@auth-craft/aws-cf-stack 1.8.0 → 1.10.0

package/assets/lambda/index.mjs

@@ -1,66 +1,68 @@
 import{createRequire}from'module';const require=createRequire(import.meta.url);
-var rT=Object.create;var Zl=Object.defineProperty;var nT=Object.getOwnPropertyDescriptor;var iT=Object.getOwnPropertyNames;var sT=Object.getPrototypeOf,oT=Object.prototype.hasOwnProperty;var ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Q=(t,e)=>()=>(t&&(e=t(t=0)),e);var he=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Ba=(t,e)=>{for(var r in e)Zl(t,r,{get:e[r],enumerable:!0})},aT=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of iT(e))!oT.call(t,i)&&i!==r&&Zl(t,i,{get:()=>e[i],enumerable:!(n=nT(e,i))||n.enumerable});return t};var Pf=(t,e,r)=>(r=t!=null?rT(sT(t)):{},aT(e||!t||!t.__esModule?Zl(r,"default",{value:t,enumerable:!0}):r,t));function rt(...t){let e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function su(t,e,r){if(e<0||e>=$a)throw new RangeError(`value must be >= 0 and <= ${$a-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function ou(t){let e=Math.floor(t/$a),r=t%$a,n=new Uint8Array(8);return su(n,e,0),su(n,r,4),n}function Wa(t){let e=new Uint8Array(4);return su(e,t),e}function ze(t){let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}var Yn,ct,$a,Tt=Q(()=>{Yn=new TextEncoder,ct=new TextDecoder,$a=2**32});function Zs(t){if(Uint8Array.prototype.toBase64)return t.toBase64();let e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function za(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);let e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}var au=Q(()=>{});var Ja={};Ba(Ja,{decode:()=>dt,encode:()=>De});function dt(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(typeof t=="string"?t:ct.decode(t),{alphabet:"base64url"});let e=t;e instanceof Uint8Array&&(e=ct.decode(e)),e=e.replace(/-/g,"+").replace(/_/g,"/");try{return za(e)}catch{throw new TypeError("The input to be decoded is not correctly encoded.")}}function De(t){let e=t;return typeof e=="string"&&(e=Yn.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Zs(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var pt=Q(()=>{Tt();au()});function dT(t){return parseInt(t.name.slice(4),10)}function Ya(t,e){if(dT(t.hash)!==e)throw Dt(`SHA-${e}`,"algorithm.hash")}function pT(t){switch(t){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw new Error("unreachable")}}function Lf(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function Mf(t,e,r){switch(e){case"HS256":case"HS384":case"HS512":{if(!Pr(t.algorithm,"HMAC"))throw Dt("HMAC");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"RS256":case"RS384":case"RS512":{if(!Pr(t.algorithm,"RSASSA-PKCS1-v1_5"))throw Dt("RSASSA-PKCS1-v1_5");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"PS256":case"PS384":case"PS512":{if(!Pr(t.algorithm,"RSA-PSS"))throw Dt("RSA-PSS");Ya(t.algorithm,parseInt(e.slice(2),10));break}case"Ed25519":case"EdDSA":{if(!Pr(t.algorithm,"Ed25519"))throw Dt("Ed25519");break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{if(!Pr(t.algorithm,e))throw Dt(e);break}case"ES256":case"ES384":case"ES512":{if(!Pr(t.algorithm,"ECDSA"))throw Dt("ECDSA");let n=pT(e);if(t.algorithm.namedCurve!==n)throw Dt(n,"algorithm.namedCurve");break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}function Jt(t,e,r){switch(e){case"A128GCM":case"A192GCM":case"A256GCM":{if(!Pr(t.algorithm,"AES-GCM"))throw Dt("AES-GCM");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"A128KW":case"A192KW":case"A256KW":{if(!Pr(t.algorithm,"AES-KW"))throw Dt("AES-KW");let n=parseInt(e.slice(1,4),10);if(t.algorithm.length!==n)throw Dt(n,"algorithm.length");break}case"ECDH":{switch(t.algorithm.name){case"ECDH":case"X25519":break;default:throw Dt("ECDH or X25519")}break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":if(!Pr(t.algorithm,"PBKDF2"))throw Dt("PBKDF2");break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{if(!Pr(t.algorithm,"RSA-OAEP"))throw Dt("RSA-OAEP");Ya(t.algorithm,parseInt(e.slice(9),10)||1);break}default:throw new TypeError("CryptoKey does not support this operation")}Lf(t,r)}var Dt,Pr,Xn=Q(()=>{Dt=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`),Pr=(t,e)=>t.name===e});function Kf(t,e,...r){if(r=r.filter(Boolean),r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}var nr,cu,Qn=Q(()=>{nr=(t,...e)=>Kf("Key must be ",t,...e),cu=(t,e,...r)=>Kf(`Key for the ${t} algorithm must be `,e,...r)});var lu={};Ba(lu,{JOSEAlgNotAllowed:()=>Tn,JOSEError:()=>nt,JOSENotSupported:()=>re,JWEDecryptionFailed:()=>Zr,JWEInvalid:()=>q,JWKInvalid:()=>eo,JWKSInvalid:()=>Ki,JWKSMultipleMatchingKeys:()=>to,JWKSNoMatchingKey:()=>Zn,JWKSTimeout:()=>ro,JWSInvalid:()=>Ee,JWSSignatureVerificationFailed:()=>ei,JWTClaimValidationFailed:()=>ft,JWTExpired:()=>Mi,JWTInvalid:()=>Xe});var nt,ft,Mi,Tn,re,Zr,q,Ee,Xe,eo,Ki,Zn,to,ro,ei,Te=Q(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ft=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Mi=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Tn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},re=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},Zr=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},q=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},Ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},Xe=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},eo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},Ki=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},Zn=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},to=class extends nt{[Symbol.asyncIterator];static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},ro=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},ei=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});function Hi(t){if(!hr(t))throw new Error("CryptoKey instance expected")}var hr,ti,no,_n=Q(()=>{hr=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ti=t=>t?.[Symbol.toStringTag]==="KeyObject",no=t=>hr(t)||ti(t)});function Qa(t){switch(t){case"A128GCM":return 128;case"A192GCM":return 192;case"A256GCM":case"A128CBC-HS256":return 256;case"A192CBC-HS384":return 384;case"A256CBC-HS512":return 512;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Xa(t,e){let r=t.byteLength<<3;if(r!==e)throw new q(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Hf(t){switch(t){case"A128GCM":case"A128GCMKW":case"A192GCM":case"A192GCMKW":case"A256GCM":case"A256GCMKW":return 96;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return 128;default:throw new re(`Unsupported JWE Algorithm: ${t}`)}}function Ff(t,e){if(e.length<<3!==Hf(t))throw new q("Invalid Initialization Vector length")}async function Vf(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(nr(e,"Uint8Array"));let n=parseInt(t.slice(1,4),10),i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return{encKey:i,macKey:s,keySize:n}}async function Bf(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function mT(t,e,r,n,i){let{encKey:s,macKey:o,keySize:a}=await Vf(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),l=rt(i,n,c,ou(i.length<<3)),d=await Bf(o,l,a);return{ciphertext:c,tag:d,iv:n}}async function hT(t,e){if(!(t instanceof Uint8Array))throw new TypeError("First argument must be a buffer");if(!(e instanceof Uint8Array))throw new TypeError("Second argument must be a buffer");let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign(r,n,t)),s=new Uint8Array(await crypto.subtle.sign(r,n,e)),o=0,a=-1;for(;++a<32;)o|=i[a]^s[a];return o===0}async function ET(t,e,r,n,i,s){let{encKey:o,macKey:a,keySize:c}=await Vf(t,e,"decrypt"),l=rt(s,n,r,ou(s.length<<3)),d=await Bf(a,l,c),p;try{p=await hT(i,d)}catch{}if(!p)throw new Zr;let m;try{m=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!m)throw new Zr;return m}async function yT(t,e,r,n,i){let s;r instanceof Uint8Array?s=await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Jt(r,t,"encrypt"),s=r);let o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function gT(t,e,r,n,i,s){let o;e instanceof Uint8Array?o=await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Jt(e,t,"decrypt"),o=e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,rt(r,i)))}catch{throw new Zr}}async function Za(t,e,r,n,i){if(!hr(r)&&!(r instanceof Uint8Array))throw new TypeError(nr(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));switch(n?Ff(t,n):n=fT(t),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(-3),10)),mT(t,e,r,n,i);case"A128GCM":case"A192GCM":case"A256GCM":return r instanceof Uint8Array&&Xa(r,parseInt(t.slice(1,4),10)),yT(t,e,r,n,i);default:throw new re(qf)}}async function ec(t,e,r,n,i,s){if(!hr(e)&&!(e instanceof Uint8Array))throw new TypeError(nr(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new q("JWE Initialization Vector missing");if(!i)throw new q("JWE Authentication Tag missing");switch(Ff(t,n),t){case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(-3),10)),ET(t,e,r,n,i,s);case"A128GCM":case"A192GCM":case"A256GCM":return e instanceof Uint8Array&&Xa(e,parseInt(t.slice(1,4),10)),gT(t,e,r,n,i,s);default:throw new re(qf)}}var Ur,fT,qf,ri=Q(()=>{Tt();Xn();Qn();Te();_n();Ur=t=>crypto.getRandomValues(new Uint8Array(Qa(t)>>3));fT=t=>crypto.getRandomValues(new Uint8Array(Hf(t)>>3));qf="Unsupported JWE Content Encryption Algorithm"});function Ge(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function Pt(t,e,r){try{return dt(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}async function rc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var tc,Er=Q(()=>{pt();tc=Symbol()});function be(t){if(!vT(t)||Object.prototype.toString.call(t)!=="[object Object]")return!1;if(Object.getPrototypeOf(t)===null)return!0;let e=t;for(;Object.getPrototypeOf(e)!==null;)e=Object.getPrototypeOf(e);return Object.getPrototypeOf(t)===e}function Lr(...t){let e=t.filter(Boolean);if(e.length===0||e.length===1)return!0;let r;for(let n of e){let i=Object.keys(n);if(!r||r.size===0){r=new Set(i);continue}for(let s of i){if(r.has(s))return!1;r.add(s)}}return!0}var vT,ni,jf,Gf,$f,Qe=Q(()=>{vT=t=>typeof t=="object"&&t!==null;ni=t=>be(t)&&typeof t.kty=="string",jf=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Gf=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,$f=t=>t.kty==="oct"&&typeof t.k=="string"});function Wf(t,e){if(t.algorithm.length!==parseInt(e.slice(1,4),10))throw new TypeError(`Invalid key size for alg: ${e}`)}function zf(t,e,r){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):(Jt(t,e,r),t)}async function io(t,e,r){let n=await zf(e,t,"wrapKey");Wf(n,t);let i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function so(t,e,r){let n=await zf(e,t,"unwrapKey");Wf(n,t);let i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}var uu=Q(()=>{Xn()});function du(t){return rt(Wa(t.length),t)}async function TT(t,e,r){let n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){let c=new Uint8Array(4+t.length+r.length);c.set(Wa(a),0),c.set(t,4),c.set(r,4+t.length);let l=await rc("sha256",c);o.set(l,(a-1)*i)}return o.slice(0,n)}async function pu(t,e,r,n,i=new Uint8Array,s=new Uint8Array){Jt(t,"ECDH"),Jt(e,"ECDH","deriveBits");let o=du(ze(r)),a=du(i),c=du(s),l=Wa(n),d=new Uint8Array,p=rt(o,a,c,l,d),m=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,_T(t)));return TT(m,n,p)}function _T(t){return t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3}function fu(t){switch(t.algorithm.namedCurve){case"P-256":case"P-384":case"P-521":return!0;default:return t.algorithm.name==="X25519"}}var Yf=Q(()=>{Tt();Xn();Er()});function xT(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Jt(t,e,"deriveBits"),t)}async function Xf(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new q("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new q("PBES2 Count Input must be a positive integer");let i=bT(e,t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await xT(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}async function Qf(t,e,r,n=2048,i=crypto.getRandomValues(new Uint8Array(16))){let s=await Xf(i,t,n,e);return{encryptedKey:await io(t.slice(-6),s,r),p2c:n,p2s:De(i)}}async function Zf(t,e,r,n,i){let s=await Xf(i,t,n,e);return so(t.slice(-6),s,r)}var bT,em=Q(()=>{pt();uu();Xn();Tt();Te();bT=(t,e)=>rt(ze(t),Uint8Array.of(0),e)});function oo(t,e){if(t.startsWith("RS")||t.startsWith("PS")){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}}function tm(t,e){let r=`SHA-${t.slice(-3)}`;switch(t){case"HS256":case"HS384":case"HS512":return{hash:r,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:r,name:"RSA-PSS",saltLength:parseInt(t.slice(-3),10)>>3};case"RS256":case"RS384":case"RS512":return{hash:r,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:r,name:"ECDSA",namedCurve:e.namedCurve};case"Ed25519":case"EdDSA":return{name:"Ed25519"};case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":return{name:t};default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}async function rm(t,e,r){if(e instanceof Uint8Array){if(!t.startsWith("HS"))throw new TypeError(nr(e,"CryptoKey","KeyObject","JSON Web Key"));return crypto.subtle.importKey("raw",e,{hash:`SHA-${t.slice(-3)}`,name:"HMAC"},!1,[r])}return Mf(e,t,r),e}async function nm(t,e,r){let n=await rm(t,e,"sign");oo(t,n);let i=await crypto.subtle.sign(tm(t,n.algorithm),n,r);return new Uint8Array(i)}async function im(t,e,r,n){let i=await rm(t,e,"verify");oo(t,i);let s=tm(t,i.algorithm);try{return await crypto.subtle.verify(s,i,r,n)}catch{return!1}}var nc=Q(()=>{Te();Xn();Qn()});async function om(t,e,r){return Jt(e,t,"encrypt"),oo(t,e),new Uint8Array(await crypto.subtle.encrypt(sm(t),e,r))}async function am(t,e,r){return Jt(e,t,"decrypt"),oo(t,e),new Uint8Array(await crypto.subtle.decrypt(sm(t),e,r))}var sm,cm=Q(()=>{Xn();nc();Te();sm=t=>{switch(t){case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return"RSA-OAEP";default:throw new re(`alg ${t} is not supported either by JOSE or your javascript runtime`)}}});function wT(t){let e,r;switch(t.kty){case"AKP":{switch(t.alg){case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":e={name:t.alg},r=t.priv?["sign"]:["verify"];break;default:throw new re(ic)}break}case"RSA":{switch(t.alg){case"PS256":case"PS384":case"PS512":e={name:"RSA-PSS",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":e={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.alg.slice(-3)}`},r=t.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":e={name:"RSA-OAEP",hash:`SHA-${parseInt(t.alg.slice(-3),10)||1}`},r=t.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new re(ic)}break}case"EC":{switch(t.alg){case"ES256":case"ES384":case"ES512":e={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[t.alg]},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:"ECDH",namedCurve:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}case"OKP":{switch(t.alg){case"Ed25519":case"EdDSA":e={name:"Ed25519"},r=t.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":e={name:t.crv},r=t.d?["deriveBits"]:[];break;default:throw new re(ic)}break}default:throw new re('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:e,keyUsages:r}}async function Fi(t){if(!t.alg)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:e,keyUsages:r}=wT(t),n={...t};return n.kty!=="AKP"&&delete n.alg,delete n.use,crypto.subtle.importKey("jwk",n,e,t.ext??!(t.d||t.priv),t.key_ops??r)}var ic,mu=Q(()=>{Te();ic='Invalid or unsupported JWK "alg" (Algorithm) Parameter value'});async function ir(t,e){if(t instanceof Uint8Array||hr(t))return t;if(ti(t)){if(t.type==="secret")return t.export();if("toCryptoKey"in t&&typeof t.toCryptoKey=="function")try{return RT(t,e)}catch(n){if(n instanceof TypeError)throw n}let r=t.export({format:"jwk"});return lm(t,r,e)}if(ni(t))return t.k?dt(t.k):lm(t,t,e,!0);throw new Error("unreachable")}var Vi,Bi,lm,RT,ii=Q(()=>{Qe();pt();mu();_n();Vi="given KeyObject instance cannot be used for this algorithm",lm=async(t,e,r,n=!1)=>{Bi||=new WeakMap;let i=Bi.get(t);if(i?.[r])return i[r];let s=await Fi({...e,alg:r});return n&&Object.freeze(t),i?i[r]=s:Bi.set(t,{[r]:s}),s},RT=(t,e)=>{Bi||=new WeakMap;let r=Bi.get(t);if(r?.[e])return r[e];let n=t.type==="public",i=!!n,s;if(t.asymmetricKeyType==="x25519"){switch(e){case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":break;default:throw new TypeError(Vi)}s=t.toCryptoKey(t.asymmetricKeyType,i,n?[]:["deriveBits"])}if(t.asymmetricKeyType==="ed25519"){if(e!=="EdDSA"&&e!=="Ed25519")throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}switch(t.asymmetricKeyType){case"ml-dsa-44":case"ml-dsa-65":case"ml-dsa-87":{if(e!==t.asymmetricKeyType.toUpperCase())throw new TypeError(Vi);s=t.toCryptoKey(t.asymmetricKeyType,i,[n?"verify":"sign"])}}if(t.asymmetricKeyType==="rsa"){let o;switch(e){case"RSA-OAEP":o="SHA-1";break;case"RS256":case"PS256":case"RSA-OAEP-256":o="SHA-256";break;case"RS384":case"PS384":case"RSA-OAEP-384":o="SHA-384";break;case"RS512":case"PS512":case"RSA-OAEP-512":o="SHA-512";break;default:throw new TypeError(Vi)}if(e.startsWith("RSA-OAEP"))return t.toCryptoKey({name:"RSA-OAEP",hash:o},i,n?["encrypt"]:["decrypt"]);s=t.toCryptoKey({name:e.startsWith("PS")?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:o},i,[n?"verify":"sign"])}if(t.asymmetricKeyType==="ec"){let a=new Map([["prime256v1","P-256"],["secp384r1","P-384"],["secp521r1","P-521"]]).get(t.asymmetricKeyDetails?.namedCurve);if(!a)throw new TypeError(Vi);let c={ES256:"P-256",ES384:"P-384",ES512:"P-521"};c[e]&&a===c[e]&&(s=t.toCryptoKey({name:"ECDSA",namedCurve:a},i,[n?"verify":"sign"])),e.startsWith("ECDH-ES")&&(s=t.toCryptoKey({name:"ECDH",namedCurve:a},i,n?[]:["deriveBits"]))}if(!s)throw new TypeError(Vi);return r?r[e]=s:Bi.set(t,{[e]:s}),s}});function kT(t){Mr(t,48,"Invalid PKCS#8 structure"),yr(t),Mr(t,2,"Expected version field");let e=yr(t);t.pos+=e,Mr(t,48,"Expected algorithm identifier");let r=yr(t);return{algIdStart:t.pos,algIdLength:r}}function CT(t){Mr(t,48,"Invalid SPKI structure"),yr(t),Mr(t,48,"Expected algorithm identifier");let e=yr(t);return{algIdStart:t.pos,algIdLength:e}}function DT(t){let e=yu(t);Mr(e,48,"Invalid certificate structure"),yr(e),Mr(e,48,"Invalid tbsCertificate structure"),yr(e),t[e.pos]===160?Eu(e,6):Eu(e,5);let r=e.pos;Mr(e,48,"Invalid SPKI structure");let n=yr(e);return t.subarray(r,r+n+(e.pos-r))}function PT(t){let e=gu(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);return DT(e)}var um,dm,pm,fm,hu,yu,yr,Eu,Mr,mm,OT,hm,Em,gu,ym,vu,gm,Au=Q(()=>{Qn();au();Te();_n();um=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
