection.send(n,a,(c,l)=>{if(this._sending=!1,this.messages++,c){if(s&&a.readableDidRead===!1&&Wa(c)){this.logger.info({tnx:"pool",cid:this.id,messageId:i},"Connection #%s was closed by the server before message %s was sent: %s",this.id,i,c.message),this.connection.close();return}return(c.code===Jv||c.code===Yv)&&c.responseCode!==421&&!this.connection._destroyed?(this.connection.reset(u=>{if(u){this.connection.close();return}this._release()}),r(c)):(this.connection.close(),this._fail(c),r(c))}l.envelope={from:n.from,to:n.to},l.messageId=i,setImmediate(()=>this._release()),r(null,l)})}_release(){if(this.messages>=this.options.maxMessages){let e=new Error("Resource exhausted");e.code=Bu,this.connection.close(),this._fail(e);return}this.pool._checkRateLimit(()=>{this.available=!0,this._startIdleTimer(),this.emit("available")})}_startIdleTimer(){if(!(!this.options.idleTimeout||this.options.idleTimeout<0)){if(this._idleTimer&&typeof this._idleTimer.refresh=="function"){this._idleTimer.refresh();return}clearTimeout(this._idleTimer),this._idleTimer=setTimeout(()=>{this.available&&(this.logger.debug({tnx:"pool",cid:this.id},"Closing connection #%s after it was idle for %sms",this.id,this.options.idleTimeout),this.available=!1,this.connection.quit())},this.options.idleTimeout),typeof this._idleTimer.unref=="function"&&this._idleTimer.unref()}}_stopIdleTimer(){clearTimeout(this._idleTimer),this._idleTimer=!1}close(){this._connected=!1,this._stopIdleTimer(),this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};var Nm={126:{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},163:{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.com","fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["icloud.com","me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},MailSenpai:{description:"MailSenpai (SMTP Senpai, EU)",host:"relay.mailsenpai.com",port:2525,secure:!1},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},TurboSMTP:{description:"TurboSMTP",host:"pro.turbo-smtp.com",port:465,secure:!0},"TurboSMTP-EU":{description:"TurboSMTP (EU region)",host:"pro.eu.turbo-smtp.com",port:465,secure:!0},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}};var sd={};Object.keys(Nm).forEach(t=>{let e=Nm[t],r=YR(e);sd[ad(t)]=r,[].concat(e.aliases||[]).forEach(n=>{sd[ad(n)]=r}),[].concat(e.domains||[]).forEach(n=>{sd[ad(n)]=r})});function ad(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function YR(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}function ic(t){return t=ad(t.split("@").pop()),sd[t]||!1}var QR=50,ZR=2e3,Rm=class extends XR{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.options.maxRequeues=typeof this.options.maxRequeues=="number"?this.options.maxRequeues:5,this.options.idleTimeout=typeof this.options.idleTimeout=="number"?this.options.idleTimeout:240*1e3,this.logger=ft(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=Xe+"[client:"+Xe+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){setImmediate(()=>r(null,!1))}send(e,r){if(this._closed){let n=new Error("Connection pool was closed");return n.code=Hu,setImmediate(()=>r(n)),!1}return this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0}close(){let e,r=this._connections.length;if(this._closed=!0,this._clearRateLimit(),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(o){this.logger.error({err:o,tnx:"callback"},"Callback error: %s",o.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(o){this.logger.error({err:o,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,o.message)}e.queueEntry=!1}})}_createConnection(){let e=new As(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Bu?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{let r=0;e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?r=this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),r?setTimeout(()=>this._continueProcessing(),r):this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{let r=new Error("Reached maximum number of retries after connection was closed");r.code=Hu,e.queueEntry.callback(r)}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){let r=Math.min(QR*2**e.queueEntry.requeueAttempts,ZR);return e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1,r}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=new As(this).auth,o=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:o}),(s,a)=>{if(s)return n(s);let c=this.options;a&&a.connection&&(this.logger.info({tnx:"proxy",remoteAddress:a.connection.remoteAddress,remotePort:a.connection.remotePort,destHost:c.host||"",destPort:c.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",a.connection.remoteAddress,a.connection.remotePort,c.host||"",c.port||""),c=Object.assign(Or(!1,c),a));let l=new zi(c);l._connectStartedAt=o;let u=!1;l.once("error",f=>{if(!u)return u=!0,l.close(),n(f)}),l.once("end",()=>{if(!u)return u=!0,n(new Error("Connection closed"))});let p=()=>{if(!u)return u=!0,l.quit(),n(null,!0)};l.connect(f=>{if(!u){if(f)return u=!0,l.close(),n(f);if(i&&(l.allowsAuth||c.forceAuth))l.login(i,m=>{if(!u){if(m)return u=!0,l.close(),n(m);p()}});else if(!i&&l.allowsAuth&&c.forceAuth){let m=new Error("Authentication info was not provided");return m.code=Vu,u=!0,l.close(),n(m)}else p()}})}),r}},ZA=Rm;import{EventEmitter as e0}from"node:events";var Om=class extends e0{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.logger=ft(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Xe+"[client:"+Xe+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth&&this.auth.oauth2&&this.mailer&&(this.auth.oauth2.provisionCallback=this.mailer.get("oauth2_provision_cb")||this.auth.oauth2.provisionCallback),this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new od(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){let n=Date.now();this.getSocket(Object.assign({},this.options,{connectStartedAt:n}),(i,o)=>{if(i)return r(i);let s=!1,a=this.options;o&&o.connection&&(this.logger.info({tnx:"proxy",remoteAddress:o.connection.remoteAddress,remotePort:o.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",o.connection.remoteAddress,o.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),o));let c=new zi(a);c._connectStartedAt=n;let l,u=()=>{l&&l!==this.auth&&l.oauth2&&l.oauth2.removeAllListeners(),l=null};c.once("error",f=>{if(!s)return s=!0,u(),c.close(),r(f)});let p=()=>{let f=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(f.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(f.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(f.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),c.send(f,e.message.createReadStream(),(v,N)=>{if(!s){if(s=!0,u(),c.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);N.envelope={from:f.from,to:f.to},N.messageId=m;try{return r(null,N)}catch(S){this.logger.error({err:S,tnx:"callback"},"Callback error for %s: %s",m,S.message)}}})};c.connect(f=>{if(!s){if(f)return s=!0,c.close(),r(f);l=this.getAuth(e.data.auth),l&&(c.allowsAuth||a.forceAuth)?c.login(l,m=>{if(u(),!s){if(m)return s=!0,c.close(),r(m);p()}}):p()}})})}verify(e){let r;e||(r=new Promise((o,s)=>{e=Mt(o,s)}));let n=e,i=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:i}),(o,s)=>{if(o)return n(o);let a=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),s));let c=new zi(a);c._connectStartedAt=i;let l=!1,u,p=()=>{u&&u!==this.auth&&u.oauth2&&u.oauth2.removeAllListeners(),u=null};c.once("error",m=>{if(!l)return l=!0,p(),c.close(),n(m)}),c.once("end",()=>{if(!l)return l=!0,p(),n(new Error("Connection closed"))});let f=()=>{if(!l)return l=!0,p(),c.quit(),n(null,!0)};c.connect(m=>{if(!l){if(m)return l=!0,c.close(),n(m);if(u=this.getAuth({}),u&&(c.allowsAuth||a.forceAuth))c.login(u,E=>{if(p(),!l){if(E)return l=!0,c.close(),n(E);f()}});else if(!u&&c.allowsAuth&&a.forceAuth){let E=new Error("Authentication info was not provided");return E.code=Vu,l=!0,p(),c.close(),n(E)}else f()}})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}},eT=Om;import{spawn as t0}from"node:child_process";import{pipeline as r0}from"node:stream";var n0=1e3,km=class{constructor(e){e=e||{},this._spawn=t0,this.options=e,this.name="Sendmail",this.version=Xe,this.path="sendmail",this.args=!1,this.logger=ft(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args)),this.winbreak=["win","windows","dos",`\r
|
|
60
|
-
`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o;if([].concat(n.from||[]).concat(n.to||[]).some(u=>/^"?-/.test(u))){let u=new Error("Can not send mail. Invalid envelope addresses.");return u.code=ju,r(u)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=u=>{if(!o&&(o=!0,typeof r=="function"))return u?r(u):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(u){return this.logger.error({err:u,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",u.message),c(u)}if(l){let u,p=()=>!!u&&u.readableEnded,f=null,m=()=>{u&&!p()&&u.destroy()},E=R=>{m(),c(R)};l.on("error",R=>{this.logger.error({err:R,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,R.message),E(R)});let v=(R,M)=>{let K=null;if(R?K=new Error(R===127?"Sendmail command not found, process exited with code "+R:"Sendmail exited with code "+R):M?K=new Error("Sendmail was terminated by "+M):p()?f&&(K=f):K=new Error("Sendmail exited before the message was written"),!K)return c();K.code=K.code||ju,this.logger.error({err:K,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,K.message),E(K)};l.once("exit",v),l.once("close",v),l.stdin.on("error",R=>{if(this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,R.message),f)return;f=R,m();let M=setTimeout(()=>E(R),n0);l.once("exit",()=>clearTimeout(M))});let N=[].concat(n.to||[]);N.length>3&&N.push("...and "+N.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,N.join(", "));let S=e.message.createReadStream();u=S,this.options.newline&&(u=r0(S,this.winbreak?new kr:new
|
|
61
|
-
`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,o.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let s;try{if(s=e.message.createReadStream(),this.options.newline){let l=s;s=l.pipe(this.winbreak?new kr:new
|
|
60
|
+
`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o;if([].concat(n.from||[]).concat(n.to||[]).some(u=>/^"?-/.test(u))){let u=new Error("Can not send mail. Invalid envelope addresses.");return u.code=ju,r(u)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=u=>{if(!o&&(o=!0,typeof r=="function"))return u?r(u):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(u){return this.logger.error({err:u,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",u.message),c(u)}if(l){let u,p=()=>!!u&&u.readableEnded,f=null,m=()=>{u&&!p()&&u.destroy()},E=R=>{m(),c(R)};l.on("error",R=>{this.logger.error({err:R,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,R.message),E(R)});let v=(R,M)=>{let K=null;if(R?K=new Error(R===127?"Sendmail command not found, process exited with code "+R:"Sendmail exited with code "+R):M?K=new Error("Sendmail was terminated by "+M):p()?f&&(K=f):K=new Error("Sendmail exited before the message was written"),!K)return c();K.code=K.code||ju,this.logger.error({err:K,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,K.message),E(K)};l.once("exit",v),l.once("close",v),l.stdin.on("error",R=>{if(this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,R.message),f)return;f=R,m();let M=setTimeout(()=>E(R),n0);l.once("exit",()=>clearTimeout(M))});let N=[].concat(n.to||[]);N.length>3&&N.push("...and "+N.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,N.join(", "));let S=e.message.createReadStream();u=S,this.options.newline&&(u=r0(S,this.winbreak?new kr:new wn,()=>!1)),u.once("error",R=>{this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,R.message),l.kill("SIGINT"),c(R)}),u.pipe(l.stdin)}else{let u=new Error("sendmail was not found");return u.code=ju,c(u)}}},tT=km;var Cm=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
|
|
61
|
+
`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,o.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let s;try{if(s=e.message.createReadStream(),this.options.newline){let l=s;s=l.pipe(this.winbreak?new kr:new wn),l.once("error",u=>s.emit("error",u))}}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return s.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:s});let a=[],c=0;s.on("readable",()=>{let l;for(;(l=s.read())!==null;)a.push(l),c+=l.length}),s.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),s.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}},rT=Cm;var Dm=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,o.join(", ")),setImmediate(()=>{e.normalize((s,a)=>s?(this.logger.error({err:s,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,s.message),r(s)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}},nT=Dm;import i0 from"node:events";function Pm(t){return t&&typeof t=="object"&&!t.code&&(t.code=Qv),t}var Um=class extends i0{constructor(e){if(super(),!e||!e.SES||!e.SES.sesClient){let r=new Error("Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw r.code=Es,r}this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){if(this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"){this.ses.sesClient.config.region().then(r=>e(null,r),r=>e(r));return}return e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Qr("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.message.getEnvelope(),o=e.message.messageId(),s=[].concat(i.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:o},"Sending message %s to <%s>",o,s.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),u=l.pipe(new kr),p=[],f=0;u.on("readable",()=>{let m;for(;(m=u.read())!==null;)p.push(m),f+=m.length}),l.once("error",m=>u.emit("error",m)),u.once("error",m=>c(m)),u.once("end",()=>c(null,Buffer.concat(p,f)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:o},"Failed creating message for %s. %s",o,c.message),r(c);let u=et({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses);this.getRegion((p,f)=>{(p||!f)&&(f="us-east-1");let m;try{let E=new this.ses.SendEmailCommand(u);m=this.ses.sesClient.send(E)}catch(E){Pm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E));return}m.then(E=>{f==="us-east-1"&&(f="email");let v={envelope:{from:i.from,to:i.to},messageId:"<"+E.MessageId+(/@/.test(E.MessageId)?"":"@"+f+".amazonses.com")+">",response:E.MessageId,raw:l};setImmediate(()=>r(null,v))}).catch(E=>{Pm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E))})})}))}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?n(Pm(s)):n(null,!0),o={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
|
|
62
62
|
To: <invalid@invalid>\r
|
|
63
63
|
Subject: Invalid\r
|
|
64
64
|
\r
|
|
@@ -128,10 +128,10 @@ Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invali
|
|
|
128
128
|
</div>
|
|
129
129
|
</body>
|
|
130
130
|
</html>
|
|
131
|
-
`}};var oc=class t{static createDirectSmtp(e){return new cd(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var f0={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function sT(t={}){let e={...f0,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let o=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${o}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return d([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return d([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return d([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let o=i.split("@");if(o.length!==2)return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[s,a]=o;return!s||s.length>64?d([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?d([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):T()}}}function Lm(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function m0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Mm(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return m0(r)}var Km="email",ld={EMAIL_SYSTEM_NOT_AVAILABLE:_("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:_("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:_("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:_("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function h0(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function aT(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:Km,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return d(ld.EMAIL_SYSTEM_NOT_AVAILABLE());let o=await i.plugins.database.users.getById(n.userId),s=o.ok&&o.data?o.data.contactEmail:void 0;if(!s)return d(ld.RECIPIENT_NOT_FOUND());let a=Lm(e),c=await Mm(a);return(await i.plugins.emailSystem.send({to:s,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?d(ld.SEND_FAILED()):T({codeHash:c,maskedRecipient:h0(s)})},async issueChallenge(n){return T({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(Km)?[Km]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(ld.USE_CHALLENGE_CODE_HASH())}}}var cT="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function ud(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let o="";for(let s of i)o+=cT[s%cT.length];r.push(o)}return r}function E0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function dd(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return E0(r)}function y0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Hm(t,e){let r=await dd(t),n=null;for(let i of e)y0(r,i)&&(n=i);return n}var Fm="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function lT(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let o of e){let s=Fm.indexOf(o);if(s===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|s,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function uT(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=Fm[r>>>e&31];return e>0&&(n+=Fm[r<<5-e&31]),n}function pd(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),uT(e)}function g0(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function v0(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,g0(e))),o=i[i.length-1]&15;return(((i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255)%10**r).toString().padStart(r,"0")}async function fd(t,e,r=Date.now(),n={}){let i=n.period??30,o=n.digits??6,s=n.window??1,a=e.trim();if(a.length!==o||!/^\d+$/u.test(a))return!1;let c=lT(t),l=Math.floor(r/1e3/i),u=!1;for(let p=-s;p<=s;p++){let f=await v0(c,l+p,o);A0(f,a)&&(u=!0)}return u}function A0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function dT(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var Vm="totp",T0={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function pT(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:Vm,requiresServerDelivery:!1,generateSecret(){return pd()},generateBackupCodes(i){return ud(i||r)},async issueChallenge(i){return T({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(Vm)?[Vm]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(T0.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let o=pd(),s=ud(r),a=await Promise.all(s.map(p=>dd(p))),c=i.data.accountName??i.userId,l=dT({secretBase32:o,accountName:c,issuer:e});return T({secret:o,otpauthUri:l,backupCodes:s,credentialData:{secret:o,backupCodeHashes:a}})},async verifyWithCredentials(i){let o=i.credentialData,s=i.data.code?.trim();if(!s||!o?.secret)return T({verified:!1,data:{}});if(await fd(o.secret,s,Date.now(),{window:n}))return T({verified:!0,data:{}});let c=o.backupCodeHashes??[];if(c.length>0){let l=await Hm(s,c);if(l)return T({verified:!0,data:{usedBackupCodeHash:l}})}return T({verified:!1,data:{}})},async verifyCredential(i,o){let s=i.data.code,a=i.data.secret;if(!s||!a)return T({verified:!1,data:{}});let c=await fd(a,s,Date.now(),{window:n});return T({verified:c,data:{}})}}}var Bm={scopes:["email","public_profile"],apiVersion:"v18.0"};var Zr={INVALID_CODE:_("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:_("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function jm(t={}){let{scopes:e=Bm.scopes,apiVersion:r=Bm.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,o){let s=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...o&&{state:o}});return`${n.AUTHORIZATION}?${s.toString()}`},async exchangeCodeForToken(i,o){try{if(!i)return d(Zr.INVALID_CODE());let s=new URLSearchParams({client_id:o.clientId,client_secret:o.clientSecret,code:i,redirect_uri:o.redirectUri}),a=await fetch(`${n.TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return T({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(s){return console.error("Facebook token exchange error:",s),d(Zr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=["id","email","name","first_name","last_name","picture","locale"],s=new URLSearchParams({fields:o.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return T(l)}catch(o){return console.error("Facebook user profile error:",o),d(Zr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=`${t.appId}|${t.appSecret}`,s=new URLSearchParams({input_token:i,access_token:o}),a=await fetch(`${n.DEBUG_TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):d(Zr.INVALID_TOKEN()):d(Zr.INVALID_TOKEN())}catch(o){return console.error("Facebook token verification error:",o),d(Zr.INVALID_TOKEN())}}}}var md={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},Ji={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var tt={INVALID_CODE:_("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:_("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:_("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:_("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:_("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function _0(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function I0(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=_0(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function Gm(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=md.scopes,accessType:o=md.accessType,includeGrantedScopes:s=md.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let u=c?.clientId??e,p=c?.redirectUri??n;if(!u||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let f=new URLSearchParams({client_id:u,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:o,...l&&{state:l},...a&&{prompt:a},...s&&{include_granted_scopes:"true"}});return`${Ji.AUTHORIZATION}?${f.toString()}`},async exchangeCodeForToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r,f=l?.redirectUri??n;try{if(!c)return d(tt.INVALID_CODE());if(!u||!p||!f)return d(tt.MISSING_CONFIG());let m=new URLSearchParams({client_id:u,client_secret:p,code:c,redirect_uri:f,grant_type:"authorization_code"}),E=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google token exchange failed with status:",E.status),d(tt.TOKEN_EXCHANGE_FAILED());let v=await E.json();return T({accessToken:v.access_token,...v.refresh_token&&{refreshToken:v.refresh_token},...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google token exchange error:",m),d(tt.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(Ji.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),d(tt.USER_PROFILE_FAILED());let u=await l.json(),p={id:u.id,...u.email&&{email:u.email},...u.verified_email!==void 0&&{emailVerified:u.verified_email},...u.name&&{name:u.name},...u.given_name&&{givenName:u.given_name},...u.family_name&&{familyName:u.family_name},...u.picture&&{avatarUrl:u.picture},...u.locale&&{locale:u.locale},provider:"google"};return T(p)}catch(l){return console.error("Google user profile error:",l),d(tt.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(`${Ji.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return d(tt.INVALID_TOKEN());let u=await l.json();return parseInt(u.expires_in,10)<=0?d(tt.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),d(tt.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return d(tt.INVALID_CREDENTIAL());let l=await fetch(`${Ji.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),d(tt.INVALID_CREDENTIAL());let u=await l.json();if(!e)return d(tt.MISSING_CONFIG());if(u.aud!==e)return d(tt.INVALID_CREDENTIAL());if(parseInt(u.expires_in,10)<=0)return d(tt.INVALID_CREDENTIAL());let f=u.email_verified==="true",m=I0(c),E={id:u.sub,...u.email&&{email:u.email},...u.email&&{emailVerified:f},...m?.name&&{name:m.name},...m?.given_name&&{givenName:m.given_name},...m?.family_name&&{familyName:m.family_name},...m?.picture&&{avatarUrl:m.picture},...m?.locale&&{locale:m.locale},provider:"google"};return T(E)}catch(l){return console.error("Google credential verification error:",l),d(tt.