+var C_=Object.create;var Rd=Object.defineProperty;var P_=Object.getOwnPropertyDescriptor;var D_=Object.getOwnPropertyNames;var U_=Object.getPrototypeOf,L_=Object.prototype.hasOwnProperty;var ne=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var M_=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},Cc=(t,e)=>{for(var r in e)Rd(t,r,{get:e[r],enumerable:!0})},K_=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of D_(e))!L_.call(t,i)&&i!==r&&Rd(t,i,{get:()=>e[i],enumerable:!(n=P_(e,i))||n.enumerable});return t};var H_=(t,e,r)=>(r=t!=null?C_(U_(t)):{},K_(e||!t||!t.__esModule?Rd(r,"default",{value:t,enumerable:!0}):r,t));function kt(...t){let e=t.reduce((i,{length:o})=>i+o,0),r=new Uint8Array(e),n=0;for(let i of t)r.set(i,n),n+=i.length;return r}function Ud(t,e,r){if(e<0||e>=Lc)throw new RangeError(`value must be >= 0 and <= ${Lc-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function Ld(t){let e=Math.floor(t/Lc),r=t%Lc,n=new Uint8Array(8);return Ud(n,e,0),Ud(n,r,4),n}function Mc(t){let e=new Uint8Array(4);return Ud(e,t),e}function Et(t){if(typeof t=="string"&&t.length>=128){if(j_.test(t))throw new TypeError("non-ASCII string encountered in encode()");return on.encode(t)}let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){let n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}function Kc(t,e=!1){if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:e?"base64url":"base64",omitPadding:e});let r=32768,n=[];for(let o=0;o<t.length;o+=r)n.push(String.fromCharCode.apply(null,t.subarray(o,o+r)));let i=btoa(n.join(""));return e?i.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_"):i}function Hc(t,e=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t,{alphabet:e?"base64url":"base64"});if(e){if(t.includes("+")||t.includes("/"))throw new TypeError("Invalid base64url");t=t.replace(/-/g,"+").replace(/_/g,"/")}let r=atob(t),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}async function Fc(t,e){let r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}var on,ao,co,Lc,j_,Ft=ne(()=>{on=new TextEncoder,ao=new TextDecoder,co=new TextDecoder("utf-8",{fatal:!0}),Lc=2**32;j_=/[^\x00-\x7f]/});var Md={};Cc(Md,{JOSEAlgNotAllowed:()=>Dn,JOSEError:()=>nt,JOSENotSupported:()=>Te,JWEDecryptionFailed:()=>sn,JWEInvalid:()=>W,JWKInvalid:()=>uo,JWKSInvalid:()=>po,JWKSMultipleMatchingKeys:()=>Ds,JWKSNoMatchingKey:()=>_i,JWKSTimeout:()=>Us,JWSInvalid:()=>ee,JWSSignatureVerificationFailed:()=>Un,JWTClaimValidationFailed:()=>ir,JWTExpired:()=>lo,JWTInvalid:()=>je});var nt,ir,lo,Dn,Te,sn,W,ee,je,uo,po,_i,Ds,Us,Un,Ie=ne(()=>{nt=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},ir=class extends nt{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},lo=class extends nt{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}},Dn=class extends nt{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},Te=class extends nt{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},sn=class extends nt{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}},W=class extends nt{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},ee=class extends nt{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},je=class extends nt{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},uo=class extends nt{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},po=class extends nt{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},_i=class extends nt{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}},Ds=class extends nt{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}},Us=class extends nt{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}},Un=class extends nt{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}});var Vc={};Cc(Vc,{decode:()=>Fr,encode:()=>Pe});function Fr(t){try{return Hc(typeof t=="string"?t:ao.decode(t),!0)}catch(e){throw new TypeError(G_,{cause:e})}}function Pe(t){return Kc(typeof t=="string"?on.encode(t):t,!0)}var G_,zt=ne(()=>{Ft();G_="The input to be decoded is not correctly encoded."});function at(t,e){if(!(t instanceof Uint8Array))throw new TypeError(`${e} must be an instance of Uint8Array`)}function he(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;let e=Object.getPrototypeOf(t);return e===null||Object.getPrototypeOf(e)===null}function Bc(t){return he(t)&&Array.isArray(t.keys)&&Array.from(t.keys).every(he)}function Ln(...t){let e=new Set;for(let r of t)if(r)for(let n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}function Se(t,e){if(t!==void 0)throw new TypeError(`${e} can only be called once`)}function xt(t,e,r){try{return Fr(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function jc(t,e,r){try{return Et(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}function Mn(t,e,r){let n;try{n=JSON.parse(co.decode(Fr(t)))}catch{throw new e(r)}if(!he(n))throw new e(r);return n}function Ls(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);return e===void 0?void 0:new Set(e)}function $c(t,e){let{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function Vr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(s=>typeof s!="string"||s.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let o=r===void 0?e:{__proto__:null,...r,...e};for(let s of n.crit){if(!(s in o))throw new Te(`Extension Header Parameter "${s}" is not recognized`);if(!Object.hasOwn(i,s)||i[s]===void 0)throw new t(`Extension Header Parameter "${s}" is missing`);if(o[s]&&(!Object.hasOwn(n,s)||n[s]===void 0))throw new t(`Extension Header Parameter "${s}" MUST be integrity protected`)}return n.crit}function mo(t,e){if(e.includes("b64")){let r=t.b64;if(typeof r!="boolean")throw new ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function Ii(t,e){let r,n;try{r=JSON.stringify(e),n=JSON.parse(r)}catch(i){throw new t("JOSE Header is not valid JSON",{cause:i})}if(!he(n))throw new t("JOSE Header is not a JSON object");return[n,r]}var fo,Gc,De=ne(()=>{Ie();zt();Ft();fo={__proto__:null,b64:!0},Gc={__proto__:null}});async function hr(t,e,r){let{alg:n,secret:i}=t,o=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return e;let s,a;if(he(e)){if(s=Ks(e),typeof s.kty!="string")throw xh(n,e,i);if(!(i?s.kty==="oct"&&typeof s.k=="string":s.kty!=="oct"&&(o?s.kty==="AKP"&&typeof s.priv=="string"||typeof s.d=="string":s.d===void 0&&s.priv===void 0)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${o?"private":"public"} JWK`);if(q_(t,s,r),s.kty==="oct")return Fr(s.k);if(!Object.isFrozen(e)){let{key_ops:u}=e;Array.isArray(u)&&Object.freeze(u),Object.freeze(e)}}else{if(!Hd(e))throw xh(n,e,i);let u=i?"secret":o?"private":"public";if(e.type!==u&&(i||["secret","public","private"].includes(e.type)))throw new TypeError(`${$_(e)} instances must be of type "${u}" for the ${n} algorithm`);if(Br(e))return e;if(a=e,a.type==="secret")return a.export()}Kd||=new WeakMap;let c=e,l=Kd.get(c);if(l?.[n])return l[n];if(l||Kd.set(c,l={}),a&&typeof a.toCryptoKey=="function"){let u=a.type==="public",p=W_[a.asymmetricKeyDetails?.namedCurve],f=t.resolve?.({crv:p,asymmetricKeyType:a.asymmetricKeyType})??t.subtle;return l[n]=a.toCryptoKey(f,u,t.usages[u?0:1])}return s??=a.export({format:"jwk"}),s.alg=n,l[n]=await jr(t,s)}function Wc(t){if(!Br(t))throw new Error("CryptoKey instance expected")}function bh(t,e,...r){if(r.length>2){let n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}function xh(t,e,r){let n=["CryptoKey","KeyObject","JSON Web Key"];return r&&n.push("Uint8Array"),new TypeError(bh(`Key for the ${t} algorithm must be `,e,...n))}function Fd(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function ho(t,e){let{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Vd(t,e,r){let n=t.algorithm;if(n.name!==e.name)throw qc(e.name);if(e.hash&&n.hash?.name!==e.hash)throw qc(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw qc(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw qc(e.length,"algorithm.length");Fd(t,r)}function Eo(t){return{__proto__:null,...t}}function Ks(t){let e=Eo(t);if(e.ext!==void 0&&typeof e.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(e.key_ops!==void 0){let r=e.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some(i=>typeof i!="string")||new Set(n).size!==n.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');e.key_ops=n}return e}function Kn(t){if(t!==void 0&&typeof t!="boolean")throw new TypeError('"extractable" option must be a boolean');return t}async function jr(t,e,r){if(!t.kty.includes(e.kty))throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let n=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,i=!!(e.d||e.priv),o={...e,ext:r??e.ext};return o.kty!=="AKP"&&delete o.alg,delete o.use,crypto.subtle.importKey("jwk",o,n,o.ext??!i,e.key_ops??t.usages[i?1:0])}async function yr(t,e,r,n=!1){return t instanceof Uint8Array&&(t=await crypto.subtle.importKey("raw",t,e,n,[r])),Vd(t,e,r),t}var $_,q_,Kd,W_,Br,Ms,Hd,Er,qc,Ct=ne(()=>{De();zt();Ie();$_=t=>t[Symbol.toStringTag],q_=(t,e,r)=>{let{alg:n}=t;if(e.use!==void 0){let i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){let i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};W_={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};Br=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},Ms=t=>t?.[Symbol.toStringTag]==="KeyObject",Hd=t=>Br(t)||Ms(t);Er=(t,...e)=>bh("Key must be ",t,...e);qc=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`)});function zc(t,e){let r=t.byteLength<<3;if(r!==e)throw new W(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}function Sh(t,e){if(e.length<<3!==t.ivBits)throw new W("Invalid Initialization Vector length")}async function wh(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Er(e,"Uint8Array"));let n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),o=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,o,n]}async function Nh(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function J_(t,e,r,n,i){let[o,s,a]=await wh(t,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},o,e)),l=kt(i,n,c,Ld(i.length*8)),u=await Nh(s,l,a);return{ciphertext:c,tag:u,iv:n}}async function Y_(t,e){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function X_(t,e,r,n,i,o){let[s,a,c]=await wh(t,e,"decrypt"),l=kt(o,n,r,Ld(o.length*8)),u=await Nh(a,l,c);try{if(await Y_(i,u))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},s,r))}catch{}throw new sn}async function Jc(t,e,r,n,i){if(!Br(r)&&!(r instanceof Uint8Array))throw new TypeError(Er(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n?Sh(t,n):n=z_(t),r instanceof Uint8Array&&zc(r,t.cekBits),t.cbc)return J_(t,e,r,n,i);let o=await yr(r,t.subtle,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},o,e));return{ciphertext:s.subarray(0,-16),tag:s.subarray(-16),iv:n}}async function Yc(t,e,r,n,i,o){if(!Br(e)&&!(e instanceof Uint8Array))throw new TypeError(Er(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new W("JWE Initialization Vector missing");if(!i)throw new W("JWE Authentication Tag missing");if(!t.cbc&&i.length!==16)throw new W("Invalid Authentication Tag length");if(Sh(t,n),e instanceof Uint8Array&&zc(e,t.cekBits),t.cbc)return X_(t,e,r,n,i,o);let s=await yr(e,t.subtle,"decrypt");try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},s,kt(r,i)))}catch{throw new sn}}var xi,z_,Hs=ne(()=>{Ft();Ct();Ie();xi=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));z_=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3))});function Fs(t){let e={__proto__:null};for(let r in t)e[r]={...t[r],alg:r};return e}var Bd=ne(()=>{});function Xc(t){return{kty:["RSA"],mode:"key-encryption",subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:Q_,ops:["wrapKey","unwrapKey"]}}function Qc(t){return{kty:["EC","OKP"],mode:t,subtle:{name:"ECDH"},resolve:({kty:e,crv:r,asymmetricKeyType:n})=>{if(r==="X25519"||n==="x25519")return{name:"X25519"};if(e==="OKP")throw new Te('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:r}},usages:Z_,ops:[void 0,"deriveBits"]}}function yo(t,e=!1){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:Zc,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function jd(){return{kty:["oct"],mode:"key-wrapping",secret:!0,subtle:{name:"PBKDF2"},usages:Zc,ops:["deriveBits","deriveBits"]}}function go(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:Zc,ops:eI,cekBits:t,ivBits:e?128:96,cbc:e}}function Rh(t,e){throw new Te(`Invalid or unsupported "${t}" (JWE ${e}) header value`)}function gr(t){return(typeof t=="string"?an[t]:void 0)??Rh("alg","Algorithm")}function vr(t){return t.mode==="key-wrapping"||t.mode==="key-encryption"||t.mode==="key-agreement-with-key-wrapping"}function bi(t){return(typeof t=="string"?tI[t]:void 0)??Rh("enc","Encryption Algorithm")}var Q_,Z_,Zc,an,eI,tI,Si=ne(()=>{Ie();Bd();Q_=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Z_=[[],["deriveBits"]],Zc=[[],[]];an=Fs({dir:{kty:["oct"],mode:"direct-encryption",secret:!0,subtle:{name:"AES-GCM"},usages:Zc,ops:["encrypt","decrypt"]},"RSA-OAEP":Xc(1),"RSA-OAEP-256":Xc(256),"RSA-OAEP-384":Xc(384),"RSA-OAEP-512":Xc(512),"ECDH-ES":Qc("direct-key-agreement"),"ECDH-ES+A128KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A192KW":Qc("key-agreement-with-key-wrapping"),"ECDH-ES+A256KW":Qc("key-agreement-with-key-wrapping"),A128KW:yo(128),A192KW:yo(192),A256KW:yo(256),A128GCMKW:yo(128,!0),A192GCMKW:yo(192,!0),A256GCMKW:yo(256,!0),"PBES2-HS256+A128KW":jd(),"PBES2-HS384+A192KW":jd(),"PBES2-HS512+A256KW":jd()}),eI=["encrypt","decrypt"];tI=Fs({A128GCM:go(128),A192GCM:go(192),A256GCM:go(256),"A128CBC-HS256":go(256,!0),"A192CBC-HS384":go(384,!0),"A256CBC-HS512":go(512,!0)})});function Oh(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");Fd(t,e)}async function rI(t,e,r){let n=await yr(e,gr(t).subtle,"wrapKey",!0),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function nI(t,e,r){let n=await yr(e,gr(t).subtle,"unwrapKey",!0),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function Ch(t,e,r){Vd(e,gr(t).subtle,r),ho(t,e)}async function Ph(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new W("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new W("PBES2 Count Input must be a positive integer");let i=kt(Et(e),Uint8Array.of(0),t),o=parseInt(e.slice(13,16),10),s={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await yr(n,gr(e).subtle,"deriveBits");return new Uint8Array(await crypto.subtle.deriveBits(s,a,o))}function Gd(t){return kt(Mc(t.length),t)}async function iI(t,e,r){let n=e>>3,i=32,o=Math.ceil(n/i),s=new Uint8Array(o*i);for(let a=1;a<=o;a++){let c=await Fc("sha256",kt(Mc(a),t,r));s.set(c,(a-1)*i)}return s.slice(0,n)}async function Dh(t,e,r,n,i=new Uint8Array,o=new Uint8Array){Oh(t),Oh(e,"deriveBits");let s=kt(Gd(Et(r)),Gd(i),Gd(o),Mc(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return iI(a,n,s)}function Uh(t){Wc(t);let e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new Te("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function el(t,e){let r=t[e];if(r!==void 0){if(typeof r!="string")throw new W(`JOSE Header "${e}" (Agreement Party${e==="apu"?"U":"V"}Info) invalid`);return xt(r,e,W)}}function Lh(t,e){if(!(t===void 0||e===void 0||t.byteLength!==e.byteLength)){for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return;throw new W('JOSE Header "apu" and "apv" values must be distinct')}}function oI(t){if(t===void 0)throw new W("JWE Encrypted Key missing")}function kh(t){if(t!==void 0)throw new W("Encountered unexpected JWE Encrypted Key")}function sI(t){if(t!==void 0&&t!==1/0&&(!Number.isSafeInteger(t)||t<1))throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity")}async function Mh(t,e,r,n,i,o){let{alg:s}=t,a=t.mode;if(a==="direct-encryption")return kh(n),r;let c=a==="direct-key-agreement";switch(c?kh(n):oI(n),t.subtle.name){case"ECDH":{let{epk:l}=i;if(!he(l)||["d","k","p","q","dp","dq","qi","oth","priv"].some(E=>Object.hasOwn(l,E)))throw new W('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');Uh(r);let u=await jr(t,l),p=el(i,"apu"),f=el(i,"apv");Lh(p,f);let m=await Dh(u,r,c?e.alg:s,c?e.cekBits:parseInt(s.slice(-5,-2),10),p,f);if(c)return m;r=m;break}case"RSA-OAEP":return Wc(r),Ch(s,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(typeof i.p2c!="number")throw new W('JOSE Header "p2c" (PBES2 Count) missing or invalid');sI(o);let l=o??1e4;if(i.p2c>l)throw new W('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof i.p2s!="string")throw new W('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let u=xt(i.p2s,"p2s",W);r=await Ph(u,s,i.p2c,r);break}case"AES-GCM":{if(typeof i.iv!="string")throw new W('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new W('JOSE Header "tag" (Authentication Tag) missing or invalid');let l=xt(i.iv,"iv",W),u=xt(i.tag,"tag",W);if(l.byteLength!==12)throw new W("Invalid Initialization Vector length");if(u.byteLength!==16)throw new W("Invalid Authentication Tag length");return Yc(bi(s.slice(0,-2)),r,n,l,u,new Uint8Array)}}return nI(s.slice(-6),r,n)}async function tl(t,e,r,n,i,o={}){let{alg:s,mode:a}=t,c=vr(t);if(i!==void 0&&!c)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${s}`);let l=await hr(a==="direct-encryption"?e:t,r,"encrypt");if(a==="direct-encryption")return[l,void 0,void 0];let u=c?i??xi(e):void 0;u&&zc(u,e.cekBits);let p,f;switch(t.subtle.name){case"ECDH":{Uh(l);let{apu:m,apv:E}=o;m!==void 0&&at(m,'"apu"'),E!==void 0&&at(E,'"apv"');let v=m??el(n,"apu"),N=E??el(n,"apv");Lh(v,N);let S;o.epk!==void 0?S=await hr(t,o.epk,"decrypt"):S=(await crypto.subtle.generateKey(l.algorithm,!0,["deriveBits"])).privateKey;let R=crypto.subtle,M=S;if(!M.extractable){if(typeof R.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');M=await R.getPublicKey(S,[])}let{x:K,y:B,crv:V,kty:$}=await R.exportKey("jwk",M),A=a==="direct-key-agreement",x=await Dh(l,S,A?e.alg:s,A?e.cekBits:parseInt(s.slice(-5,-2),10),v,N),b={x:K,crv:V,kty:$};if($==="EC"&&(b.y=B),f={epk:b},m!==void 0&&(f.apu=Pe(m)),E!==void 0&&(f.apv=Pe(E)),A)return[x,void 0,f];l=x;break}case"RSA-OAEP":{Wc(l),Ch(s,l,"encrypt"),p=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",l,u));break}case"PBKDF2":{let{p2c:m=2048,p2s:E=crypto.getRandomValues(new Uint8Array(16))}=o;l=await Ph(E,s,m,l),f={p2c:m,p2s:Pe(E)};break}case"AES-GCM":{let m=o.iv===void 0?crypto.getRandomValues(new Uint8Array(12)):o.iv;if(!(m instanceof Uint8Array))throw new TypeError('"iv" must be an instance of Uint8Array');let E=await Jc(bi(s.slice(0,-2)),u,l,m,new Uint8Array);p=E.ciphertext,f={iv:Pe(E.iv),tag:Pe(E.tag)}}}if(p??=await rI(s.slice(-6),l,u),!(p instanceof Uint8Array)||!p.byteLength)throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");return[u,p,f]}var rl=ne(()=>{zt();Ct();Si();Ie();De();Ft();Hs()});function nl(t,e){if(t.zip!==void 0&&t.zip!=="DEF")throw new Te('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(t.zip!==void 0&&!e?.zip)throw new W('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function Kh(t){if(typeof globalThis[t]>"u")throw new Te(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Hh(t,e,r=1/0){let n=t.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let i=[],o=0,s=t.readable.getReader();for(;;){let{value:a,done:c}=await s.read();if(c)break;if(i.push(a),o+=a.byteLength,r!==1/0&&o>r)throw new W("Decompressed plaintext exceeded the configured limit")}return kt(...i)}async function Fh(t){return Kh("CompressionStream"),Hh(new CompressionStream("deflate-raw"),t)}async function Vh(t,e){return Kh("DecompressionStream"),Hh(new DecompressionStream("deflate-raw"),t,e)}var $d=ne(()=>{Ie();Ft()});function il(t){let{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s}=t;if(n!==void 0&&(typeof n!="string"||!n))throw new W("JWE Initialization Vector incorrect type");if(typeof r!="string")throw new W("JWE Ciphertext missing or incorrect type");if(o!==void 0&&(typeof o!="string"||!o))throw new W("JWE Authentication Tag incorrect type");if(i!==void 0&&typeof i!="string")throw new W("JWE Protected Header incorrect type");if(e!==void 0&&(typeof e!="string"||!e))throw new W("JWE AAD incorrect type");if(s!