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return d(tt.INVALID_TOKEN());if(!u||!p)return d(tt.MISSING_CONFIG());let f=new URLSearchParams({client_id:u,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),m=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!m.ok)return console.error("Google refresh token failed with status:",m.status),d(tt.REFRESH_TOKEN_FAILED());let E=await m.json();return T({accessToken:E.access_token,...E.expires_in&&{expiresIn:E.expires_in}})}catch(f){return console.error("Google refresh token error:",f),d(tt.REFRESH_TOKEN_FAILED())}}}}function fT(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function o(){if(n===0)return;let s=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(u=>u>s);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(o,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(s,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let u=Date.now(),p=u-l,f=e.get(s)??{hits:[]},m=f.hits.filter(E=>E>p);if(m.length>=c){let E=m[0]??u,v=Math.max(0,E+l-u);return f.hits=m,e.set(s,f),{allowed:!1,remaining:0,retryAfterMs:v,limit:c}}return m.push(u),f.hits=m,e.set(s,f),{allowed:!0,remaining:c-m.length,retryAfterMs:0,limit:c}},async reset(s){e.delete(s)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as XO,DynamoDBClient as QO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as ZO}from"@aws-sdk/lib-dynamodb";var te={DatabaseConnectionError:_("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:Q("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:Q("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:Q("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:Q("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:_("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:_("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:Q("INVALID_DATA","Invalid data: {reason}"),Timeout:_("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:_("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:Q("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:Q("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function re(t){return t.getTime()}function J(t){return new Date(t)}function mT(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function sc(t){return t instanceof Date?mT(t.getTime()):mT(t)}function $m(t){return t<Date.now()}function Cr(t){return t?re(t):null}function Kt(t){return t==null?null:J(t)}function Ht(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Pr(t){let e=[],r=[],n={},i={},o=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let u=`#${c}`;if(n[u]=c,l==null)r.push(u);else{let p=`:val${o}`;e.push(`${u} = ${p}`),i[p]=l,o++}}let s=[];return e.length>0&&s.push(`SET ${e.join(", ")}`),r.length>0&&s.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:s.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function qm(t="PK"){return`attribute_not_exists(${t})`}var Wm={USER:"USR"},ce={USER:`${Wm.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Be={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},Tt="#",U={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Be.AUTH,USER_PROFILE_SK:()=>Be.PROFILE,USER_MFA_SK:t=>`${Be.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Be.MFA}${t}${Tt}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Be.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Be.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Be.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Be.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Be.METADATA,SESSION_SK:()=>Be.METADATA,PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${Tt}${e}`,PROVIDER_METADATA_SK:()=>Be.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Be.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Be.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Be.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Be.PROVIDER.length),r=e.indexOf(Tt);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Be.MFA.length),r=e.indexOf(Tt);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Be.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${Wm.USER}${Tt}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${Tt}${e}${Tt}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${Tt}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${Tt}${e??"ROOT"}${Tt}${r}${Tt}${n}`},h={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},hd={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${Tt}${e}`,extractCreatedAt:t=>{let e=t.indexOf(Tt),r=e===-1?t:t.slice(0,e);return Number(r)}};var ue={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},We="S",x0={partitionKey:{name:"PK",type:We},sortKey:{name:"SK",type:We},ttlAttribute:"TTL",globalSecondaryIndexes:[{indexName:ue.ACTIVE_SESSIONS,partitionKey:{name:"activeSessionPk",type:We},sortKey:{name:"activeSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USER_SESSIONS,partitionKey:{name:"userSessionPk",type:We},sortKey:{name:"userSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USERS_BY_STATUS,partitionKey:{name:"userStatusPk",type:We},sortKey:{name:"userStatusSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["displayName","createdAt"]}},{indexName:ue.USER_PROVIDERS,partitionKey:{name:"userProviderPk",type:We},sortKey:{name:"userProviderSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userId","externalEmail","externalName","createdAt"]}},{indexName:ue.USER_IDENTITIES,partitionKey:{name:"identityUserPk",type:We},sortKey:{name:"identityUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["loginEnabled","verifiedAt","createdAt"]}},{indexName:ue.USER_CREDENTIALS,partitionKey:{name:"credentialUserPk",type:We},sortKey:{name:"credentialUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["revokedAt","createdAt"]}},{indexName:ue.USER_TENANTS,partitionKey:{name:"userTenantPk",type:We},sortKey:{name:"userTenantSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userStatus","role","roles","perm","authPerm","isOwner","createdAt","updatedAt"]}},{indexName:ue.TENANT_INVITES,partitionKey:{name:"inviteTenantPk",type:We},sortKey:{name:"inviteTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITE_TOKEN,partitionKey:{name:"inviteTokenGsi",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.INVITEE_EMAIL,partitionKey:{name:"inviteeEmailGsi",type:We},sortKey:{name:"inviteeEmailTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITEE_PHONE,partitionKey:{name:"inviteePhoneGsi",type:We},sortKey:{name:"inviteePhoneTenantSk",type:We},projection:{type:"ALL"}}]};import{DeleteCommand as J0,GetCommand as Y0,PutCommand as X0,UpdateCommand as RT}from"@aws-sdk/lib-dynamodb";var b0=BigInt(0),ac=BigInt(1),S0=BigInt(2),w0=BigInt(7),N0=BigInt(256),R0=BigInt(113),yT=[],gT=[],vT=[];for(let t=0,e=ac,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],yT.push(2*(5*n+r)),gT.push((t+1)*(t+2)/2%64);let i=b0;for(let o=0;o<7;o++)e=(e<<ac^(e>>w0)*R0)%N0,e&S0&&(i^=ac<<(ac<<BigInt(o))-ac);vT.push(i)}var AT=Ov(vT,!0),O0=AT[0],k0=AT[1],C0=(t,e,r)=>t<<r|e>>>32-r,P0=(t,e,r)=>e<<r|t>>>32-r,D0=(t,e,r)=>e<<r-32|t>>>64-r,U0=(t,e,r)=>t<<r-32|e>>>64-r,hT=(t,e,r)=>r>32?D0(t,e,r):C0(t,e,r),ET=(t,e,r)=>r>32?U0(t,e,r):P0(t,e,r),_s=new Uint32Array(10);function L0(t,e=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(t.length!==50)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(Ye(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');for(let r=24-e;r<24;r++){for(let o=0;o<10;o++)_s[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let s=(o+8)%10,a=(o+2)%10,c=_s[a],l=_s[a+1],u=hT(c,l,1)^_s[s],p=ET(c,l,1)^_s[s+1];for(let f=0;f<50;f+=10)t[o+f]^=u,t[o+f+1]^=p}let n=t[2],i=t[3];for(let o=0;o<24;o++){let s=gT[o],a=hT(n,i,s),c=ET(n,i,s),l=yT[o];n=t[l],i=t[l+1],t[l]=a,t[l+1]=c}for(let o=0;o<50;o+=10){let s=t[o],a=t[o+1],c=t[o+2],l=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&s,t[o+7]^=~t[o+9]&a,t[o+8]^=~s&c,t[o+9]^=~a&l}t[0]^=O0[r],t[1]^=k0[r]}Nt(_s)}var zm=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,o=24){if(Ye(e,"blockLen"),Ye(r,"suffix"),Ye(o,"rounds"),wv(i,"enableXOF"),this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=o,Ye(n,"outputLen"),!(0<e&&e<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=ji(this.state)}clone(){return this._cloneInto()}keccak(){fs(this.state32),L0(this.state32,this.rounds),fs(this.state32),this.posOut=0,this.pos=0}update(e){xn(this),In(e);let{blockLen:r,state:n,state32:i}=this,o=e.length,s=r%4===0&&e.byteOffset%4===0,a=r/4,c=s&&o>=r?ji(e):void 0;for(let l=0;l<o;){if(c!==void 0&&this.pos===0&&l%4===0&&o-l>=r){for(let p=0,f=l/4;p<a;p++)i[p]^=c[f+p];l+=r,this.pos=r,this.keccak();continue}let u=Math.min(r-this.pos,o-l);for(let p=0;p<u;p++)n[this.pos++]^=e[l++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){xn(this,!1),In(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,o=e.length;i<o;){this.posOut>=n&&this.keccak();let s=Math.min(n-this.posOut,o-i);e.set(r.subarray(this.posOut,this.posOut+s),i),this.posOut+=s,i+=s}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(e)}xof(e){return Ye(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(ds(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.length===this.outputLen?e:e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,Nt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:o,enableXOF:s}=this;return e||=new t(r,n,i,s,o),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=o,e.suffix=n,e.outputLen=i,e.enableXOF=s,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},M0=(t,e,r,n={})=>Ru(()=>new zm(e,t,r),n);var TT=M0(6,72,64,Ou(10));var K0=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,Jm=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",_T=Gt+"Number primitive has more than 15 significant digits: ",Dr=1e14,de=14,Ym=9007199254740991,Xm=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],pi=1e7,mt=1e9;function IT(t){var e,r,n,i=R.prototype={constructor:R,toString:null,valueOf:null},o=new R(1),s=20,a=4,c=-7,l=21,u=-1e7,p=1e7,f=!1,m=1,E=0,v={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},N="0123456789abcdefghijklmnopqrstuvwxyz",S=!0;function R(A,x){var b,g,I,O,P,k,C,D,L=this;if(!(L instanceof R))return new R(A,x);if(x==null){if(A&&A._isBigNumber===!0){L.s=A.s,!A.c||A.e>p?L.c=L.e=null:A.e<u?L.c=[L.e=0]:(L.e=A.e,L.c=A.c.slice());return}if((k=typeof A=="number")&&A*0==0){if(L.s=1/A<0?(A=-A,-1):1,A===~~A){for(O=0,P=A;P>=10;P/=10,O++);O>p?L.c=L.e=null:(L.e=O,L.c=[A]);return}D=String(A)}else{if(!K0.test(D=String(A)))return n(L,D,k);L.s=D.charCodeAt(0)==45?(D=D.slice(1),-1):1}(O=D.indexOf("."))>-1&&(D=D.replace(".","")),(P=D.search(/e/i))>0?(O<0&&(O=P),O+=+D.slice(P+1),D=D.substring(0,P)):O<0&&(O=D.length)}else{if(ze(x,2,N.length,"Base"),x==10&&S)return L=new R(A),V(L,s+L.e+1,a);if(D=String(A),k=typeof A=="number"){if(A*0!=0)return n(L,D,k,x);if(L.s=1/A<0?(D=D.slice(1),-1):1,R.DEBUG&&D.replace(/^0\.0*|\./,"").length>15)throw Error(_T+A)}else L.s=D.charCodeAt(0)===45?(D=D.slice(1),-1):1;for(b=N.slice(0,x),O=P=0,C=D.length;P<C;P++)if(b.indexOf(g=D.charAt(P))<0){if(g=="."){if(P>O){O=C;continue}}else if(!I&&(D==D.toUpperCase()&&(D=D.toLowerCase())||D==D.toLowerCase()&&(D=D.toUpperCase()))){I=!0,P=-1,O=0;continue}return n(L,String(A),k,x)}k=!1,D=r(D,x,10,L.s),(O=D.indexOf("."))>-1?D=D.replace(".",""):O=D.length}for(P=0;D.charCodeAt(P)===48;P++);for(C=D.length;D.charCodeAt(--C)===48;);if(D=D.slice(P,++C)){if(C-=P,k&&R.DEBUG&&C>15&&(A>Ym||A!==pr(A)))throw Error(_T+L.s*A);if((O=O-P-1)>p)L.c=L.e=null;else if(O<u)L.c=[L.e=0];else{if(L.e=O,L.c=[],P=(O+1)%de,O<0&&(P+=de),P<C){for(P&&L.c.push(+D.slice(0,P)),C-=de;P<C;)L.c.push(+D.slice(P,P+=de));P=de-(D=D.slice(P)).length}else P-=C;for(;P--;D+="0");L.c.push(+D)}}else L.c=[L.e=0]}R.clone=IT,R.ROUND_UP=0,R.ROUND_DOWN=1,R.ROUND_CEIL=2,R.ROUND_FLOOR=3,R.ROUND_HALF_UP=4,R.ROUND_HALF_DOWN=5,R.ROUND_HALF_EVEN=6,R.ROUND_HALF_CEIL=7,R.ROUND_HALF_FLOOR=8,R.EUCLID=9,R.config=R.set=function(A){var x,b;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(b=A[x],ze(b,0,mt,x),s=b),A.hasOwnProperty(x="ROUNDING_MODE")&&(b=A[x],ze(b,0,8,x),a=b),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(b=A[x],b&&b.pop?(ze(b[0],-mt,0,x),ze(b[1],0,mt,x),c=b[0],l=b[1]):(ze(b,-mt,mt,x),c=-(l=b<0?-b:b))),A.hasOwnProperty(x="RANGE"))if(b=A[x],b&&b.pop)ze(b[0],-mt,-1,x),ze(b[1],1,mt,x),u=b[0],p=b[1];else if(ze(b,-mt,mt,x),b)u=-(p=b<0?-b:b);else throw Error(Gt+x+" cannot be zero: "+b);if(A.hasOwnProperty(x="CRYPTO"))if(b=A[x],b===!!b)if(b)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))f=b;else throw f=!b,Error(Gt+"crypto unavailable");else f=b;else throw Error(Gt+x+" not true or false: "+b);if(A.hasOwnProperty(x="MODULO_MODE")&&(b=A[x],ze(b,0,9,x),m=b),A.hasOwnProperty(x="POW_PRECISION")&&(b=A[x],ze(b,0,mt,x),E=b),A.hasOwnProperty(x="FORMAT"))if(b=A[x],typeof b=="object")v=b;else throw Error(Gt+x+" not an object: "+b);if(A.hasOwnProperty(x="ALPHABET"))if(b=A[x],typeof b=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(b))S=b.slice(0,10)=="0123456789",N=b;else throw Error(Gt+x+" invalid: "+b)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:s,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[u,p],CRYPTO:f,MODULO_MODE:m,POW_PRECISION:E,FORMAT:v,ALPHABET:N}},R.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!R.DEBUG)return!0;var x,b,g=A.c,I=A.e,O=A.s;e:if({}.toString.call(g)=="[object Array]"){if((O===1||O===-1)&&I>=-mt&&I<=mt&&I===pr(I)){if(g[0]===0){if(I===0&&g.length===1)return!0;break e}if(x=(I+1)%de,x<1&&(x+=de),String(g[0]).length==x){for(x=0;x<g.length;x++)if(b=g[x],b<0||b>=Dr||b!==pr(b))break e;if(b!==0)return!0}}}else if(g===null&&I===null&&(O===null||O===1||O===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},R.maximum=R.max=function(){return K(arguments,-1)},R.minimum=R.min=function(){return K(arguments,1)},R.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(b){var g,I,O,P,k,C=0,D=[],L=new R(o);if(b==null?b=s:ze(b,0,mt),P=Jm(b/de),f)if(crypto.getRandomValues){for(g=crypto.getRandomValues(new Uint32Array(P*=2));C<P;)k=g[C]*131072+(g[C+1]>>>11),k>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),g[C]=I[0],g[C+1]=I[1]):(D.push(k%1e14),C+=2);C=P/2}else if(crypto.randomBytes){for(g=crypto.randomBytes(P*=7);C<P;)k=(g[C]&31)*281474976710656+g[C+1]*1099511627776+g[C+2]*4294967296+g[C+3]*16777216+(g[C+4]<<16)+(g[C+5]<<8)+g[C+6],k>=9e15?crypto.randomBytes(7).copy(g,C):(D.push(k%1e14),C+=7);C=P/7}else throw f=!1,Error(Gt+"crypto unavailable");if(!f)for(;C<P;)k=x(),k<9e15&&(D[C++]=k%1e14);for(P=D[--C],b%=de,P&&b&&(k=Xm[de-b],D[C]=pr(P/k)*k);D[C]===0;D.pop(),C--);if(C<0)D=[O=0];else{for(O=-1;D[0]===0;D.splice(0,1),O-=de);for(C=1,k=D[0];k>=10;k/=10,C++);C<de&&(O-=de-C)}return L.e=O,L.c=D,L}})(),R.sum=function(){for(var A=1,x=arguments,b=new R(x[0]);A<x.length;)b=b.plus(x[A++]);return b},r=(function(){var A="0123456789";function x(b,g,I,O){for(var P,k=[0],C,D=0,L=b.length;D<L;){for(C=k.length;C--;k[C]*=g);for(k[0]+=O.indexOf(b.charAt(D++)),P=0;P<k.length;P++)k[P]>I-1&&(k[P+1]==null&&(k[P+1]=0),k[P+1]+=k[P]/I|0,k[P]%=I)}return k.reverse()}return function(b,g,I,O,P){var k,C,D,L,H,z,Y,pe,Oe=b.indexOf("."),Fe=s,me=a;for(Oe>=0&&(L=E,E=0,b=b.replace(".",""),pe=new R(g),z=pe.pow(b.length-Oe),E=L,pe.c=x(wn(dr(z.c),z.e,"0"),10,I,A),pe.e=pe.c.length),Y=x(b,g,I,P?(k=N,A):(k=A,N)),D=L=Y.length;Y[--L]==0;Y.pop());if(!Y[0])return k.charAt(0);if(Oe<0?--D:(z.c=Y,z.e=D,z.s=O,z=e(z,pe,Fe,me,I),Y=z.c,H=z.r,D=z.e),C=D+Fe+1,Oe=Y[C],L=I/2,H=H||C<0||Y[C+1]!=null,H=me<4?(Oe!=null||H)&&(me==0||me==(z.s<0?3:2)):Oe>L||Oe==L&&(me==4||H||me==6&&Y[C-1]&1||me==(z.s<0?8:7)),C<1||!Y[0])b=H?wn(k.charAt(1),-Fe,k.charAt(0)):k.charAt(0);else{if(Y.length=C,H)for(--I;++Y[--C]>I;)Y[C]=0,C||(++D,Y=[1].concat(Y));for(L=Y.length;!Y[--L];);for(Oe=0,b="";Oe<=L;b+=k.charAt(Y[Oe++]));b=wn(b,D,k.charAt(0))}return b}})(),e=(function(){function A(g,I,O){var P,k,C,D,L=0,H=g.length,z=I%pi,Y=I/pi|0;for(g=g.slice();H--;)C=g[H]%pi,D=g[H]/pi|0,P=Y*C+D*z,k=z*C+P%pi*pi+L,L=(k/O|0)+(P/pi|0)+Y*D,g[H]=k%O;return L&&(g=[L].concat(g)),g}function x(g,I,O,P){var k,C;if(O!=P)C=O>P?1:-1;else for(k=C=0;k<O;k++)if(g[k]!=I[k]){C=g[k]>I[k]?1:-1;break}return C}function b(g,I,O,P){for(var k=0;O--;)g[O]-=k,k=g[O]<I[O]?1:0,g[O]=k*P+g[O]-I[O];for(;!g[0]&&g.length>1;g.splice(0,1));}return function(g,I,O,P,k){var C,D,L,H,z,Y,pe,Oe,Fe,me,we,st,Zi,kn,eo,_t,yi,It=g.s==I.s?1:-1,Qe=g.c,Ke=I.c;if(!Qe||!Qe[0]||!Ke||!Ke[0])return new R(!g.s||!I.s||(Qe?Ke&&Qe[0]==Ke[0]:!Ke)?NaN:Qe&&Qe[0]==0||!Ke?It*0:It/0);for(Oe=new R(It),Fe=Oe.c=[],D=g.e-I.e,It=O+D+1,k||(k=Dr,D=fr(g.e/de)-fr(I.e/de),It=It/de|0),L=0;Ke[L]==(Qe[L]||0);L++);if(Ke[L]>(Qe[L]||0)&&D--,It<0)Fe.push(1),H=!0;else{for(kn=Qe.length,_t=Ke.length,L=0,It+=2,z=pr(k/(Ke[0]+1)),z>1&&(Ke=A(Ke,z,k),Qe=A(Qe,z,k),_t=Ke.length,kn=Qe.length),Zi=_t,me=Qe.slice(0,_t),we=me.length;we<_t;me[we++]=0);yi=Ke.slice(),yi=[0].concat(yi),eo=Ke[0],Ke[1]>=k/2&&eo++;do{if(z=0,C=x(Ke,me,_t,we),C<0){if(st=me[0],_t!=we&&(st=st*k+(me[1]||0)),z=pr(st/eo),z>1)for(z>=k&&(z=k-1),Y=A(Ke,z,k),pe=Y.length,we=me.length;x(Y,me,pe,we)==1;)z--,b(Y,_t<pe?yi:Ke,pe,k),pe=Y.length,C=1;else z==0&&(C=z=1),Y=Ke.slice(),pe=Y.length;if(pe<we&&(Y=[0].concat(Y)),b(me,Y,we,k),we=me.length,C==-1)for(;x(Ke,me,_t,we)<1;)z++,b(me,_t<we?yi:Ke,we,k),we=me.length}else C===0&&(z++,me=[0]);Fe[L++]=z,me[0]?me[we++]=Qe[Zi]||0:(me=[Qe[Zi]],we=1)}while((Zi++<kn||me[0]!=null)&&It--);H=me[0]!=null,Fe[0]||Fe.splice(0,1)}if(k==Dr){for(L=1,It=Fe[0];It>=10;It/=10,L++);V(Oe,O+(Oe.e=L+D*de-1)+1,P,H)}else Oe.e=D,Oe.r=+H;return Oe}})();function M(A,x,b,g){var I,O,P,k,C;if(b==null?b=a:ze(b,0,8),!A.c)return A.toString();if(I=A.c[0],P=A.e,x==null)C=dr(A.c),C=g==1||g==2&&(P<=c||P>=l)?yd(C,P):wn(C,P,"0");else if(A=V(new R(A),x,b),O=A.e,C=dr(A.c),k=C.length,g==1||g==2&&(x<=O||O<=c)){for(;k<x;C+="0",k++);C=yd(C,O)}else if(x-=P+(g===2&&O>P),C=wn(C,O,"0"),O+1>k){if(--x>0)for(C+=".";x--;C+="0");}else if(x+=O-k,x>0)for(O+1==k&&(C+=".");x--;C+="0");return A.s<0&&I?"-"+C:C}function K(A,x){for(var b,g,I=1,O=new R(A[0]);I<A.length;I++)g=new R(A[I]),(!g.s||(b=Yi(O,g))===x||b===0&&O.s===x)&&(O=g);return O}function B(A,x,b){for(var g=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,g++);return(b=g+b*de-1)>p?A.c=A.e=null:b<u?A.c=[A.e=0]:(A.e=b,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,b=/^\.([^.]+)$/,g=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(O,P,k,C){var D,L=k?P:P.replace(I,"");if(g.test(L))O.s=isNaN(L)?null:L<0?-1:1;else{if(!k&&(L=L.replace(A,function(H,z,Y){return D=(Y=Y.toLowerCase())=="x"?16:Y=="b"?2:8,!C||C==D?z:H}),C&&(D=C,L=L.replace(x,"$1").replace(b,"0.$1")),P!=L))return new R(L,D);if(R.DEBUG)throw Error(Gt+"Not a"+(C?" base "+C:"")+" number: "+P);O.s=null}O.c=O.e=null}})();function V(A,x,b,g){var I,O,P,k,C,D,L,H=A.c,z=Xm;if(H){e:{for(I=1,k=H[0];k>=10;k/=10,I++);if(O=x-I,O<0)O+=de,P=x,C=H[D=0],L=pr(C/z[I-P-1]%10);else if(D=Jm((O+1)/de),D>=H.length)if(g){for(;H.length<=D;H.push(0));C=L=0,I=1,O%=de,P=O-de+1}else break e;else{for(C=k=H[D],I=1;k>=10;k/=10,I++);O%=de,P=O-de+I,L=P<0?0:pr(C/z[I-P-1]%10)}if(g=g||x<0||H[D+1]!=null||(P<0?C:C%z[I-P-1]),g=b<4?(L||g)&&(b==0||b==(A.s<0?3:2)):L>5||L==5&&(b==4||g||b==6&&(O>0?P>0?C/z[I-P]:0:H[D-1])%10&1||b==(A.s<0?8:7)),x<1||!H[0])return H.length=0,g?(x-=A.e+1,H[0]=z[(de-x%de)%de],A.e=-x||0):H[0]=A.e=0,A;if(O==0?(H.length=D,k=1,D--):(H.length=D+1,k=z[de-O],H[D]=P>0?pr(C/z[I-P]%z[P])*k:0),g)for(;;)if(D==0){for(O=1,P=H[0];P>=10;P/=10,O++);for(P=H[0]+=k,k=1;P>=10;P/=10,k++);O!=k&&(A.e++,H[0]==Dr&&(H[0]=1));break}else{if(H[D]+=k,H[D]!=Dr)break;H[D--]=0,k=1}for(O=H.length;H[--O]===0;H.pop());}A.e>p?A.c=A.e=null:A.e<u&&(A.c=[A.e=0])}return A}function $(A){var x,b=A.e;return b===null?A.toString():(x=dr(A.c),x=b<=c||b>=l?yd(x,b):wn(x,b,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new R(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Yi(this,new R(A,x))},i.decimalPlaces=i.dp=function(A,x){var b,g,I,O=this;if(A!=null)return ze(A,0,mt),x==null?x=a:ze(x,0,8),V(new R(O),A+O.e+1,x);if(!(b=O.c))return null;if(g=((I=b.length-1)-fr(this.e/de))*de,I=b[I])for(;I%10==0;I/=10,g--);return g<0&&(g=0),g},i.dividedBy=i.div=function(A,x){return e(this,new R(A,x),s,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new R(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var b,g,I,O,P,k,C,D,L,H=this;if(A=new R(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+$(A));if(x!=null&&(x=new R(x)),k=A.e>14,!H.c||!H.c[0]||H.c[0]==1&&!H.e&&H.c.length==1||!A.c||!A.c[0])return L=new R(Math.pow(+$(H),k?A.s*(2-Ed(A)):+$(A))),x?L.mod(x):L;if(C=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new R(NaN);g=!C&&H.isInteger()&&x.isInteger(),g&&(H=H.mod(x))}else{if(A.e>9&&(H.e>0||H.e<-1||(H.e==0?H.c[0]>1||k&&H.c[1]>=24e7:H.c[0]<8e13||k&&H.c[0]<=9999975e7)))return O=H.s<0&&Ed(A)?-0:0,H.e>-1&&(O=1/O),new R(C?1/O:O);E&&(O=Jm(E/de+2))}for(k?(b=new R(.5),C&&(A.s=1),D=Ed(A)):(I=Math.abs(+$(A)),D=I%2),L=new R(o);;){if(D){if(L=L.times(H),!L.c)break;O?L.c.length>O&&(L.c.length=O):g&&(L=L.mod(x))}if(I){if(I=pr(I/2),I===0)break;D=I%2}else if(A=A.times(b),V(A,A.e+1,1),A.e>14)D=Ed(A);else{if(I=+$(A),I===0)break;D=I%2}H=H.times(H),O?H.c&&H.c.length>O&&(H.c.length=O):g&&(H=H.mod(x))}return g?L:(C&&(L=o.div(L)),x?L.mod(x):O?V(L,E,a,P):L)},i.integerValue=function(A){var x=new R(this);return A==null?A=a:ze(A,0,8),V(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Yi(this,new R(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Yi(this,new R(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Yi(this,new R(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/de)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Yi(this,new R(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Yi(this,new R(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var b,g,I,O,P=this,k=P.s;if(A=new R(A,x),x=A.s,!k||!x)return new R(NaN);if(k!=x)return A.s=-x,P.plus(A);var C=P.e/de,D=A.e/de,L=P.c,H=A.c;if(!C||!D){if(!L||!H)return L?(A.s=-x,A):new R(H?P:NaN);if(!L[0]||!H[0])return H[0]?(A.s=-x,A):new R(L[0]?P:a==3?-0:0)}if(C=fr(C),D=fr(D),L=L.slice(),k=C-D){for((O=k<0)?(k=-k,I=L):(D=C,I=H),I.reverse(),x=k;x--;I.push(0));I.reverse()}else for(g=(O=(k=L.length)<(x=H.length))?k:x,k=x=0;x<g;x++)if(L[x]!=H[x]){O=L[x]<H[x];break}if(O&&(I=L,L=H,H=I,A.s=-A.s),x=(g=H.length)-(b=L.length),x>0)for(;x--;L[b++]=0);for(x=Dr-1;g>k;){if(L[--g]<H[g]){for(b=g;b&&!L[--b];L[b]=x);--L[b],L[g]+=Dr}L[g]-=H[g]}for(;L[0]==0;L.splice(0,1),--D);return L[0]?B(A,L,D):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var b,g,I=this;return A=new R(A,x),!I.c||!A.s||A.c&&!A.c[0]?new R(NaN):!A.c||I.c&&!I.c[0]?new R(I):(m==9?(g=A.s,A.s=1,b=e(I,A,0,3),A.s=g,b.s*=g):b=e(I,A,0,m),A=I.minus(b.times(A)),!A.c[0]&&m==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var b,g,I,O,P,k,C,D,L,H,z,Y,pe,Oe,Fe,me=this,we=me.c,st=(A=new R(A,x)).c;if(!we||!st||!we[0]||!st[0])return!me.s||!A.s||we&&!we[0]&&!st||st&&!st[0]&&!we?A.c=A.e=A.s=null:(A.s*=me.s,!we||!st?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(g=fr(me.e/de)+fr(A.e/de),A.s*=me.s,C=we.length,H=st.length,C<H&&(pe=we,we=st,st=pe,I=C,C=H,H=I),I=C+H,pe=[];I--;pe.push(0));for(Oe=Dr,Fe=pi,I=H;--I>=0;){for(b=0,z=st[I]%Fe,Y=st[I]/Fe|0,P=C,O=I+P;O>I;)D=we[--P]%Fe,L=we[P]/Fe|0,k=Y*D+L*z,D=z*D+k%Fe*Fe+pe[O]+b,b=(D/Oe|0)+(k/Fe|0)+Y*L,pe[O--]=D%Oe;pe[O]=b}return b?++g:pe.splice(0,1),B(A,pe,g)},i.negated=function(){var A=new R(this);return A.s=-A.s||null,A},i.plus=function(A,x){var b,g=this,I=g.s;if(A=new R(A,x),x=A.s,!I||!x)return new R(NaN);if(I!=x)return A.s=-x,g.minus(A);var O=g.e/de,P=A.e/de,k=g.c,C=A.c;if(!O||!P){if(!k||!C)return new R(I/0);if(!k[0]||!C[0])return C[0]?A:new R(k[0]?g:I*0)}if(O=fr(O),P=fr(P),k=k.slice(),I=O-P){for(I>0?(P=O,b=C):(I=-I,b=k),b.reverse();I--;b.push(0));b.reverse()}for(I=k.length,x=C.length,I-x<0&&(b=C,C=k,k=b,x=I),I=0;x;)I=(k[--x]=k[x]+C[x]+I)/Dr|0,k[x]=Dr===k[x]?0:k[x]%Dr;return I&&(k=[I].concat(k),++P),B(A,k,P)},i.precision=i.sd=function(A,x){var b,g,I,O=this;if(A!=null&&A!==!!A)return ze(A,1,mt),x==null?x=a:ze(x,0,8),V(new R(O),A,x);if(!(b=O.c))return null;if(I=b.length-1,g=I*de+1,I=b[I]){for(;I%10==0;I/=10,g--);for(I=b[0];I>=10;I/=10,g++);}return A&&O.e+1>g&&(g=O.e+1),g},i.shiftedBy=function(A){return ze(A,-Ym,Ym),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,b,g,I,O=this,P=O.c,k=O.s,C=O.e,D=s+4,L=new R("0.5");if(k!==1||!P||!P[0])return new R(!k||k<0&&(!P||P[0])?NaN:P?O:1/0);if(k=Math.sqrt(+$(O)),k==0||k==1/0?(x=dr(P),(x.length+C)%2==0&&(x+="0"),k=Math.sqrt(+x),C=fr((C+1)/2)-(C<0||C%2),k==1/0?x="5e"+C:(x=k.toExponential(),x=x.slice(0,x.indexOf("e")+1)+C),b=new R(x)):b=new R(k+""),b.c[0]){for(C=b.e,k=C+D,k<3&&(k=0);;)if(I=b,b=L.times(I.plus(e(O,I,D,1))),dr(I.c).slice(0,k)===(x=dr(b.c)).slice(0,k))if(b.e<C&&--k,x=x.slice(k-3,k+1),x=="9999"||!g&&x=="4999"){if(!g&&(V(I,I.e+s+2,0),I.times(I).eq(O))){b=I;break}D+=4,k+=4,g=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&(V(b,b.e+s+2,1),A=!b.times(b).eq(O));break}}return V(b,b.e+s+1,a,A)},i.toExponential=function(A,x){return A!=null&&(ze(A,0,mt),A++),M(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(ze(A,0,mt),A=A+this.e+1),M(this,A,x)},i.toFormat=function(A,x,b){var g,I=this;if(b==null)A!=null&&x&&typeof x=="object"?(b=x,x=null):A&&typeof A=="object"?(b=A,A=x=null):b=v;else if(typeof b!="object")throw Error(Gt+"Argument not an object: "+b);if(g=I.toFixed(A,x),I.c){var O,P=g.split("."),k=+b.groupSize,C=+b.secondaryGroupSize,D=b.groupSeparator||"",L=P[0],H=P[1],z=I.s<0,Y=z?L.slice(1):L,pe=Y.length;if(C&&(O=k,k=C,C=O,pe-=O),k>0&&pe>0){for(O=pe%k||k,L=Y.substr(0,O);O<pe;O+=k)L+=D+Y.substr(O,k);C>0&&(L+=D+Y.slice(O)),z&&(L="-"+L)}g=H?L+(b.decimalSeparator||"")+((C=+b.fractionGroupSize)?H.replace(new RegExp("\\d{"+C+"}\\B","g"),"$&"+(b.fractionGroupSeparator||"")):H):L}return(b.prefix||"")+g+(b.suffix||"")},i.toFraction=function(A){var x,b,g,I,O,P,k,C,D,L,H,z,Y=this,pe=Y.c;if(A!=null&&(k=new R(A),!k.isInteger()&&(k.c||k.s!==1)||k.lt(o)))throw Error(Gt+"Argument "+(k.isInteger()?"out of range: ":"not an integer: ")+$(k));if(!pe)return new R(Y);for(x=new R(o),D=b=new R(o),g=C=new R(o),z=dr(pe),O=x.e=z.length-Y.e-1,x.c[0]=Xm[(P=O%de)<0?de+P:P],A=!A||k.comparedTo(x)>0?O>0?x:D:k,P=p,p=1/0,k=new R(z),C.c[0]=0;L=e(k,x,0,1),I=b.plus(L.times(g)),I.comparedTo(A)!=1;)b=g,g=I,D=C.plus(L.times(I=D)),C=I,x=k.minus(L.times(I=x)),k=I;return I=e(A.minus(b),g,0,1),C=C.plus(I.times(D)),b=b.plus(I.times(g)),C.s=D.s=Y.s,O=O*2,H=e(D,g,O,a).minus(Y).abs().comparedTo(e(C,b,O,a).minus(Y).abs())<1?[D,g]:[C,b],p=P,H},i.toNumber=function(){return+$(this)},i.toPrecision=function(A,x){return A!=null&&ze(A,1,mt),M(this,A,x,2)},i.toString=function(A){var x,b=this,g=b.s,I=b.e;return I===null?g?(x="Infinity",g<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?yd(dr(b.c),I):wn(dr(b.c),I,"0"):A===10&&S?(b=V(new R(b),s+I+1,a),x=wn(dr(b.c),b.e,"0")):(ze(A,2,N.length,"Base"),x=r(wn(dr(b.c),I,"0"),10,A,g,!0)),g<0&&b.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return $(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&R.set(t),R}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,o=t[0]+"";n<i;){for(e=t[n++]+"",r=de-e.length;r--;e="0"+e);o+=e}for(i=o.length;o.charCodeAt(--i)===48;);return o.slice(0,i+1||1)}function Yi(t,e){var r,n,i=t.c,o=e.c,s=t.s,a=e.s,c=t.e,l=e.e;if(!s||!a)return null;if(r=i&&!i[0],n=o&&!o[0],r||n)return r?n?0:-a:s;if(s!=a)return s;if(r=s<0,n=c==l,!i||!o)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=o.length)?c:l,s=0;s<a;s++)if(i[s]!=o[s])return i[s]>o[s]^r?1:-1;return c==l?0:c>l^r?1:-1}function ze(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function Ed(t){var e=t.c.length-1;return fr(t.e/de)==e&&t.c[e]%2!=0}function yd(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function wn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var H0=IT(),xT=H0;var F0=24,cc=32,V0=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,Zm=V0(),Qm=(t=4,e=Zm)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function B0(t){let e=new xT(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var ST=(t="")=>{let e=new TextEncoder;return B0(TT(e.encode(t))).toString(36).slice(1)},bT=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),j0=t=>bT[Math.floor(t()*bT.length)],G0=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=Zm}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Qm(cc,e):Qm(cc,e);return ST(n).substring(0,cc)},$0=t=>()=>t++,q0=476782367,wT=({random:t=Zm,counter:e=$0(Math.floor(t()*q0)),length:r=F0,fingerprint:n=G0({random:t})}={})=>{if(r>cc)throw new Error(`Length must be between 2 and ${cc}. Received: ${r}`);return function(){let o=j0(t),s=Date.now().toString(36),a=e().toString(36),c=Qm(r,t),l=`${s+c+a+n}`;return`${o+ST(l).substring(1,r)}`}},ht=W0(wT);function W0(t){let e;return()=>(e||(e=t()),e())}function Is(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Ce(t){return Is(t)==="ConditionalCheckFailedException"}function z0(t){let e=Is(t),r=t instanceof Error?t.message:typeof t=="string"?t:void 0;return[e,r].filter(Boolean).join(": ")||String(t)}function NT(t,e){console.error(`[repo-plugin-dynamodb] ${t} failed \u2014 ${z0(e)}`)}function G(t,e){return NT(t,e),te.DatabaseQueryError({query:t})}function Rt(t,e){return NT(t,e),te.UnknownError({message:t})}var lc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return ht()}async get(e){try{let r=await this.docClient.send(new Y0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()}}));if(!r.Item)return T(null);let n=this.unmarshall(r.Item);return $m(re(n.expiresAt))?T(null):T(n)}catch(r){return d(G("get challenge",r))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:J(r)},o=re(e.expiresAt),s=Math.floor((o+this.ttlGracePeriod)/1e3);return await this.docClient.send(new X0({TableName:this.tableName,Item:this.marshall(i,s)})),T(i)}catch(r){return d(G("create challenge",r))}}async update(e,r){try{let n=[],i={},o={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=h.METHOD,o[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=h.PHASE,o[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=h.CODE_HASH,o[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=h.CHALLENGE_STATUS,o[":challengeStatus"]=r.status),n.length===0?T(void 0):(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T(void 0))}catch(n){return d(G("update challenge",n))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let s=(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":h.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[h.ATTEMPTS]??0;return T(s)}catch(o){return Ce(o)?d(te.AttemptsExceeded()):d(G("increment challenge attempts",o))}}async remove(e){try{return await this.docClient.send(new J0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":h.PK}})),T(void 0)}catch(r){return Ce(r)?T(void 0):d(G("remove challenge",r))}}marshall(e,r){let n={[h.PK]:U.CHALLENGE_PK(e.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:e.userId,[h.PURPOSE]:e.purpose,[h.CHALLENGE_STATUS]:e.status,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.TTL]:r};return e.tenantId&&(n[h.TENANT_ID]=e.tenantId),e.phase&&(n[h.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[h.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[h.METHOD]=e.method),e.codeHash&&(n[h.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[h.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[h.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[h.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[h.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[h.COUNTRY]=e.country),e.city&&(n[h.CITY]=e.city),e.metadata&&(n[h.METADATA]=e.metadata),e.flowKey&&(n[h.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[h.PK]),userId:e[h.USER_ID],purpose:e[h.PURPOSE],status:e[h.CHALLENGE_STATUS],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT])};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.PHASE]&&(n.phase=e[h.PHASE]),e[h.ALLOWED_METHODS]&&(n.allowedMethods=e[h.ALLOWED_METHODS]),e[h.METHOD]&&(n.method=e[h.METHOD]),e[h.CODE_HASH]&&(n.codeHash=e[h.CODE_HASH]),e[h.ATTEMPTS]!==void 0&&(n.attempts=e[h.ATTEMPTS]),e[h.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[h.MAX_ATTEMPTS]),e[h.IDENTITY_TYPE]&&(n.identityType=e[h.IDENTITY_TYPE]),e[h.IDENTITY_VALUE]&&(n.identityValue=e[h.IDENTITY_VALUE]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.FLOW_KEY]&&(n.flowKey=e[h.FLOW_KEY]),n}};import{BatchGetCommand as Q0,DeleteCommand as Z0,GetCommand as eO,PutCommand as tO,QueryCommand as gd,UpdateCommand as rO}from"@aws-sdk/lib-dynamodb";var uc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return ht()}async get(e){try{let r=await this.docClient.send(new eO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get credential",r))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return T(null);let i=n.Items[0];if(!i)return T(null);let o=le.credentialId(i[h.PK]);return this.get(o)}catch(n){return d(G("get credential by user and type",n))}}async getByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(s=>le.credentialId(s[h.PK])),i=await this.batchGet(n);if(i.ok===!1)return d(i.errors,i.meta);if(!i.data)return T([]);let o=i.data.filter(s=>s!==null);return T(o)}catch(r){return d(G("get credentials by user",r))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new tO({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(i)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"credential"})):d(G("create credential",r))}}async update(e,r){try{let n=ae(),i=[],o={},s={};return i.push(`#${h.UPDATED_AT} = :updatedAt`),o[`#${h.UPDATED_AT}`]=h.UPDATED_AT,s[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${h.CREDENTIAL_VALUE} = :value`),o[`#${h.CREDENTIAL_VALUE}`]=h.CREDENTIAL_VALUE,s[":value"]=r.value),r.data!==void 0&&(i.push(`#${h.METADATA} = :data`),o[`#${h.METADATA}`]=h.METADATA,s[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${h.REVOKED_AT} = :revokedAt`),o[`#${h.REVOKED_AT}`]=h.REVOKED_AT,s[":revokedAt"]=r.revokedAt?re(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${h.LAST_USED_AT} = :lastUsedAt`),o[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,s[":lastUsedAt"]=r.lastUsedAt?re(r.lastUsedAt):null),await this.docClient.send(new rO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"credential",id:e})):d(G("update credential",n))}}async remove(e){try{return await this.docClient.send(new Z0({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(r){return Ce(r)?d(te.NotFound({entity:"credential",id:e})):d(G("delete credential",r))}}async hasType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return T((n.Count||0)>0)}catch(n){return d(G("check credential type",n))}}async countByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count credentials",r))}}async batchGet(e){if(e.length===0)return T([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let s=(await this.docClient.send(new Q0({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[h.PK]:U.CREDENTIAL_PK(c),[h.SK]:U.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of s){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return T(n)}catch(r){return d(G("batch get credentials",r))}}marshall(e){let r={[h.PK]:U.CREDENTIAL_PK(e.id),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(e.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(e.type,e.id),[h.USER_ID]:e.userId,[h.CREDENTIAL_VALUE]:e.value,[h.METADATA]:e.data,[h.REVOKED_AT]:e.revokedAt?re(e.revokedAt):null,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)};return e.lastUsedAt&&(r[h.LAST_USED_AT]=re(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[h.PK]),n=le.credentialTypeFromUserSK(e[h.CREDENTIAL_USER_SK]);return{id:r,userId:e[h.USER_ID],type:n,value:e[h.CREDENTIAL_VALUE],data:e[h.METADATA]||{},revokedAt:Kt(e[h.REVOKED_AT]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT]),lastUsedAt:Kt(e[h.LAST_USED_AT])}}};import{BatchGetCommand as nO,DeleteCommand as iO,GetCommand as oO,PutCommand as sO,QueryCommand as aO,UpdateCommand as eh}from"@aws-sdk/lib-dynamodb";function th(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Cr(t.lastFailedAt),lockedUntil:Cr(t.lockedUntil)}}function OT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Kt(n.lastFailedAt),lockedUntil:Kt(n.lockedUntil)};return e}function kT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=th(n));return e}var dc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new oO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}}));if(!n.Item)return T(null);let i=this.unmarshall(n.Item);return T(i)}catch(n){return d(G("get identity",n))}}async getByUserId(e){try{let r=await this.docClient.send(new aO({TableName:this.tableName,IndexName:ue.USER_IDENTITIES,KeyConditionExpression:`${h.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":U.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let o=this.unmarshall(i);o!==null&&n.push(o)}return T(n)}catch(r){return d(G("get identities by userId",r))}}async create(e){try{let r=ae(),n={...e,createdAt:J(r),updatedAt:J(r)};return await this.docClient.send(new sO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"identity"})):d(G("create identity",r))}}async update(e,r,n){try{let i=[],o=[],s={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),s["#loginEnabled"]=h.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Cr(n.verifiedAt);l===null?(o.push("#verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),s["#guards"]=h.GUARDS,a[":guards"]=kT(n.guards)),n.pendingVerification!==void 0&&(s["#pendingVerification"]=h.PENDING_VERIFICATION,n.pendingVerification===null?o.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),s["#updatedAt"]=h.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),o.length>0&&c.push(`REMOVE ${o.join(", ")}`),await this.docClient.send(new eh({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update identity",i))}}async remove(e,r){try{return await this.docClient.send(new iO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}})),T(void 0)}catch(n){return d(G("remove identity",n))}}async updateGuard(e,r,n,i){let o={[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()};try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":h.GUARDS,"#guardKey":n,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guard":th(i),":updatedAt":ae()}})),T(void 0)}catch(s){if(Ce(s))try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":h.GUARDS,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:th(i)},":updatedAt":ae()}})),T(void 0)}catch(a){return d(G("update guard",a))}return d(G("update guard",s))}}async batchGet(e){try{if(e.length===0)return T([]);let n=(await this.docClient.send(new nO({RequestItems:{[this.tableName]:{Keys:e.map(({type:s,value:a})=>({[h.PK]:U.IDENTITY_PK(s,a),[h.SK]:U.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let s of n){let a=this.unmarshall(s);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let o=e.map(({type:s,value:a})=>{let c=`${s}#${a}`;return i.get(c)||null});return T(o)}catch(r){return d(G("batch get identities",r))}}marshall(e){let r={[h.PK]:U.IDENTITY_PK(e.type,e.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(e.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(e.type,e.value),[h.USER_ID]:e.userId,[h.LOGIN_ENABLED]:e.loginEnabled,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)},n=Cr(e.verifiedAt);return n!==null&&(r[h.VERIFIED_AT]=n),r[h.GUARDS]=kT(e.guards),e.pendingVerification&&(r[h.PENDING_VERIFICATION]=Ht({...e.pendingVerification,expiresAt:re(e.pendingVerification.expiresAt),resendAvailableAt:Cr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[h.PK]);if(!r){let n=e[h.IDENTITY_USER_SK]?le.userIndexSKInfo(e[h.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[h.PK],GSI1SK:e[h.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:J(r.expiresAt),resendAvailableAt:Kt(r.resendAvailableAt)}}};import{TransactWriteCommand as cO}from"@aws-sdk/lib-dynamodb";var pc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=ht(),i=re(e.challenge.expiresAt),o=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new cO({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,o))]})),T(void 0)}catch(r){return Is(r)==="TransactionCanceledException"||Ce(r)?d(te.UniqueConstraintViolation({field:"registration"})):d(G("create email verification registration transaction",r))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ht(e),ConditionExpression:`attribute_not_exists(${h.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[h.PK]:U.USER_PK(e.profile.id),[h.SK]:U.USER_PROFILE_SK(),userStatus:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[h.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[h.PK]:U.USER_PK(e.userAuth.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[h.CREATED_AT]:r,[h.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[h.PK]:U.IDENTITY_PK(n.type,n.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(n.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(n.type,n.value),[h.USER_ID]:n.userId,[h.LOGIN_ENABLED]:n.loginEnabled,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.PENDING_VERIFICATION]:Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)})},o=Cr(n.verifiedAt);return o!==null&&(i[h.VERIFIED_AT]=o),i[h.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,o={[h.PK]:U.CREDENTIAL_PK(r),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(i.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(i.type,r),[h.USER_ID]:i.userId,[h.CREDENTIAL_VALUE]:i.value,[h.METADATA]:i.data,[h.REVOKED_AT]:i.revokedAt?re(i.revokedAt):null,[h.CREATED_AT]:n,[h.UPDATED_AT]:n};return i.lastUsedAt&&(o[h.LAST_USED_AT]=re(i.lastUsedAt)),o}marshallChallenge(e,r,n){let i=e.challenge,o={[h.PK]:U.CHALLENGE_PK(i.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:i.userId,[h.PURPOSE]:i.purpose,[h.CHALLENGE_STATUS]:i.status,[h.EXPIRES_AT]:re(i.expiresAt),[h.CREATED_AT]:r,[h.TTL]:n};return i.tenantId&&(o[h.TENANT_ID]=i.tenantId),i.phase&&(o[h.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(o[h.ALLOWED_METHODS]=i.allowedMethods),i.method&&(o[h.METHOD]=i.method),i.codeHash&&(o[h.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(o[h.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(o[h.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(o[h.IDENTITY_TYPE]=i.identityType),i.identityValue&&(o[h.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(o[h.DEVICE_LABEL]=i.deviceLabel),i.country&&(o[h.COUNTRY]=i.country),i.city&&(o[h.CITY]=i.city),i.metadata&&(o[h.METADATA]=i.metadata),i.flowKey&&(o[h.FLOW_KEY]=i.flowKey),o}};import{DynamoDBClient as dO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as pO,GetCommand as DT,PutCommand as fO,QueryCommand as fc,UpdateCommand as bs}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as lO}from"@aws-sdk/lib-dynamodb";var CT=100,PT=5;function uO(t){return new Promise(e=>setTimeout(e,t))}async function xs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=CT){let o=r.slice(i,i+CT),s=0;for(;o.length>0;){let a=await t.send(new lO({RequestItems:{[e]:{Keys:o}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(s+=1,s>PT)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${PT} retries`);o=l,await uO(2**s*25)}}return n}var mc=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new dO({});this.docClient=e.docClient||pO.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return ht()}generateTokenId(){return ht()}async get(e){try{let r=await this.docClient.send(new DT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get session",r))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),o={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},s=sc(re(e.expiresAt)+this.ttlGracePeriod),a=hd.sessionSK(r,n);return await this.docClient.send(new fO({TableName:this.tableName,Item:this.marshall(o,s,a)})),T(o)}catch(r){return d(G("create session",r))}}async update(e,r){try{let n=[],i={},o={};if(r.tokenId!==void 0&&(n.push(`#${h.TOKEN_ID} = :tokenId`),i[`#${h.TOKEN_ID}`]=h.TOKEN_ID,o[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${h.EXPIRES_AT} = :expiresAt`),i[`#${h.EXPIRES_AT}`]=h.EXPIRES_AT,o[":expiresAt"]=re(r.expiresAt);let s=sc(re(r.expiresAt)+this.ttlGracePeriod);n.push(`#${h.TTL} = :ttl`),i[`#${h.TTL}`]=h.TTL,o[":ttl"]=s}return r.lastUsedAt!==void 0&&(n.push(`#${h.LAST_USED_AT} = :lastUsedAt`),i[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,o[":lastUsedAt"]=re(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${h.METADATA} = :metadata`),i[`#${h.METADATA}`]=h.METADATA,o[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${h.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${h.PREVIOUS_TOKEN_ID}`]=h.PREVIOUS_TOKEN_ID,o[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${h.ROTATED_AT} = :rotatedAt`),i[`#${h.ROTATED_AT}`]=h.ROTATED_AT,o[":rotatedAt"]=r.rotatedAt),n.length===0?T():(await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T())}catch(n){return d(G("update session",n))}}async rotateToken(e,r,n){try{let i=sc(re(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.TOKEN_ID} = :tokenId, #${h.PREVIOUS_TOKEN_ID} = :previousTokenId, #${h.ROTATED_AT} = :rotatedAt, #${h.EXPIRES_AT} = :expiresAt, #${h.LAST_USED_AT} = :lastUsedAt, #${h.TTL} = :ttl`,ConditionExpression:`#${h.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.PREVIOUS_TOKEN_ID}`]:h.PREVIOUS_TOKEN_ID,[`#${h.ROTATED_AT}`]:h.ROTATED_AT,[`#${h.EXPIRES_AT}`]:h.EXPIRES_AT,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT,[`#${h.TTL}`]:h.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":re(n.expiresAt),":lastUsedAt":re(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),T(!0)}catch(i){return Ce(i)?T(!1):d(G("rotate session token",i))}}async switchTenant(e,r){try{let n=[`#${h.TENANT_ID} = :tenantId`,`#${h.TOKEN_ID} = :tokenId`,`#${h.LAST_USED_AT} = :lastUsedAt`],i=[],o={[`#${h.TENANT_ID}`]:h.TENANT_ID,[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT},s={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};o[`#${h.TENANT_TYPE}`]=h.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${h.TENANT_TYPE} = :tenantType`),s[":tenantType"]=r.tenantType):i.push(`#${h.TENANT_TYPE}`),o[`#${h.PERM}`]=h.PERM,r.perms!==void 0?(n.push(`#${h.PERM} = :perms`),s[":perms"]=JSON.stringify(r.perms)):i.push(`#${h.PERM}`),o[`#${h.ROLES}`]=h.ROLES,r.roles!==void 0?(n.push(`#${h.ROLES} = :roles`),s[":roles"]=r.roles):i.push(`#${h.ROLES}`),o["#revokedAt"]=h.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK}) AND attribute_not_exists(#revokedAt)`})),T()}catch(n){return Ce(n)?d(te.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):d(G("switch tenant",n))}}async revoke(e){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date)},ConditionExpression:`attribute_exists(${h.PK})`})),T()}catch(r){return Ce(r)?T():d(G("revoke session",r))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ConditionExpression:`#${h.USER_ID} = :userId AND attribute_not_exists(#${h.REVOKED_AT})`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.USER_ID}`]:h.USER_ID,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date),":userId":r}})),T()}catch(n){return Ce(n)?T():d(G("revoke session by user",n))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.USER_SESSIONS,KeyConditionExpression:`${h.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find sessions by user",n))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find active sessions by user",n))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(i=>{let o=le.sessionId(i[h.PK]),s=hd.extractCreatedAt(i[h.ACTIVE_SESSION_SK]);return{id:o,createdAt:new Date(s)}});return T(n)}catch(r){return d(G("get active sessions for limit",r))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=re(new Date),i=await Promise.allSettled(e.map(s=>this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(s),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),o=0;for(let s of i)s.status==="fulfilled"?o+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Is(s.reason)});return o}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return T(0);let i=n.Items.map(s=>le.sessionId(s[h.PK])).filter(s=>!r||s!