==void 0&&!he(s))throw new W("JWE Shared Unprotected Header incorrect type");return{aad:e,ciphertext:r,iv:n,protected:i,tag:o,unprotected:s===void 0?void 0:{...s}}}function ol(t){let e,r;try{let{header:n}=t;if(he(n)){r=n.alg;let o=Object.keys(n);o.includes("alg")||(r=void 0),e=Object.fromEntries(o.map(s=>[s,s==="alg"?r:n[s]]))}else e=n;let{encrypted_key:i}=t;return[{encrypted_key:i,header:e},r]}catch(n){return[void 0,r,n]}}function sl(t){let{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new W("JWE Encrypted Key incorrect type");if(r!==void 0&&!he(r))throw new W("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new W("JOSE Header missing")}function qd(t){let{protected:e,ciphertext:r,iv:n,tag:i,aad:o}=t,s;return e!==void 0&&(s=Mn(e,W,"JWE Protected Header is invalid")),[s,xt(r,"ciphertext",W),n!==void 0?xt(n,"iv",W):void 0,i!==void 0?xt(i,"tag",W):void 0,jc((e??"")+(o!==void 0?`.${o}`:""),"aad",W)]}function Hn(t){return[t&&Ls("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&Ls("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t?.crit,t?.maxPBES2Count,t?.maxDecompressedLength]}async function Vs(t,e,r,n=qd(t)){let[i,o,s,a,c]=n,{header:l,unprotected:u,aad:p}=t,f;if(l!==void 0||u!==void 0){if(!Ln(i,l,u))throw new W("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");f={...i,...l,...u}}else f=i??{};let[m,E,v,N,S]=e,{encrypted_key:R}=t;Vr(W,Gc,v,i,f),nl(f,i);let{alg:M,enc:K}=f;if(typeof M!="string"||!M)throw new W("missing JWE Algorithm (alg) in JWE Header");let B=an[M];if(R===""&&(!B||!vr(B)))throw new W("JWE Encrypted Key incorrect type");let V=B?.mode==="integrated-encryption";if(!V&&(typeof K!="string"||!K))throw new W("missing JWE Encryption Algorithm (enc) in JWE Header");if(m&&!m.has(M)||!m&&M.startsWith("PBES2"))throw new Dn('"alg" (Algorithm) Header Parameter value not allowed');let $;if(V){if(K!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(s?.byteLength)throw new W("JWE Initialization Vector must be empty for integrated encryption");if(a?.byteLength)throw new W("JWE Authentication Tag must be empty for integrated encryption")}else{if(E&&!E.has(K))throw new Dn('"enc" (Encryption Algorithm) Header Parameter value not allowed');$=bi(K)}let A;if(R!==void 0)try{A=xt(R,"encrypted_key",W)}catch(O){if(!B||!vr(B))throw O;A=new Uint8Array}let x=!1;typeof r=="function"&&(r=await r(i,t),x=!0);let b=B??gr(M);vr(b)&&A===void 0&&(A=new Uint8Array);let g=await hr(b.mode==="direct-encryption"?$:b,r,"decrypt"),I;if(b.mode==="integrated-encryption")I=await b.decrypt(g,A,o,c,i,f);else{let O=$,P;try{P=await Mh(b,O,g,A,f,N),vr(b)&&P instanceof Uint8Array&&P.byteLength<<3!==O.cekBits&&(P=xi(O))}catch(k){if(k instanceof TypeError||k instanceof W||k instanceof Te)throw k;P=xi(O)}I=await Yc(O,P,o,s,a,c)}if(f.zip==="DEF"){let O=S??25e4;if(O===0)throw new Te('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(O!==1/0&&(!Number.isSafeInteger(O)||O<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");I=await Vh(I,O).catch(P=>{throw P instanceof W?P:new W("Failed to decompress plaintext",{cause:P})})}return{plaintext:I,...i&&{protectedHeader:i},...p!==void 0&&{additionalAuthenticatedData:xt(p,"aad",W)},...u&&{sharedUnprotectedHeader:u},...l&&{unprotectedHeader:l},...x&&{key:g}}}async function al(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new W("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:o,3:s,4:a,length:c}=t.split(".");if(c!==5)throw new W("Invalid Compact JWE");return Vs({ciphertext:s,iv:o||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}var Bs=ne(()=>{Hs();De();Ie();rl();Ft();Ct();Si();$d()});async function Bh(t,e,r){return al(t,Hn(r),e)}var jh=ne(()=>{Bs()});async function Gh(t,e,r){if(!he(t))throw new W("Flattened JWE must be an object");let n=il(t),[i,,o]=ol(t);if(!i)throw o;let s={...n,...i};return sl(s),Vs(s,Hn(r),e)}var $h=ne(()=>{Ie();De();Bs()});async function qh(t,e,r){if(!he(t))throw new W("General JWE must be an object");let n=t.recipients;if(!Array.isArray(n))throw new W("JWE Recipients missing or incorrect type");let i=Array.from(n);if(!i.every(he))throw new W("JWE Recipients missing or incorrect type");if(!i.length)throw new W("JWE Recipients has no members");let o,s,a;try{o=Hn(r),s=il(t),a=qd(s)}catch{throw new sn}let c=i.map(l=>ol(l));if(i.length>1)for(let[,l]of c){let u=a[0]?.alg??l??s.unprotected?.alg,p=typeof u=="string"?an[u]:void 0;if(p&&!vr(p))throw new W(`"${u}" alg may only have a single recipient`)}for(let[l]of c)if(l)try{let u={...s,...l};return sl(u),await Vs(u,o,e,a)}catch{}throw new sn}var Wh=ne(()=>{Bs();Ie();De();Si()});function cl(t,e,r){if(!Ln(t,e,r))throw new W("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Wd(t,e,r=!1){if(!t[1]&&!t[2]&&!t[3])throw new W("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");e!==void 0&&(t[8]=e?.crit);let[,n,i,o,s,a,c,l,u]=t;if(s!==void 0&&at(s,"JWE Additional Authenticated Data"),a!==void 0&&at(a,"JWE Content Encryption Key"),c!==void 0&&at(c,"JWE Initialization Vector"),!r&&n!==void 0&&(n=Ii(W,n)[0],t[1]=n),i!==void 0&&(i=Ii(W,i)[0],t[2]=i),!r&&o!==void 0&&(o=Ii(W,o)[0],t[3]=o),l!==void 0&&!he(l))throw new TypeError("JWE Key Management Parameters must be an object");cl(n,i,o);let p={...n,...i,...o};$c(W,n),Vr(W,Gc,u,n,p),nl(p,n);let{alg:f,enc:m}=p;if(typeof f!="string"||!f)throw new W('JWE "alg" (Algorithm) Header Parameter missing or invalid');let E=an[f];if(E?.mode==="integrated-encryption"){if(m!==void 0)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');if(a!==void 0)throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${f}`);if(c!==void 0)throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${f}`);return[p,void 0,E]}if(typeof m!="string"||!m)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,bi(m),E]}async function zd(t,e,r){let[n,i,o]=e,[s,a,c,l,u,p,f,m,,E]=t,v=a,N=c,S=o??gr(n.alg),R,M,K;S.mode==="integrated-encryption"?K=await hr(S,r,"encrypt"):[K,R,M]=await tl(S,i,r,n,p,m),M&&(E?N=N?{...N,...M}:M:v=v?{...v,...M}:M,cl(v,N,l));let B=v?Pe(JSON.stringify(v)):"",V=u?.byteLength?Pe(u):void 0,$=Et(V?`${B}.${V}`:B),A=s;n.zip==="DEF"&&(A=await Fh(A).catch(O=>{throw new W("Failed to compress plaintext",{cause:O})}));let x,b,g;S.mode==="integrated-encryption"?[R,x]=await S.encrypt(K,A,$,v,n,m):{ciphertext:x,tag:b,iv:g}=await Jc(i,A,K,f,$);let I={ciphertext:Pe(x)};return g&&(I.iv=Pe(g)),b&&(I.tag=Pe(b)),R?.byteLength&&(I.encrypted_key=Pe(R)),V&&(I.aad=V),v&&(I.protected=B),l&&(I.unprotected=l),N&&(I.header=N),I}async function vo(t,e,r){return zd(t,Wd(t,r),e)}function ll(t){return[t.protected,t.encrypted_key,t.iv,t.ciphertext,t.tag].join(".")}var js=ne(()=>{zt();Hs();rl();Ie();De();Ft();Ct();Si();$d()});var Jd,ul,zh=ne(()=>{De();Ie();Hs();zt();js();rl();Si();Jd=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return Se(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return Se(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},ul=class{#e;#t=[];#r;#o;#i;constructor(e){this.#e=e}addRecipient(e,r){let n=new Jd(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return Se(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Se(this.#o,"setSharedUnprotectedHeader"),this.#o=e,this}setAdditionalAuthenticatedData(e){return this.#i=e,this}async encrypt(){if(!this.#t.length)throw new W("at least one recipient must be added");at(this.#e,"plaintext");let e=this.#t.length>1,r,n=this.#r,i=this.#o,o=[];for(let E of this.#t){let[v,N,S,R]=E.state,M=[this.#e,n,v,i,this.#i,void 0,void 0,N,R,e],K=Wd(M,void 0,o.length>0);o.length||(n=M[1],i=M[3]),o.push([M,K,S]);let[{alg:B,enc:V},,$]=K;if(e&&$&&!vr($))throw new W(`"${B}" alg may only have a single recipient`);if(!r)r=V;else if(r!==V)throw new W('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}for(let[,E]of o)E[2]??=gr(E[0].alg);let[s,a,c]=o[0],l=e?xi(a[1]):void 0;s[5]=l;let{encrypted_key:u,header:p,...f}=await zd(s,a,c),m={...f,recipients:[{}]};u&&(m.recipients[0].encrypted_key=u),p&&(m.recipients[0].header=p);for(let E=1;E<o.length;E++){let[v,[N,S,R],M]=o[E],K=v[2],[,B,V]=await tl(R,S,M,N,l,v[7]),$={encrypted_key:Pe(B)};if(K||V){let A={...K,...V};V&&cl(v[1],A,v[3]),$.header=A}m.recipients.push($)}return m}}});function Yd(t){let e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:Gs}}function Ao(t,e){let r={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:r,signing:e?{...r,saltLength:e}:r,usages:Gs,minRsaBits:2048}}function Xd(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:Gs}}function Jh(){let t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:Gs}}function Qd(t){let e={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:e,signing:e,usages:Gs}}function To(t){let e=typeof t=="string"?$s[t]:void 0;if(!e)throw new Te(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}var Gs,$s,_o=ne(()=>{Ie();Bd();Gs=[["verify"],["sign"]];$s=Fs({HS256:Yd(256),HS384:Yd(384),HS512:Yd(512),RS256:Ao(256),RS384:Ao(384),RS512:Ao(512),PS256:Ao(256,32),PS384:Ao(384,48),PS512:Ao(512,64),ES256:Xd("P-256",256),ES384:Xd("P-384",384),ES512:Xd("P-521",512),EdDSA:Jh(),Ed25519:Jh(),"ML-DSA-44":Qd(44),"ML-DSA-65":Qd(65),"ML-DSA-87":Qd(87)})});function dl(t,e){let r=t.protected,n=t.header,i=he(n)?{...n}:n,o=e?e[0]:t.payload;!e&&o instanceof Uint8Array&&(o=new Uint8Array(o));let s=t.signature,a={payload:o,signature:s};if(r!==void 0&&(a.protected=r),n!==void 0&&(a.header=i),r===void 0&&i===void 0)throw new ee('Flattened JWS must have either of the "protected" or "header" members');if(r!==void 0&&typeof r!="string")throw new ee("JWS Protected Header incorrect type");if(o===void 0)throw new ee("JWS Payload missing");if(typeof s!="string")throw new ee("JWS Signature missing or incorrect type");if(i!==void 0&&!he(i))throw new ee("JWS Unprotected Header incorrect type");return a}function Fn(t){return[t&&Ls("algorithms",t.algorithms),t?.crit]}function Zd(t){return t===void 0?{}:Mn(t,ee,"JWS Protected Header is invalid")}function pl(t){let e=/[\p{Cs}\p{Cn}]/u.exec(t)?.[0];if(e!==void 0)throw new ee(/\p{Cs}/u.test(e)?"JWS Payload must be a well-formed Unicode string":"JWS Payload must not contain unassigned Unicode code points");return on.encode(t)}function aI(t){try{return Et(t)}catch{throw new ee("JWS Compact Serialization payload must use only ASCII characters")}}async function qs(t,e,r,n,i){let{protected:o,header:s,payload:a}=t,c=i??Zd(o);if(!Ln(c,s))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...c,...s},u=mo(c,Vr(ee,fo,e[1],c,l)),{alg:p}=l;if(typeof p!="string"||!p)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(p))throw new Dn('"alg" (Algorithm) Header Parameter value not allowed');if(u){if(typeof a!="string")throw new ee("JWS Payload must be a string")}else if(typeof a!="string"&&!(a instanceof Uint8Array))throw new ee("JWS Payload must be a string or an Uint8Array instance");let f=u||typeof a!="string"?a:n(a),m=!1;typeof r=="function"&&(r=await r(c,t),m=!0);let E=To(p),v=kt(o!==void 0?Et(o):new Uint8Array,Et("."),typeof f=="string"?e[2]??=jc(f,"payload",ee):f),N=xt(t.signature,"signature",ee),S=await hr(E,r,"verify"),R=await yr(S,E.subtle,"verify");E.minRsaBits&&ho(E.alg,R);let M=!1;try{M=await crypto.subtle.verify(E.signing,R,N,v)}catch{}if(!M)throw new Un;let K={payload:typeof f=="string"?xt(f,"payload",ee):f};return o!==void 0&&(K.protectedHeader=c),s!==void 0&&(K.unprotectedHeader=s),m?[{...K,key:S},u]:[K,u]}async function fl(t,e,r){if(t instanceof Uint8Array&&(t=ao.decode(t)),typeof t!="string")throw new ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:o,length:s}=t.split(".");if(s!==3)throw new ee("Invalid Compact JWS");return qs({payload:i,protected:n,signature:o},e,r,aI)}var Ws=ne(()=>{_o();Ie();Ft();De();Ct()});async function Yh(t,e,r){let[n]=await fl(t,Fn(r),e);return n}var Xh=ne(()=>{Ws()});async function Qh(t,e,r){if(!he(t))throw new ee("Flattened JWS must be an object");let n=dl(t),[i]=await qs(n,Fn(r),e,pl);return i}var Zh=ne(()=>{Ie();De();Ws()});function cI(t,e){try{let r=dl(t,[e]),n=Zd(r.protected),{b64:i,crit:o}=n;return[r,n,Array.isArray(o)&&o.includes("b64")?typeof i=="boolean"?i?1:2:0:1]}catch{return}}async function eE(t,e,r){if(!he(t))throw new ee("General JWS must be an object");let{signatures:n,payload:i}=t;if(!Array.isArray(n))throw new ee("JWS Signatures missing or incorrect type");let o=Array.from(n);if(!o.every(he))throw new ee("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=Fn(r)}catch{throw new Un}let a=i instanceof Uint8Array?new Uint8Array(i):i,c=o.map(u=>cI(u,a)).filter(u=>u!==void 0),l=0;for(let[,,u]of c)if(l|=u,l===3)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");for(let u of c)try{let[p]=await qs(u[0],s,e,pl,u[1]);return p}catch{}throw new Un}var tE=ne(()=>{Ws();Ie();De()});function ep(){throw new TypeError("Invalid time period format")}function ml(t){typeof t!="string"&&ep();let e=uI.exec(t);(!e||e[4]&&e[1])&&ep();let r=parseFloat(e[2]),n=Math.round(r*lI[e[3][0].toLowerCase()]);return Number.isFinite(n)||ep(),e[1]==="-"||e[4]==="ago"?-n:n}function xo(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function tp(t,e){if(typeof e!="string")throw new TypeError(`"${t}" claim must be a string`)}function dI(t){if(typeof t!="string"&&(!Array.isArray(t)||Array.from(t).some(e=>typeof e!="string")))throw new TypeError('"aud" claim must be a string or an array of strings')}function rp(t,e){return typeof t=="number"?xo(e,t):t instanceof Date?xo(e,zs(t)):zs(new Date)+ml(t)}function np(t,e,r=!1){let n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new ir(`"${e}" claim must be a number`,t,e,"invalid");return n}}function ip(t,e){throw new ir(`unexpected "${e}" claim value`,t,e,Io)}function bo(t,e,r={}){let n;try{n=JSON.parse(co.decode(e))}catch{}if(!he(n))throw new je("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i!==void 0&&(typeof t.typ!="string"||rE(t.typ)!==rE(i)))throw new ir('unexpected "typ" JWT header value',n,"typ",Io);let{requiredClaims:o=[],issuer:s,subject:a,audience:c,maxTokenAge:l}=r,u=[...o];l!==void 0&&u.push("iat"),c!==void 0&&u.push("aud"),a!==void 0&&u.push("sub"),s!==void 0&&u.push("iss");for(let R of new Set(u.reverse()))if(!Object.hasOwn(n,R))throw new ir(`missing required "${R}" claim`,n,R,"missing");s!==void 0&&!(Array.isArray(s)?s:[s]).includes(n.iss)&&ip(n,"iss"),a!==void 0&&n.sub!==a&&ip(n,"sub"),c!==void 0&&!pI(n.aud,typeof c=="string"?[c]:c)&&ip(n,"aud");let{clockTolerance:p}=r,f=0;if(typeof p=="string")f=ml(p);else if(p!==void 0){if(typeof p!="number")throw new TypeError("Invalid clockTolerance option type");f=p}xo("clockTolerance option",f);let{currentDate:m}=r,E=xo("currentDate option",zs(m===void 0?new Date:m)),v=np(n,"iat",l!==void 0),N=np(n,"nbf");if(N!==void 0&&N>E+f)throw new ir('"nbf" claim timestamp check failed',n,"nbf",Io);let S=np(n,"exp");if(S!==void 0&&S<=E-f)throw new lo('"exp" claim timestamp check failed',n,"exp",Io);if(l!==void 0){let R=E-v,M=xo("maxTokenAge option",typeof l=="number"?l:ml(l));if(R-f>M)throw new lo('"iat" claim timestamp check failed (too far in the past)',n,"iat",Io);if(R<-f)throw new ir('"iat" claim timestamp check failed (it should be in the past)',n,"iat",Io)}return n}function cn(t){return nE.get(t)}function So(t){let e=cn(t);for(let r of["iat","nbf","exp"]){let n=e[r];if(typeof n=="number"&&!Number.isFinite(n))throw new TypeError(`"${r}" claim must be a finite number`)}return on.encode(JSON.stringify(e))}function hl(t,e){return cn(t)[e]}var zs,lI,uI,Io,rE,pI,nE,Vn,wo=ne(()=>{Ie();Ft();De();zs=t=>Math.floor(t.getTime()/1e3),lI={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},uI=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,Io="check_failed";rE=t=>{let e=t.toLowerCase();return t.includes("/")?e:`application/${e}`},pI=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;Vn=class{constructor(e={}){if(!he(e))throw new TypeError("JWT Claims Set MUST be an object");(nE||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return tp("iss",e),cn(this).iss=e,this}setSubject(e){return tp("sub",e),cn(this).sub=e,this}setAudience(e){return dI(e),cn(this).aud=e,this}setJti(e){return tp("jti",e),cn(this).jti=e,this}setNotBefore(e){return cn(this).nbf=rp(e,"setNotBefore"),this}setExpirationTime(e){return cn(this).exp=rp(e,"setExpirationTime"),this}setIssuedAt(e){let r=cn(this);return e===void 0?r.iat=zs(new Date):typeof e=="string"?r.iat=xo("setIssuedAt",zs(new Date)+ml(e)):r.iat=rp(e,"setIssuedAt"),this}}});async function Bn(t,e,r){let[n,i]=await fl(t,Fn(r),e);if(!i)throw new je("JWTs MUST NOT use unencoded payload");let o=bo(n.protectedHeader,n.payload,r);return{...n,payload:o}}var iE=ne(()=>{Ws();wo();Ie()});async function oE(t,e,r){let{plaintext:n,...i}=await al(t,Hn(r),e),{protectedHeader:o}=i,s=bo(o,n,r);for(let a of["iss","sub","aud"])if(o[a]!==void 0&&(a==="aud"?JSON.stringify(o.aud)!==JSON.stringify(s.aud):o[a]!==s[a]))throw new ir(`replicated "${a}" claim header parameter mismatch`,s,a,"mismatch");return{payload:s,...i}}var sE=ne(()=>{Bs();wo();Ie()});var El,aE=ne(()=>{De();js();El=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}async encrypt(e,r){return ll(await vo([...this.#e],e,r))}}});var yl,cE=ne(()=>{De();js();yl=class{#e;constructor(e){at(e,"plaintext"),this.#e=[e]}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setSharedUnprotectedHeader(e){return Se(this.#e[3],"setSharedUnprotectedHeader"),this.#e[3]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}setAdditionalAuthenticatedData(e){return this.#e[4]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}async encrypt(e,r){return vo([...this.#e],e,r)}}});async function Js(t,e,r){let[n,i,o,s]=t,a="";if(i!==void 0){let S=Ii(ee,i);i=S[0],a=Pe(S[1])}if(o!==void 0&&(o=Ii(ee,o)[0]),!i&&!o)throw new ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Ln(i,o))throw new ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let c={...i,...o};$c(ee,i);let l=mo(i,Vr(ee,fo,s,i,c));l||r?.();let{alg:u}=c;if(typeof u!="string"||!u)throw new ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let p=To(u),f="",m=n,E;if(l){let S=t[4];S?(f=S[0]??=Pe(n),m=S[1]??=Et(f)):(f=Pe(n),E=on.encode(`${a}.${f}`))}E??=kt(Et(a),Et("."),m);let v=await yr(await hr(p,e,"sign"),p.subtle,"sign");p.minRsaBits&&ho(p.alg,v);let N={signature:Pe(new Uint8Array(await crypto.subtle.sign(p.signing,v,E))),payload:f};return i&&(N.protected=a),o&&(N.header=o),[N,l]}async function gl(t,e,r,n,i){let[o]=await Js([t,e,void 0,r],n,i);return`${o.protected}.${o.payload}.${o.signature}`}var Ys=ne(()=>{zt();_o();De();Ie();Ft();Ct()});var vl,lE=ne(()=>{Ys();De();vl=class{#e;#t;constructor(e){at(e,"payload"),this.#e=e}setProtectedHeader(e){return Se(this.#t,"setProtectedHeader"),this.#t=e,this}async sign(e,r){return gl(this.#e,this.#t,r?.crit,e,()=>{throw new TypeError("use the flattened module for creating JWS with b64: false")})}}});var Al,uE=ne(()=>{Ys();De();Al=class{#e;constructor(e){at(e,"payload"),this.#e=[e]}setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setUnprotectedHeader(e){return Se(this.#e[2],"setUnprotectedHeader"),this.#e[2]=e,this}async sign(e,r){let n=[...this.#e];n[3]=r?.crit;let[i]=await Js(n,e);return i}}});var op,Tl,dE=ne(()=>{Ys();Ie();De();op=class{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return Se(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return Se(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Tl=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new op(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new ee("at least one signature must be added");at(this.#e,"payload");let e={signatures:[],payload:""},r=[],n;for(let i of this.#t){let[o,s,a,c]=i.state,[{payload:l,...u},p]=await Js([this.#e,o,s,c,r],a);if(n===void 0)n=p,e.payload=l;else if(n!==p)throw new ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(u)}return e}}});var fI,No,pE=ne(()=>{Ys();Ie();wo();De();fI=Vn,No=class extends fI{#e;setProtectedHeader(e){return Se(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,r){return gl(So(this),this.#e,r?.crit,e,()=>{throw new je("JWTs MUST NOT use unencoded payload")})}}});var mI,_l,fE=ne(()=>{js();wo();De();mI=Vn,_l=class extends mI{#e=[void 0];#t;#r;#o;setProtectedHeader(e){return Se(this.#e[1],"setProtectedHeader"),this.#e[1]=e,this}setKeyManagementParameters(e){return Se(this.#e[7],"setKeyManagementParameters"),this.#e[7]=e,this}setContentEncryptionKey(e){return Se(this.#e[5],"setContentEncryptionKey"),this.#e[5]=e,this}setInitializationVector(e){return Se(this.#e[6],"setInitializationVector"),this.#e[6]=e,this}replicateIssuerAsHeader(){return this.#t=!0,this}replicateSubjectAsHeader(){return this.#r=!0,this}replicateAudienceAsHeader(){return this.#o=!0,this}async encrypt(e,r){let n=So(this);this.#e[1]&&(this.#t||this.#r||this.#o)&&(this.#e[1]={...this.#e[1],iss:this.#t?hl(this,"iss"):void 0,sub:this.#r?hl(this,"sub"):void 0,aud:this.#o?hl(this,"aud"):void 0});let i=[...this.#e];return i[0]=n,ll(await vo(i,e,r))}}});function wi(t='JWK "alg" (Algorithm) Parameter'){throw new Te(`Invalid or unsupported ${t} value`)}function Ni(t,e){return(typeof t=="string"?$s[t]??an[t]:void 0)??wi(e)}var jn,Xs=ne(()=>{Ie();_o();Si();jn='"alg" (Algorithm)'});function yI(t,e){if(Gn(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),ln(t),e==="pkcs8"){Gn(t,2,"Expected version field");let r=ln(t);t.pos+=r}Gn(t,48,"Expected algorithm identifier"),ln(t)}function vI(t){let e=gE(t);Gn(e,48,"Invalid certificate structure");let r=ln(e);if(r<0||e.pos+r>e.data.length)throw new Error("Unexpected end of ASN.1 input");Gn(e,48,"Invalid tbsCertificate structure"),ln(e),t[e.pos]===160?mE(e,6):mE(e,5);let n=e.pos;Gn(e,48,"Invalid SPKI structure");let i=ln(e);return t.subarray(n,n+i+(e.pos-n))}var hI,hE,EE,yE,Qs,gE,sp,ln,mE,Gn,vE,EI,gI,ap,cp,AE,TE,_E,lp=ne(()=>{Ct();Ft();Ie();Xs();hI=(t,e)=>{let r=(t.match(/.{1,64}/g)||[]).join(`