==r),o=await this.revokeSessionsByIds(i,"revokeAllByUserId");return T(o)}catch(n){return d(G("revoke all sessions by user",n))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return T(r)}catch(r){return d(G("revoke batch sessions",r))}}async countByUserId(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count active sessions by user",r))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new DT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(r),[h.SK]:U.SESSION_SK()},ProjectionExpression:`${h.TOKEN_ID}, ${h.REVOKED_AT}, ${h.EXPIRES_AT}`}));if(!n.Item)return T(!1);let i=n.Item,o=i[h.TOKEN_ID]===e&&!i[h.REVOKED_AT]&&J(i[h.EXPIRES_AT])>new Date;return T(o)}catch(n){return d(G("check token active",n))}}marshall(e,r,n){let i={[h.PK]:U.SESSION_PK(e.id),[h.SK]:U.SESSION_SK(),[h.USER_SESSION_PK]:U.USER_PK(e.userId),[h.USER_SESSION_SK]:n,...!e.revokedAt&&{[h.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[h.ACTIVE_SESSION_SK]:n},[h.USER_ID]:e.userId,[h.TOKEN_ID]:e.tokenId,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.LAST_USED_AT]:re(e.lastUsedAt),[h.TTL]:r};return e.tenantId&&(i[h.TENANT_ID]=e.tenantId),e.tenantType&&(i[h.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[h.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[h.ROLES]=e.roles),e.deviceLabel&&(i[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[h.COUNTRY]=e.country),e.city&&(i[h.CITY]=e.city),e.metadata&&(i[h.METADATA]=e.metadata),e.revokedAt&&(i[h.REVOKED_AT]=re(e.revokedAt)),e.previousTokenId&&(i[h.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[h.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[h.PK]),userId:e[h.USER_ID],tokenId:e[h.TOKEN_ID],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT]),lastUsedAt:J(e[h.LAST_USED_AT]),revokedAt:e[h.REVOKED_AT]?J(e[h.REVOKED_AT]):null};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.TENANT_TYPE]&&(n.tenantType=e[h.TENANT_TYPE]),e[h.PERM]!==void 0&&(n.perms=JSON.parse(e[h.PERM])),e[h.ROLES]!==void 0&&(n.roles=e[h.ROLES]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[h.PREVIOUS_TOKEN_ID]),e[h.ROTATED_AT]!==void 0&&(n.rotatedAt=e[h.ROTATED_AT]),n}};import{QueryCommand as mO}from"@aws-sdk/lib-dynamodb";var hc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new mO(s)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(i.declinedAt=J(e.declinedAt)),e.revokedAt&&(i.revokedAt=J(e.revokedAt)),i}};import{GetCommand as UT,PutCommand as hO,QueryCommand as fi,UpdateCommand as EO}from"@aws-sdk/lib-dynamodb";var yO=10080*60*1e3,Ec=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[h.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(n.declinedAt=J(e.declinedAt)),e.revokedAt&&(n.revokedAt=J(e.revokedAt)),n}generateInviteId(){return ht()}async getById(e){try{let r=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()}}));return r.Item?T(this.mapItemToEntity(r.Item)):T(null)}catch(r){return d(G("getById invite",r))}}async getByToken(e){try{let n=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":h.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return T(null);let i=n[0],o=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return o.Item?T(this.mapItemToEntity(o.Item)):T(null)}catch(r){return d(G("getByToken invite",r))}}async create(e){try{let r=ae(),n=re(e.expiresAt),i=Math.floor((n+yO)/1e3),o={PK:U.INVITE_PK(e.id),SK:U.INVITE_SK(),[h.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[h.INVITED_BY_ID]:e.invitedById,[h.INVITE_STATUS]:e.status,[h.INVITE_TOKEN]:e.inviteToken,[h.EXPIRES_AT]:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.TTL]:i,[h.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[h.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[h.INVITE_TOKEN_GSI]:e.inviteToken},s={};e.invitedByName&&(s.name=e.invitedByName),e.invitedByEmail&&(s.email=e.invitedByEmail),e.invitedByJobTitle&&(s.jobTitle=e.invitedByJobTitle),Object.keys(s).length>0&&(o[h.INVITED_BY_INFO]=s),e.inviteeUserId&&(o[h.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(o[h.INVITEE_EMAIL]=e.inviteeEmail,o[h.INVITEE_EMAIL_GSI]=e.inviteeEmail,o[h.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(o[h.INVITEE_PHONE]=e.inviteePhone,o[h.INVITEE_PHONE_GSI]=e.inviteePhone,o[h.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(o[h.ROLES]=e.roles),e.perms!==void 0&&(o[h.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(o[h.AUTH_PERM]=e.authPerm),e.displayName&&(o[h.DISPLAY_NAME]=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.jobTitle&&(o.jobTitle=e.jobTitle),await this.docClient.send(new hO({TableName:this.tableName,Item:o,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:J(r),updatedAt:J(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),T(a)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"invite id"})):d(Rt("create invite",r))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],o={"#inviteStatus":h.INVITE_STATUS,"#inviteTenantSk":h.INVITE_TENANT_SK,"#updatedAt":h.UPDATED_AT},s={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),o["#acceptedAt"]=h.ACCEPTED_AT,s[":acceptedAt"]=re(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),o["#declinedAt"]=h.DECLINED_AT,s[":declinedAt"]=re(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),o["#revokedAt"]=h.REVOKED_AT,s[":revokedAt"]=re(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),o["#inviteTokenGsi"]=h.INVITE_TOKEN_GSI,o["#inviteeEmailGsi"]=h.INVITEE_EMAIL_GSI,o["#inviteeEmailTenantSk"]=h.INVITEE_EMAIL_TENANT_SK,o["#inviteePhoneGsi"]=h.INVITEE_PHONE_GSI,o["#inviteePhoneTenantSk"]=h.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new EO({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantInvite",id:e})):d(Rt("updateStatus invite",n))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":h.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndEmail",n))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":h.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndPhone",n))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK,"#inviteeUserId":h.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndUserId",n))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new fi(s)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByEmail",r))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByPhone",r))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return T(r.Count??0)}catch(r){return d(G("countPendingByTenant",r))}}async expireOld(e){return T(0)}};import{QueryCommand as gO}from"@aws-sdk/lib-dynamodb";var yc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=(await this.docClient.send(new gO(i))).Items||[],a=[],c=new Map;for(let m of s){let E=m.SK;if(E.startsWith(Be.TENANT_PROFILE)){let v=le.tenantProfileUserId(E);c.set(v,m)}else E.startsWith(ce.USER)&&a.push(m)}a.sort((m,E)=>E.createdAt-m.createdAt);let l=a.slice(0,n),u=a.length>n,p=l.map(m=>{let E=le.tenantMemberUserId(m.SK),v=c.get(E);return this.toListItem(m,e,E,v)}),f=u&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:u,cursor:f,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e,r,n,i){let o={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};if(e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm),i){let s={tenantId:r,userId:n,createdAt:J(i.createdAt),updatedAt:J(i.updatedAt)};i.contactEmail&&(s.contactEmail=i.contactEmail),i.contactPhone&&(s.contactPhone=i.contactPhone),i.displayName&&(s.displayName=i.displayName),i.displayNameSource&&(s.displayNameSource=i.displayNameSource),i.givenName&&(s.givenName=i.givenName),i.familyName&&(s.familyName=i.familyName),i.avatarUrl&&(s.avatarUrl=i.avatarUrl),i.locale&&(s.locale=i.locale),i.jobTitle&&(s.jobTitle=i.jobTitle),i.bio&&(s.bio=i.bio),i.metadata&&(s.metadata=JSON.parse(i.metadata)),o.tenantProfile=s}return o}};import{DeleteCommand as vO,DynamoDBDocumentClient as AO,GetCommand as LT,PutCommand as TO,QueryCommand as _O,TransactWriteCommand as IO,UpdateCommand as MT}from"@aws-sdk/lib-dynamodb";var gc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=AO.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)}}));if(!n.Item)return T(null);let i=this.mapItemToEntity(n.Item);return T(i)}catch(n){return d(G("get",n))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ht({PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new IO({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new TO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?d(te.UniqueConstraintViolation({field:"tenant owner"})):d(te.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant member"})):d(Rt("create tenant member",r))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updatePermissions tenant member",i))}}async updateStatus(e,r,n){try{return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updateStatus tenant member",i))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=await this.docClient.send(new _O(i)),s=(o.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!o.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return mr(s,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async hasOwner(e){try{let r=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_OWNER_MARKER_SK()}}));return T(!!r.Item)}catch(r){return d(G("hasOwner",r))}}async remove(e,r){try{return await this.docClient.send(new vO({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("remove tenant member",n))}}};import{BatchGetCommand as xO,QueryCommand as bO}from"@aws-sdk/lib-dynamodb";var vc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Qt.DEFAULT,o=r?.parentTenantId,s=o?`${i}#${o}#`:`${i}#`,a={TableName:this.tableName,IndexName:ue.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":s},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new bO(a)),l=c.Items??[],u=await this.fetchProfileMap(e,l),p=l.map(E=>this.toListItem(E,e,u)),f=!!c.LastEvaluatedKey,m=f?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:f,cursor:m,prevCursor:r?.cursor??null})}catch(n){return d(G("listByUser query",n))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(s=>({PK:U.TENANT_PROFILE_PK(le.tenantId(s.PK)),SK:U.TENANT_PROFILE_SK(e)})),o=await this.docClient.send(new xO({RequestItems:{[this.tableName]:{Keys:i}}}));for(let s of o.Responses?.[this.tableName]??[]){let a=s,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),o={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm);let s=n.get(i);return s&&(s.contactEmail&&(o.contactEmail=s.contactEmail),s.contactPhone&&(o.contactPhone=s.contactPhone),s.displayName&&(o.displayName=s.displayName),s.displayNameSource&&(o.displayNameSource=s.displayNameSource),s.givenName&&(o.givenName=s.givenName),s.familyName&&(o.familyName=s.familyName),s.avatarUrl&&(o.avatarUrl=s.avatarUrl),s.locale&&(o.locale=s.locale),s.jobTitle&&(o.jobTitle=s.jobTitle),s.bio&&(o.bio=s.bio),s.metadata&&(o.metadata=JSON.parse(s.metadata))),o}};import{DeleteCommand as SO,GetCommand as wO,PutCommand as NO,UpdateCommand as RO}from"@aws-sdk/lib-dynamodb";var Ac=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return ht()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new wO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()}}));return r.Item?T(this.toEntity(r.Item)):T(null)}catch(r){return d(G("get tenant",r))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ht({PK:U.TENANT_PK(r),SK:U.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new NO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant"})):d(Rt("create tenant",r))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s}=Pr(n);return await this.docClient.send(new RO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("update tenant",n))}}async delete(e){try{return await this.docClient.send(new SO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("delete tenant",r))}}async list(){return d(te.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return d(te.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return d(te.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as OO,GetCommand as kO,PutCommand as CO,UpdateCommand as vd}from"@aws-sdk/lib-dynamodb";var Tc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new kO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}}));return r.Item?T(this.unmarshall(r.Item,e)):T(null)}catch(r){return d(G("get user auth",r))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new CO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"userAuth"})):d(G("create user auth",r))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update user auth status",n))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa required",n))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa methods",n))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa settings",n))}}async remove(e){try{return await this.docClient.send(new OO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}})),T(void 0)}catch(r){return d(G("remove user auth",r))}}marshall(e){return{[h.PK]:U.USER_PK(e.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}};import{DynamoDBDocumentClient as PO,DeleteCommand as DO,GetCommand as UO,PutCommand as LO,QueryCommand as KT,UpdateCommand as rh}from"@aws-sdk/lib-dynamodb";function Ss(t,e){return e?U.USER_MFA_WITH_ID_SK(t,e):U.USER_MFA_SK(t)}var _c=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=PO.from(e)}toDynamoDBItem(e){let r={PK:U.USER_PK(e.userId),SK:Ss(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:J(e.createdAt),verifiedAt:Kt(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Kt(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Kt(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Kt(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Ss(r,n),o=await this.docClient.send(new UO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}}));return o.Item?T(this.fromDynamoDBItem(o.Item,e)):T(null)}catch(i){return d(G("get MFA authenticator",i))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":Be.MFA}},o=((await this.docClient.send(new KT(r))).Items??[]).map(s=>this.fromDynamoDBItem(s,e));return T(o)}catch(r){return d(G("find MFA authenticators by user",r))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":`${Be.MFA}${r}`}},s=((await this.docClient.send(new KT(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return T(s)}catch(n){return d(G("find MFA authenticators by method",n))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=ht());let n=this.toDynamoDBItem(r);return await this.docClient.send(new LO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(this.fromDynamoDBItem(n,e.userId))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"MFA authenticator"})):d(G("create MFA authenticator",r))}}async update(e,r,n,i){try{let o=Ss(r,n),s=[],a={},c={};if(i.label!==void 0&&(s.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(s.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(s.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(s.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(s.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(s.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(s.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(s.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),s.length===0)return T(void 0);let l={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:o},UpdateExpression:`SET ${s.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new rh(l)),T(void 0)}catch(o){return d(G("update MFA authenticator",o))}}async remove(e,r,n){try{let i=Ss(r,n);return await this.docClient.send(new DO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}})),T(void 0)}catch(i){return d(G("remove MFA authenticator",i))}}async incrementFailedAttempts(e,r,n,i,o){try{let s=Ss(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},u={":zero":0,":inc":1,":lastFailedAt":a};o!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",u[":lockedUntil"]=a+o*60*1e3,u[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:s},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:u};return await this.docClient.send(new rh(p)),T(void 0)}catch(s){return d(G("increment failed attempts",s))}}async resetFailedAttempts(e,r,n){try{let i=Ss(r,n),o={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new rh(o)),T(void 0)}catch(i){return d(G("reset failed attempts",i))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as MO,DynamoDBDocumentClient as KO,GetCommand as HO,PutCommand as FO,QueryCommand as HT,UpdateCommand as FT}from"@aws-sdk/lib-dynamodb";var Ic=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=KO.from(e)}generateUserId(){return ht()}async getById(e){try{let r=await this.docClient.send(new HO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}}));if(!r.Item)return T(null);let n=r.Item;if(n.deletedAt)return T(null);let o={id:le.userId(n.PK),status:n.userStatus,createdAt:J(n.createdAt),updatedAt:J(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:J(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return T(o)}catch(r){return d(G("getById user",r))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",o={PK:U.USER_PK(n),SK:U.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(o.contactEmail=e.contactEmail),e.contactPhone&&(o.contactPhone=e.contactPhone),e.username&&(o.username=e.username),e.displayName&&(o.displayName=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.avatarUrl&&(o.avatarUrl=e.avatarUrl),e.locale&&(o.locale=e.locale),e.metadata&&(o.metadata=JSON.stringify(e.metadata)),o[h.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),o[h.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new FO({TableName:this.tableName,Item:Ht(o),ConditionExpression:qm("PK")}));let s={id:n,status:i,createdAt:J(r),updatedAt:J(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return T(s)}catch(r){return d(G("create user",r))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return T(void 0);i.updatedAt=n;let o=Pr(i);return await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:o.UpdateExpression,ExpressionAttributeNames:o.ExpressionAttributeNames,ExpressionAttributeValues:o.ExpressionAttributeValues})),T(void 0)}catch(n){return d(G("updateProfile",n))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=Ae.USER_STATUS_PK(e),s=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":o},Limit:n,ExclusiveStartKey:i})),a=[];if(s.Items&&s.Items.length>0)for(let u of s.Items){let p=le.userId(u.PK);a.push(p)}let c=!!s.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return T(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch(n){return d(G("get users by status",n))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return T(n.Count||0)}catch(r){return d(G("count users by status",r))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt, #${h.USER_STATUS_PK} = :statusPk, #${h.USER_STATUS_SK} = :statusSk`,o={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",o[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${h.UPDATED_AT}`]:h.UPDATED_AT,[`#${h.USER_STATUS_PK}`]:h.USER_STATUS_PK,[`#${h.USER_STATUS_SK}`]:h.USER_STATUS_SK},ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userProfile",id:e})):d(G("sync auth status",n))}}async remove(e){try{return await this.docClient.send(new MO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}})),T(void 0)}catch(r){return d(G("remove user profile",r))}}};import{DeleteCommand as VO,DynamoDBDocumentClient as BO,GetCommand as jO,PutCommand as GO,QueryCommand as $O,UpdateCommand as qO}from"@aws-sdk/lib-dynamodb";var xc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=BO.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:J(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:U.PROVIDER_PK(e.provider,e.externalId),SK:U.PROVIDER_METADATA_SK(),userProviderPk:U.USER_PK(e.userId),userProviderSk:U.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?re(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ht(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new jO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}}));return n.Item?T(this.mapItemToUserProviderLink(n.Item)):T(null)}catch(n){return d(G("find provider by external id",n))}}async findByUserId(e){try{let r=await this.docClient.send(new $O({TableName:this.tableName,IndexName:ue.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":h.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":U.USER_PK(e)}}));return!r.Items||r.Items.length===0?T([]):T(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch(r){return d(G("find providers by user id",r))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new GO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),T(this.mapItemToUserProviderLink(n))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):d(G("create user provider",r))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return T(void 0);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new qO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update user provider",i))}}async remove(e,r){try{return await this.docClient.send(new VO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}})),T(void 0)}catch(n){return d(G("delete user provider",n))}}};import{DeleteCommand as WO,GetCommand as zO,PutCommand as JO,UpdateCommand as YO}from"@aws-sdk/lib-dynamodb";var bc=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new zO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)}}));return n.Item?T(this.mapItemToEntity(n.Item)):T(null)}catch(n){return d(G("get user tenant profile",n))}}async create(e){try{let r=ae(),n={PK:U.TENANT_PROFILE_PK(e.tenantId),SK:U.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new JO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:J(r),updatedAt:J(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),T(i)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"user tenant profile"})):d(Rt("create user tenant profile",r))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new YO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("update user tenant profile",i))}}async remove(e,r){try{return await this.docClient.send(new WO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("remove user tenant profile",n))}}};var nh=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new QO(e.clientConfig||{});let r=ZO.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ic(this.client,this.tableName),this.sessions=new mc({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new xc(this.client,this.tableName),this.userMfaAuthenticators=new _c(this.client,this.tableName),this.challenges=new lc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new dc({docClient:r,tableName:this.tableName}),this.credentials=new uc({docClient:r,tableName:this.tableName}),this.registration=new pc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Tc({docClient:r,tableName:this.tableName}),this.tenantMembers=new gc(this.client,this.tableName),this.tenantInvites=new Ec({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new bc(r,this.tableName),this.tenants=new Ac({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new hc({docClient:r,tableName:this.tableName}),tenantMembers:new yc({docClient:r,tableName:this.tableName}),tenants:new vc({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new XO({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function VT(t){return new nh(t)}ra();var ih=1,BT=2,jT=3,GT="auth-craft:internal";async function ek(t){let e=t.replace(/^0x/,""),r=qT(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let o=`-----BEGIN PRIVATE KEY-----
|
|
131
|
+
`}};var oc=class t{static createDirectSmtp(e){return new cd(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var f0={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function sT(t={}){let e={...f0,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let o=e.requireTLD?"(?:[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.)+[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${o}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return d([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return d([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return d([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let o=i.split("@");if(o.length!==2)return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[s,a]=o;return!s||s.length>64?d([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?d([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):T()}}}function Lm(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function m0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Mm(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return m0(r)}var Km="email",ld={EMAIL_SYSTEM_NOT_AVAILABLE:_("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:_("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:_("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:_("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function h0(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function aT(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:Km,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return d(ld.EMAIL_SYSTEM_NOT_AVAILABLE());let o=await i.plugins.database.users.getById(n.userId),s=o.ok&&o.data?o.data.contactEmail:void 0;if(!s)return d(ld.RECIPIENT_NOT_FOUND());let a=Lm(e),c=await Mm(a);return(await i.plugins.emailSystem.send({to:s,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?d(ld.SEND_FAILED()):T({codeHash:c,maskedRecipient:h0(s)})},async issueChallenge(n){return T({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(Km)?[Km]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(ld.USE_CHALLENGE_CODE_HASH())}}}var cT="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function ud(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let o="";for(let s of i)o+=cT[s%cT.length];r.push(o)}return r}function E0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function dd(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return E0(r)}function y0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Hm(t,e){let r=await dd(t),n=null;for(let i of e)y0(r,i)&&(n=i);return n}var Fm="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function lT(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let o of e){let s=Fm.indexOf(o);if(s===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|s,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function uT(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=Fm[r>>>e&31];return e>0&&(n+=Fm[r<<5-e&31]),n}function pd(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),uT(e)}function g0(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function v0(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,g0(e))),o=i[i.length-1]&15;return(((i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255)%10**r).toString().padStart(r,"0")}async function fd(t,e,r=Date.now(),n={}){let i=n.period??30,o=n.digits??6,s=n.window??1,a=e.trim();if(a.length!==o||!/^\d+$/u.test(a))return!1;let c=lT(t),l=Math.floor(r/1e3/i),u=!1;for(let p=-s;p<=s;p++){let f=await v0(c,l+p,o);A0(f,a)&&(u=!0)}return u}function A0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function dT(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var Vm="totp",T0={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function pT(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:Vm,requiresServerDelivery:!1,generateSecret(){return pd()},generateBackupCodes(i){return ud(i||r)},async issueChallenge(i){return T({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(Vm)?[Vm]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(T0.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let o=pd(),s=ud(r),a=await Promise.all(s.map(p=>dd(p))),c=i.data.accountName??i.userId,l=dT({secretBase32:o,accountName:c,issuer:e});return T({secret:o,otpauthUri:l,backupCodes:s,credentialData:{secret:o,backupCodeHashes:a}})},async verifyWithCredentials(i){let o=i.credentialData,s=i.data.code?.trim();if(!s||!o?.secret)return T({verified:!1,data:{}});if(await fd(o.secret,s,Date.now(),{window:n}))return T({verified:!0,data:{}});let c=o.backupCodeHashes??[];if(c.length>0){let l=await Hm(s,c);if(l)return T({verified:!0,data:{usedBackupCodeHash:l}})}return T({verified:!1,data:{}})},async verifyCredential(i,o){let s=i.data.code,a=i.data.secret;if(!s||!a)return T({verified:!1,data:{}});let c=await fd(a,s,Date.now(),{window:n});return T({verified:c,data:{}})}}}var Bm={scopes:["email","public_profile"],apiVersion:"v18.0"};var Zr={INVALID_CODE:_("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:_("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function jm(t={}){let{scopes:e=Bm.scopes,apiVersion:r=Bm.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,o){let s=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...o&&{state:o}});return`${n.AUTHORIZATION}?${s.toString()}`},async exchangeCodeForToken(i,o){try{if(!i)return d(Zr.INVALID_CODE());let s=new URLSearchParams({client_id:o.clientId,client_secret:o.clientSecret,code:i,redirect_uri:o.redirectUri}),a=await fetch(`${n.TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return T({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(s){return console.error("Facebook token exchange error:",s),d(Zr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=["id","email","name","first_name","last_name","picture","locale"],s=new URLSearchParams({fields:o.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return T(l)}catch(o){return console.error("Facebook user profile error:",o),d(Zr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=`${t.appId}|${t.appSecret}`,s=new URLSearchParams({input_token:i,access_token:o}),a=await fetch(`${n.DEBUG_TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):d(Zr.INVALID_TOKEN()):d(Zr.INVALID_TOKEN())}catch(o){return console.error("Facebook token verification error:",o),d(Zr.INVALID_TOKEN())}}}}var md={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},Ji={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var tt={INVALID_CODE:_("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:_("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:_("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:_("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:_("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function _0(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function I0(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=_0(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function Gm(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=md.scopes,accessType:o=md.accessType,includeGrantedScopes:s=md.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let u=c?.clientId??e,p=c?.redirectUri??n;if(!u||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let f=new URLSearchParams({client_id:u,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:o,...l&&{state:l},...a&&{prompt:a},...s&&{include_granted_scopes:"true"}});return`${Ji.AUTHORIZATION}?${f.toString()}`},async exchangeCodeForToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r,f=l?.redirectUri??n;try{if(!c)return d(tt.INVALID_CODE());if(!u||!p||!f)return d(tt.MISSING_CONFIG());let m=new URLSearchParams({client_id:u,client_secret:p,code:c,redirect_uri:f,grant_type:"authorization_code"}),E=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google token exchange failed with status:",E.status),d(tt.TOKEN_EXCHANGE_FAILED());let v=await E.json();return T({accessToken:v.access_token,...v.refresh_token&&{refreshToken:v.refresh_token},...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google token exchange error:",m),d(tt.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(Ji.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),d(tt.USER_PROFILE_FAILED());let u=await l.json(),p={id:u.id,...u.email&&{email:u.email},...u.verified_email!==void 0&&{emailVerified:u.verified_email},...u.name&&{name:u.name},...u.given_name&&{givenName:u.given_name},...u.family_name&&{familyName:u.family_name},...u.picture&&{avatarUrl:u.picture},...u.locale&&{locale:u.locale},provider:"google"};return T(p)}catch(l){return console.error("Google user profile error:",l),d(tt.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(`${Ji.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return d(tt.INVALID_TOKEN());let u=await l.json();return parseInt(u.expires_in,10)<=0?d(tt.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),d(tt.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return d(tt.INVALID_CREDENTIAL());let l=await fetch(`${Ji.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),d(tt.INVALID_CREDENTIAL());let u=await l.json();if(!e)return d(tt.MISSING_CONFIG());if(u.aud!==e)return d(tt.INVALID_CREDENTIAL());if(parseInt(u.expires_in,10)<=0)return d(tt.INVALID_CREDENTIAL());let f=u.email_verified==="true",m=I0(c),E={id:u.sub,...u.email&&{email:u.email},...u.email&&{emailVerified:f},...m?.name&&{name:m.name},...m?.given_name&&{givenName:m.given_name},...m?.family_name&&{familyName:m.family_name},...m?.picture&&{avatarUrl:m.picture},...m?.locale&&{locale:m.locale},provider:"google"};return T(E)}catch(l){return console.error("Google credential verification error:",l),d(tt.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return d(tt.INVALID_TOKEN());if(!u||!p)return d(tt.MISSING_CONFIG());let f=new URLSearchParams({client_id:u,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),m=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!m.ok)return console.error("Google refresh token failed with status:",m.status),d(tt.REFRESH_TOKEN_FAILED());let E=await m.json();return T({accessToken:E.access_token,...E.expires_in&&{expiresIn:E.expires_in}})}catch(f){return console.error("Google refresh token error:",f),d(tt.REFRESH_TOKEN_FAILED())}}}}function fT(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function o(){if(n===0)return;let s=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(u=>u>s);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(o,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(s,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let u=Date.now(),p=u-l,f=e.get(s)??{hits:[]},m=f.hits.filter(E=>E>p);if(m.length>=c){let E=m[0]??u,v=Math.max(0,E+l-u);return f.hits=m,e.set(s,f),{allowed:!1,remaining:0,retryAfterMs:v,limit:c}}return m.push(u),f.hits=m,e.set(s,f),{allowed:!0,remaining:c-m.length,retryAfterMs:0,limit:c}},async reset(s){e.delete(s)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as XO,DynamoDBClient as QO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as ZO}from"@aws-sdk/lib-dynamodb";var te={DatabaseConnectionError:_("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:Q("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:Q("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:Q("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:Q("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:_("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:_("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:Q("INVALID_DATA","Invalid data: {reason}"),Timeout:_("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:_("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:Q("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:Q("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function re(t){return t.getTime()}function J(t){return new Date(t)}function mT(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function sc(t){return t instanceof Date?mT(t.getTime()):mT(t)}function $m(t){return t<Date.now()}function Cr(t){return t?re(t):null}function Kt(t){return t==null?null:J(t)}function Ht(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Dr(t){let e=[],r=[],n={},i={},o=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let u=`#${c}`;if(n[u]=c,l==null)r.push(u);else{let p=`:val${o}`;e.push(`${u} = ${p}`),i[p]=l,o++}}let s=[];return e.length>0&&s.push(`SET ${e.join(", ")}`),r.length>0&&s.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:s.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function qm(t="PK"){return`attribute_not_exists(${t})`}var Wm={USER:"USR"},ce={USER:`${Wm.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Be={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},Tt="#",U={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Be.AUTH,USER_PROFILE_SK:()=>Be.PROFILE,USER_MFA_SK:t=>`${Be.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Be.MFA}${t}${Tt}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Be.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Be.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Be.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Be.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Be.METADATA,SESSION_SK:()=>Be.METADATA,PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${Tt}${e}`,PROVIDER_METADATA_SK:()=>Be.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Be.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Be.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Be.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Be.PROVIDER.length),r=e.indexOf(Tt);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Be.MFA.length),r=e.indexOf(Tt);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Be.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${Wm.USER}${Tt}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${Tt}${e}${Tt}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${Tt}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${Tt}${e??"ROOT"}${Tt}${r}${Tt}${n}`},h={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},hd={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${Tt}${e}`,extractCreatedAt:t=>{let e=t.indexOf(Tt),r=e===-1?t:t.slice(0,e);return Number(r)}};var ue={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},We="S",x0={partitionKey:{name:"PK",type:We},sortKey:{name:"SK",type:We},ttlAttribute:"TTL",globalSecondaryIndexes:[{indexName:ue.ACTIVE_SESSIONS,partitionKey:{name:"activeSessionPk",type:We},sortKey:{name:"activeSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USER_SESSIONS,partitionKey:{name:"userSessionPk",type:We},sortKey:{name:"userSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USERS_BY_STATUS,partitionKey:{name:"userStatusPk",type:We},sortKey:{name:"userStatusSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["displayName","createdAt"]}},{indexName:ue.USER_PROVIDERS,partitionKey:{name:"userProviderPk",type:We},sortKey:{name:"userProviderSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userId","externalEmail","externalName","createdAt"]}},{indexName:ue.USER_IDENTITIES,partitionKey:{name:"identityUserPk",type:We},sortKey:{name:"identityUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["loginEnabled","verifiedAt","createdAt"]}},{indexName:ue.USER_CREDENTIALS,partitionKey:{name:"credentialUserPk",type:We},sortKey:{name:"credentialUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["revokedAt","createdAt"]}},{indexName:ue.USER_TENANTS,partitionKey:{name:"userTenantPk",type:We},sortKey:{name:"userTenantSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userStatus","role","roles","perm","authPerm","isOwner","createdAt","updatedAt"]}},{indexName:ue.TENANT_INVITES,partitionKey:{name:"inviteTenantPk",type:We},sortKey:{name:"inviteTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITE_TOKEN,partitionKey:{name:"inviteTokenGsi",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.INVITEE_EMAIL,partitionKey:{name:"inviteeEmailGsi",type:We},sortKey:{name:"inviteeEmailTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITEE_PHONE,partitionKey:{name:"inviteePhoneGsi",type:We},sortKey:{name:"inviteePhoneTenantSk",type:We},projection:{type:"ALL"}}]};import{DeleteCommand as J0,GetCommand as Y0,PutCommand as X0,UpdateCommand as RT}from"@aws-sdk/lib-dynamodb";var b0=BigInt(0),ac=BigInt(1),S0=BigInt(2),w0=BigInt(7),N0=BigInt(256),R0=BigInt(113),yT=[],gT=[],vT=[];for(let t=0,e=ac,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],yT.push(2*(5*n+r)),gT.push((t+1)*(t+2)/2%64);let i=b0;for(let o=0;o<7;o++)e=(e<<ac^(e>>w0)*R0)%N0,e&S0&&(i^=ac<<(ac<<BigInt(o))-ac);vT.push(i)}var AT=Ov(vT,!0),O0=AT[0],k0=AT[1],C0=(t,e,r)=>t<<r|e>>>32-r,D0=(t,e,r)=>e<<r|t>>>32-r,P0=(t,e,r)=>e<<r-32|t>>>64-r,U0=(t,e,r)=>t<<r-32|e>>>64-r,hT=(t,e,r)=>r>32?P0(t,e,r):C0(t,e,r),ET=(t,e,r)=>r>32?U0(t,e,r):D0(t,e,r),_s=new Uint32Array(10);function L0(t,e=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(t.length!==50)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(Ye(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');for(let r=24-e;r<24;r++){for(let o=0;o<10;o++)_s[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let s=(o+8)%10,a=(o+2)%10,c=_s[a],l=_s[a+1],u=hT(c,l,1)^_s[s],p=ET(c,l,1)^_s[s+1];for(let f=0;f<50;f+=10)t[o+f]^=u,t[o+f+1]^=p}let n=t[2],i=t[3];for(let o=0;o<24;o++){let s=gT[o],a=hT(n,i,s),c=ET(n,i,s),l=yT[o];n=t[l],i=t[l+1],t[l]=a,t[l+1]=c}for(let o=0;o<50;o+=10){let s=t[o],a=t[o+1],c=t[o+2],l=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&s,t[o+7]^=~t[o+9]&a,t[o+8]^=~s&c,t[o+9]^=~a&l}t[0]^=O0[r],t[1]^=k0[r]}Nt(_s)}var zm=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,o=24){if(Ye(e,"blockLen"),Ye(r,"suffix"),Ye(o,"rounds"),wv(i,"enableXOF"),this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=o,Ye(n,"outputLen"),!(0<e&&e<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=ji(this.state)}clone(){return this._cloneInto()}keccak(){fs(this.state32),L0(this.state32,this.rounds),fs(this.state32),this.posOut=0,this.pos=0}update(e){bn(this),xn(e);let{blockLen:r,state:n,state32:i}=this,o=e.length,s=r%4===0&&e.byteOffset%4===0,a=r/4,c=s&&o>=r?ji(e):void 0;for(let l=0;l<o;){if(c!==void 0&&this.pos===0&&l%4===0&&o-l>=r){for(let p=0,f=l/4;p<a;p++)i[p]^=c[f+p];l+=r,this.pos=r,this.keccak();continue}let u=Math.min(r-this.pos,o-l);for(let p=0;p<u;p++)n[this.pos++]^=e[l++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){bn(this,!1),xn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,o=e.length;i<o;){this.posOut>=n&&this.keccak();let s=Math.min(n-this.posOut,o-i);e.set(r.subarray(this.posOut,this.posOut+s),i),this.posOut+=s,i+=s}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(e)}xof(e){return Ye(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(ds(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.length===this.outputLen?e:e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,Nt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:o,enableXOF:s}=this;return e||=new t(r,n,i,s,o),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=o,e.suffix=n,e.outputLen=i,e.enableXOF=s,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},M0=(t,e,r,n={})=>Ru(()=>new zm(e,t,r),n);var TT=M0(6,72,64,Ou(10));var K0=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,Jm=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",_T=Gt+"Number primitive has more than 15 significant digits: ",Pr=1e14,de=14,Ym=9007199254740991,Xm=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],pi=1e7,mt=1e9;function IT(t){var e,r,n,i=R.prototype={constructor:R,toString:null,valueOf:null},o=new R(1),s=20,a=4,c=-7,l=21,u=-1e7,p=1e7,f=!1,m=1,E=0,v={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},N="0123456789abcdefghijklmnopqrstuvwxyz",S=!0;function R(A,x){var b,g,I,O,D,k,C,P,L=this;if(!(L instanceof R))return new R(A,x);if(x==null){if(A&&A._isBigNumber===!0){L.s=A.s,!A.c||A.e>p?L.c=L.e=null:A.e<u?L.c=[L.e=0]:(L.e=A.e,L.c=A.c.slice());return}if((k=typeof A=="number")&&A*0==0){if(L.s=1/A<0?(A=-A,-1):1,A===~~A){for(O=0,D=A;D>=10;D/=10,O++);O>p?L.c=L.e=null:(L.e=O,L.c=[A]);return}P=String(A)}else{if(!K0.test(P=String(A)))return n(L,P,k);L.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(O=P.indexOf("."))>-1&&(P=P.replace(".","")),(D=P.search(/e/i))>0?(O<0&&(O=D),O+=+P.slice(D+1),P=P.substring(0,D)):O<0&&(O=P.length)}else{if(ze(x,2,N.length,"Base"),x==10&&S)return L=new R(A),V(L,s+L.e+1,a);if(P=String(A),k=typeof A=="number"){if(A*0!=0)return n(L,P,k,x);if(L.s=1/A<0?(P=P.slice(1),-1):1,R.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(_T+A)}else L.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(b=N.slice(0,x),O=D=0,C=P.length;D<C;D++)if(b.indexOf(g=P.charAt(D))<0){if(g=="."){if(D>O){O=C;continue}}else if(!I&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){I=!0,D=-1,O=0;continue}return n(L,String(A),k,x)}k=!1,P=r(P,x,10,L.s),(O=P.indexOf("."))>-1?P=P.replace(".",""):O=P.length}for(D=0;P.charCodeAt(D)===48;D++);for(C=P.length;P.charCodeAt(--C)===48;);if(P=P.slice(D,++C)){if(C-=D,k&&R.DEBUG&&C>15&&(A>Ym||A!==pr(A)))throw Error(_T+L.s*A);if((O=O-D-1)>p)L.c=L.e=null;else if(O<u)L.c=[L.e=0];else{if(L.e=O,L.c=[],D=(O+1)%de,O<0&&(D+=de),D<C){for(D&&L.c.push(+P.slice(0,D)),C-=de;D<C;)L.c.push(+P.slice(D,D+=de));D=de-(P=P.slice(D)).length}else D-=C;for(;D--;P+="0");L.c.push(+P)}}else L.c=[L.e=0]}R.clone=IT,R.ROUND_UP=0,R.ROUND_DOWN=1,R.ROUND_CEIL=2,R.ROUND_FLOOR=3,R.ROUND_HALF_UP=4,R.ROUND_HALF_DOWN=5,R.ROUND_HALF_EVEN=6,R.ROUND_HALF_CEIL=7,R.ROUND_HALF_FLOOR=8,R.EUCLID=9,R.config=R.set=function(A){var x,b;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(b=A[x],ze(b,0,mt,x),s=b),A.hasOwnProperty(x="ROUNDING_MODE")&&(b=A[x],ze(b,0,8,x),a=b),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(b=A[x],b&&b.pop?(ze(b[0],-mt,0,x),ze(b[1],0,mt,x),c=b[0],l=b[1]):(ze(b,-mt,mt,x),c=-(l=b<0?-b:b))),A.hasOwnProperty(x="RANGE"))if(b=A[x],b&&b.pop)ze(b[0],-mt,-1,x),ze(b[1],1,mt,x),u=b[0],p=b[1];else if(ze(b,-mt,mt,x),b)u=-(p=b<0?-b:b);else throw Error(Gt+x+" cannot be zero: "+b);if(A.hasOwnProperty(x="CRYPTO"))if(b=A[x],b===!!b)if(b)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))f=b;else throw f=!b,Error(Gt+"crypto unavailable");else f=b;else throw Error(Gt+x+" not true or false: "+b);if(A.hasOwnProperty(x="MODULO_MODE")&&(b=A[x],ze(b,0,9,x),m=b),A.hasOwnProperty(x="POW_PRECISION")&&(b=A[x],ze(b,0,mt,x),E=b),A.hasOwnProperty(x="FORMAT"))if(b=A[x],typeof b=="object")v=b;else throw Error(Gt+x+" not an object: "+b);if(A.hasOwnProperty(x="ALPHABET"))if(b=A[x],typeof b=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(b))S=b.slice(0,10)=="0123456789",N=b;else throw Error(Gt+x+" invalid: "+b)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:s,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[u,p],CRYPTO:f,MODULO_MODE:m,POW_PRECISION:E,FORMAT:v,ALPHABET:N}},R.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!R.DEBUG)return!0;var x,b,g=A.c,I=A.e,O=A.s;e:if({}.toString.call(g)=="[object Array]"){if((O===1||O===-1)&&I>=-mt&&I<=mt&&I===pr(I)){if(g[0]===0){if(I===0&&g.length===1)return!0;break e}if(x=(I+1)%de,x<1&&(x+=de),String(g[0]).length==x){for(x=0;x<g.length;x++)if(b=g[x],b<0||b>=Pr||b!==pr(b))break e;if(b!==0)return!0}}}else if(g===null&&I===null&&(O===null||O===1||O===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},R.maximum=R.max=function(){return K(arguments,-1)},R.minimum=R.min=function(){return K(arguments,1)},R.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(b){var g,I,O,D,k,C=0,P=[],L=new R(o);if(b==null?b=s:ze(b,0,mt),D=Jm(b/de),f)if(crypto.getRandomValues){for(g=crypto.getRandomValues(new Uint32Array(D*=2));C<D;)k=g[C]*131072+(g[C+1]>>>11),k>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),g[C]=I[0],g[C+1]=I[1]):(P.push(k%1e14),C+=2);C=D/2}else if(crypto.randomBytes){for(g=crypto.randomBytes(D*=7);C<D;)k=(g[C]&31)*281474976710656+g[C+1]*1099511627776+g[C+2]*4294967296+g[C+3]*16777216+(g[C+4]<<16)+(g[C+5]<<8)+g[C+6],k>=9e15?crypto.randomBytes(7).copy(g,C):(P.push(k%1e14),C+=7);C=D/7}else throw f=!1,Error(Gt+"crypto unavailable");if(!f)for(;C<D;)k=x(),k<9e15&&(P[C++]=k%1e14);for(D=P[--C],b%=de,D&&b&&(k=Xm[de-b],P[C]=pr(D/k)*k);P[C]===0;P.pop(),C--);if(C<0)P=[O=0];else{for(O=-1;P[0]===0;P.splice(0,1),O-=de);for(C=1,k=P[0];k>=10;k/=10,C++);C<de&&(O-=de-C)}return L.e=O,L.c=P,L}})(),R.sum=function(){for(var A=1,x=arguments,b=new R(x[0]);A<x.length;)b=b.plus(x[A++]);return b},r=(function(){var A="0123456789";function x(b,g,I,O){for(var D,k=[0],C,P=0,L=b.length;P<L;){for(C=k.length;C--;k[C]*=g);for(k[0]+=O.indexOf(b.charAt(P++)),D=0;D<k.length;D++)k[D]>I-1&&(k[D+1]==null&&(k[D+1]=0),k[D+1]+=k[D]/I|0,k[D]%=I)}return k.reverse()}return function(b,g,I,O,D){var k,C,P,L,H,z,Y,pe,Oe=b.indexOf("."),Fe=s,me=a;for(Oe>=0&&(L=E,E=0,b=b.replace(".",""),pe=new R(g),z=pe.pow(b.length-Oe),E=L,pe.c=x(Nn(dr(z.c),z.e,"0"),10,I,A),pe.e=pe.c.length),Y=x(b,g,I,D?(k=N,A):(k=A,N)),P=L=Y.length;Y[--L]==0;Y.pop());if(!Y[0])return k.charAt(0);if(Oe<0?--P:(z.c=Y,z.e=P,z.s=O,z=e(z,pe,Fe,me,I),Y=z.c,H=z.r,P=z.e),C=P+Fe+1,Oe=Y[C],L=I/2,H=H||C<0||Y[C+1]!=null,H=me<4?(Oe!=null||H)&&(me==0||me==(z.s<0?3:2)):Oe>L||Oe==L&&(me==4||H||me==6&&Y[C-1]&1||me==(z.s<0?8:7)),C<1||!Y[0])b=H?Nn(k.charAt(1),-Fe,k.charAt(0)):k.charAt(0);else{if(Y.length=C,H)for(--I;++Y[--C]>I;)Y[C]=0,C||(++P,Y=[1].concat(Y));for(L=Y.length;!Y[--L];);for(Oe=0,b="";Oe<=L;b+=k.charAt(Y[Oe++]));b=Nn(b,P,k.charAt(0))}return b}})(),e=(function(){function A(g,I,O){var D,k,C,P,L=0,H=g.length,z=I%pi,Y=I/pi|0;for(g=g.slice();H--;)C=g[H]%pi,P=g[H]/pi|0,D=Y*C+P*z,k=z*C+D%pi*pi+L,L=(k/O|0)+(D/pi|0)+Y*P,g[H]=k%O;return L&&(g=[L].concat(g)),g}function x(g,I,O,D){var k,C;if(O!