 `);return`-----BEGIN ${e}-----
 ${r}
------END ${e}-----`},dm=async(t,e,r)=>{if(ti(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!hr(r))throw new TypeError(nr(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return um(Zs(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},pm=t=>dm("public","spki",t),fm=t=>dm("private","pkcs8",t),hu=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},yu=t=>({data:t,pos:0}),yr=t=>{let e=t.data[t.pos++];if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|t.data[t.pos++];return n}return e},Eu=(t,e=1)=>{if(e<=0)return;t.pos++;let r=yr(t);t.pos+=r,e>1&&Eu(t,e-1)},Mr=(t,e,r)=>{if(t.data[t.pos++]!==e)throw new Error(r)},mm=(t,e)=>{let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},OT=t=>{Mr(t,6,"Expected algorithm OID");let e=yr(t);return mm(t,e)};hm=t=>{let e=OT(t);if(hu(e,[43,101,110]))return"X25519";if(!hu(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Mr(t,6,"Expected curve OID");let r=yr(t),n=mm(t,r);for(let{name:i,oid:s}of[{name:"P-256",oid:[42,134,72,206,61,3,1,7]},{name:"P-384",oid:[43,129,4,0,34]},{name:"P-521",oid:[43,129,4,0,35]}])if(hu(n,s))return i;throw new Error("Unsupported named curve")},Em=async(t,e,r,n)=>{let i,s,o=t==="spki",a=()=>o?["verify"]:["sign"],c=()=>o?["encrypt","wrapKey"]:["decrypt","unwrapKey"];switch(r){case"PS256":case"PS384":case"PS512":i={name:"RSA-PSS",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RS256":case"RS384":case"RS512":i={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${r.slice(-3)}`},s=a();break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":i={name:"RSA-OAEP",hash:`SHA-${parseInt(r.slice(-3),10)||1}`},s=c();break;case"ES256":case"ES384":case"ES512":{i={name:"ECDSA",namedCurve:{ES256:"P-256",ES384:"P-384",ES512:"P-521"}[r]},s=a();break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{try{let l=n.getNamedCurve(e);i=l==="X25519"?{name:"X25519"}:{name:"ECDH",namedCurve:l}}catch{throw new re("Invalid or unsupported key format")}s=o?[]:["deriveBits"];break}case"Ed25519":case"EdDSA":i={name:"Ed25519"},s=a();break;case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":i={name:r},s=a();break;default:throw new re('Invalid or unsupported "alg" (Algorithm) value')}return crypto.subtle.importKey(t,e,i,n?.extractable??!!o,s)},gu=(t,e)=>za(t.replace(e,"")),ym=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return kT(o),hm(o)}),Em("pkcs8",n,e,i)},vu=(t,e,r)=>{let n=gu(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g),i=r;return e?.startsWith?.("ECDH-ES")&&(i||={},i.getNamedCurve=s=>{let o=yu(s);return CT(o),hm(o)}),Em("spki",n,e,i)};gm=(t,e,r)=>{let n;try{n=PT(t)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return vu(um(Zs(n),"PUBLIC KEY"),e,r)}});async function sc(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return vu(t,e,r)}async function vm(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return gm(t,e,r)}async function ao(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return ym(t,e,r)}async function it(t,e,r){if(!be(t))throw new TypeError("JWK must be an object");let n;switch(e??=t.alg,n??=r?.extractable??t.ext,t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return dt(t.k);case"RSA":if("oth"in t&&t.oth!==void 0)throw new re('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');return Fi({...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return Fi({...t,ext:n})}case"EC":case"OKP":return Fi({...t,alg:e,ext:n});default:throw new re('Unsupported "kty" (Key Type) Parameter value')}}var co=Q(()=>{pt();Au();mu();Te();Qe()});async function Am(t){if(ti(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:De(t)};if(!hr(t))throw new TypeError(nr(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:e,key_ops:r,alg:n,use:i,...s}=await crypto.subtle.exportKey("jwk",t);return s.kty==="AKP"&&(s.alg=n),s}var Tm=Q(()=>{Qn();pt();_n()});async function _m(t){return pm(t)}async function Im(t){return fm(t)}async function qi(t){return Am(t)}var oc=Q(()=>{Au();Tm()});async function xm(t,e,r,n){let i=t.slice(0,7),s=await Za(i,r,e,n,new Uint8Array);return{encryptedKey:s.ciphertext,iv:De(s.iv),tag:De(s.tag)}}async function bm(t,e,r,n,i){let s=t.slice(0,7);return ec(s,e,r,n,i,new Uint8Array)}var Sm=Q(()=>{ri();pt()});function lo(t){if(t===void 0)throw new q("JWE Encrypted Key missing")}async function wm(t,e,r,n,i){switch(t){case"dir":{if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");return e}case"ECDH-ES":if(r!==void 0)throw new q("Encountered unexpected JWE Encrypted Key");case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(!be(n.epk))throw new q('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');if(Hi(e),!fu(e))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let s=await it(n.epk,t);Hi(s);let o,a;if(n.apu!==void 0){if(typeof n.apu!="string")throw new q('JOSE Header "apu" (Agreement PartyUInfo) invalid');o=Pt(n.apu,"apu",q)}if(n.apv!==void 0){if(typeof n.apv!="string")throw new q('JOSE Header "apv" (Agreement PartyVInfo) invalid');a=Pt(n.apv,"apv",q)}let c=await pu(s,e,t==="ECDH-ES"?n.enc:t,t==="ECDH-ES"?Qa(n.enc):parseInt(t.slice(-5,-2),10),o,a);return t==="ECDH-ES"?c:(lo(r),so(t.slice(-6),c,r))}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":return lo(r),Hi(e),am(t,e,r);case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{if(lo(r),typeof n.p2c!="number")throw new q('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=i?.maxPBES2Count||1e4;if(n.p2c>s)throw new q('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof n.p2s!="string")throw new q('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let o;return o=Pt(n.p2s,"p2s",q),Zf(t,e,r,n.p2c,o)}case"A128KW":case"A192KW":case"A256KW":return lo(r),so(t,e,r);case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{if(lo(r),typeof n.iv!="string")throw new q('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof n.tag!="string")throw new q('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=Pt(n.iv,"iv",q);let o;return o=Pt(n.tag,"tag",q),bm(t,e,r,s,o)}default:throw new re(Nm)}}async function ac(t,e,r,n,i={}){let s,o,a;switch(t){case"dir":{a=r;break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{if(Hi(r),!fu(r))throw new re("ECDH with the provided key is not allowed or not supported by your javascript runtime");let{apu:c,apv:l}=i,d;i.epk?d=await ir(i.epk,t):d=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let{x:p,y:m,crv:E,kty:v}=await qi(d),b=await pu(r,d,t==="ECDH-ES"?e:t,t==="ECDH-ES"?Qa(e):parseInt(t.slice(-5,-2),10),c,l);if(o={epk:{x:p,crv:E,kty:v}},v==="EC"&&(o.epk.y=m),c&&(o.apu=De(c)),l&&(o.apv=De(l)),t==="ECDH-ES"){a=b;break}a=n||Ur(e);let k=t.slice(-6);s=await io(k,b,a);break}case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":{a=n||Ur(e),Hi(r),s=await om(t,r,a);break}case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":{a=n||Ur(e);let{p2c:c,p2s:l}=i;({encryptedKey:s,...o}=await Qf(t,r,a,c,l));break}case"A128KW":case"A192KW":case"A256KW":{a=n||Ur(e),s=await io(t,r,a);break}case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":{a=n||Ur(e);let{iv:c}=i;({encryptedKey:s,...o}=await xm(t,r,a,c));break}default:throw new re(Nm)}return{cek:a,encryptedKey:s,parameters:o}}var Nm,cc=Q(()=>{uu();Yf();em();cm();pt();ii();Te();Er();ri();co();oc();Qe();Sm();_n();Nm='Invalid or unsupported "alg" (JWE Algorithm) header value'});function Kr(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return new Set;if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let s;r!==void 0?s=new Map([...Object.entries(r),...e.entries()]):s=e;for(let o of n.crit){if(!s.has(o))throw new re(`Extension Header Parameter "${o}" is not recognized`);if(i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s.get(o)&&n[o]===void 0)throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return new Set(n.crit)}var ji=Q(()=>{Te()});function uo(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}var Tu=Q(()=>{});function Hr(t,e,r){switch(t.substring(0,2)){case"A1":case"A2":case"di":case"HS":case"PB":UT(t,e,r);break;default:LT(t,e,r)}}var Gi,_u,UT,LT,$i=Q(()=>{Qn();_n();Qe();Gi=t=>t?.[Symbol.toStringTag],_u=(t,e,r)=>{if(e.use!==void 0){let n;switch(r){case"sign":case"verify":n="sig";break;case"encrypt":case"decrypt":n="enc";break}if(e.use!==n)throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`)}if(e.alg!==void 0&&e.alg!==t)throw new TypeError(`Invalid key for this operation, its "alg" must be "${t}" when present`);if(Array.isArray(e.key_ops)){let n;switch(!0){case(r==="sign"||r==="verify"):case t==="dir":case t.includes("CBC-HS"):n=r;break;case t.startsWith("PBES2"):n="deriveBits";break;case/^A\d{3}(?:GCM)?(?:KW)?$/.test(t):!t.includes("GCM")&&t.endsWith("KW")?n=r==="encrypt"?"wrapKey":"unwrapKey":n=r;break;case(r==="encrypt"&&t.startsWith("RSA")):n="wrapKey";break;case r==="decrypt":n=t.startsWith("RSA")?"unwrapKey":"deriveBits";break}if(n&&e.key_ops?.includes?.(n)===!1)throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`)}return!0},UT=(t,e,r)=>{if(!(e instanceof Uint8Array)){if(ni(e)){if($f(e)&&_u(t,e,r))return;throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present')}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"));if(e.type!=="secret")throw new TypeError(`${Gi(e)} instances for symmetric algorithms must be of type "secret"`)}},LT=(t,e,r)=>{if(ni(e))switch(r){case"decrypt":case"sign":if(jf(e)&&_u(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a private JWK");case"encrypt":case"verify":if(Gf(e)&&_u(t,e,r))return;throw new TypeError("JSON Web Key for this operation must be a public JWK")}if(!no(e))throw new TypeError(cu(t,e,"CryptoKey","KeyObject","JSON Web Key"));if(e.type==="secret")throw new TypeError(`${Gi(e)} instances for asymmetric algorithms must not be of type "secret"`);if(e.type==="public")switch(r){case"sign":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm signing must be of type "private"`);case"decrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm decryption must be of type "private"`)}if(e.type==="private")switch(r){case"verify":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm verifying must be of type "public"`);case"encrypt":throw new TypeError(`${Gi(e)} instances for asymmetric algorithm encryption must be of type "public"`)}}});function Rm(t){if(typeof globalThis[t]>"u")throw new re(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Om(t){Rm("CompressionStream");let e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});let n=[],i=e.readable.getReader();for(;;){let{value:s,done:o}=await i.read();if(o)break;n.push(s)}return rt(...n)}async function km(t,e){Rm("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});let i=[],s=0,o=r.readable.getReader();for(;;){let{value:a,done:c}=await o.read();if(c)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new q("Decompressed plaintext exceeded the configured limit")}return rt(...i)}var Iu=Q(()=>{Te();Tt()});async function Wi(t,e,r){if(!be(t))throw new q("Flattened JWE must be an object");if(t.protected===void 0&&t.header===void 0&&t.unprotected===void 0)throw new q("JOSE Header missing");if(t.iv!==void 0&&typeof t.iv!="string")throw new q("JWE Initialization Vector incorrect type");if(typeof t.ciphertext!="string")throw new q("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new q("JWE Authentication Tag incorrect type");if(t.protected!==void 0&&typeof t.protected!="string")throw new q("JWE Protected Header incorrect type");if(t.encrypted_key!==void 0&&typeof t.encrypted_key!="string")throw new q("JWE Encrypted Key incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new q("JWE AAD incorrect type");if(t.header!==void 0&&!be(t.header))throw new q("JWE Shared Unprotected Header incorrect type");if(t.unprotected!==void 0&&!be(t.unprotected))throw new q("JWE Per-Recipient Unprotected Header incorrect type");let n;if(t.protected)try{let G=dt(t.protected);n=JSON.parse(ct.decode(G))}catch{throw new q("JWE Protected Header is invalid")}if(!Lr(n,t.header,t.unprotected))throw new q("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");let i={...n,...t.header,...t.unprotected};if(Kr(q,new Map,r?.crit,n,i),i.zip!==void 0&&i.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(i.zip!==void 0&&!n?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:s,enc:o}=i;if(typeof s!="string"||!s)throw new q("missing JWE Algorithm (alg) in JWE Header");if(typeof o!="string"||!o)throw new q("missing JWE Encryption Algorithm (enc) in JWE Header");let a=r&&uo("keyManagementAlgorithms",r.keyManagementAlgorithms),c=r&&uo("contentEncryptionAlgorithms",r.contentEncryptionAlgorithms);if(a&&!a.has(s)||!a&&s.startsWith("PBES2"))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(c&&!c.has(o))throw new Tn('"enc" (Encryption Algorithm) Header Parameter value not allowed');let l;t.encrypted_key!==void 0&&(l=Pt(t.encrypted_key,"encrypted_key",q));let d=!1;typeof e=="function"&&(e=await e(n,t),d=!0),Hr(s==="dir"?o:s,e,"decrypt");let p=await ir(e,s),m;try{m=await wm(s,p,l,i,r)}catch(G){if(G instanceof TypeError||G instanceof q||G instanceof re)throw G;m=Ur(o)}let E,v;t.iv!==void 0&&(E=Pt(t.iv,"iv",q)),t.tag!==void 0&&(v=Pt(t.tag,"tag",q));let b=t.protected!==void 0?ze(t.protected):new Uint8Array,k;t.aad!==void 0?k=rt(b,ze("."),ze(t.aad)):k=b;let C=Pt(t.ciphertext,"ciphertext",q),L=await ec(o,m,C,E,v,k),B={plaintext:L};if(i.zip==="DEF"){let G=r?.maxDecompressedLength??25e4;if(G===0)throw new re('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(G!==1/0&&(!Number.isSafeInteger(G)||G<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");B.plaintext=await km(L,G).catch(j=>{throw j instanceof q?j:new q("Failed to decompress plaintext",{cause:j})})}return t.protected!==void 0&&(B.protectedHeader=n),t.aad!==void 0&&(B.additionalAuthenticatedData=Pt(t.aad,"aad",q)),t.unprotected!==void 0&&(B.sharedUnprotectedHeader=t.unprotected),t.header!==void 0&&(B.unprotectedHeader=t.header),d?{...B,key:p}:B}var lc=Q(()=>{pt();ri();Er();Te();Qe();Qe();cc();Tt();ri();ji();Tu();ii();$i();Iu()});async function uc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new q("Compact JWE must be a string or Uint8Array");let{0:n,1:i,2:s,3:o,4:a,length:c}=t.split(".");if(c!==5)throw new q("Invalid Compact JWE");let l=await Wi({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r),d={plaintext:l.plaintext,protectedHeader:l.protectedHeader};return typeof e=="function"?{...d,key:l.key}:d}var xu=Q(()=>{lc();Te();Tt()});async function Cm(t,e,r){if(!be(t))throw new q("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(be))throw new q("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new q("JWE Recipients has no members");for(let n of t.recipients)try{return await Wi({aad:t.aad,ciphertext:t.ciphertext,encrypted_key:n.encrypted_key,header:n.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected},e,r)}catch{}throw new Zr}var Dm=Q(()=>{lc();Te();Qe()});var en,dc=Q(()=>{pt();Er();ri();cc();Te();Qe();Tt();ji();ii();$i();Iu();en=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return Ge(this.#o,"setKeyManagementParameters"),this.#o=e,this}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return Ge(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return Ge(this.#s,"setUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}setContentEncryptionKey(e){return Ge(this.#i,"setContentEncryptionKey"),this.#i=e,this}setInitializationVector(e){return Ge(this.#a,"setInitializationVector"),this.#a=e,this}async encrypt(e,r){if(!this.#t&&!this.#s&&!this.#r)throw new q("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(!Lr(this.#t,this.#s,this.#r))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let n={...this.#t,...this.#s,...this.#r};if(Kr(q,new Map,r?.crit,this.#t,n),n.zip!==void 0&&n.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(n.zip!==void 0&&!this.#t?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');let{alg:i,enc:s}=n;if(typeof i!="string"||!i)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof s!="string"||!s)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');let o;if(this.#i&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);Hr(i==="dir"?s:i,e,"encrypt");let a;{let C,L=await ir(e,i);({cek:a,encryptedKey:o,parameters:C}=await ac(i,s,L,this.#i,this.#o)),C&&(r&&tc in r?this.#s?this.#s={...this.#s,...C}:this.setUnprotectedHeader(C):this.#t?this.#t={...this.#t,...C}:this.setProtectedHeader(C))}let c,l,d,p;if(this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array),this.#n){p=De(this.#n);let C=ze(p);c=rt(d,ze("."),C)}else c=d;let m=this.#e;n.zip==="DEF"&&(m=await Om(m).catch(C=>{throw new q("Failed to compress plaintext",{cause:C})}));let{ciphertext:E,tag:v,iv:b}=await Za(s,m,a,this.#a,c),k={ciphertext:De(E)};return b&&(k.iv=De(b)),v&&(k.tag=De(v)),o&&(k.encrypted_key=De(o)),p&&(k.aad=p),this.#t&&(k.protected=l),this.#r&&(k.unprotected=this.#r),this.#s&&(k.header=this.