=D)C=O>D?1:-1;else for(k=C=0;k<O;k++)if(g[k]!=I[k]){C=g[k]>I[k]?1:-1;break}return C}function b(g,I,O,D){for(var k=0;O--;)g[O]-=k,k=g[O]<I[O]?1:0,g[O]=k*D+g[O]-I[O];for(;!g[0]&&g.length>1;g.splice(0,1));}return function(g,I,O,D,k){var C,P,L,H,z,Y,pe,Oe,Fe,me,we,st,Zi,Cn,eo,_t,yi,It=g.s==I.s?1:-1,Qe=g.c,Ke=I.c;if(!Qe||!Qe[0]||!Ke||!Ke[0])return new R(!g.s||!I.s||(Qe?Ke&&Qe[0]==Ke[0]:!Ke)?NaN:Qe&&Qe[0]==0||!Ke?It*0:It/0);for(Oe=new R(It),Fe=Oe.c=[],P=g.e-I.e,It=O+P+1,k||(k=Pr,P=fr(g.e/de)-fr(I.e/de),It=It/de|0),L=0;Ke[L]==(Qe[L]||0);L++);if(Ke[L]>(Qe[L]||0)&&P--,It<0)Fe.push(1),H=!0;else{for(Cn=Qe.length,_t=Ke.length,L=0,It+=2,z=pr(k/(Ke[0]+1)),z>1&&(Ke=A(Ke,z,k),Qe=A(Qe,z,k),_t=Ke.length,Cn=Qe.length),Zi=_t,me=Qe.slice(0,_t),we=me.length;we<_t;me[we++]=0);yi=Ke.slice(),yi=[0].concat(yi),eo=Ke[0],Ke[1]>=k/2&&eo++;do{if(z=0,C=x(Ke,me,_t,we),C<0){if(st=me[0],_t!=we&&(st=st*k+(me[1]||0)),z=pr(st/eo),z>1)for(z>=k&&(z=k-1),Y=A(Ke,z,k),pe=Y.length,we=me.length;x(Y,me,pe,we)==1;)z--,b(Y,_t<pe?yi:Ke,pe,k),pe=Y.length,C=1;else z==0&&(C=z=1),Y=Ke.slice(),pe=Y.length;if(pe<we&&(Y=[0].concat(Y)),b(me,Y,we,k),we=me.length,C==-1)for(;x(Ke,me,_t,we)<1;)z++,b(me,_t<we?yi:Ke,we,k),we=me.length}else C===0&&(z++,me=[0]);Fe[L++]=z,me[0]?me[we++]=Qe[Zi]||0:(me=[Qe[Zi]],we=1)}while((Zi++<Cn||me[0]!=null)&&It--);H=me[0]!=null,Fe[0]||Fe.splice(0,1)}if(k==Pr){for(L=1,It=Fe[0];It>=10;It/=10,L++);V(Oe,O+(Oe.e=L+P*de-1)+1,D,H)}else Oe.e=P,Oe.r=+H;return Oe}})();function M(A,x,b,g){var I,O,D,k,C;if(b==null?b=a:ze(b,0,8),!A.c)return A.toString();if(I=A.c[0],D=A.e,x==null)C=dr(A.c),C=g==1||g==2&&(D<=c||D>=l)?yd(C,D):Nn(C,D,"0");else if(A=V(new R(A),x,b),O=A.e,C=dr(A.c),k=C.length,g==1||g==2&&(x<=O||O<=c)){for(;k<x;C+="0",k++);C=yd(C,O)}else if(x-=D+(g===2&&O>D),C=Nn(C,O,"0"),O+1>k){if(--x>0)for(C+=".";x--;C+="0");}else if(x+=O-k,x>0)for(O+1==k&&(C+=".");x--;C+="0");return A.s<0&&I?"-"+C:C}function K(A,x){for(var b,g,I=1,O=new R(A[0]);I<A.length;I++)g=new R(A[I]),(!g.s||(b=Yi(O,g))===x||b===0&&O.s===x)&&(O=g);return O}function B(A,x,b){for(var g=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,g++);return(b=g+b*de-1)>p?A.c=A.e=null:b<u?A.c=[A.e=0]:(A.e=b,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,b=/^\.([^.]+)$/,g=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(O,D,k,C){var P,L=k?D:D.replace(I,"");if(g.test(L))O.s=isNaN(L)?null:L<0?-1:1;else{if(!k&&(L=L.replace(A,function(H,z,Y){return P=(Y=Y.toLowerCase())=="x"?16:Y=="b"?2:8,!C||C==P?z:H}),C&&(P=C,L=L.replace(x,"$1").replace(b,"0.$1")),D!=L))return new R(L,P);if(R.DEBUG)throw Error(Gt+"Not a"+(C?" base "+C:"")+" number: "+D);O.s=null}O.c=O.e=null}})();function V(A,x,b,g){var I,O,D,k,C,P,L,H=A.c,z=Xm;if(H){e:{for(I=1,k=H[0];k>=10;k/=10,I++);if(O=x-I,O<0)O+=de,D=x,C=H[P=0],L=pr(C/z[I-D-1]%10);else if(P=Jm((O+1)/de),P>=H.length)if(g){for(;H.length<=P;H.push(0));C=L=0,I=1,O%=de,D=O-de+1}else break e;else{for(C=k=H[P],I=1;k>=10;k/=10,I++);O%=de,D=O-de+I,L=D<0?0:pr(C/z[I-D-1]%10)}if(g=g||x<0||H[P+1]!=null||(D<0?C:C%z[I-D-1]),g=b<4?(L||g)&&(b==0||b==(A.s<0?3:2)):L>5||L==5&&(b==4||g||b==6&&(O>0?D>0?C/z[I-D]:0:H[P-1])%10&1||b==(A.s<0?8:7)),x<1||!H[0])return H.length=0,g?(x-=A.e+1,H[0]=z[(de-x%de)%de],A.e=-x||0):H[0]=A.e=0,A;if(O==0?(H.length=P,k=1,P--):(H.length=P+1,k=z[de-O],H[P]=D>0?pr(C/z[I-D]%z[D])*k:0),g)for(;;)if(P==0){for(O=1,D=H[0];D>=10;D/=10,O++);for(D=H[0]+=k,k=1;D>=10;D/=10,k++);O!=k&&(A.e++,H[0]==Pr&&(H[0]=1));break}else{if(H[P]+=k,H[P]!=Pr)break;H[P--]=0,k=1}for(O=H.length;H[--O]===0;H.pop());}A.e>p?A.c=A.e=null:A.e<u&&(A.c=[A.e=0])}return A}function $(A){var x,b=A.e;return b===null?A.toString():(x=dr(A.c),x=b<=c||b>=l?yd(x,b):Nn(x,b,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new R(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Yi(this,new R(A,x))},i.decimalPlaces=i.dp=function(A,x){var b,g,I,O=this;if(A!=null)return ze(A,0,mt),x==null?x=a:ze(x,0,8),V(new R(O),A+O.e+1,x);if(!(b=O.c))return null;if(g=((I=b.length-1)-fr(this.e/de))*de,I=b[I])for(;I%10==0;I/=10,g--);return g<0&&(g=0),g},i.dividedBy=i.div=function(A,x){return e(this,new R(A,x),s,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new R(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var b,g,I,O,D,k,C,P,L,H=this;if(A=new R(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+$(A));if(x!=null&&(x=new R(x)),k=A.e>14,!H.c||!H.c[0]||H.c[0]==1&&!H.e&&H.c.length==1||!A.c||!A.c[0])return L=new R(Math.pow(+$(H),k?A.s*(2-Ed(A)):+$(A))),x?L.mod(x):L;if(C=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new R(NaN);g=!C&&H.isInteger()&&x.isInteger(),g&&(H=H.mod(x))}else{if(A.e>9&&(H.e>0||H.e<-1||(H.e==0?H.c[0]>1||k&&H.c[1]>=24e7:H.c[0]<8e13||k&&H.c[0]<=9999975e7)))return O=H.s<0&&Ed(A)?-0:0,H.e>-1&&(O=1/O),new R(C?1/O:O);E&&(O=Jm(E/de+2))}for(k?(b=new R(.5),C&&(A.s=1),P=Ed(A)):(I=Math.abs(+$(A)),P=I%2),L=new R(o);;){if(P){if(L=L.times(H),!L.c)break;O?L.c.length>O&&(L.c.length=O):g&&(L=L.mod(x))}if(I){if(I=pr(I/2),I===0)break;P=I%2}else if(A=A.times(b),V(A,A.e+1,1),A.e>14)P=Ed(A);else{if(I=+$(A),I===0)break;P=I%2}H=H.times(H),O?H.c&&H.c.length>O&&(H.c.length=O):g&&(H=H.mod(x))}return g?L:(C&&(L=o.div(L)),x?L.mod(x):O?V(L,E,a,D):L)},i.integerValue=function(A){var x=new R(this);return A==null?A=a:ze(A,0,8),V(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Yi(this,new R(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Yi(this,new R(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Yi(this,new R(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/de)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Yi(this,new R(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Yi(this,new R(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var b,g,I,O,D=this,k=D.s;if(A=new R(A,x),x=A.s,!k||!x)return new R(NaN);if(k!=x)return A.s=-x,D.plus(A);var C=D.e/de,P=A.e/de,L=D.c,H=A.c;if(!C||!P){if(!L||!H)return L?(A.s=-x,A):new R(H?D:NaN);if(!L[0]||!H[0])return H[0]?(A.s=-x,A):new R(L[0]?D:a==3?-0:0)}if(C=fr(C),P=fr(P),L=L.slice(),k=C-P){for((O=k<0)?(k=-k,I=L):(P=C,I=H),I.reverse(),x=k;x--;I.push(0));I.reverse()}else for(g=(O=(k=L.length)<(x=H.length))?k:x,k=x=0;x<g;x++)if(L[x]!=H[x]){O=L[x]<H[x];break}if(O&&(I=L,L=H,H=I,A.s=-A.s),x=(g=H.length)-(b=L.length),x>0)for(;x--;L[b++]=0);for(x=Pr-1;g>k;){if(L[--g]<H[g]){for(b=g;b&&!L[--b];L[b]=x);--L[b],L[g]+=Pr}L[g]-=H[g]}for(;L[0]==0;L.splice(0,1),--P);return L[0]?B(A,L,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var b,g,I=this;return A=new R(A,x),!I.c||!A.s||A.c&&!A.c[0]?new R(NaN):!A.c||I.c&&!I.c[0]?new R(I):(m==9?(g=A.s,A.s=1,b=e(I,A,0,3),A.s=g,b.s*=g):b=e(I,A,0,m),A=I.minus(b.times(A)),!A.c[0]&&m==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var b,g,I,O,D,k,C,P,L,H,z,Y,pe,Oe,Fe,me=this,we=me.c,st=(A=new R(A,x)).c;if(!we||!st||!we[0]||!st[0])return!me.s||!A.s||we&&!we[0]&&!st||st&&!st[0]&&!we?A.c=A.e=A.s=null:(A.s*=me.s,!we||!st?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(g=fr(me.e/de)+fr(A.e/de),A.s*=me.s,C=we.length,H=st.length,C<H&&(pe=we,we=st,st=pe,I=C,C=H,H=I),I=C+H,pe=[];I--;pe.push(0));for(Oe=Pr,Fe=pi,I=H;--I>=0;){for(b=0,z=st[I]%Fe,Y=st[I]/Fe|0,D=C,O=I+D;O>I;)P=we[--D]%Fe,L=we[D]/Fe|0,k=Y*P+L*z,P=z*P+k%Fe*Fe+pe[O]+b,b=(P/Oe|0)+(k/Fe|0)+Y*L,pe[O--]=P%Oe;pe[O]=b}return b?++g:pe.splice(0,1),B(A,pe,g)},i.negated=function(){var A=new R(this);return A.s=-A.s||null,A},i.plus=function(A,x){var b,g=this,I=g.s;if(A=new R(A,x),x=A.s,!I||!x)return new R(NaN);if(I!=x)return A.s=-x,g.minus(A);var O=g.e/de,D=A.e/de,k=g.c,C=A.c;if(!O||!D){if(!k||!C)return new R(I/0);if(!k[0]||!C[0])return C[0]?A:new R(k[0]?g:I*0)}if(O=fr(O),D=fr(D),k=k.slice(),I=O-D){for(I>0?(D=O,b=C):(I=-I,b=k),b.reverse();I--;b.push(0));b.reverse()}for(I=k.length,x=C.length,I-x<0&&(b=C,C=k,k=b,x=I),I=0;x;)I=(k[--x]=k[x]+C[x]+I)/Pr|0,k[x]=Pr===k[x]?0:k[x]%Pr;return I&&(k=[I].concat(k),++D),B(A,k,D)},i.precision=i.sd=function(A,x){var b,g,I,O=this;if(A!=null&&A!==!!A)return ze(A,1,mt),x==null?x=a:ze(x,0,8),V(new R(O),A,x);if(!(b=O.c))return null;if(I=b.length-1,g=I*de+1,I=b[I]){for(;I%10==0;I/=10,g--);for(I=b[0];I>=10;I/=10,g++);}return A&&O.e+1>g&&(g=O.e+1),g},i.shiftedBy=function(A){return ze(A,-Ym,Ym),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,b,g,I,O=this,D=O.c,k=O.s,C=O.e,P=s+4,L=new R("0.5");if(k!==1||!D||!D[0])return new R(!k||k<0&&(!D||D[0])?NaN:D?O:1/0);if(k=Math.sqrt(+$(O)),k==0||k==1/0?(x=dr(D),(x.length+C)%2==0&&(x+="0"),k=Math.sqrt(+x),C=fr((C+1)/2)-(C<0||C%2),k==1/0?x="5e"+C:(x=k.toExponential(),x=x.slice(0,x.indexOf("e")+1)+C),b=new R(x)):b=new R(k+""),b.c[0]){for(C=b.e,k=C+P,k<3&&(k=0);;)if(I=b,b=L.times(I.plus(e(O,I,P,1))),dr(I.c).slice(0,k)===(x=dr(b.c)).slice(0,k))if(b.e<C&&--k,x=x.slice(k-3,k+1),x=="9999"||!g&&x=="4999"){if(!g&&(V(I,I.e+s+2,0),I.times(I).eq(O))){b=I;break}P+=4,k+=4,g=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&(V(b,b.e+s+2,1),A=!b.times(b).eq(O));break}}return V(b,b.e+s+1,a,A)},i.toExponential=function(A,x){return A!=null&&(ze(A,0,mt),A++),M(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(ze(A,0,mt),A=A+this.e+1),M(this,A,x)},i.toFormat=function(A,x,b){var g,I=this;if(b==null)A!=null&&x&&typeof x=="object"?(b=x,x=null):A&&typeof A=="object"?(b=A,A=x=null):b=v;else if(typeof b!="object")throw Error(Gt+"Argument not an object: "+b);if(g=I.toFixed(A,x),I.c){var O,D=g.split("."),k=+b.groupSize,C=+b.secondaryGroupSize,P=b.groupSeparator||"",L=D[0],H=D[1],z=I.s<0,Y=z?L.slice(1):L,pe=Y.length;if(C&&(O=k,k=C,C=O,pe-=O),k>0&&pe>0){for(O=pe%k||k,L=Y.substr(0,O);O<pe;O+=k)L+=P+Y.substr(O,k);C>0&&(L+=P+Y.slice(O)),z&&(L="-"+L)}g=H?L+(b.decimalSeparator||"")+((C=+b.fractionGroupSize)?H.replace(new RegExp("\\d{"+C+"}\\B","g"),"$&"+(b.fractionGroupSeparator||"")):H):L}return(b.prefix||"")+g+(b.suffix||"")},i.toFraction=function(A){var x,b,g,I,O,D,k,C,P,L,H,z,Y=this,pe=Y.c;if(A!=null&&(k=new R(A),!k.isInteger()&&(k.c||k.s!==1)||k.lt(o)))throw Error(Gt+"Argument "+(k.isInteger()?"out of range: ":"not an integer: ")+$(k));if(!pe)return new R(Y);for(x=new R(o),P=b=new R(o),g=C=new R(o),z=dr(pe),O=x.e=z.length-Y.e-1,x.c[0]=Xm[(D=O%de)<0?de+D:D],A=!A||k.comparedTo(x)>0?O>0?x:P:k,D=p,p=1/0,k=new R(z),C.c[0]=0;L=e(k,x,0,1),I=b.plus(L.times(g)),I.comparedTo(A)!=1;)b=g,g=I,P=C.plus(L.times(I=P)),C=I,x=k.minus(L.times(I=x)),k=I;return I=e(A.minus(b),g,0,1),C=C.plus(I.times(P)),b=b.plus(I.times(g)),C.s=P.s=Y.s,O=O*2,H=e(P,g,O,a).minus(Y).abs().comparedTo(e(C,b,O,a).minus(Y).abs())<1?[P,g]:[C,b],p=D,H},i.toNumber=function(){return+$(this)},i.toPrecision=function(A,x){return A!=null&&ze(A,1,mt),M(this,A,x,2)},i.toString=function(A){var x,b=this,g=b.s,I=b.e;return I===null?g?(x="Infinity",g<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?yd(dr(b.c),I):Nn(dr(b.c),I,"0"):A===10&&S?(b=V(new R(b),s+I+1,a),x=Nn(dr(b.c),b.e,"0")):(ze(A,2,N.length,"Base"),x=r(Nn(dr(b.c),I,"0"),10,A,g,!0)),g<0&&b.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return $(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&R.set(t),R}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,o=t[0]+"";n<i;){for(e=t[n++]+"",r=de-e.length;r--;e="0"+e);o+=e}for(i=o.length;o.charCodeAt(--i)===48;);return o.slice(0,i+1||1)}function Yi(t,e){var r,n,i=t.c,o=e.c,s=t.s,a=e.s,c=t.e,l=e.e;if(!s||!a)return null;if(r=i&&!i[0],n=o&&!o[0],r||n)return r?n?0:-a:s;if(s!=a)return s;if(r=s<0,n=c==l,!i||!o)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=o.length)?c:l,s=0;s<a;s++)if(i[s]!=o[s])return i[s]>o[s]^r?1:-1;return c==l?0:c>l^r?1:-1}function ze(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function Ed(t){var e=t.c.length-1;return fr(t.e/de)==e&&t.c[e]%2!=0}function yd(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function Nn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var H0=IT(),xT=H0;var F0=24,cc=32,V0=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,Zm=V0(),Qm=(t=4,e=Zm)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function B0(t){let e=new xT(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var ST=(t="")=>{let e=new TextEncoder;return B0(TT(e.encode(t))).toString(36).slice(1)},bT=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),j0=t=>bT[Math.floor(t()*bT.length)],G0=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=Zm}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Qm(cc,e):Qm(cc,e);return ST(n).substring(0,cc)},$0=t=>()=>t++,q0=476782367,wT=({random:t=Zm,counter:e=$0(Math.floor(t()*q0)),length:r=F0,fingerprint:n=G0({random:t})}={})=>{if(r>cc)throw new Error(`Length must be between 2 and ${cc}. Received: ${r}`);return function(){let o=j0(t),s=Date.now().toString(36),a=e().toString(36),c=Qm(r,t),l=`${s+c+a+n}`;return`${o+ST(l).substring(1,r)}`}},ht=W0(wT);function W0(t){let e;return()=>(e||(e=t()),e())}function Is(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Ce(t){return Is(t)==="ConditionalCheckFailedException"}function z0(t){let e=Is(t),r=t instanceof Error?t.message:typeof t=="string"?t:void 0;return[e,r].filter(Boolean).join(": ")||String(t)}function NT(t,e){console.error(`[repo-plugin-dynamodb] ${t} failed \u2014 ${z0(e)}`)}function G(t,e){return NT(t,e),te.DatabaseQueryError({query:t})}function Rt(t,e){return NT(t,e),te.UnknownError({message:t})}var lc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return ht()}async get(e){try{let r=await this.docClient.send(new Y0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()}}));if(!r.Item)return T(null);let n=this.unmarshall(r.Item);return $m(re(n.expiresAt))?T(null):T(n)}catch(r){return d(G("get challenge",r))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:J(r)},o=re(e.expiresAt),s=Math.floor((o+this.ttlGracePeriod)/1e3);return await this.docClient.send(new X0({TableName:this.tableName,Item:this.marshall(i,s)})),T(i)}catch(r){return d(G("create challenge",r))}}async update(e,r){try{let n=[],i={},o={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=h.METHOD,o[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=h.PHASE,o[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=h.CODE_HASH,o[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=h.CHALLENGE_STATUS,o[":challengeStatus"]=r.status),n.length===0?T(void 0):(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T(void 0))}catch(n){return d(G("update challenge",n))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let s=(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":h.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[h.ATTEMPTS]??0;return T(s)}catch(o){return Ce(o)?d(te.AttemptsExceeded()):d(G("increment challenge attempts",o))}}async remove(e){try{return await this.docClient.send(new J0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":h.PK}})),T(void 0)}catch(r){return Ce(r)?T(void 0):d(G("remove challenge",r))}}marshall(e,r){let n={[h.PK]:U.CHALLENGE_PK(e.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:e.userId,[h.PURPOSE]:e.purpose,[h.CHALLENGE_STATUS]:e.status,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.TTL]:r};return e.tenantId&&(n[h.TENANT_ID]=e.tenantId),e.phase&&(n[h.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[h.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[h.METHOD]=e.method),e.codeHash&&(n[h.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[h.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[h.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[h.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[h.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[h.COUNTRY]=e.country),e.city&&(n[h.CITY]=e.city),e.metadata&&(n[h.METADATA]=e.metadata),e.flowKey&&(n[h.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[h.PK]),userId:e[h.USER_ID],purpose:e[h.PURPOSE],status:e[h.CHALLENGE_STATUS],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT])};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.PHASE]&&(n.phase=e[h.PHASE]),e[h.ALLOWED_METHODS]&&(n.allowedMethods=e[h.ALLOWED_METHODS]),e[h.METHOD]&&(n.method=e[h.METHOD]),e[h.CODE_HASH]&&(n.codeHash=e[h.CODE_HASH]),e[h.ATTEMPTS]!==void 0&&(n.attempts=e[h.ATTEMPTS]),e[h.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[h.MAX_ATTEMPTS]),e[h.IDENTITY_TYPE]&&(n.identityType=e[h.IDENTITY_TYPE]),e[h.IDENTITY_VALUE]&&(n.identityValue=e[h.IDENTITY_VALUE]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.FLOW_KEY]&&(n.flowKey=e[h.FLOW_KEY]),n}};import{BatchGetCommand as Q0,DeleteCommand as Z0,GetCommand as eO,PutCommand as tO,QueryCommand as gd,UpdateCommand as rO}from"@aws-sdk/lib-dynamodb";var uc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return ht()}async get(e){try{let r=await this.docClient.send(new eO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get credential",r))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return T(null);let i=n.Items[0];if(!i)return T(null);let o=le.credentialId(i[h.PK]);return this.get(o)}catch(n){return d(G("get credential by user and type",n))}}async getByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(s=>le.credentialId(s[h.PK])),i=await this.batchGet(n);if(i.ok===!1)return d(i.errors,i.meta);if(!i.data)return T([]);let o=i.data.filter(s=>s!==null);return T(o)}catch(r){return d(G("get credentials by user",r))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new tO({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(i)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"credential"})):d(G("create credential",r))}}async update(e,r){try{let n=ae(),i=[],o={},s={};return i.push(`#${h.UPDATED_AT} = :updatedAt`),o[`#${h.UPDATED_AT}`]=h.UPDATED_AT,s[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${h.CREDENTIAL_VALUE} = :value`),o[`#${h.CREDENTIAL_VALUE}`]=h.CREDENTIAL_VALUE,s[":value"]=r.value),r.data!==void 0&&(i.push(`#${h.METADATA} = :data`),o[`#${h.METADATA}`]=h.METADATA,s[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${h.REVOKED_AT} = :revokedAt`),o[`#${h.REVOKED_AT}`]=h.REVOKED_AT,s[":revokedAt"]=r.revokedAt?re(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${h.LAST_USED_AT} = :lastUsedAt`),o[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,s[":lastUsedAt"]=r.lastUsedAt?re(r.lastUsedAt):null),await this.docClient.send(new rO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"credential",id:e})):d(G("update credential",n))}}async remove(e){try{return await this.docClient.send(new Z0({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(r){return Ce(r)?d(te.NotFound({entity:"credential",id:e})):d(G("delete credential",r))}}async hasType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return T((n.Count||0)>0)}catch(n){return d(G("check credential type",n))}}async countByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count credentials",r))}}async batchGet(e){if(e.length===0)return T([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let s=(await this.docClient.send(new Q0({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[h.PK]:U.CREDENTIAL_PK(c),[h.SK]:U.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of s){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return T(n)}catch(r){return d(G("batch get credentials",r))}}marshall(e){let r={[h.PK]:U.CREDENTIAL_PK(e.id),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(e.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(e.type,e.id),[h.USER_ID]:e.userId,[h.CREDENTIAL_VALUE]:e.value,[h.METADATA]:e.data,[h.REVOKED_AT]:e.revokedAt?re(e.revokedAt):null,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)};return e.lastUsedAt&&(r[h.LAST_USED_AT]=re(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[h.PK]),n=le.credentialTypeFromUserSK(e[h.CREDENTIAL_USER_SK]);return{id:r,userId:e[h.USER_ID],type:n,value:e[h.CREDENTIAL_VALUE],data:e[h.METADATA]||{},revokedAt:Kt(e[h.REVOKED_AT]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT]),lastUsedAt:Kt(e[h.LAST_USED_AT])}}};import{BatchGetCommand as nO,DeleteCommand as iO,GetCommand as oO,PutCommand as sO,QueryCommand as aO,UpdateCommand as eh}from"@aws-sdk/lib-dynamodb";function th(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Cr(t.lastFailedAt),lockedUntil:Cr(t.lockedUntil)}}function OT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Kt(n.lastFailedAt),lockedUntil:Kt(n.lockedUntil)};return e}function kT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=th(n));return e}var dc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new oO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}}));if(!n.Item)return T(null);let i=this.unmarshall(n.Item);return T(i)}catch(n){return d(G("get identity",n))}}async getByUserId(e){try{let r=await this.docClient.send(new aO({TableName:this.tableName,IndexName:ue.USER_IDENTITIES,KeyConditionExpression:`${h.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":U.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let o=this.unmarshall(i);o!==null&&n.push(o)}return T(n)}catch(r){return d(G("get identities by userId",r))}}async create(e){try{let r=ae(),n={...e,createdAt:J(r),updatedAt:J(r)};return await this.docClient.send(new sO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"identity"})):d(G("create identity",r))}}async update(e,r,n){try{let i=[],o=[],s={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),s["#loginEnabled"]=h.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Cr(n.verifiedAt);l===null?(o.push("#verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),s["#guards"]=h.GUARDS,a[":guards"]=kT(n.guards)),n.pendingVerification!==void 0&&(s["#pendingVerification"]=h.PENDING_VERIFICATION,n.pendingVerification===null?o.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),s["#updatedAt"]=h.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),o.length>0&&c.push(`REMOVE ${o.join(", ")}`),await this.docClient.send(new eh({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update identity",i))}}async remove(e,r){try{return await this.docClient.send(new iO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}})),T(void 0)}catch(n){return d(G("remove identity",n))}}async updateGuard(e,r,n,i){let o={[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()};try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":h.GUARDS,"#guardKey":n,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guard":th(i),":updatedAt":ae()}})),T(void 0)}catch(s){if(Ce(s))try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":h.GUARDS,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:th(i)},":updatedAt":ae()}})),T(void 0)}catch(a){return d(G("update guard",a))}return d(G("update guard",s))}}async batchGet(e){try{if(e.length===0)return T([]);let n=(await this.docClient.send(new nO({RequestItems:{[this.tableName]:{Keys:e.map(({type:s,value:a})=>({[h.PK]:U.IDENTITY_PK(s,a),[h.SK]:U.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let s of n){let a=this.unmarshall(s);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let o=e.map(({type:s,value:a})=>{let c=`${s}#${a}`;return i.get(c)||null});return T(o)}catch(r){return d(G("batch get identities",r))}}marshall(e){let r={[h.PK]:U.IDENTITY_PK(e.type,e.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(e.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(e.type,e.value),[h.USER_ID]:e.userId,[h.LOGIN_ENABLED]:e.loginEnabled,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)},n=Cr(e.verifiedAt);return n!==null&&(r[h.VERIFIED_AT]=n),r[h.GUARDS]=kT(e.guards),e.pendingVerification&&(r[h.PENDING_VERIFICATION]=Ht({...e.pendingVerification,expiresAt:re(e.pendingVerification.expiresAt),resendAvailableAt:Cr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[h.PK]);if(!r){let n=e[h.IDENTITY_USER_SK]?le.userIndexSKInfo(e[h.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[h.PK],GSI1SK:e[h.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:J(r.expiresAt),resendAvailableAt:Kt(r.resendAvailableAt)}}};import{TransactWriteCommand as cO}from"@aws-sdk/lib-dynamodb";var pc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=ht(),i=re(e.challenge.expiresAt),o=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new cO({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,o))]})),T(void 0)}catch(r){return Is(r)==="TransactionCanceledException"||Ce(r)?d(te.UniqueConstraintViolation({field:"registration"})):d(G("create email verification registration transaction",r))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ht(e),ConditionExpression:`attribute_not_exists(${h.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[h.PK]:U.USER_PK(e.profile.id),[h.SK]:U.USER_PROFILE_SK(),userStatus:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[h.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[h.PK]:U.USER_PK(e.userAuth.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[h.CREATED_AT]:r,[h.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[h.PK]:U.IDENTITY_PK(n.type,n.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(n.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(n.type,n.value),[h.USER_ID]:n.userId,[h.LOGIN_ENABLED]:n.loginEnabled,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.PENDING_VERIFICATION]:Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)})},o=Cr(n.verifiedAt);return o!==null&&(i[h.VERIFIED_AT]=o),i[h.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,o={[h.PK]:U.CREDENTIAL_PK(r),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(i.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(i.type,r),[h.USER_ID]:i.userId,[h.CREDENTIAL_VALUE]:i.value,[h.METADATA]:i.data,[h.REVOKED_AT]:i.revokedAt?re(i.revokedAt):null,[h.CREATED_AT]:n,[h.UPDATED_AT]:n};return i.lastUsedAt&&(o[h.LAST_USED_AT]=re(i.lastUsedAt)),o}marshallChallenge(e,r,n){let i=e.challenge,o={[h.PK]:U.CHALLENGE_PK(i.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:i.userId,[h.PURPOSE]:i.purpose,[h.CHALLENGE_STATUS]:i.status,[h.EXPIRES_AT]:re(i.expiresAt),[h.CREATED_AT]:r,[h.TTL]:n};return i.tenantId&&(o[h.TENANT_ID]=i.tenantId),i.phase&&(o[h.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(o[h.ALLOWED_METHODS]=i.allowedMethods),i.method&&(o[h.METHOD]=i.method),i.codeHash&&(o[h.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(o[h.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(o[h.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(o[h.IDENTITY_TYPE]=i.identityType),i.identityValue&&(o[h.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(o[h.DEVICE_LABEL]=i.deviceLabel),i.country&&(o[h.COUNTRY]=i.country),i.city&&(o[h.CITY]=i.city),i.metadata&&(o[h.METADATA]=i.metadata),i.flowKey&&(o[h.FLOW_KEY]=i.flowKey),o}};import{DynamoDBClient as dO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as pO,GetCommand as PT,PutCommand as fO,QueryCommand as fc,UpdateCommand as bs}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as lO}from"@aws-sdk/lib-dynamodb";var CT=100,DT=5;function uO(t){return new Promise(e=>setTimeout(e,t))}async function xs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=CT){let o=r.slice(i,i+CT),s=0;for(;o.length>0;){let a=await t.send(new lO({RequestItems:{[e]:{Keys:o}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(s+=1,s>DT)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${DT} retries`);o=l,await uO(2**s*25)}}return n}var mc=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new dO({});this.docClient=e.docClient||pO.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return ht()}generateTokenId(){return ht()}async get(e){try{let r=await this.docClient.send(new PT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get session",r))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),o={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},s=sc(re(e.expiresAt)+this.ttlGracePeriod),a=hd.sessionSK(r,n);return await this.docClient.send(new fO({TableName:this.tableName,Item:this.marshall(o,s,a)})),T(o)}catch(r){return d(G("create session",r))}}async update(e,r){try{let n=[],i={},o={};if(r.tokenId!==void 0&&(n.push(`#${h.TOKEN_ID} = :tokenId`),i[`#${h.TOKEN_ID}`]=h.TOKEN_ID,o[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${h.EXPIRES_AT} = :expiresAt`),i[`#${h.EXPIRES_AT}`]=h.EXPIRES_AT,o[":expiresAt"]=re(r.expiresAt);let s=sc(re(r.expiresAt)+this.ttlGracePeriod);n.push(`#${h.TTL} = :ttl`),i[`#${h.TTL}`]=h.TTL,o[":ttl"]=s}return r.lastUsedAt!==void 0&&(n.push(`#${h.LAST_USED_AT} = :lastUsedAt`),i[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,o[":lastUsedAt"]=re(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${h.METADATA} = :metadata`),i[`#${h.METADATA}`]=h.METADATA,o[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${h.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${h.PREVIOUS_TOKEN_ID}`]=h.PREVIOUS_TOKEN_ID,o[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${h.ROTATED_AT} = :rotatedAt`),i[`#${h.ROTATED_AT}`]=h.ROTATED_AT,o[":rotatedAt"]=r.rotatedAt),n.length===0?T():(await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T())}catch(n){return d(G("update session",n))}}async rotateToken(e,r,n){try{let i=sc(re(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.TOKEN_ID} = :tokenId, #${h.PREVIOUS_TOKEN_ID} = :previousTokenId, #${h.ROTATED_AT} = :rotatedAt, #${h.EXPIRES_AT} = :expiresAt, #${h.LAST_USED_AT} = :lastUsedAt, #${h.TTL} = :ttl`,ConditionExpression:`#${h.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.PREVIOUS_TOKEN_ID}`]:h.PREVIOUS_TOKEN_ID,[`#${h.ROTATED_AT}`]:h.ROTATED_AT,[`#${h.EXPIRES_AT}`]:h.EXPIRES_AT,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT,[`#${h.TTL}`]:h.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":re(n.expiresAt),":lastUsedAt":re(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),T(!0)}catch(i){return Ce(i)?T(!1):d(G("rotate session token",i))}}async switchTenant(e,r){try{let n=[`#${h.TENANT_ID} = :tenantId`,`#${h.TOKEN_ID} = :tokenId`,`#${h.LAST_USED_AT} = :lastUsedAt`],i=[],o={[`#${h.TENANT_ID}`]:h.TENANT_ID,[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT},s={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};o[`#${h.TENANT_TYPE}`]=h.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${h.TENANT_TYPE} = :tenantType`),s[":tenantType"]=r.tenantType):i.push(`#${h.TENANT_TYPE}`),o[`#${h.PERM}`]=h.PERM,r.perms!==void 0?(n.push(`#${h.PERM} = :perms`),s[":perms"]=JSON.stringify(r.perms)):i.push(`#${h.PERM}`),o[`#${h.ROLES}`]=h.ROLES,r.roles!==void 0?(n.push(`#${h.ROLES} = :roles`),s[":roles"]=r.roles):i.push(`#${h.ROLES}`),o["#revokedAt"]=h.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK}) AND attribute_not_exists(#revokedAt)`})),T()}catch(n){return Ce(n)?d(te.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):d(G("switch tenant",n))}}async revoke(e){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date)},ConditionExpression:`attribute_exists(${h.PK})`})),T()}catch(r){return Ce(r)?T():d(G("revoke session",r))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ConditionExpression:`#${h.USER_ID} = :userId AND attribute_not_exists(#${h.REVOKED_AT})`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.USER_ID}`]:h.USER_ID,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date),":userId":r}})),T()}catch(n){return Ce(n)?T():d(G("revoke session by user",n))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.USER_SESSIONS,KeyConditionExpression:`${h.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find sessions by user",n))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find active sessions by user",n))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(i=>{let o=le.sessionId(i[h.PK]),s=hd.extractCreatedAt(i[h.ACTIVE_SESSION_SK]);return{id:o,createdAt:new Date(s)}});return T(n)}catch(r){return d(G("get active sessions for limit",r))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=re(new Date),i=await Promise.allSettled(e.map(s=>this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(s),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),o=0;for(let s of i)s.status==="fulfilled"?o+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Is(s.reason)});return o}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return T(0);let i=n.Items.map(s=>le.sessionId(s[h.PK])).filter(s=>!r||s!==r),o=await this.revokeSessionsByIds(i,"revokeAllByUserId");return T(o)}catch(n){return d(G("revoke all sessions by user",n))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return T(r)}catch(r){return d(G("revoke batch sessions",r))}}async countByUserId(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count active sessions by user",r))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new PT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(r),[h.SK]:U.SESSION_SK()},ProjectionExpression:`${h.TOKEN_ID}, ${h.REVOKED_AT}, ${h.EXPIRES_AT}`}));if(!n.Item)return T(!1);let i=n.Item,o=i[h.TOKEN_ID]===e&&!i[h.REVOKED_AT]&&J(i[h.EXPIRES_AT])>new Date;return T(o)}catch(n){return d(G("check token active",n))}}marshall(e,r,n){let i={[h.PK]:U.SESSION_PK(e.id),[h.SK]:U.SESSION_SK(),[h.USER_SESSION_PK]:U.USER_PK(e.userId),[h.USER_SESSION_SK]:n,...!e.revokedAt&&{[h.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[h.ACTIVE_SESSION_SK]:n},[h.USER_ID]:e.userId,[h.TOKEN_ID]:e.tokenId,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.LAST_USED_AT]:re(e.lastUsedAt),[h.TTL]:r};return e.tenantId&&(i[h.TENANT_ID]=e.tenantId),e.tenantType&&(i[h.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[h.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[h.ROLES]=e.roles),e.deviceLabel&&(i[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[h.COUNTRY]=e.country),e.city&&(i[h.CITY]=e.city),e.metadata&&(i[h.METADATA]=e.metadata),e.revokedAt&&(i[h.REVOKED_AT]=re(e.revokedAt)),e.previousTokenId&&(i[h.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[h.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[h.PK]),userId:e[h.USER_ID],tokenId:e[h.TOKEN_ID],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT]),lastUsedAt:J(e[h.LAST_USED_AT]),revokedAt:e[h.REVOKED_AT]?J(e[h.REVOKED_AT]):null};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.TENANT_TYPE]&&(n.tenantType=e[h.TENANT_TYPE]),e[h.PERM]!==void 0&&(n.perms=JSON.parse(e[h.PERM])),e[h.ROLES]!==void 0&&(n.roles=e[h.ROLES]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[h.PREVIOUS_TOKEN_ID]),e[h.ROTATED_AT]!==void 0&&(n.rotatedAt=e[h.ROTATED_AT]),n}};import{QueryCommand as mO}from"@aws-sdk/lib-dynamodb";var hc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new mO(s)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(i.declinedAt=J(e.declinedAt)),e.revokedAt&&(i.revokedAt=J(e.revokedAt)),i}};import{GetCommand as UT,PutCommand as hO,QueryCommand as fi,UpdateCommand as EO}from"@aws-sdk/lib-dynamodb";var yO=10080*60*1e3,Ec=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[h.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(n.declinedAt=J(e.declinedAt)),e.revokedAt&&(n.revokedAt=J(e.revokedAt)),n}generateInviteId(){return ht()}async getById(e){try{let r=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()}}));return r.Item?T(this.mapItemToEntity(r.Item)):T(null)}catch(r){return d(G("getById invite",r))}}async getByToken(e){try{let n=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":h.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return T(null);let i=n[0],o=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return o.Item?T(this.mapItemToEntity(o.Item)):T(null)}catch(r){return d(G("getByToken invite",r))}}async create(e){try{let r=ae(),n=re(e.expiresAt),i=Math.floor((n+yO)/1e3),o={PK:U.INVITE_PK(e.id),SK:U.INVITE_SK(),[h.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[h.INVITED_BY_ID]:e.invitedById,[h.INVITE_STATUS]:e.status,[h.INVITE_TOKEN]:e.inviteToken,[h.EXPIRES_AT]:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.TTL]:i,[h.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[h.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[h.INVITE_TOKEN_GSI]:e.inviteToken},s={};e.invitedByName&&(s.name=e.invitedByName),e.invitedByEmail&&(s.email=e.invitedByEmail),e.invitedByJobTitle&&(s.jobTitle=e.invitedByJobTitle),Object.keys(s).length>0&&(o[h.INVITED_BY_INFO]=s),e.inviteeUserId&&(o[h.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(o[h.INVITEE_EMAIL]=e.inviteeEmail,o[h.INVITEE_EMAIL_GSI]=e.inviteeEmail,o[h.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(o[h.INVITEE_PHONE]=e.inviteePhone,o[h.INVITEE_PHONE_GSI]=e.inviteePhone,o[h.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(o[h.ROLES]=e.roles),e.perms!==void 0&&(o[h.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(o[h.AUTH_PERM]=e.authPerm),e.displayName&&(o[h.DISPLAY_NAME]=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.jobTitle&&(o.jobTitle=e.jobTitle),await this.docClient.send(new hO({TableName:this.tableName,Item:o,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:J(r),updatedAt:J(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),T(a)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"invite id"})):d(Rt("create invite",r))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],o={"#inviteStatus":h.INVITE_STATUS,"#inviteTenantSk":h.INVITE_TENANT_SK,"#updatedAt":h.UPDATED_AT},s={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),o["#acceptedAt"]=h.ACCEPTED_AT,s[":acceptedAt"]=re(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),o["#declinedAt"]=h.DECLINED_AT,s[":declinedAt"]=re(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),o["#revokedAt"]=h.REVOKED_AT,s[":revokedAt"]=re(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),o["#inviteTokenGsi"]=h.INVITE_TOKEN_GSI,o["#inviteeEmailGsi"]=h.INVITEE_EMAIL_GSI,o["#inviteeEmailTenantSk"]=h.INVITEE_EMAIL_TENANT_SK,o["#inviteePhoneGsi"]=h.INVITEE_PHONE_GSI,o["#inviteePhoneTenantSk"]=h.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new EO({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantInvite",id:e})):d(Rt("updateStatus invite",n))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":h.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndEmail",n))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":h.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndPhone",n))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK,"#inviteeUserId":h.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndUserId",n))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new fi(s)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByEmail",r))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByPhone",r))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return T(r.Count??0)}catch(r){return d(G("countPendingByTenant",r))}}async expireOld(e){return T(0)}};import{QueryCommand as gO}from"@aws-sdk/lib-dynamodb";var yc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=(await this.docClient.send(new gO(i))).Items||[],a=[],c=new Map;for(let m of s){let E=m.SK;if(E.startsWith(Be.TENANT_PROFILE)){let v=le.tenantProfileUserId(E);c.set(v,m)}else E.startsWith(ce.USER)&&a.push(m)}a.sort((m,E)=>E.createdAt-m.createdAt);let l=a.slice(0,n),u=a.length>n,p=l.map(m=>{let E=le.tenantMemberUserId(m.SK),v=c.get(E);return this.toListItem(m,e,E,v)}),f=u&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:u,cursor:f,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e,r,n,i){let o={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};if(e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm),i){let s={tenantId:r,userId:n,createdAt:J(i.createdAt),updatedAt:J(i.updatedAt)};i.contactEmail&&(s.contactEmail=i.contactEmail),i.contactPhone&&(s.contactPhone=i.contactPhone),i.displayName&&(s.displayName=i.displayName),i.displayNameSource&&(s.displayNameSource=i.displayNameSource),i.givenName&&(s.givenName=i.givenName),i.familyName&&(s.familyName=i.familyName),i.avatarUrl&&(s.avatarUrl=i.avatarUrl),i.locale&&(s.locale=i.locale),i.jobTitle&&(s.jobTitle=i.jobTitle),i.bio&&(s.bio=i.bio),i.metadata&&(s.metadata=JSON.parse(i.metadata)),o.tenantProfile=s}return o}};import{DeleteCommand as vO,DynamoDBDocumentClient as AO,GetCommand as LT,PutCommand as TO,QueryCommand as _O,TransactWriteCommand as IO,UpdateCommand as MT}from"@aws-sdk/lib-dynamodb";var gc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=AO.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)}}));if(!n.Item)return T(null);let i=this.mapItemToEntity(n.Item);return T(i)}catch(n){return d(G("get",n))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ht({PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new IO({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new TO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?d(te.UniqueConstraintViolation({field:"tenant owner"})):d(te.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant member"})):d(Rt("create tenant member",r))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updatePermissions tenant member",i))}}async updateStatus(e,r,n){try{return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updateStatus tenant member",i))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=await this.docClient.send(new _O(i)),s=(o.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!o.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return mr(s,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async hasOwner(e){try{let r=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_OWNER_MARKER_SK()}}));return T(!!r.Item)}catch(r){return d(G("hasOwner",r))}}async remove(e,r){try{return await this.docClient.send(new vO({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("remove tenant member",n))}}};import{BatchGetCommand as xO,QueryCommand as bO}from"@aws-sdk/lib-dynamodb";var vc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Qt.DEFAULT,o=r?.parentTenantId,s=o?`${i}#${o}#`:`${i}#`,a={TableName:this.tableName,IndexName:ue.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":s},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new bO(a)),l=c.Items??[],u=await this.fetchProfileMap(e,l),p=l.map(E=>this.toListItem(E,e,u)),f=!!c.LastEvaluatedKey,m=f?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:f,cursor:m,prevCursor:r?.cursor??null})}catch(n){return d(G("listByUser query",n))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(s=>({PK:U.TENANT_PROFILE_PK(le.tenantId(s.PK)),SK:U.TENANT_PROFILE_SK(e)})),o=await this.docClient.send(new xO({RequestItems:{[this.tableName]:{Keys:i}}}));for(let s of o.Responses?.[this.tableName]??[]){let a=s,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),o={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm);let s=n.get(i);return s&&(s.contactEmail&&(o.contactEmail=s.contactEmail),s.contactPhone&&(o.contactPhone=s.contactPhone),s.displayName&&(o.displayName=s.displayName),s.displayNameSource&&(o.displayNameSource=s.displayNameSource),s.givenName&&(o.givenName=s.givenName),s.familyName&&(o.familyName=s.familyName),s.avatarUrl&&(o.avatarUrl=s.avatarUrl),s.locale&&(o.locale=s.locale),s.jobTitle&&(o.jobTitle=s.jobTitle),s.bio&&(o.bio=s.bio),s.metadata&&(o.metadata=JSON.parse(s.metadata))),o}};import{DeleteCommand as SO,GetCommand as wO,PutCommand as NO,UpdateCommand as RO}from"@aws-sdk/lib-dynamodb";var Ac=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return ht()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new wO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()}}));return r.Item?T(this.toEntity(r.Item)):T(null)}catch(r){return d(G("get tenant",r))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ht({PK:U.TENANT_PK(r),SK:U.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new NO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant"})):d(Rt("create tenant",r))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s}=Dr(n);return await this.docClient.send(new RO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("update tenant",n))}}async delete(e){try{return await this.docClient.send(new SO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("delete tenant",r))}}async list(){return d(te.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return d(te.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return d(te.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as OO,GetCommand as kO,PutCommand as CO,UpdateCommand as vd}from"@aws-sdk/lib-dynamodb";var Tc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new kO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}}));return r.Item?T(this.unmarshall(r.Item,e)):T(null)}catch(r){return d(G("get user auth",r))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new CO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"userAuth"})):d(G("create user auth",r))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update user auth status",n))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa required",n))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa methods",n))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa settings",n))}}async remove(e){try{return await this.docClient.send(new OO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}})),T(void 0)}catch(r){return d(G("remove user auth",r))}}marshall(e){return{[h.PK]:U.USER_PK(e.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}};import{DynamoDBDocumentClient as DO,DeleteCommand as PO,GetCommand as UO,PutCommand as LO,QueryCommand as KT,UpdateCommand as rh}from"@aws-sdk/lib-dynamodb";function Ss(t,e){return e?U.USER_MFA_WITH_ID_SK(t,e):U.USER_MFA_SK(t)}var _c=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=DO.from(e)}toDynamoDBItem(e){let r={PK:U.USER_PK(e.userId),SK:Ss(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:J(e.createdAt),verifiedAt:Kt(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Kt(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Kt(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Kt(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Ss(r,n),o=await this.docClient.send(new UO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}}));return o.Item?T(this.fromDynamoDBItem(o.Item,e)):T(null)}catch(i){return d(G("get MFA authenticator",i))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":Be.MFA}},o=((await this.docClient.send(new KT(r))).Items??[]).map(s=>this.fromDynamoDBItem(s,e));return T(o)}catch(r){return d(G("find MFA authenticators by user",r))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":`${Be.MFA}${r}`}},s=((await this.docClient.send(new KT(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return T(s)}catch(n){return d(G("find MFA authenticators by method",n))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=ht());let n=this.toDynamoDBItem(r);return await this.docClient.send(new LO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(this.fromDynamoDBItem(n,e.userId))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"MFA authenticator"})):d(G("create MFA authenticator",r))}}async update(e,r,n,i){try{let o=Ss(r,n),s=[],a={},c={};if(i.label!==void 0&&(s.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(s.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(s.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(s.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(s.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(s.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(s.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(s.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),s.length===0)return T(void 0);let l={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:o},UpdateExpression:`SET ${s.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new rh(l)),T(void 0)}catch(o){return d(G("update MFA authenticator",o))}}async remove(e,r,n){try{let i=Ss(r,n);return await this.docClient.send(new PO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}})),T(void 0)}catch(i){return d(G("remove MFA authenticator",i))}}async incrementFailedAttempts(e,r,n,i,o){try{let s=Ss(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},u={":zero":0,":inc":1,":lastFailedAt":a};o!