#s),k}}});var bu,pc,Pm=Q(()=>{dc();Er();Te();ri();Qe();cc();pt();ji();ii();$i();bu=class{#e;unprotectedHeader;keyManagementParameters;key;options;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}setKeyManagementParameters(e){return Ge(this.keyManagementParameters,"setKeyManagementParameters"),this.keyManagementParameters=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}},pc=class{#e;#t=[];#r;#s;#n;constructor(e){this.#e=e}addRecipient(e,r){let n=new bu(this,e,{crit:r?.crit});return this.#t.push(n),n}setProtectedHeader(e){return Ge(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return Ge(this.#s,"setSharedUnprotectedHeader"),this.#s=e,this}setAdditionalAuthenticatedData(e){return this.#n=e,this}async encrypt(){if(!this.#t.length)throw new q("at least one recipient must be added");if(this.#t.length===1){let[i]=this.#t,s=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(i.unprotectedHeader).encrypt(i.key,{...i.options}),o={ciphertext:s.ciphertext,iv:s.iv,recipients:[{}],tag:s.tag};return s.aad&&(o.aad=s.aad),s.protected&&(o.protected=s.protected),s.unprotected&&(o.unprotected=s.unprotected),s.encrypted_key&&(o.recipients[0].encrypted_key=s.encrypted_key),s.header&&(o.recipients[0].header=s.header),o}let e;for(let i=0;i<this.#t.length;i++){let s=this.#t[i];if(!Lr(this.#r,this.#s,s.unprotectedHeader))throw new q("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");let o={...this.#r,...this.#s,...s.unprotectedHeader},{alg:a}=o;if(typeof a!="string"||!a)throw new q('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(a==="dir"||a==="ECDH-ES")throw new q('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(typeof o.enc!="string"||!o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');if(!e)e=o.enc;else if(e!==o.enc)throw new q('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');if(Kr(q,new Map,s.options.crit,this.#r,o),o.zip!==void 0&&o.zip!=="DEF")throw new re('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(o.zip!==void 0&&!this.#r?.zip)throw new q('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}let r=Ur(e),n={ciphertext:"",recipients:[]};for(let i=0;i<this.#t.length;i++){let s=this.#t[i],o={};if(n.recipients.push(o),i===0){let p=await new en(this.#e).setAdditionalAuthenticatedData(this.#n).setContentEncryptionKey(r).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#s).setUnprotectedHeader(s.unprotectedHeader).setKeyManagementParameters(s.keyManagementParameters).encrypt(s.key,{...s.options,[tc]:!0});n.ciphertext=p.ciphertext,n.iv=p.iv,n.tag=p.tag,p.aad&&(n.aad=p.aad),p.protected&&(n.protected=p.protected),p.unprotected&&(n.unprotected=p.unprotected),o.encrypted_key=p.encrypted_key,p.header&&(o.header=p.header);continue}let a=s.unprotectedHeader?.alg||this.#r?.alg||this.#s?.alg;Hr(a==="dir"?e:a,s.key,"encrypt");let c=await ir(s.key,a),{encryptedKey:l,parameters:d}=await ac(a,e,c,r,s.keyManagementParameters);o.encrypted_key=De(l),(s.unprotectedHeader||d)&&(o.header={...s.unprotectedHeader,...d})}return n}}});async function zi(t,e,r){if(!be(t))throw new Ee("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new Ee('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new Ee("JWS Protected Header incorrect type");if(t.payload===void 0)throw new Ee("JWS Payload missing");if(typeof t.signature!="string")throw new Ee("JWS Signature missing or incorrect type");if(t.header!==void 0&&!be(t.header))throw new Ee("JWS Unprotected Header incorrect type");let n={};if(t.protected)try{let k=dt(t.protected);n=JSON.parse(ct.decode(k))}catch{throw new Ee("JWS Protected Header is invalid")}if(!Lr(n,t.header))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let i={...n,...t.header},s=Kr(Ee,new Map([["b64",!0]]),r?.crit,n,i),o=!0;if(s.has("b64")&&(o=n.b64,typeof o!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:a}=i;if(typeof a!="string"||!a)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');let c=r&&uo("algorithms",r.algorithms);if(c&&!c.has(a))throw new Tn('"alg" (Algorithm) Header Parameter value not allowed');if(o){if(typeof t.payload!="string")throw new Ee("JWS Payload must be a string")}else if(typeof t.payload!="string"&&!(t.payload instanceof Uint8Array))throw new Ee("JWS Payload must be a string or an Uint8Array instance");let l=!1;typeof e=="function"&&(e=await e(n,t),l=!0),Hr(a,e,"verify");let d=rt(t.protected!==void 0?ze(t.protected):new Uint8Array,ze("."),typeof t.payload=="string"?o?ze(t.payload):Yn.encode(t.payload):t.payload),p=Pt(t.signature,"signature",Ee),m=await ir(e,a);if(!await im(a,m,p,d))throw new ei;let v;o?v=Pt(t.payload,"payload",Ee):typeof t.payload=="string"?v=Yn.encode(t.payload):v=t.payload;let b={payload:v};return t.protected!==void 0&&(b.protectedHeader=n),t.header!==void 0&&(b.unprotectedHeader=t.header),l?{...b,key:m}:b}var fc=Q(()=>{pt();nc();Te();Tt();Er();Qe();Qe();$i();ji();Tu();ii()});async function mc(t,e,r){if(t instanceof Uint8Array&&(t=ct.decode(t)),typeof t!="string")throw new Ee("Compact JWS must be a string or Uint8Array");let{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new Ee("Invalid Compact JWS");let a=await zi({payload:i,protected:n,signature:s},e,r),c={payload:a.payload,protectedHeader:a.protectedHeader};return typeof e=="function"?{...c,key:a.key}:c}var Su=Q(()=>{fc();Te();Tt()});async function Um(t,e,r){if(!be(t))throw new Ee("General JWS must be an object");if(!Array.isArray(t.signatures)||!t.signatures.every(be))throw new Ee("JWS Signatures missing or incorrect type");for(let n of t.signatures)try{return await zi({header:n.header,payload:t.payload,protected:n.protected,signature:n.signature},e,r)}catch{}throw new ei}var Lm=Q(()=>{fc();Te();Qe()});function po(t){let e=HT.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");let r=parseFloat(e[2]),n=e[3].toLowerCase(),i;switch(n){case"sec":case"secs":case"second":case"seconds":case"s":i=Math.round(r);break;case"minute":case"minutes":case"min":case"mins":case"m":i=Math.round(r*Km);break;case"hour":case"hours":case"hr":case"hrs":case"h":i=Math.round(r*Hm);break;case"day":case"days":case"d":i=Math.round(r*Nu);break;case"week":case"weeks":case"w":i=Math.round(r*MT);break;default:i=Math.round(r*KT);break}return e[1]==="-"||e[4]==="ago"?-i:i}function si(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function Ji(t,e,r={}){let n;try{n=JSON.parse(ct.decode(e))}catch{}if(!be(n))throw new Xe("JWT Claims Set must be a top-level JSON object");let{typ:i}=r;if(i&&(typeof t.typ!="string"||Mm(t.typ)!==Mm(i)))throw new ft('unexpected "typ" JWT header value',n,"typ","check_failed");let{requiredClaims:s=[],issuer:o,subject:a,audience:c,maxTokenAge:l}=r,d=[...s];l!==void 0&&d.push("iat"),c!==void 0&&d.push("aud"),a!==void 0&&d.push("sub"),o!==void 0&&d.push("iss");for(let v of new Set(d.reverse()))if(!(v in n))throw new ft(`missing required "${v}" claim`,n,v,"missing");if(o&&!(Array.isArray(o)?o:[o]).includes(n.iss))throw new ft('unexpected "iss" claim value',n,"iss","check_failed");if(a&&n.sub!==a)throw new ft('unexpected "sub" claim value',n,"sub","check_failed");if(c&&!FT(n.aud,typeof c=="string"?[c]:c))throw new ft('unexpected "aud" claim value',n,"aud","check_failed");let p;switch(typeof r.clockTolerance){case"string":p=po(r.clockTolerance);break;case"number":p=r.clockTolerance;break;case"undefined":p=0;break;default:throw new TypeError("Invalid clockTolerance option type")}let{currentDate:m}=r,E=In(m||new Date);if((n.iat!==void 0||l)&&typeof n.iat!="number")throw new ft('"iat" claim must be a number',n,"iat","invalid");if(n.nbf!==void 0){if(typeof n.nbf!="number")throw new ft('"nbf" claim must be a number',n,"nbf","invalid");if(n.nbf>E+p)throw new ft('"nbf" claim timestamp check failed',n,"nbf","check_failed")}if(n.exp!==void 0){if(typeof n.exp!="number")throw new ft('"exp" claim must be a number',n,"exp","invalid");if(n.exp<=E-p)throw new Mi('"exp" claim timestamp check failed',n,"exp","check_failed")}if(l){let v=E-n.iat,b=typeof l=="number"?l:po(l);if(v-p>b)throw new Mi('"iat" claim timestamp check failed (too far in the past)',n,"iat","check_failed");if(v<0-p)throw new ft('"iat" claim timestamp check failed (it should be in the past)',n,"iat","check_failed")}return n}var In,Km,Hm,Nu,MT,KT,HT,Mm,FT,xn,Yi=Q(()=>{Te();Tt();Qe();In=t=>Math.floor(t.getTime()/1e3),Km=60,Hm=Km*60,Nu=Hm*24,MT=Nu*7,KT=Nu*365.25,HT=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;Mm=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,FT=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(Set.prototype.has.bind(new Set(t))):!1;xn=class{#e;constructor(e){if(!be(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return Yn.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){typeof e=="number"?this.#e.nbf=si("setNotBefore",e):e instanceof Date?this.#e.nbf=si("setNotBefore",In(e)):this.#e.nbf=In(new Date)+po(e)}set exp(e){typeof e=="number"?this.#e.exp=si("setExpirationTime",e):e instanceof Date?this.#e.exp=si("setExpirationTime",In(e)):this.#e.exp=In(new Date)+po(e)}set iat(e){e===void 0?this.#e.iat=In(new Date):e instanceof Date?this.#e.iat=si("setIssuedAt",In(e)):typeof e=="string"?this.#e.iat=si("setIssuedAt",In(new Date)+po(e)):this.#e.iat=si("setIssuedAt",e)}}});async function bn(t,e,r){let n=await mc(t,e,r);if(n.protectedHeader.crit?.includes("b64")&&n.protectedHeader.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");let s={payload:Ji(n.protectedHeader,n.payload,r),protectedHeader:n.protectedHeader};return typeof e=="function"?{...s,key:n.key}:s}var Fm=Q(()=>{Su();Yi();Te()});async function Vm(t,e,r){let n=await uc(t,e,r),i=Ji(n.protectedHeader,n.plaintext,r),{protectedHeader:s}=n;if(s.iss!==void 0&&s.iss!==i.iss)throw new ft('replicated "iss" claim header parameter mismatch',i,"iss","mismatch");if(s.sub!==void 0&&s.sub!==i.sub)throw new ft('replicated "sub" claim header parameter mismatch',i,"sub","mismatch");if(s.aud!==void 0&&JSON.stringify(s.aud)!==JSON.stringify(i.aud))throw new ft('replicated "aud" claim header parameter mismatch',i,"aud","mismatch");let o={payload:i,protectedHeader:s};return typeof e=="function"?{...o,key:n.key}:o}var Bm=Q(()=>{xu();Yi();Te()});var Xi,wu=Q(()=>{dc();Xi=class{#e;constructor(e){this.#e=new en(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){let n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}});var Sn,hc=Q(()=>{pt();nc();Qe();Te();Tt();$i();ji();ii();Er();Sn=class{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return Ge(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return Ge(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){if(!this.#t&&!this.#r)throw new Ee("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Lr(this.#t,this.#r))throw new Ee("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let n={...this.#t,...this.#r},i=Kr(Ee,new Map([["b64",!0]]),r?.crit,this.#t,n),s=!0;if(i.has("b64")&&(s=this.#t.b64,typeof s!="boolean"))throw new Ee('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:o}=n;if(typeof o!="string"||!o)throw new Ee('JWS "alg" (Algorithm) Header Parameter missing or invalid');Hr(o,e,"sign");let a,c;s?(a=De(this.#e),c=ze(a)):(c=this.#e,a="");let l,d;this.#t?(l=De(JSON.stringify(this.#t)),d=ze(l)):(l="",d=new Uint8Array);let p=rt(d,ze("."),c),m=await ir(e,o),E=await nm(o,m,p),v={signature:De(E),payload:a};return this.#r&&(v.header=this.#r),this.#t&&(v.protected=l),v}}});var Qi,Ru=Q(()=>{hc();Qi=class{#e;constructor(e){this.#e=new Sn(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}async sign(e,r){let n=await this.#e.sign(e,r);if(n.payload===void 0)throw new TypeError("use the flattened module for creating JWS with b64: false");return`${n.protected}.${n.payload}.${n.signature}`}}});var Ou,Ec,qm=Q(()=>{hc();Te();Er();Ou=class{#e;protectedHeader;unprotectedHeader;options;key;constructor(e,r,n){this.#e=e,this.key=r,this.options=n}setProtectedHeader(e){return Ge(this.protectedHeader,"setProtectedHeader"),this.protectedHeader=e,this}setUnprotectedHeader(e){return Ge(this.unprotectedHeader,"setUnprotectedHeader"),this.unprotectedHeader=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}},Ec=class{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){let n=new Ou(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new Ee("at least one signature must be added");let e={signatures:[],payload:""};for(let r=0;r<this.#t.length;r++){let n=this.#t[r],i=new Sn(this.#e);i.setProtectedHeader(n.protectedHeader),i.setUnprotectedHeader(n.unprotectedHeader);let{payload:s,...o}=await i.sign(n.key,n.options);if(r===0)e.payload=s;else if(e.payload!==s)throw new Ee("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(o)}return e}}});var Zi,jm=Q(()=>{Ru();Te();Yi();Zi=class{#e;#t;constructor(e={}){this.#t=new xn(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){let n=new Qi(this.#t.data());if(n.setProtectedHeader(this.#e),Array.isArray(this.#e?.crit)&&this.#e.crit.includes("b64")&&this.#e.b64===!1)throw new Xe("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}});var yc,Gm=Q(()=>{wu();Yi();Er();yc=class{#e;#t;#r;#s;#n;#i;#a;#o;constructor(e={}){this.#o=new xn(e)}setIssuer(e){return this.#o.iss=e,this}setSubject(e){return this.#o.sub=e,this}setAudience(e){return this.#o.aud=e,this}setJti(e){return this.#o.jti=e,this}setNotBefore(e){return this.#o.nbf=e,this}setExpirationTime(e){return this.#o.exp=e,this}setIssuedAt(e){return this.#o.iat=e,this}setProtectedHeader(e){return Ge(this.#s,"setProtectedHeader"),this.#s=e,this}setKeyManagementParameters(e){return Ge(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return Ge(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Ge(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#n=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,r){let n=new Xi(this.#o.data());return this.#s&&(this.#n||this.#i||this.#a)&&(this.#s={...this.#s,iss:this.#n?this.#o.iss:void 0,sub:this.#i?this.#o.sub:void 0,aud:this.#a?this.#o.aud:void 0}),n.setProtectedHeader(this.#s),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}});async function ku(t,e){let r;if(ni(t))r=t;else if(no(t))r=await qi(t);else throw new TypeError(nr(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":Fr(r.alg,'"alg" (Algorithm) Parameter'),Fr(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":Fr(r.crv,'"crv" (Curve) Parameter'),Fr(r.x,'"x" (X Coordinate) Parameter'),Fr(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":Fr(r.crv,'"crv" (Subtype of Key Pair) Parameter'),Fr(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":Fr(r.e,'"e" (Exponent) Parameter'),Fr(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":Fr(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new re('"kty" (Key Type) Parameter missing or unsupported')}let i=ze(JSON.stringify(n));return De(await rc(e,i))}async function $m(t,e){e??="sha256";let r=await ku(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var Fr,Wm=Q(()=>{Er();pt();Te();Tt();_n();Qe();oc();Qn();Fr=(t,e)=>{if(typeof t!="string"||!t)throw new eo(`${e} missing or invalid`)}});async function zm(t,e){let r={...t,...e?.header};if(!be(r.jwk))throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n=await it({...r.jwk,ext:!0},r.alg);if(n instanceof Uint8Array||n.type!=="public")throw new Ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return n}var Jm=Q(()=>{co();Qe();Te()});function VT(t){switch(typeof t=="string"&&t.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";case"ML":return"AKP";default:throw new re('Unsupported "alg" value for a JSON Web Key Set')}}function BT(t){return t&&typeof t=="object"&&Array.isArray(t.keys)&&t.keys.every(qT)}function qT(t){return be(t)}async function Ym(t,e,r){let n=t.get(e)||t.set(e,{}).get(e);if(n[r]===void 0){let i=await it({...e,ext:!0},r);if(i instanceof Uint8Array||i.type!=="public")throw new Ki("JSON Web Key Set members must be public keys");n[r]=i}return n[r]}function fo(t){let e=new Cu(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperties(r,{jwks:{value:()=>structuredClone(e.jwks()),enumerable:!1,configurable:!1,writable:!1}}),r}var Cu,Du=Q(()=>{co();Te();Qe();Cu=class{#e;#t=new WeakMap;constructor(e){if(!BT(e))throw new Ki("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){let{alg:n,kid:i}={...e,...r?.header},s=VT(n),o=this.#e.keys.filter(l=>{let d=s===l.kty;if(d&&typeof i=="string"&&(d=i===l.kid),d&&(typeof l.alg=="string"||s==="AKP")&&(d=n===l.alg),d&&typeof l.use=="string"&&(d=l.use==="sig"),d&&Array.isArray(l.key_ops)&&(d=l.key_ops.includes("verify")),d)switch(n){case"ES256":d=l.crv==="P-256";break;case"ES384":d=l.crv==="P-384";break;case"ES512":d=l.crv==="P-521";break;case"Ed25519":case"EdDSA":d=l.crv==="Ed25519";break}return d}),{0:a,length:c}=o;if(c===0)throw new Zn;if(c!==1){let l=new to,d=this.#t;throw l[Symbol.asyncIterator]=async function*(){for(let p of o)try{yield await Ym(d,p,n)}catch{}},l}return Ym(this.#t,a,n)}}});function jT(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function GT(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new ro:s});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function $T(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>=e||!("jwks"in t)||!be(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,be))}function Xm(t,e){let r=new Uu(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0,configurable:!1},fresh:{get:()=>r.fresh(),enumerable:!0,configurable:!1},reload:{value:()=>r.reload(),enumerable:!0,configurable:!1,writable:!1},reloading:{get:()=>r.pendingFetch(),enumerable:!0,configurable:!1},jwks:{value:()=>r.jwks(),enumerable:!0,configurable:!1,writable:!1}}),n}var Pu,Lu,mo,Uu,Qm=Q(()=>{Te();Du();Qe();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(Pu="jose/v6.2.3");Lu=Symbol();mo=Symbol();Uu=class{#e;#t;#r;#s;#n;#i;#a;#o;#l;#c;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href),this.#t=typeof r?.timeoutDuration=="number"?r?.timeoutDuration:5e3,this.#r=typeof r?.cooldownDuration=="number"?r?.cooldownDuration:3e4,this.#s=typeof r?.cacheMaxAge=="number"?r?.cacheMaxAge:6e5,this.#a=new Headers(r?.headers),Pu&&!this.#a.has("User-Agent")&&this.#a.set("User-Agent",Pu),this.#a.has("accept")||(this.#a.set("accept","application/json"),this.#a.append("accept","application/jwk-set+json")),this.#o=r?.[Lu],r?.[mo]!==void 0&&(this.#c=r?.[mo],$T(r?.[mo],this.#s)&&(this.#n=this.#c.uat,this.#l=fo(this.#c.jwks)))}pendingFetch(){return!!this.#i}coolingDown(){return typeof this.#n=="number"?Date.now()<this.#n+this.#r:!1}fresh(){return typeof this.#n=="number"?Date.now()<this.#n+this.#s:!1}jwks(){return this.#l?.jwks()}async getKey(e,r){(!this.#l||!this.fresh())&&await this.reload();try{return await this.#l(e,r)}catch(n){if(n instanceof Zn&&this.coolingDown()===!1)return await this.reload(),this.#l(e,r);throw n}}async reload(){this.#i&&jT()&&(this.#i=void 0),this.#i||=GT(this.#e.href,this.#a,AbortSignal.timeout(this.#t),this.#o).then(e=>{this.#l=fo(e),this.#c&&(this.#c.uat=Date.now(),this.#c.jwks=e),this.#n=Date.now(),this.#i=void 0}).catch(e=>{throw this.#i=void 0,e}),await this.#i}}});var gc,Zm=Q(()=>{pt();Tt();Te();Yi();gc=class{#e;constructor(e={}){this.#e=new xn(e)}encode(){let e=De(JSON.stringify({alg:"none"})),r=De(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new Xe("Unsecured JWT must be a string");let{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new Xe("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(ct.decode(dt(n))),a.alg!=="none")throw new Error}catch{throw new Xe("Invalid Unsecured JWT")}return{payload:Ji(a,dt(i),r),header:a}}}});function eh(t){let e;if(typeof t=="string"){let r=t.split(".");(r.length===3||r.length===5)&&([e]=r)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");try{if(typeof e!="string"||!e)throw new Error;let r=JSON.parse(ct.decode(dt(e)));if(!be(r))throw new Error;return r}catch{throw new TypeError("Invalid Token or Protected Header formatting")}}var th=Q(()=>{pt();Tt();Qe()});function rh(t){if(typeof t!="string")throw new Xe("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new Xe("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new Xe("Invalid JWT");if(!e)throw new Xe("JWTs must contain a payload");let n;try{n=dt(e)}catch{throw new Xe("Failed to base64url decode the payload")}let i;try{i=JSON.parse(ct.decode(n))}catch{throw new Xe("Failed to parse the decoded payload as JSON")}if(!be(i))throw new Xe("Invalid JWT Claims Set");return i}var nh=Q(()=>{pt();Tt();Qe();Te()});function Mu(t){let e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new re("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function ih(t,e){let r,n;switch(t){case"PS256":case"PS384":case"PS512":r={name:"RSA-PSS",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RS256":case"RS384":case"RS512":r={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${t.slice(-3)}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["sign","verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":r={name:"RSA-OAEP",hash:`SHA-${parseInt(t.slice(-3),10)||1}`,publicExponent:Uint8Array.of(1,0,1),modulusLength:Mu(e)},n=["decrypt","unwrapKey","encrypt","wrapKey"];break;case"ES256":r={name:"ECDSA",namedCurve:"P-256"},n=["sign","verify"];break;case"ES384":r={name:"ECDSA",namedCurve:"P-384"},n=["sign","verify"];break;case"ES512":r={name:"ECDSA",namedCurve:"P-521"},n=["sign","verify"];break;case"Ed25519":case"EdDSA":{n=["sign","verify"],r={name:"Ed25519"};break}case"ML-DSA-44":case"ML-DSA-65":case"ML-DSA-87":{n=["sign","verify"],r={name:t};break}case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":{n=["deriveBits"];let i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":{r={name:"ECDH",namedCurve:i};break}case"X25519":r={name:"X25519"};break;default:throw new re("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}break}default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(r,e?.extractable??!1,n)}var sh=Q(()=>{Te()});async function oh(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:throw new re('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}var ah=Q(()=>{Te()});var ch={};Ba(ch,{CompactEncrypt:()=>Xi,CompactSign:()=>Qi,EmbeddedJWK:()=>zm,EncryptJWT:()=>yc,FlattenedEncrypt:()=>en,FlattenedSign:()=>Sn,GeneralEncrypt:()=>pc,GeneralSign:()=>Ec,SignJWT:()=>Zi,UnsecuredJWT:()=>gc,base64url:()=>Ja,calculateJwkThumbprint:()=>ku,calculateJwkThumbprintUri:()=>$m,compactDecrypt:()=>uc,compactVerify:()=>mc,createLocalJWKSet:()=>fo,createRemoteJWKSet:()=>Xm,cryptoRuntime:()=>WT,customFetch:()=>Lu,decodeJwt:()=>rh,decodeProtectedHeader:()=>eh,errors:()=>lu,exportJWK:()=>qi,exportPKCS8:()=>Im,exportSPKI:()=>_m,flattenedDecrypt:()=>Wi,flattenedVerify:()=>zi,generalDecrypt:()=>Cm,generalVerify:()=>Um,generateKeyPair:()=>ih,generateSecret:()=>oh,importJWK:()=>it,importPKCS8:()=>ao,importSPKI:()=>sc,importX509:()=>vm,jwksCache:()=>mo,jwtDecrypt:()=>Vm,jwtVerify:()=>bn});var WT,ho=Q(()=>{xu();lc();Dm();Pm();Su();fc();Lm();Fm();Bm();wu();dc();Ru();hc();qm();jm();Gm();Wm();Jm();Du();Qm();Zm();oc();co();th();nh();Te();sh();ah();pt();WT="WebCryptoAPI"});var eg=he((oa,wl)=>{(function(t,e){"use strict";var r="",n="?",i="function",s="undefined",o="object",a="string",c="major",l="model",d="name",p="type",m="vendor",E="version",v="architecture",b="console",k="mobile",C="tablet",L="smarttv",B="wearable",G="embedded",j=500,$="Amazon",te="Apple",A="ASUS",x="BlackBerry",S="Browser",y="Chrome",_="Edge",w="Firefox",R="Google",N="Huawei",O="LG",P="Microsoft",U="Motorola",K="Opera",W="Samsung",J="Sharp",de="Sony",ke="Xiaomi",He="Zebra",fe="Facebook",Ne="Chromium OS",at="Mac OS",Ri=function(ve,Ce){var pe={};for(var Ke in ve)Ce[Ke]&&Ce[Ke].length%2===0?pe[Ke]=Ce[Ke].concat(ve[Ke]):pe[Ke]=ve[Ke];return pe},gn=function(ve){for(var Ce={},pe=0;pe<ve.length;pe++)Ce[ve[pe].toUpperCase()]=ve[pe];return Ce},Oi=function(ve,Ce){return typeof ve===a?Nt(Ce).indexOf(Nt(ve))!==-1:!1},Nt=function(ve){return ve.toLowerCase()},Gn=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},wt=function(ve,Ce){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof Ce===s?ve:ve.substring(0,j)},Ye=function(ve,Ce){for(var pe=0,Ke,Xr,kr,Oe,ie,Cr;pe<Ce.length&&!ie;){var Ql=Ce[pe],Df=Ce[pe+1];for(Ke=Xr=0;Ke<Ql.length&&!ie&&Ql[Ke];)if(ie=Ql[Ke++].exec(ve),ie)for(kr=0;kr<Df.length;kr++)Cr=ie[++Xr],Oe=Df[kr],typeof Oe===o&&Oe.length>0?Oe.length===2?typeof Oe[1]==i?this[Oe[0]]=Oe[1].call(this,Cr):this[Oe[0]]=Oe[1]:Oe.length===3?typeof Oe[1]===i&&!(Oe[1].exec&&Oe[1].test)?this[Oe[0]]=Cr?Oe[1].call(this,Cr,Oe[2]):e:this[Oe[0]]=Cr?Cr.replace(Oe[1],Oe[2]):e:Oe.length===4&&(this[Oe[0]]=Cr?Oe[3].call(this,Cr.replace(Oe[1],Oe[2])):e):this[Oe]=Cr||e;pe+=2}},Me=function(ve,Ce){for(var pe in Ce)if(typeof Ce[pe]===o&&Ce[pe].length>0){for(var Ke=0;Ke<Ce[pe].length;Ke++)if(Oi(Ce[pe][Ke],ve))return pe===n?e:pe}else if(Oi(Ce[pe],ve))return pe===n?e:pe;return ve},tT={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},kf={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Cf={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[E,[d,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[E,[d,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[d,E],[/opios[\/ ]+([\w\.]+)/i],[E,[d,K+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[E,[d,K+" GX"]],[/\bopr\/([\w\.]+)/i],[E,[d,K]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[E,[d,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[d,E],[/\bddg\/([\w\.]+)/i],[E,[d,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[E,[d,"UC"+S]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[E,[d,"WeChat"]],[/konqueror\/([\w\.]+)/i],[E,[d,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[E,[d,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[E,[d,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[E,[d,"Smart Lenovo "+S]],[/(avast|avg)\/([\w\.]+)/i],[[d,/(.+)/,"$1 Secure "+S],E],[/\bfocus\/([\w\.]+)/i],[E,[d,w+" Focus"]],[/\bopt\/([\w\.]+)/i],[E,[d,K+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[E,[d,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[E,[d,"Dolphin"]],[/coast\/([\w\.]+)/i],[E,[d,K+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[E,[d,"MIUI "+S]],[/fxios\/([-\w\.]+)/i],[E,[d,w]],[/\bqihu|(qi?ho?o?|360)browser/i],[[d,"360 "+S]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[d,/(.+)/,"$1 "+S],E],[/samsungbrowser\/([\w\.]+)/i],[E,[d,W+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[d,/_/g," "],E],[/metasr[\/ ]?([\d\.]+)/i],[E,[d,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[d,"Sogou Mobile"],E],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[d,E],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[d],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[d,fe],E],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[d,E],[/\bgsa\/([\w\.]+) .*safari\//i],[E,[d,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[E,[d,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[E,[d,y+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[d,y+" WebView"],E],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[E,[d,"Android "+S]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[d,E],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[E,[d,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[E,d],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[d,[E,Me,tT]],[/(webkit|khtml)\/([\w\.]+)/i],[d,E],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[d,"Netscape"],E],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[E,[d,w+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[d,E],[/(cobalt)\/([\w\.]+)/i],[d,[E,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[v,"amd64"]],[/(ia32(?=;))/i],[[v,Nt]],[/((?:i[346]|x)86)[;\)]/i],[[v,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[v,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[v,"armhf"]],[/windows (ce|mobile); ppc;/i],[[v,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[v,/ower/,r,Nt]],[/(sun4\w)[;\)]/i],[[v,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[v,Nt]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[m,W],[p,C]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[m,W],[p,k]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[m,te],[p,k]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[m,te],[p,C]],[/(macintosh);/i],[l,[m,te]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[m,J],[p,k]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[m,N],[p,C]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[m,N],[p,k]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,k]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[m,ke],[p,C]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[m,"OPPO"],[p,k]],[/\b(opd2\d{3}a?) bui/i],[l,[m,"OPPO"],[p,C]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[m,"Vivo"],[p,k]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[m,"Realme"],[p,k]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[m,U],[p,k]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[m,U],[p,C]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[m,O],[p,C]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[m,O],[p,k]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[m,"Lenovo"],[p,C]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[m,"Nokia"],[p,k]],[/(pixel c)\b/i],[l,[m,R],[p,C]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[m,R],[p,k]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[m,de],[p,k]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[m,de],[p,C]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[m,"OnePlus"],[p,k]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[m,$],[p,C]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[m,$],[p,k]],[/(playbook);[-\w\),; ]+(rim)/i],[l,m,[p,C]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[m,x],[p,k]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[m,A],[p,C]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[m,A],[p,k]],[/(nexus 9)/i],[l,[m,"HTC"],[p,C]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[m,[l,/_/g," "],[p,k]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[m,"Acer"],[p,C]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[m,"Meizu"],[p,k]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[m,"Ulefone"],[p,k]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[m,l,[p,k]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[m,l,[p,C]],[/(surface duo)/i],[l,[m,P],[p,C]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[m,"Fairphone"],[p,k]],[/(u304aa)/i],[l,[m,"AT&T"],[p,k]],[/\bsie-(\w*)/i],[l,[m,"Siemens"],[p,k]],[/\b(rct\w+) b/i],[l,[m,"RCA"],[p,C]],[/\b(venue[\d ]{2,7}) b/i],[l,[m,"Dell"],[p,C]],[/\b(q(?:mv|ta)\w+) b/i],[l,[m,"Verizon"],[p,C]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[m,"Barnes & Noble"],[p,C]],[/\b(tm\d{3}\w+) b/i],[l,[m,"NuVision"],[p,C]],[/\b(k88) b/i],[l,[m,"ZTE"],[p,C]],[/\b(nx\d{3}j) b/i],[l,[m,"ZTE"],[p,k]],[/\b(gen\d{3}) b.+49h/i],[l,[m,"Swiss"],[p,k]],[/\b(zur\d{3}) b/i],[l,[m,"Swiss"],[p,C]],[/\b((zeki)?tb.*\b) b/i],[l,[m,"Zeki"],[p,C]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[m,"Dragon Touch"],l,[p,C]],[/\b(ns-?\w{0,9}) b/i],[l,[m,"Insignia"],[p,C]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[m,"NextBook"],[p,C]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[m,"Voice"],l,[p,k]],[/\b(lvtel\-)?(v1[12]) b/i],[[m,"LvTel"],l,[p,k]],[/\b(ph-1) /i],[l,[m,"Essential"],[p,k]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[m,"Envizen"],[p,C]],[/\b(trio[-\w\. ]+) b/i],[l,[m,"MachSpeed"],[p,C]],[/\btu_(1491) b/i],[l,[m,"Rotor"],[p,C]],[/(shield[\w ]+) b/i],[l,[m,"Nvidia"],[p,C]],[/(sprint) (\w+)/i],[m,l,[p,k]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[m,P],[p,k]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[m,He],[p,C]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[m,He],[p,k]],[/smart-tv.+(samsung)/i],[m,[p,L]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[m,W],[p,L]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[m,O],[p,L]],[/(apple) ?tv/i],[m,[l,te+" TV"],[p,L]],[/crkey/i],[[l,y+"cast"],[m,R],[p,L]],[/droid.+aft(\w+)( bui|\))/i],[l,[m,$],[p,L]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[m,J],[p,L]],[/(bravia[\w ]+)( bui|\))/i],[l,[m,de],[p,L]],[/(mitv-\w{5}) bui/i],[l,[m,ke],[p,L]],[/Hbbtv.*(technisat) (.*);/i],[m,l,[p,L]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[m,wt],[l,wt],[p,L]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,L]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[m,l,[p,b]],[/droid.+; (shield) bui/i],[l,[m,"Nvidia"],[p,b]],[/(playstation [345portablevi]+)/i],[l,[m,de],[p,b]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[m,P],[p,b]],[/((pebble))app/i],[m,l,[p,B]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[m,te],[p,B]],[/droid.+; (glass) \d/i],[l,[m,R],[p,B]],[/droid.+; (wt63?0{2,3})\)/i],[l,[m,He],[p,B]],[/(quest( \d| pro)?)/i],[l,[m,fe],[p,B]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[m,[p,G]],[/(aeobc)\b/i],[l,[m,$],[p,G]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,k]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,C]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,C]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,k]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[m,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[E,[d,_+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[E,[d,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[d,E],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[E,d]],os:[[/microsoft (windows) (vista|xp)/i],[d,E],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[d,[E,Me,kf]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[E,Me,kf],[d,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[E,/_/g,"."],[d,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[d,at],[E,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[E,d],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[d,E],[/\(bb(10);/i],[E,[d,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[E,[d,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[E,[d,w+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[E,[d,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[E,[d,"watchOS"]],[/crkey\/([\d\.]+)/i],[E,[d,y+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[d,Ne],E],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[d,E],[/(sunos) ?([\w\.\d]*)/i],[[d,"Solaris"],E],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[d,E]]},er=function(ve,Ce){if(typeof ve===o&&(Ce=ve,ve=e),!(this instanceof er))return new er(ve,Ce).getResult();var pe=typeof t!==s&&t.navigator?t.navigator:e,Ke=ve||(pe&&pe.userAgent?pe.userAgent:r),Xr=pe&&pe.userAgentData?pe.userAgentData:e,kr=Ce?Ri(Cf,Ce):Cf,Oe=pe&&pe.userAgent==Ke;return this.getBrowser=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.browser),ie[c]=Gn(ie[E]),Oe&&pe&&pe.brave&&typeof pe.brave.isBrave==i&&(ie[d]="Brave"),ie},this.getCPU=function(){var ie={};return ie[v]=e,Ye.call(ie,Ke,kr.cpu),ie},this.getDevice=function(){var ie={};return ie[m]=e,ie[l]=e,ie[p]=e,Ye.call(ie,Ke,kr.device),Oe&&!ie[p]&&Xr&&Xr.mobile&&(ie[p]=k),Oe&&ie[l]=="Macintosh"&&pe&&typeof pe.standalone!==s&&pe.maxTouchPoints&&pe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=C),ie},this.getEngine=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.engine),ie},this.getOS=function(){var ie={};return ie[d]=e,ie[E]=e,Ye.call(ie,Ke,kr.os),Oe&&!ie[d]&&Xr&&Xr.platform&&Xr.platform!="Unknown"&&(ie[d]=Xr.platform.replace(/chrome os/i,Ne).replace(/macos/i,at)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return Ke},this.setUA=function(ie){return Ke=typeof ie===a&&ie.length>j?wt(ie,j):ie,this},this.setUA(Ke),this};er.BROWSER=gn([d,E,c]),er.CPU=gn([v]),er.DEVICE=gn([l,m,p,b,k,L,C,B,G]),er.ENGINE=er.OS=gn([d,E]),typeof oa!==s?(typeof wl!==s&&wl.exports&&(oa=wl.exports=er),oa.UAParser=er):typeof define===i&&define.amd?define(function(){return er}):typeof t!==s&&(t.UAParser=er);var ki=typeof t!==s&&(t.jQuery||t.Zepto);if(ki&&!ki.ua){var Va=new er;ki.ua=Va.getResult(),ki.ua.get=function(){return Va.getUA()},ki.ua.set=function(ve){Va.setUA(ve);var Ce=Va.getResult();for(var pe in Ce)ki.ua[pe]=Ce[pe]}}})(typeof window=="object"?window:oa)});var og=he((H7,sg)=>{"use strict";var ng=ee("url"),ig=1800,op=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=ng.parse(r||""),i=this.parse(e),s;return i.domain?(s=i.domain.replace(/^\./,""),(n.hostname.length<s.length||("."+n.hostname).substr(-s.length+1)!=="."+s)&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||ig)||ig)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={};return(e||"").toString().split(";").forEach(n=>{let i=n.split("="),s=i.shift().trim().toLowerCase(),o=i.join("=").trim(),a;if(s)switch(s){case"expires":o=new Date(o),o.toString()!=="Invalid Date"&&(r.expires=o);break;case"path":r.path=o;break;case"domain":a=o.toLowerCase(),a.length&&a.charAt(0)!=="."&&(a="."+a),r.domain=a;break;case"max-age":r.expires=new Date(Date.now()+(Number(o)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break;default:r.name||(r.name=s,r.value=o)}}),r}match(e,r){let n=ng.parse(r||"");return!(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain)||this.getPath(n.pathname).substr(0,e.path.length)!==e.path||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");return r.pop(),r=r.join("/").trim(),r.charAt(0)!=="/"&&(r="/"+r),r.substr(-1)!=="/"&&(r+="/"),r}};sg.exports=op});var br=he((F7,fS)=>{fS.exports={name:"nodemailer",version:"8.0.10",description:"Easy as cake e-mail sending from your Node.js applications",main:"lib/nodemailer.js",scripts:{test:"node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))","test:coverage":"c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",format:'prettier --write "**/*.{js,json,md}"',"format:check":'prettier --check "**/*.