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",u[":lockedUntil"]=a+o*60*1e3,u[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:s},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:u};return await this.docClient.send(new rh(p)),T(void 0)}catch(s){return d(G("increment failed attempts",s))}}async resetFailedAttempts(e,r,n){try{let i=Ss(r,n),o={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new rh(o)),T(void 0)}catch(i){return d(G("reset failed attempts",i))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as MO,DynamoDBDocumentClient as KO,GetCommand as HO,PutCommand as FO,QueryCommand as HT,UpdateCommand as FT}from"@aws-sdk/lib-dynamodb";var Ic=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=KO.from(e)}generateUserId(){return ht()}async getById(e){try{let r=await this.docClient.send(new HO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}}));if(!r.Item)return T(null);let n=r.Item;if(n.deletedAt)return T(null);let o={id:le.userId(n.PK),status:n.userStatus,createdAt:J(n.createdAt),updatedAt:J(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:J(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return T(o)}catch(r){return d(G("getById user",r))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",o={PK:U.USER_PK(n),SK:U.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(o.contactEmail=e.contactEmail),e.contactPhone&&(o.contactPhone=e.contactPhone),e.username&&(o.username=e.username),e.displayName&&(o.displayName=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.avatarUrl&&(o.avatarUrl=e.avatarUrl),e.locale&&(o.locale=e.locale),e.metadata&&(o.metadata=JSON.stringify(e.metadata)),o[h.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),o[h.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new FO({TableName:this.tableName,Item:Ht(o),ConditionExpression:qm("PK")}));let s={id:n,status:i,createdAt:J(r),updatedAt:J(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return T(s)}catch(r){return d(G("create user",r))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return T(void 0);i.updatedAt=n;let o=Dr(i);return await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:o.UpdateExpression,ExpressionAttributeNames:o.ExpressionAttributeNames,ExpressionAttributeValues:o.ExpressionAttributeValues})),T(void 0)}catch(n){return d(G("updateProfile",n))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=Ae.USER_STATUS_PK(e),s=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":o},Limit:n,ExclusiveStartKey:i})),a=[];if(s.Items&&s.Items.length>0)for(let u of s.Items){let p=le.userId(u.PK);a.push(p)}let c=!!s.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return T(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch(n){return d(G("get users by status",n))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return T(n.Count||0)}catch(r){return d(G("count users by status",r))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt, #${h.USER_STATUS_PK} = :statusPk, #${h.USER_STATUS_SK} = :statusSk`,o={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",o[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${h.UPDATED_AT}`]:h.UPDATED_AT,[`#${h.USER_STATUS_PK}`]:h.USER_STATUS_PK,[`#${h.USER_STATUS_SK}`]:h.USER_STATUS_SK},ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userProfile",id:e})):d(G("sync auth status",n))}}async remove(e){try{return await this.docClient.send(new MO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}})),T(void 0)}catch(r){return d(G("remove user profile",r))}}};import{DeleteCommand as VO,DynamoDBDocumentClient as BO,GetCommand as jO,PutCommand as GO,QueryCommand as $O,UpdateCommand as qO}from"@aws-sdk/lib-dynamodb";var xc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=BO.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:J(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:U.PROVIDER_PK(e.provider,e.externalId),SK:U.PROVIDER_METADATA_SK(),userProviderPk:U.USER_PK(e.userId),userProviderSk:U.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?re(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ht(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new jO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}}));return n.Item?T(this.mapItemToUserProviderLink(n.Item)):T(null)}catch(n){return d(G("find provider by external id",n))}}async findByUserId(e){try{let r=await this.docClient.send(new $O({TableName:this.tableName,IndexName:ue.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":h.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":U.USER_PK(e)}}));return!r.Items||r.Items.length===0?T([]):T(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch(r){return d(G("find providers by user id",r))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new GO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),T(this.mapItemToUserProviderLink(n))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):d(G("create user provider",r))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return T(void 0);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new qO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update user provider",i))}}async remove(e,r){try{return await this.docClient.send(new VO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}})),T(void 0)}catch(n){return d(G("delete user provider",n))}}};import{DeleteCommand as WO,GetCommand as zO,PutCommand as JO,UpdateCommand as YO}from"@aws-sdk/lib-dynamodb";var bc=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new zO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)}}));return n.Item?T(this.mapItemToEntity(n.Item)):T(null)}catch(n){return d(G("get user tenant profile",n))}}async create(e){try{let r=ae(),n={PK:U.TENANT_PROFILE_PK(e.tenantId),SK:U.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new JO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:J(r),updatedAt:J(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),T(i)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"user tenant profile"})):d(Rt("create user tenant profile",r))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Dr(i);return await this.docClient.send(new YO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("update user tenant profile",i))}}async remove(e,r){try{return await this.docClient.send(new WO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("remove user tenant profile",n))}}};var nh=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new QO(e.clientConfig||{});let r=ZO.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ic(this.client,this.tableName),this.sessions=new mc({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new xc(this.client,this.tableName),this.userMfaAuthenticators=new _c(this.client,this.tableName),this.challenges=new lc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new dc({docClient:r,tableName:this.tableName}),this.credentials=new uc({docClient:r,tableName:this.tableName}),this.registration=new pc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Tc({docClient:r,tableName:this.tableName}),this.tenantMembers=new gc(this.client,this.tableName),this.tenantInvites=new Ec({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new bc(r,this.tableName),this.tenants=new Ac({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new hc({docClient:r,tableName:this.tableName}),tenantMembers:new yc({docClient:r,tableName:this.tableName}),tenants:new vc({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new XO({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function VT(t){return new nh(t)}ra();var ih=1,BT=2,jT=3,GT="auth-craft:internal";async function ek(t){let e=t.replace(/^0x/,""),r=qT(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let o=`-----BEGIN PRIVATE KEY-----
|
|
132
132
|
`+btoa(String.fromCharCode(...i)).match(/.{1,64}/g).join(`
|
|
133
133
|
`)+`
|
|
134
134
|
-----END PRIVATE KEY-----`;return ta(o,"EdDSA")}async function tk(t){let e=t.replace(/^0x/,""),r=qT(e),n=nk(r);return Vt({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function oh(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
|
|
135
135
|
`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return ek(r)}if(r.startsWith("-----"))return ta(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function $T(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
|
|
136
|
-
`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return tk(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ra(),GE));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function rk(t){return new TextEncoder().encode(t)}function qT(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function nk(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var Ad=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await rk(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await oh(this.config.privateKey,e),i=await $T(this.config.publicKey,e),o,s;return this.config.servicePrivateKey&&this.config.servicePublicKey?(o=await oh(this.config.servicePrivateKey,e),s=await $T(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(o=await oh(this.config.servicePrivateKey,e),s=i):(o=n,s=i),{privateKey:n,publicKey:i,servicePrivateKey:o,servicePublicKey:s}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),o=i+r*60,s=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:s??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?BT:ih,iat:i,exp:o};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new No(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,o=this.config.clockTolerance??0,s={algorithms:[i],clockTolerance:o};this.config.issuer&&(s.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(s.audience=n);let{payload:a}=await Bn(e,r,s);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1);return this.signJwt(o,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1),s={...o};return e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=e.perms),{token:await this.signJwt(s,n.privateKey),expiresAt:o.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,o=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(o,n.privateKey),expiresAt:o.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==BT||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,o=e.aud??this.config.serviceTokenAudience??GT,s={sub:e.sub,aud:o,iss:this.config.issuer??"",jti:e.jti,typ:jT,iat:n,exp:n+i*60};return e.roles!==void 0&&(s.roles=e.roles),this.signJwt(s,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??GT,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==jT?null:i}async initialize(){}async cleanup(){}};function sh(t){return new Ad(t)}import{DynamoDBClient as ik}from"@aws-sdk/client-dynamodb";function ok(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),T(void 0)}}}function sk(){return j.email.mode==="console"?ok():j.email.mode==="queue"?$a.createAwsSqs({queueUrl:j.email.queue.url,...j.email.queue.region?{region:j.email.queue.region}:{},envelope:j.email.queue.envelope,sourceSystem:j.email.queue.sourceSystem,eventTypeMap:j.email.queue.eventTypeMap,defaultMetadata:j.email.queue.defaultMetadata}):oc.createDirectSmtp({host:j.smtp.host,port:j.smtp.port,secure:j.smtp.secure,auth:{user:j.smtp.user,pass:j.smtp.pass},fromEmail:j.smtp.from,fromName:"Auth Craft"})}async function WT(){let t=Kv(),e=xv({codeLifetimeMinutes:j.auth.verificationCodeLifetimeMinutes}),r=sT(),n=sh({algorithm:j.jwtAlgorithm,privateKey:j.jwtPrivateKey,publicKey:j.jwtPublicKey,accessTokenExpiresIn:j.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:j.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:j.jwtIssuer,accessTokenAudience:j.jwtAccessTokenAudience,refreshTokenAudience:j.jwtRefreshTokenAudience,accessTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system],refreshTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system]}),i=new ik({region:j.awsRegion,...j.dynamodbEndpoint?{endpoint:j.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),o=VT({tableName:j.dynamodbTableName,client:i}),s=sk(),a=new Map;j.oauth.facebook&&a.set("facebook",jm({appId:j.oauth.facebook.clientId,appSecret:j.oauth.facebook.clientSecret,redirectUri:j.oauth.facebook.redirectUri})),j.oauth.google&&a.set("google",Gm({clientId:j.oauth.google.clientId,clientSecret:j.oauth.google.clientSecret,redirectUri:j.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:o,emailSystem:s,deviceParser:Vv(),rateLimiter:fT(),mfa:{totp:pT({issuer:j.auth.systemName}),email:aT()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await Va({systemId:j.auth.systemName,plugins:c,security:{...If.HIGH,maxFailedAttempts:j.security.maxLoginAttempts,lockoutDurationMinutes:j.security.lockoutDurationMinutes,requireVerifiedIdentity:j.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:j.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:j.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:j.auth.verificationResendCooldownSeconds,verifySessionOnAuth:j.security.verifySessionOnAuth,systemTenantId:j.security.systemTenantId,tokenAudiences:j.security.tokenAudiences},system:{environment:j.nodeEnv},policy:{auditEnabled:j.features.auditEnabled,deviceTrackingEnabled:j.features.deviceTracking,sessionRotationEnabled:!0},version:j.auth.appVersion,email:{appName:"Auth Craft",appUrl:j.auth.appUrl,supportEmail:j.auth.supportEmail}})}var Sc={INTERNAL_ERROR:Q("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:_("INVALID_TOKEN_TYPE","Access token required")};function N_(t,e){let r=dn(e);return t.json(r.body,r.status)}function Yk(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}_v();var Qi=j.appBasePath?(j.appBasePath.startsWith("/")?j.appBasePath:`/${j.appBasePath}`).replace(/\/$/,""):"",R_=Qi?`${Qi}/health`:"/health",vh=null,Lr=null;async function Xk(){return vh||(vh=await WT(),console.log("\u2705 Auth SDK initialized")),vh}async function O_(){if(!Lr){let t=await Xk(),e={algorithm:j.jwtAlgorithm,publicKey:j.jwtPublicKey,issuer:j.jwtIssuer},r=Ar(e),n=Ro({gateway:{...j.gatewayJwt.publicKeyHex?{publicKeyHex:j.gatewayJwt.publicKeyHex}:{},expectedIssuer:j.gatewayJwt.issuer,expectedAudience:j.gatewayJwt.audience,header:j.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==yn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}}}),i=gp({auth:{jwt:{...e,verify:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==yn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Lr=new Gr,j.nodeEnv!=="production"&&Lr.use("*",async(s,a)=>{let c=s.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:s.req.method,path:s.req.path,gatewaySecret:s.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:s.res.status,duration:`${Date.now()-l}ms`}))}),j.corsOrigins.length>0&&Lr.use("*",uv({origin:j.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),j.gatewaySecret&&Lr.use("*",async(s,a)=>{if(s.req.path===R_)return a();let c=s.req.header("X-Gateway-Secret");return!c||!Yk(c,j.gatewaySecret)?(j.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),s.notFound()):a()}),Lr.get(R_,s=>N_(s,T({status:"healthy",timestamp:new Date().toISOString()}))),Lr.use("*",vp);let o=ff({auth:t,policy:i,tokenStrategy:j.auth.tokens.refreshTokenStrategy,...j.auth.tokens.refreshTokenCookie?{refreshTokenCookie:j.auth.tokens.refreshTokenCookie}:{},...j.corsOrigins.length>0?{trustedOrigins:j.corsOrigins}:{}});if(Lr.route(Qi,o),console.log(`\u{1F510} Auth routes mounted at ${Qi||"/"}`),j.internal.publicKey){let s=Qi?`${Qi}${j.internal.serviceRoutePath}`:j.internal.serviceRoutePath,a=Tf({auth:t,internal:{publicKeyJwk:j.internal.publicKey,alg:j.internal.alg,audience:j.internal.audience,issuer:j.internal.issuer}});Lr.route(s,a),console.log(`\u{1F512} Internal routes mounted at ${s}`)}Lr.onError((s,a)=>{console.error("\u274C [Error]",{message:s.message,stack:s.stack,path:a.req.path});let c=j.nodeEnv==="production"?"Internal Server Error":s.message||"Internal Server Error";return N_(a,d(Sc.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Lr}var Moe=async(t,e)=>{try{let r=await O_();return _f(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=j.nodeEnv==="production"?"Internal Server Error":n,o=dn(d(Sc.INTERNAL_ERROR({message:i})));return{statusCode:o.status,body:JSON.stringify(o.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(w_(),S_));O_().then(e=>{let r=j.port,n=j.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${j.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Qi||""}`),console.log(`\u{1F511} Gateway secret: ${j.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${j.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{Moe as handler};
|
|
136
|
+
`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return tk(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ra(),GE));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function rk(t){return new TextEncoder().encode(t)}function qT(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function nk(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var Ad=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await rk(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await oh(this.config.privateKey,e),i=await $T(this.config.publicKey,e),o,s;return this.config.servicePrivateKey&&this.config.servicePublicKey?(o=await oh(this.config.servicePrivateKey,e),s=await $T(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(o=await oh(this.config.servicePrivateKey,e),s=i):(o=n,s=i),{privateKey:n,publicKey:i,servicePrivateKey:o,servicePublicKey:s}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),o=i+r*60,s=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:s??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?BT:ih,iat:i,exp:o};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new No(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,o=this.config.clockTolerance??0,s={algorithms:[i],clockTolerance:o};this.config.issuer&&(s.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(s.audience=n);let{payload:a}=await jn(e,r,s);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1);return this.signJwt(o,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1),s={...o};return e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=e.perms),{token:await this.signJwt(s,n.privateKey),expiresAt:o.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,o=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(o,n.privateKey),expiresAt:o.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==BT||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,o=e.aud??this.config.serviceTokenAudience??GT,s={sub:e.sub,aud:o,iss:this.config.issuer??"",jti:e.jti,typ:jT,iat:n,exp:n+i*60};return e.roles!==void 0&&(s.roles=e.roles),this.signJwt(s,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??GT,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==jT?null:i}async initialize(){}async cleanup(){}};function sh(t){return new Ad(t)}import{DynamoDBClient as ik}from"@aws-sdk/client-dynamodb";function ok(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),T(void 0)}}}function sk(){return j.email.mode==="console"?ok():j.email.mode==="queue"?$a.createAwsSqs({queueUrl:j.email.queue.url,...j.email.queue.region?{region:j.email.queue.region}:{},envelope:j.email.queue.envelope,sourceSystem:j.email.queue.sourceSystem,eventTypeMap:j.email.queue.eventTypeMap,defaultMetadata:j.email.queue.defaultMetadata}):oc.createDirectSmtp({host:j.smtp.host,port:j.smtp.port,secure:j.smtp.secure,auth:{user:j.smtp.user,pass:j.smtp.pass},fromEmail:j.smtp.from,fromName:"Auth Craft"})}async function WT(){let t=Kv(),e=xv({codeLifetimeMinutes:j.auth.verificationCodeLifetimeMinutes}),r=sT(),n=sh({algorithm:j.jwtAlgorithm,privateKey:j.jwtPrivateKey,publicKey:j.jwtPublicKey,accessTokenExpiresIn:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenExpiresIn:j.auth.tokens.refreshTokenLifetimeMinutes,issuer:j.jwtIssuer,accessTokenAudience:j.jwtAccessTokenAudience,refreshTokenAudience:j.jwtRefreshTokenAudience,accessTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system],refreshTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system]}),i=new ik({region:j.awsRegion,...j.dynamodbEndpoint?{endpoint:j.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),o=VT({tableName:j.dynamodbTableName,client:i}),s=sk(),a=new Map;j.oauth.facebook&&a.set("facebook",jm({appId:j.oauth.facebook.clientId,appSecret:j.oauth.facebook.clientSecret,redirectUri:j.oauth.facebook.redirectUri})),j.oauth.google&&a.set("google",Gm({clientId:j.oauth.google.clientId,clientSecret:j.oauth.google.clientSecret,redirectUri:j.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:o,emailSystem:s,deviceParser:Vv(),rateLimiter:fT(),mfa:{totp:pT({issuer:j.auth.systemName}),email:aT()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await Va({systemId:j.auth.systemName,plugins:c,security:{...If.HIGH,maxFailedAttempts:j.security.maxLoginAttempts,lockoutDurationMinutes:j.security.lockoutDurationMinutes,requireVerifiedIdentity:j.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:j.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:j.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:j.auth.verificationResendCooldownSeconds,verifySessionOnAuth:j.security.verifySessionOnAuth,systemTenantId:j.security.systemTenantId,tokenAudiences:j.security.tokenAudiences},system:{environment:j.nodeEnv},policy:{auditEnabled:j.features.auditEnabled,deviceTrackingEnabled:j.features.deviceTracking,sessionRotationEnabled:!0},version:j.auth.appVersion,email:{appName:"Auth Craft",appUrl:j.auth.appUrl,supportEmail:j.auth.supportEmail}})}var Sc={INTERNAL_ERROR:Q("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:_("INVALID_TOKEN_TYPE","Access token required")};function N_(t,e){let r=dn(e);return t.json(r.body,r.status)}function Yk(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}_v();var Qi=j.appBasePath?(j.appBasePath.startsWith("/")?j.appBasePath:`/${j.appBasePath}`).replace(/\/$/,""):"",R_=Qi?`${Qi}/health`:"/health",vh=null,Lr=null;async function Xk(){return vh||(vh=await WT(),console.log("\u2705 Auth SDK initialized")),vh}async function O_(){if(!Lr){let t=await Xk(),e={algorithm:j.jwtAlgorithm,publicKey:j.jwtPublicKey,issuer:j.jwtIssuer},r=Ar(e),n=Ro({gateway:{...j.gatewayJwt.publicKeyHex?{publicKeyHex:j.gatewayJwt.publicKeyHex}:{},expectedIssuer:j.gatewayJwt.issuer,expectedAudience:j.gatewayJwt.audience,header:j.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==gn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}}}),i=gp({auth:{jwt:{...e,verify:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==gn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Lr=new Gr,j.nodeEnv!=="production"&&Lr.use("*",async(s,a)=>{let c=s.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:s.req.method,path:s.req.path,gatewaySecret:s.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:s.res.status,duration:`${Date.now()-l}ms`}))}),j.corsOrigins.length>0&&Lr.use("*",uv({origin:j.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),j.gatewaySecret&&Lr.use("*",async(s,a)=>{if(s.req.path===R_)return a();let c=s.req.header("X-Gateway-Secret");return!c||!Yk(c,j.gatewaySecret)?(j.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),s.notFound()):a()}),Lr.get(R_,s=>N_(s,T({status:"healthy",timestamp:new Date().toISOString()}))),Lr.use("*",vp);let o=ff({auth:t,policy:i,tokenStrategy:j.auth.tokens.refreshTokenStrategy,...j.auth.tokens.refreshTokenCookie?{refreshTokenCookie:j.auth.tokens.refreshTokenCookie}:{},...j.corsOrigins.length>0?{trustedOrigins:j.corsOrigins}:{}});if(Lr.route(Qi,o),console.log(`\u{1F510} Auth routes mounted at ${Qi||"/"}`),j.internal.publicKey){let s=Qi?`${Qi}${j.internal.serviceRoutePath}`:j.internal.serviceRoutePath,a=Tf({auth:t,internal:{publicKeyJwk:j.internal.publicKey,alg:j.internal.alg,audience:j.internal.audience,issuer:j.internal.issuer}});Lr.route(s,a),console.log(`\u{1F512} Internal routes mounted at ${s}`)}Lr.onError((s,a)=>{console.error("\u274C [Error]",{message:s.message,stack:s.stack,path:a.req.path});let c=j.nodeEnv==="production"?"Internal Server Error":s.message||"Internal Server Error";return N_(a,d(Sc.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Lr}var Moe=async(t,e)=>{try{let r=await O_();return _f(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=j.nodeEnv==="production"?"Internal Server Error":n,o=dn(d(Sc.INTERNAL_ERROR({message:i})));return{statusCode:o.status,body:JSON.stringify(o.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(w_(),S_));O_().then(e=>{let r=j.port,n=j.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${j.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Qi||""}`),console.log(`\u{1F511} Gateway secret: ${j.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${j.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{Moe as handler};
|
|
137
137
|
//# sourceMappingURL=index.mjs.map
|