{js,json,md}"',lint:"eslint .","lint:fix":"eslint . --fix",update:"rm -rf node_modules/ package-lock.json && ncu -u && npm install","test:syntax":'docker run --rm -v "$PWD:/app:ro" -w /app node:6-alpine node test/syntax-compat.js'},repository:{type:"git",url:"https://github.com/nodemailer/nodemailer.git"},keywords:["Nodemailer"],author:"Andris Reinman",license:"MIT-0",bugs:{url:"https://github.com/nodemailer/nodemailer/issues"},homepage:"https://nodemailer.com/",devDependencies:{"@aws-sdk/client-sesv2":"3.1037.0",bunyan:"1.8.15",c8:"11.0.0",eslint:"10.2.1","eslint-config-prettier":"10.1.8",globals:"17.5.0",libbase64:"1.3.0",libmime:"5.3.8",libqp:"2.1.1",prettier:"3.8.3",proxy:"1.0.2","proxy-test-server":"1.0.0","smtp-server":"3.18.4"},engines:{node:">=6.0.0"}}});var lr=he((V7,ap)=>{"use strict";var ag={ECONNECTION:"Connection closed unexpectedly",ETIMEDOUT:"Connection or operation timed out",ESOCKET:"Socket-level error",EDNS:"DNS resolution failed",ETLS:"TLS handshake or STARTTLS failed",EREQUIRETLS:"REQUIRETLS not supported by server (RFC 8689)",EPROTOCOL:"Invalid SMTP server response",EENVELOPE:"Invalid mail envelope (sender or recipients)",EMESSAGE:"Message delivery error",ESTREAM:"Stream processing error",EAUTH:"Authentication failed",ENOAUTH:"Authentication credentials not provided",EOAUTH2:"OAuth2 token generation or refresh error",EMAXLIMIT:"Pool resource limit reached (max messages per connection)",ESENDMAIL:"Sendmail command error",ESES:"AWS SES transport error",ECONFIG:"Invalid configuration",EPROXY:"Proxy connection error",EFILEACCESS:"File access rejected (disableFileAccess is set)",EURLACCESS:"URL access rejected (disableUrlAccess is set)",EFETCH:"HTTP fetch error"};ap.exports={ERROR_CODES:ag};for(let t of Object.keys(ag))ap.exports[t]=t});var ca=he((B7,cp)=>{"use strict";var mS=ee("http"),hS=ee("https"),cg=ee("url"),ES=ee("zlib"),{PassThrough:yS}=ee("stream"),lg=og(),gS=br(),vS=ee("net"),Wr=lr(),AS=5;cp.exports=function(t,e){return ug(t,e)};cp.exports.Cookies=lg;function ug(t,e){e=e||{},e.fetchRes=e.fetchRes||new yS,e.cookies=e.cookies||new lg,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?AS:e.maxRedirects,e.cookie&&([].concat(e.cookie||[]).forEach(m=>{e.cookies.set(m,t)}),e.cookie=!1);let r=e.fetchRes,n=cg.parse(t),i=(e.method||"").toString().trim().toUpperCase()||"GET",s=!1,o,a,c=n.protocol==="https:"?hS:mS,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+gS.version};if(Object.keys(e.headers||{}).forEach(m=>{l[m.toLowerCase().trim()]=e.headers[m]}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(o=e.cookies.get(t))&&(l.cookie=o),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(m=>{let E=e.body[m].toString().trim();return encodeURIComponent(m)+"="+encodeURIComponent(E)}).join("&"))}catch(m){if(s)return;s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let d,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!1,agent:!1};e.tls&&Object.assign(p,e.tls),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!vS.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{d=c.request(p)}catch(m){return s=!0,setImmediate(()=>{m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),r}return e.timeout&&d.setTimeout(e.timeout,()=>{if(s)return;s=!0,d.abort();let m=new Error("Request Timeout");m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m)}),d.on("error",m=>{s||(s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m))}),d.on("response",m=>{let E;if(!s){switch(m.headers["content-encoding"]){case"gzip":case"deflate":E=ES.createUnzip();break}if(m.headers["set-cookie"]&&[].concat(m.headers["set-cookie"]||[]).forEach(v=>{e.cookies.set(v,t)}),[301,302,303,307,308].includes(m.statusCode)&&m.headers.location){if(e.redirects++,e.redirects>e.maxRedirects){s=!0;let v=new Error("Maximum redirect count exceeded");v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}return e.method="GET",e.body=!1,ug(cg.resolve(t,m.headers.location),e)}if(r.statusCode=m.statusCode,r.headers=m.headers,m.statusCode>=300&&!e.allowErrorResponse){s=!0;let v=new Error("Invalid status code "+m.statusCode);v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort();return}m.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())}),E?(m.pipe(E).pipe(r),E.on("error",v=>{s||(s=!0,v.code=Wr.EFETCH,v.sourceUrl=t,r.emit("error",v),d.abort())})):m.pipe(r)}}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(d);d.write(a)}catch(m){s=!0,m.code=Wr.EFETCH,m.sourceUrl=t,r.emit("error",m);return}d.end()}),r}});var Kt=he((q7,gt)=>{"use strict";var TS=ee("url"),_S=ee("util"),IS=ee("fs"),xS=ca(),dg=lr(),zr=ee("dns"),bS=ee("net"),SS=ee("os"),la=300*1e3,NS=30*1e3,pg=1e3,Ol=0;gt.exports._lastCacheCleanup=()=>Ol;gt.exports._resetCacheCleanup=()=>{Ol=0};var mg;try{mg=SS.networkInterfaces()}catch{}gt.exports.networkInterfaces=mg;var hg=(t,e)=>{let r=gt.exports.networkInterfaces;return r?Object.keys(r).map(n=>r[n]).reduce((n,i)=>n.concat(i),[]).filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},fg=(t,e,r,n)=>{if(r=r||{},!hg(t,r.allowInternalNetworkInterfaces))return n(null,[]);(zr.Resolver?new zr.Resolver(r):zr)["resolve"+t](e,(s,o)=>{if(s){switch(s.code){case zr.NODATA:case zr.NOTFOUND:case zr.NOTIMP:case zr.SERVFAIL:case zr.CONNREFUSED:case zr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(s)}return n(null,Array.isArray(o)?o:[].concat(o||[]))})},ur=gt.exports.dnsCache=new Map,Fn=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({servername:t.servername,host:n,_addresses:r},e||{})};gt.exports.resolveHostname=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||bS.isIP(t.host)){let a={addresses:[t.host],servername:t.servername||!1};return e(null,Fn(a,{cached:!1}))}let r;if(ur.has(t.host)){r=ur.get(t.host);let a=Date.now();if(a-Ol>NS){Ol=a;for(let[c,l]of ur.entries())l.expires&&l.expires<a&&ur.delete(c);if(ur.size>pg){let c=Math.floor(pg*.1);Array.from(ur.keys()).slice(0,c).forEach(d=>ur.delete(d))}}if(!r.expires||r.expires>=a)return e(null,Fn(r.value,{cached:!0}))}let n=[],i=[],s=null,o=null;fg(4,t.host,t,(a,c)=>{a?s=a:n=c||[],fg(6,t.host,t,(l,d)=>{l?o=l:i=d||[];let p=n.concat(i);if(p.length){let m={addresses:p,servername:t.servername||t.host};return ur.set(t.host,{value:m,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(m,{cached:!1}))}if(s&&o&&r)return ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:s}));try{zr.lookup(t.host,{all:!0},(m,E)=>{if(m)return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(m);let v=E?E.filter(k=>hg(k.family)).map(k=>k.address):[];if(E&&E.length&&!v.length&&console.warn(`Failed to resolve IPv${E[0].family} addresses with current network`),!v.length&&r)return e(null,Fn(r.value,{cached:!0}));let b={addresses:v.length?v:[t.host],servername:t.servername||t.host};return ur.set(t.host,{value:b,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(b,{cached:!1}))})}catch(m){return r?(ur.set(t.host,{value:r.value,expires:Date.now()+(t.dnsTtl||la)}),e(null,Fn(r.value,{cached:!0,error:m}))):e(s||o||m)}})})};gt.exports.parseConnectionUrl=t=>{t=t||"";let e={},r=TS.parse(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}if(!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),r.auth){let n=r.auth.split(":");e.auth={user:n.shift(),pass:n.join(":")}}return Object.keys(r.query||{}).forEach(n=>{let i=e,s=n,o=r.query[n];switch(isNaN(o)||(o=Number(o)),o){case"true":o=!0;break;case"false":o=!1;break}if(n.indexOf("tls.")===0)s=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;s in i||(i[s]=o)}),e};gt.exports._logFunc=(t,e,r,n,i,...s)=>{let o=Object.assign({},r||{},n||{});delete o.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](o,i,...s)};gt.exports.getLogger=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(s=>{r[s]=()=>!1}),r;let i=t.logger===!0?wS(n):t.logger;return n.forEach(s=>{r[s]=(o,a,...c)=>{gt.exports._logFunc(i,s,e,o,a,...c)}}),r};gt.exports.callbackPromise=(t,e)=>function(){let r=Array.from(arguments),n=r.shift();n?e(n):t(...r)};gt.exports.parseDataURI=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,s=n.split(";");if(s.length>0){let l=s[s.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,s.pop())}let o=s.length>0?s.shift():"application/octet-stream",a={};for(let l=0;l<s.length;l++){let d=s[l],p=d.indexOf("=");if(p>0){let m=d.substring(0,p).trim(),E=d.substring(p+1).trim();m&&(a[m]=E)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:o||"application/octet-stream",params:a}};gt.exports.resolveContent=(t,e,r,n)=>{!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;n||(i=new Promise((a,c)=>{n=gt.exports.callbackPromise(a,c)}));let s=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!s)return n(null,s);if(typeof s=="object"){if(typeof s.pipe=="function")return lp(s,(a,c)=>{if(a)return n(a);t[e].content?t[e].content=c:t[e]=c,n(null,c)});if(/^https?:\/\//i.test(s.path||s.href))return r.disableUrlAccess?setImmediate(()=>{let a=new Error("Url access rejected for "+(s.path||s.href));a.code=dg.EURLACCESS,n(a)}):lp(xS(s.path||s.href),n);if(/^data:/i.test(s.path||s.href)){let a=gt.exports.parseDataURI(s.path||s.href);return!a||!a.data?n(null,Buffer.from(0)):n(null,a.data)}else if(s.path)return r.disableFileAccess?setImmediate(()=>{let a=new Error("File access rejected for "+s.path);a.code=dg.EFILEACCESS,n(a)}):lp(IS.createReadStream(s.path),n)}return typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(s=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,s)),i};gt.exports.assign=function(){let t=Array.from(arguments),e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=Object.assign(e[n]||{},r[n]):e[n]=r[n]})}),e};gt.exports.encodeXText=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let s=e[n];s<33||s>126||s===43||s===61?r+="+"+(s<16?"0":"")+s.toString(16).toUpperCase():r+=String.fromCharCode(s)}return r};function lp(t,e){let r=!1,n=[],i=0;t.on("error",s=>{r||(r=!0,e(s))}),t.on("readable",()=>{let s;for(;(s=t.read())!==null;)n.push(s),i+=s.length}),t.on("end",()=>{if(r)return;r=!0;let s;try{s=Buffer.concat(n,i)}catch(o){return e(o)}e(null,s)})}function wS(t){let e=t.reduce((s,o)=>Math.max(s,o.length),0),r=new Map;t.forEach(s=>{let o=s.toUpperCase();o.length<e&&(o+=" ".repeat(e-o.length)),r.set(s,o)});let n=(s,o,a,...c)=>{let l="";o&&(o.tnx==="server"?l="S: ":o.tnx==="client"&&(l="C: "),o.sid&&(l="["+o.sid+"] "+l),o.cid&&(l="[#"+o.cid+"] "+l)),a=_S.format(a,...c),a.split(/\r?\n/).forEach(d=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(s),l+d)})},i={};return t.forEach(s=>{i[s]=n.bind(null,s)}),i}});var up=he((j7,vg)=>{"use strict";var RS=ee("path"),Eg="application/octet-stream",OS="bin",yg=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),gg=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);vg.exports={detectMimeType(t){if(!t)return Eg;let e=RS.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=gg.has(r)?gg.get(r):Eg;return Array.isArray(n)?n[0]:n},detectExtension(t){if(!t)return OS;let e=(t||"").toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(yg.has(r+"/"+n)){let i=yg.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}}});var fp=he((G7,Sg)=>{"use strict";var kS=/^xn--/,CS=/[^\0-\x7F]/,DS=/[\x2E\u3002\uFF0E\uFF61]/g,PS={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},dp=35,Jr=Math.floor,pp=String.fromCharCode;function Vn(t){throw new RangeError(PS[t])}function US(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function Tg(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(DS,".");let i=t.split("."),s=US(i,e).join(".");return n+s}function _g(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let s=t.charCodeAt(r++);(s&64512)==56320?e.push(((i&1023)<<10)+(s&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var LS=t=>String.fromCodePoint(...t),MS=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Ag=function(t,e){return t+22+75*(t<26)-((e!=0)<<5)},Ig=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>dp*26>>1;n+=36)t=Jr(t/dp);return Jr(n+(dp+1)*t/(t+38))},xg=function(t){let e=[],r=t.length,n=0,i=128,s=72,o=t.lastIndexOf("-");o<0&&(o=0);for(let a=0;a<o;++a)t.charCodeAt(a)>=128&&Vn("not-basic"),e.push(t.charCodeAt(a));for(let a=o>0?o+1:0;a<r;){let c=n;for(let d=1,p=36;;p+=36){a>=r&&Vn("invalid-input");let m=MS(t.charCodeAt(a++));m>=36&&Vn("invalid-input"),m>Jr((2147483647-n)/d)&&Vn("overflow"),n+=m*d;let E=p<=s?1:p>=s+26?26:p-s;if(m<E)break;let v=36-E;d>Jr(2147483647/v)&&Vn("overflow"),d*=v}let l=e.length+1;s=Ig(n-c,l,c==0),Jr(n/l)>2147483647-i&&Vn("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},bg=function(t){let e=[];t=_g(t);let r=t.length,n=128,i=0,s=72;for(let c of t)c<128&&e.push(pp(c));let o=e.length,a=o;for(o&&e.push("-");a<r;){let c=2147483647;for(let d of t)d>=n&&d<c&&(c=d);let l=a+1;c-n>Jr((2147483647-i)/l)&&Vn("overflow"),i+=(c-n)*l,n=c;for(let d of t)if(d<n&&++i>2147483647&&Vn("overflow"),d===n){let p=i;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(p<E)break;let v=p-E,b=36-E;e.push(pp(Ag(E+v%b,0))),p=Jr(v/b)}e.push(pp(Ag(p,0))),s=Ig(i,l,a===o),i=0,++a}++i,++n}return e.join("")},KS=function(t){return Tg(t,function(e){return kS.test(e)?xg(e.slice(4).toLowerCase()):e})},HS=function(t){return Tg(t,function(e){return CS.test(e)?"xn--"+bg(e):e})},FS={version:"2.3.1",ucs2:{decode:_g,encode:LS},decode:xg,encode:bg,toASCII:HS,toUnicode:KS};Sg.exports=FS});var yp=he(($7,Ng)=>{"use strict";var{Transform:VS}=ee("stream");function mp(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function hp(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=[],n=0,i=e*1024,s=new RegExp(".{"+e+"}","g");for(;n<t.length;){let o=t.substr(n,i).replace(s,`$&\r
-`).trim();r.push(o),n+=i}return r.join(`\r
-`).trim()}var Ep=class extends VS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return setImmediate(n);this.inputBytes+=e.length,this._remainingBytes&&this._remainingBytes.length&&(e=Buffer.concat([this._remainingBytes,e],this._remainingBytes.length+e.length),this._remainingBytes=!1),e.length%3?(this._remainingBytes=e.slice(e.length-e.length%3),e=e.slice(0,e.length-e.length%3)):this._remainingBytes=!1;let i=this._curLine+mp(e);if(this.options.lineLength){i=hp(i,this.options.lineLength);let s=i.lastIndexOf(`
-`);s<0?(this._curLine=i,i=""):s===i.length-1?this._curLine="":(this._curLine=i.substring(s+1),i=i.substring(0,s+1))}i&&(this.outputBytes+=i.length,this.push(Buffer.from(i,"ascii"))),setImmediate(n)}_flush(e){this._remainingBytes&&this._remainingBytes.length&&(this._curLine+=mp(this._remainingBytes)),this._curLine&&(this._curLine=hp(this._curLine,this.options.lineLength),this.outputBytes+=this._curLine.length,this.push(Buffer.from(this._curLine,"ascii")),this._curLine=""),e()}};Ng.exports={encode:mp,wrap:hp,Encoder:Ep}});var Ap=he((W7,Rg)=>{"use strict";var{Transform:BS}=ee("stream"),qS=[[9],[10],[13],[32,60],[62,126]];function gp(t){typeof t=="string"&&(t=Buffer.from(t,"utf-8"));let e="",r;for(let n=0,i=t.length;n<i;n++){if(r=t[n],jS(r,qS)&&!((r===32||r===9)&&(n===i-1||t[n+1]===10||t[n+1]===13))){e+=String.fromCharCode(r);continue}e+="="+(r<16?"0":"")+r.toString(16).toUpperCase()}return e}function wg(t,e){if(t=(t||"").toString(),e=e||76,t.length<=e)return t;let r=0,n=t.length,i,s,o,a=Math.floor(e/3),c="";for(;r<n;){if(o=t.substr(r,e),i=o.match(/\r\n/)){o=o.substr(0,i.index+i[0].length),c+=o,r+=o.length;continue}if(o.substr(-1)===`
-`){c+=o,r+=o.length;continue}if(i=o.substr(-a).match(/\n.*?$/)){o=o.substr(0,o.length-(i[0].length-1)),c+=o,r+=o.length;continue}if(o.length>e-a&&(i=o.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))o=o.substr(0,o.length-(i[0].length-1));else if(o.match(/[=][\da-f]{0,2}$/i))for((i=o.match(/[=][\da-f]{0,1}$/i))&&(o=o.substr(0,o.length-i[0].length));o.length>3&&o.length<n-r&&!o.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=o.match(/[=][\da-f]{2}$/gi))&&(s=parseInt(i[0].substr(1,2),16),!(s<128||(o=o.substr(0,o.length-3),s>=192))););r+o.length<n&&o.substr(-1)!==`
-`?(o.length===e&&o.match(/[=][\da-f]{2}$/i)?o=o.substr(0,o.length-3):o.length===e&&(o=o.substr(0,o.length-1)),r+=o.length,o+=`=\r
-`):r+=o.length,c+=o}return c}function jS(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var vp=class extends BS{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i;if(r!=="buffer"&&(e=Buffer.from(e,r)),!e||!e.length)return n();this.inputBytes+=e.length,this.options.lineLength?(i=this._curLine+gp(e),i=wg(i,this.options.lineLength),i=i.replace(/(^|\n)([^\n]*)$/,(s,o,a)=>(this._curLine=a,o)),i&&(this.outputBytes+=i.length,this.push(i))):(i=gp(e),this.outputBytes+=i.length,this.push(i,"ascii")),n()}_flush(e){this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii")),e()}};Rg.exports={encode:gp,wrap:wg,Encoder:vp}});var da=he((z7,kg)=>{"use strict";var ua=yp(),GS=Ap(),Og=up();kg.exports={isPlainText(t,e){return typeof t=="string"&&!(e?/[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)},hasLongerLines(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)},encodeWord(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=GS.encode(t).replace(/[^a-z0-9!*+\-/=]/gi,s=>{let o=s.charCodeAt(0).toString(16).toUpperCase();return s===" "?"_":"="+(o.length===1?"0"+o:o)}):e==="B"&&(n=typeof t=="string"?t:ua.encode(t),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:ua.encode(t)).length>r)if(e==="Q")n=this.splitMimeEncodedString(n,r).join("?= =?"+i+"?"+e+"?");else{let s=[],o="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud83c\ud83d\ud83e]/.test(l)&&a<c-1&&(l+=n.charAt(++a)),Buffer.byteLength(o+l)<=r||a===0?o+=l:(s.push(ua.encode(o)),o=l)}o&&s.push(ua.encode(o)),s.length>1?n=s.join("?= =?"+i+"?"+e+"?"):n=s.join("")}else e==="B"&&(n=ua.encode(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")},encodeWords(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return this.encodeWord(t,e,r);let s=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!s)return t;let o=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=s.index+(s[1]||"").length;return(o?t.substr(0,o):"")+this.encodeWord(t.substring(o,a),e||"Q",r)+(a<t.length?t.substr(a):"")},buildHeaderValue(t){let e=[];return Object.keys(t.params||{}).forEach(r=>{let n=t.params[r];!this.isPlainText(n,!0)||n.length>=75?this.buildHeaderParam(r,n,50).forEach(i=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(i.value)||i.key.substr(-1)==="*"?e.push(i.key+"="+i.value):e.push(i.key+"="+JSON.stringify(i.value))}):/[\s'"\\;:/=(),<>@[\]?]|^-/.test(n)?e.push(r+"="+JSON.stringify(n)):e.push(r+"="+n)}),t.value+(e.length?"; "+e.join("; "):"")},buildHeaderParam(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),s,o,a,c=0,l,d;if(r=r||50,this.isPlainText(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),p=>(n.push({line:p}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let m=[];for(l=0,d=i.length;l<d;l++)s=i.charAt(l),o=s.charCodeAt(0),o>=55296&&o<=56319&&l<d-1?(s+=i.charAt(l+1),m.push(s),l++):m.push(s);i=m}a="utf-8''";let p=!0;for(c=0,l=0,d=i.length;l<d;l++){if(s=i[l],p)s=this.safeEncodeURIComponent(s);else if(s=s===" "?s:this.safeEncodeURIComponent(s),s!==i[l])if((this.safeEncodeURIComponent(a)+s).length>=r)n.push({line:a,encoded:p}),a="",c=l-1;else{p=!0,l=c,a="";continue}(a+s).length>=r?(n.push({line:a,encoded:p}),a=s=i[l]===" "?" ":this.safeEncodeURIComponent(i[l]),s===i[l]?(p=!1,c=l-1):p=!0):a+=s}a&&n.push({line:a,encoded:p})}return n.map((p,m)=>({key:t+"*"+m+(p.encoded?"*":""),value:p.line}))},parseHeaderValue(t){let e={value:!1,params:{}},r=!1,n="",i="value",s=!1,o=!1,a;for(let c=0,l=t.length;c<l;c++)if(a=t.charAt(c),i==="key"){if(a==="="){r=n.trim().toLowerCase(),i="value",n="";continue}n+=a}else{if(o)n+=a;else if(a==="\\"){o=!0;continue}else s&&a===s?s=!1:!s&&a==='"'?s=a:!s&&a===";"?(r===!1?e.value=n.trim():e.params[r]=n.trim(),i="key",n=""):n+=a;o=!1}return i==="value"?r===!1?e.value=n.trim():e.params[r]=n.trim():n.trim()&&(e.params[n.trim().toLowerCase()]=""),Object.keys(e.params).forEach(c=>{let l,d,p,m;(p=c.match(/(\*(\d+)|\*(\d+)\*|\*)$/))&&(l=c.substr(0,p.index),d=Number(p[2]||p[3])||0,(!e.params[l]||typeof e.params[l]!="object")&&(e.params[l]={charset:!1,values:[]}),m=e.params[c],d===0&&p[0].substr(-1)==="*"&&(p=m.match(/^([^']*)'[^']*'(.*)$/))&&(e.params[l].charset=p[1]||"iso-8859-1",m=p[2]),e.params[l].values[d]=m,delete e.params[c])}),Object.keys(e.params).forEach(c=>{let l;e.params[c]&&Array.isArray(e.params[c].values)&&(l=e.params[c].values.map(d=>d||"").join(""),e.params[c].charset?e.params[c]="=?"+e.params[c].charset+"?Q?"+l.replace(/[=?_\s]/g,d=>{let p=d.charCodeAt(0).toString(16);return d===" "?"_":"%"+(p.length<2?"0":"")+p}).replace(/%/g,"=")+"?=":e.params[c]=l)}),e},detectExtension:t=>Og.detectExtension(t),detectMimeType:t=>Og.detectMimeType(t),foldLines(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,s="",o,a;for(;n<i;){if(o=t.substr(n,e),o.length<e){s+=o;break}if(a=o.match(/^[^\n\r]*(\r?\n|\r)/)){o=a[0],s+=o,n+=o.length;continue}else(a=o.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<o.length?o=o.substr(0,o.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+o.length).match(/^[^\s]+(\s*)/))&&(o=o+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));s+=o,n+=o.length,n<i&&(s+=`\r
-`)}return s},splitMimeEncodedString:(t,e)=>{let r=[],n,i,s,o;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(i=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,i.index)),o=!1;!o;)o=!0,(i=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(i[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),o=!1));n.length&&r.push(n),t=t.substr(n.length)}return r},encodeURICharComponent:t=>{let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e},safeEncodeURIComponent(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{return t.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g,"")}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>this.encodeURICharComponent(e))}}});var Pg=he((J7,Dg)=>{"use strict";function $S(t,e){let r=!1,n="text",i=[],s={address:[],comment:[],group:[],text:[],textWasQuoted:[]},o=!1;for(let a=0,c=t.length;a<c;a++){let l=t[a],d=a?t[a-1]:null;if(l.type==="operator")switch(l.value){case"<":n="address",o=!1;break;case"(":n="comment",o=!1;break;case":":n="group",r=!0,o=!1;break;case'"':o=!o,n="text";break;default:n="text",o=!1;break}else l.value&&(n==="address"&&(l.value=l.value.replace(/^[^<]*<\s*/,"")),d&&d.noBreak&&s[n].length?(s[n][s[n].length-1]+=l.value,n==="text"&&o&&(s.textWasQuoted[s.textWasQuoted.length-1]=!0)):(s[n].push(l.value),n==="text"&&s.textWasQuoted.push(o)))}if(!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),r){s.text=s.text.join(" ");let a=[];s.group.length&&Cg(s.group.join(","),{_depth:e+1}).forEach(l=>{l.group?a=a.concat(l.group):a.push(l)}),i.push({name:s.text||"",group:a})}else{if(!s.address.length&&s.text.length){for(let c=s.text.length-1;c>=0;c--)if(!s.textWasQuoted[c]&&/^[^@\s]+@[^@\s]+$/.test(s.text[c])){s.address=s.text.splice(c,1),s.textWasQuoted.splice(c,1);break}if(!s.address.length){let c=!1;for(let l=s.text.length-1;l>=0&&!(!s.textWasQuoted[l]&&(s.text[l]=s.text[l].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/,d=>c?d:(s.address=[d.trim()],c=!0," ")).trim(),c));l--);}}!s.text.length&&s.comment.length&&(s.text=s.comment,s.comment=[]),s.address.length>1&&(s.text=s.text.concat(s.address.splice(1))),s.text=s.text.join(" "),s.address=s.address.join(" ");let a={address:s.address||s.text||"",name:s.text||s.address||""};a.address===a.name&&(/@/.test(a.address||"")?a.name="":a.address=""),i.push(a)}return i}var Tp=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),s=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,s)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" ","	","\r",`
-`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
-`&&(e=" "),(e.charCodeAt(0)>=33||[" ","	"].includes(e))&&(this.node.value+=e),this.escaped=!1}},WS=50;function Cg(t,e){e=e||{};let r=e._depth||0;if(r>WS)return[];let i=new Tp(t).tokenize(),s=[],o=[],a=[];i.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&s.push(o),o=[]):o.push(c)}),o.length&&s.push(o),s.forEach(c=>{let l=$S(c,r);l.length&&(a=a.concat(l))});for(let c=a.length-2;c>=0;c--){let l=a[c],d=a[c+1];l.address===""&&l.name&&!l.group&&d.address&&d.name&&(d.name=l.name+", "+d.name,a.splice(c,1))}if(e.flatten){let c=[],l=d=>{d.forEach(p=>{if(p.group)return l(p.group);c.push(p)})};return l(a),c}return a}Dg.exports=Cg});var Lg=he((Y7,Ug)=>{"use strict";var{Transform:zS}=ee("stream"),_p=class extends zS{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
+-----END ${e}-----`},hE=async(t,e,r)=>{if(Ms(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!Br(r))throw new TypeError(Er(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return hI(Kc(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},EE=t=>hE("public","spki",t),yE=t=>hE("private","pkcs8",t),Qs=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},gE=t=>({data:t,pos:0}),sp=t=>{let e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},ln=t=>{let e=sp(t);if(e&128){let r=e&127,n=0;for(let i=0;i<r;i++)n=n<<8|sp(t);return n}return e},mE=(t,e=1)=>{for(;e-- >0;){t.pos++;let r=ln(t);t.pos+=r}},Gn=(t,e,r)=>{if(sp(t)!==e)throw new Error(r)},vE=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");let r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},EI=t=>{Gn(t,6,"Expected algorithm OID");let e=ln(t);return vE(t,e)};gI=t=>{let e=EI(t);if(Qs(e,[43,101,110]))return"X25519";if(!Qs(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");Gn(t,6,"Expected curve OID");let r=ln(t),n=vE(t,r);if(Qs(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Qs(n,[43,129,4,0,34]))return"P-384";if(Qs(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},ap=async(t,e,r,n)=>{let i=Kn(n?.extractable),o=Ni(r,jn);o.secret&&wi(jn);let s=t==="spki",a;if(o.resolve)try{let c=gE(e);yI(c,t),a=o.resolve({crv:gI(c)})}catch{throw new Te("Invalid or unsupported key format")}else a=o.subtle;return crypto.subtle.importKey(t,e,a,i??s,o.usages[s?0:1])},cp=(t,e)=>Hc(t.replace(e,"")),AE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return ap("pkcs8",n,e,r)},TE=(t,e,r)=>{let n=cp(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return ap("spki",n,e,r)};_E=(t,e,r)=>{let n;try{let i=cp(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=vI(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return ap("spki",n,e,r)}});function IE(t){return EE(t)}function xE(t){return yE(t)}async function Il(t){if(Ms(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:Pe(t)};if(!Br(t))throw new TypeError(Er(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");let e=await crypto.subtle.exportKey("jwk",t);delete e.ext,delete e.key_ops,delete e.use,e.kty!=="AKP"&&delete e.alg;for(let r of Object.keys(e))e[r]===void 0&&delete e[r];return e}var up=ne(()=>{lp();Ct();zt()});async function dp(t,e){let r;if(he(t)){if(r=Eo(t),typeof r.kty!="string")throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"))}else if(Hd(t))r=Eo(await Il(t));else throw new TypeError(Er(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":un(r.alg,'"alg" (Algorithm) Parameter'),un(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":un(r.crv,'"crv" (Curve) Parameter'),un(r.x,'"x" (X Coordinate) Parameter'),un(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":un(r.crv,'"crv" (Subtype of Key Pair) Parameter'),un(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":un(r.e,'"e" (Exponent) Parameter'),un(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!="string")throw new uo('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new Te('"kty" (Key Type) Parameter missing or unsupported')}let i=Et(JSON.stringify(n));return Pe(await Fc(e,i))}async function bE(t,e){e??="sha256";let r=await dp(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}var un,SE=ne(()=>{Ft();zt();Ie();Ct();De();up();un=(t,e)=>{if(typeof t!="string"||!t)throw new uo(`${e} missing or invalid`)}});async function wE(t,e){let r={...t,...e?.header};if(!he(r.jwk))throw new ee('"jwk" (JSON Web Key) Header Parameter must be a JSON object');let n;try{n=Ks(r.jwk)}catch(s){throw new ee("Invalid Embedded JWK",{cause:s})}let i=To(r.alg);if(n.use!==void 0&&n.use!=="sig")throw new ee('Invalid Embedded JWK, its "use" must be "sig" when present');if(n.alg!==void 0&&n.alg!==i.alg)throw new ee(`Invalid Embedded JWK, its "alg" must be "${i.alg}" when present`);let o=await jr(i,n,!0);if(o.type!=="public")throw new ee('"jwk" (JSON Web Key) Header Parameter must be a public key');return o}var NE=ne(()=>{Ct();_o();De();Ie()});function AI(t,e,r,n){let{kty:i,key_ops:o,ext:s,kid:a,alg:c,use:l,crv:u}=t;return(s===void 0||typeof s=="boolean")&&(o===void 0||Array.isArray(o)&&o.every((p,f)=>typeof p=="string"&&o.indexOf(p)===f)&&o.includes("verify"))&&e.kty.includes(i)&&(n===void 0||typeof n=="string"&&n===a)&&(c===void 0?i!=="AKP":r===c)&&(l===void 0||l==="sig")&&(!e.crv||u===e.crv)}async function RE(t,e,r){let n=t.get(e)||t.set(e,{}).get(e),{alg:i}=r;if(n[i]===void 0){let o=jr(r,e,!0).then(s=>{if(s.type!=="public")throw new po("JSON Web Key Set members must be public keys");return n[i]=s,s}).catch(s=>{throw n[i]===o&&delete n[i],s});n[i]=o}return n[i]}function Zs(t){let e;try{e=structuredClone(t)}catch{}if(!Bc(e))throw new po("JSON Web Key Set malformed");let r=e.keys.map(i=>{let o=Eo(i);return Array.isArray(o.key_ops)&&(o.key_ops=[...o.key_ops]),o}),n=new WeakMap;return Object.defineProperty(async(i,o)=>{let{alg:s,kid:a}={...i,...o?.header},c=typeof s=="string"?$s[s]:void 0;if(!c||c.secret)throw new Te('Unsupported "alg" value for a JSON Web Key Set');let l=e.keys.filter((f,m)=>AI(r[m],c,s,a)),{0:u,length:p}=l;if(!p)throw new _i;if(p!==1){let f=new Ds;throw f[Symbol.asyncIterator]=async function*(){for(let m of l)try{yield await RE(n,m,c)}catch{}},f}return RE(n,u,c)},"jwks",{value:()=>structuredClone(e)})}var pp=ne(()=>{Ct();_o();Ie();De()});function TI(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}async function _I(t,e,r,n=fetch){let i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(o=>{throw o.name==="TimeoutError"?new Us:o});if(i.status!==200)throw new nt("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new nt("Failed to parse the JSON Web Key Set HTTP response as JSON")}}function ea(t,e){return Number.isFinite(t)&&Date.now()<t+e}function OE(t,e,r){if(Number.isNaN(t))throw new TypeError(`"${r}" option must not be NaN`);return typeof t=="number"?t:e}function kE(t,e){if(!(t instanceof URL))throw new TypeError("url must be an instance of URL");let r=new URL(t.href).href,n=e??{},i=n.timeoutDuration;if(typeof i=="number"&&(!Number.isInteger(i)||i<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let o=typeof i=="number"?i:5e3,s=OE(n.cooldownDuration,3e4,"cooldownDuration"),a=OE(n.cacheMaxAge,6e5,"cacheMaxAge"),c=new Headers(n.headers);fp&&!c.has("User-Agent")&&c.set("User-Agent",fp),c.has("accept")||c.set("accept","application/json, application/jwk-set+json");let l=n[mp],u=n[hp],p,f,m=0,E=0,v;if(u&&typeof u=="object"){let{uat:S,jwks:R}=u;ea(S,a)&&Bc(R)&&(p=S,v=Zs(R))}let N=async()=>{if(f&&TI()&&(f=void 0),!f){let S=++m,R=f=_I(r,c,AbortSignal.timeout(o),l).then(M=>{let K=Zs(M);if(S<=E)return;v=K;let B=Date.now();u&&(u.uat=B,u.jwks=M),p=B,E=S}).finally(()=>{f===R&&(f=void 0)})}await f};return Object.defineProperties(async(S,R)=>{(!v||!ea(p,a))&&await N();try{return await v(S,R)}catch(M){if(M instanceof _i&&!ea(p,s))return await N(),v(S,R);throw M}},{coolingDown:{get:()=>ea(p,s),enumerable:!0},fresh:{get:()=>ea(p,a),enumerable:!0},reload:{value:N,enumerable:!0},reloading:{get:()=>!!f,enumerable:!0},jwks:{value:()=>v?.jwks(),enumerable:!0}})}var fp,mp,hp,CE=ne(()=>{Ie();pp();De();(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(fp="jose/v6.2.12");mp=Symbol();hp=Symbol()});var II,xl,PE=ne(()=>{zt();De();Ie();wo();II=Vn,xl=class extends II{encode(){let e=Pe(JSON.stringify({alg:"none"})),r=Pe(So(this));return`${e}.${r}.`}static decode(e,r){if(typeof e!="string")throw new je("Unsecured JWT must be a string");let{0:n,1:i,2:o,length:s}=e.split(".");if(s!==3||o!=="")throw new je("Invalid Unsecured JWT");let a,c;try{a=Mn(n,ee,"JWS Protected Header is invalid");let l=Vr(ee,fo,void 0,a,a);c=mo(a,l)}catch(l){throw l instanceof ee?new je("Invalid Unsecured JWT",{cause:l}):l}if(a.alg!=="none")throw new je("Invalid Unsecured JWT");if(!c)throw new je("JWTs MUST NOT use unencoded payload");return{payload:bo(a,xt(i,"payload",je),r),header:a}}}});async function bl(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return TE(t,e,r)}async function DE(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return _E(t,e,r)}async function ta(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return AE(t,e,r)}async function Vt(t,e,r){if(!he(t))throw new TypeError("JWK must be an object");let n=Ks(t),i=Kn(r?.extractable),{alg:o}=n;if(e??=o,n.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!="string")throw new TypeError('missing "k" (Key Value) Parameter value');return Fr(n.k);case"AKP":{if(typeof o!="string"||!o)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==o)throw new TypeError("JWK alg and alg option value mismatch");return jr(Ni(e),n,i)}case"RSA":case"EC":case"OKP":return jr(Ni(e),n,i);default:throw new Te('Unsupported "kty" (Key Type) Parameter value')}}var UE=ne(()=>{zt();lp();Ct();Xs();Ie();De()});function LE(t){let e;if(typeof t=="string"){let n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Mn(e,TypeError,r)}var ME=ne(()=>{De()});function KE(t){if(typeof t!="string")throw new je("JWTs must use Compact JWS serialization, JWT must be a string");let{1:e,length:r}=t.split(".");if(r===5)throw new je("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new je("Invalid JWT");if(!e)throw new je("JWTs must contain a payload");let n;try{n=Fr(e)}catch{throw new je("Failed to base64url decode the payload")}let i;try{i=JSON.parse(co.decode(n))}catch{throw new je("Failed to parse the decoded payload as JSON")}if(!he(i))throw new je("Invalid JWT Claims Set");return i}var HE=ne(()=>{zt();Ft();De();Ie()});function xI(t){let e=t?.modulusLength??2048;if(typeof e!="number"||!Number.isInteger(e)||e<2048)throw new Te("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function FE(t,e){let r=Kn(e?.extractable),n=Ni(t,jn);n.secret&&wi(jn);let i;if(n.resolve){let o=e?.crv??"P-256";if(!["P-256","P-384","P-521","X25519"].includes(o))throw new Te("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");i=n.resolve({crv:o})}else{if(n.crv!==void 0&&e?.crv!==void 0&&e.crv!==n.crv)throw new Te(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${n.crv}`);i=n.kty[0]==="RSA"?{...n.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:xI(e)}:n.subtle}return crypto.subtle.generateKey(i,r??!1,[...n.usages[1],...n.usages[0]])}var VE=ne(()=>{Ie();Ct();Xs()});async function BE(t,e){let r=Kn(e?.extractable),n,i,o;switch(t){case"HS256":case"HS384":case"HS512":n=+t.slice(-3),i={name:"HMAC",hash:`SHA-${n}`,length:n},o=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return crypto.getRandomValues(new Uint8Array(+t.slice(-3)>>3));case"A128KW":case"A192KW":case"A256KW":n=+t.slice(1,4),i={name:"AES-KW",length:n},o=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":n=+t.slice(1,4),i={name:"AES-GCM",length:n},o=["encrypt","decrypt"];break;default:wi(jn)}return crypto.subtle.generateKey(i,r??!1,o)}var jE=ne(()=>{Xs();Ct()});var GE={};Cc(GE,{CompactEncrypt:()=>El,CompactSign:()=>vl,EmbeddedJWK:()=>wE,EncryptJWT:()=>_l,FlattenedEncrypt:()=>yl,FlattenedSign:()=>Al,GeneralEncrypt:()=>ul,GeneralSign:()=>Tl,SignJWT:()=>No,UnsecuredJWT:()=>xl,base64url:()=>Vc,calculateJwkThumbprint:()=>dp,calculateJwkThumbprintUri:()=>bE,compactDecrypt:()=>Bh,compactVerify:()=>Yh,createLocalJWKSet:()=>Zs,createRemoteJWKSet:()=>kE,cryptoRuntime:()=>bI,customFetch:()=>mp,decodeJwt:()=>KE,decodeProtectedHeader:()=>LE,errors:()=>Md,exportJWK:()=>Il,exportPKCS8:()=>xE,exportSPKI:()=>IE,flattenedDecrypt:()=>Gh,flattenedVerify:()=>Qh,generalDecrypt:()=>qh,generalVerify:()=>eE,generateKeyPair:()=>FE,generateSecret:()=>BE,importJWK:()=>Vt,importPKCS8:()=>ta,importSPKI:()=>bl,importX509:()=>DE,jwksCache:()=>hp,jwtDecrypt:()=>oE,jwtVerify:()=>Bn});var bI,ra=ne(()=>{jh();$h();Wh();zh();Xh();Zh();tE();iE();sE();aE();cE();lE();uE();dE();pE();fE();SE();NE();pp();CE();PE();up();UE();ME();HE();Ie();VE();jE();zt();bI="WebCryptoAPI"});var Hv=M_((Ga,Lu)=>{(function(t,e){"use strict";var r="",n="?",i="function",o="undefined",s="object",a="string",c="major",l="model",u="name",p="type",f="vendor",m="version",E="architecture",v="console",N="mobile",S="tablet",R="smarttv",M="wearable",K="embedded",B=500,V="Amazon",$="Apple",A="ASUS",x="BlackBerry",b="Browser",g="Chrome",I="Edge",O="Firefox",P="Google",k="Huawei",C="LG",D="Microsoft",L="Motorola",H="Opera",z="Samsung",Y="Sharp",pe="Sony",Oe="Xiaomi",Fe="Zebra",me="Facebook",we="Chromium OS",st="Mac OS",Zi=function(ve,ke){var fe={};for(var He in ve)ke[He]&&ke[He].length%2===0?fe[He]=ke[He].concat(ve[He]):fe[He]=ve[He];return fe},kn=function(ve){for(var ke={},fe=0;fe<ve.length;fe++)ke[ve[fe].toUpperCase()]=ve[fe];return ke},eo=function(ve,ke){return typeof ve===a?_t(ke).indexOf(_t(ve))!==-1:!1},_t=function(ve){return ve.toLowerCase()},yi=function(ve){return typeof ve===a?ve.replace(/[^\d\.]/g,r).split(".")[0]:e},It=function(ve,ke){if(typeof ve===a)return ve=ve.replace(/^\s\s*/,r),typeof ke===o?ve:ve.substring(0,B)},Qe=function(ve,ke){for(var fe=0,He,rn,Mr,Re,ie,Kr;fe<ke.length&&!ie;){var Nd=ke[fe],_h=ke[fe+1];for(He=rn=0;He<Nd.length&&!ie&&Nd[He];)if(ie=Nd[He++].exec(ve),ie)for(Mr=0;Mr<_h.length;Mr++)Kr=ie[++rn],Re=_h[Mr],typeof Re===s&&Re.length>0?Re.length===2?typeof Re[1]==i?this[Re[0]]=Re[1].call(this,Kr):this[Re[0]]=Re[1]:Re.length===3?typeof Re[1]===i&&!(Re[1].exec&&Re[1].test)?this[Re[0]]=Kr?Re[1].call(this,Kr,Re[2]):e:this[Re[0]]=Kr?Kr.replace(Re[1],Re[2]):e:Re.length===4&&(this[Re[0]]=Kr?Re[3].call(this,Kr.replace(Re[1],Re[2])):e):this[Re]=Kr||e;fe+=2}},Ke=function(ve,ke){for(var fe in ke)if(typeof ke[fe]===s&&ke[fe].length>0){for(var He=0;He<ke[fe].length;He++)if(eo(ke[fe][He],ve))return fe===n?e:fe}else if(eo(ke[fe],ve))return fe===n?e:fe;return ve},k_={"1.0":"/8","1.2":"/1","1.3":"/3","2.0":"/412","2.0.2":"/416","2.0.3":"/417","2.0.4":"/419","?":"/"},Ah={ME:"4.90","NT 3.11":"NT3.51","NT 4.0":"NT4.0",2e3:"NT 5.0",XP:["NT 5.1","NT 5.2"],Vista:"NT 6.0",7:"NT 6.1",8:"NT 6.2","8.1":"NT 6.3",10:["NT 6.4","NT 10.0"],RT:"ARM"},Th={browser:[[/\b(?:crmo|crios)\/([\w\.]+)/i],[m,[u,"Chrome"]],[/edg(?:e|ios|a)?\/([\w\.]+)/i],[m,[u,"Edge"]],[/(opera mini)\/([-\w\.]+)/i,/(opera [mobiletab]{3,6})\b.+version\/([-\w\.]+)/i,/(opera)(?:.+version\/|[\/ ]+)([\w\.]+)/i],[u,m],[/opios[\/ ]+([\w\.]+)/i],[m,[u,H+" Mini"]],[/\bop(?:rg)?x\/([\w\.]+)/i],[m,[u,H+" GX"]],[/\bopr\/([\w\.]+)/i],[m,[u,H]],[/\bb[ai]*d(?:uhd|[ub]*[aekoprswx]{5,6})[\/ ]?([\w\.]+)/i],[m,[u,"Baidu"]],[/(kindle)\/([\w\.]+)/i,/(lunascape|maxthon|netfront|jasmine|blazer)[\/ ]?([\w\.]*)/i,/(avant|iemobile|slim)\s?(?:browser)?[\/ ]?([\w\.]*)/i,/(?:ms|\()(ie) ([\w\.]+)/i,/(flock|rockmelt|midori|epiphany|silk|skyfire|bolt|iron|vivaldi|iridium|phantomjs|bowser|quark|qupzilla|falkon|rekonq|puffin|brave|whale(?!.+naver)|qqbrowserlite|qq|duckduckgo)\/([-\w\.]+)/i,/(heytap|ovi)browser\/([\d\.]+)/i,/(weibo)__([\d\.]+)/i],[u,m],[/\bddg\/([\w\.]+)/i],[m,[u,"DuckDuckGo"]],[/(?:\buc? ?browser|(?:juc.+)ucweb)[\/ ]?([\w\.]+)/i],[m,[u,"UC"+b]],[/microm.+\bqbcore\/([\w\.]+)/i,/\bqbcore\/([\w\.]+).+microm/i,/micromessenger\/([\w\.]+)/i],[m,[u,"WeChat"]],[/konqueror\/([\w\.]+)/i],[m,[u,"Konqueror"]],[/trident.+rv[: ]([\w\.]{1,9})\b.+like gecko/i],[m,[u,"IE"]],[/ya(?:search)?browser\/([\w\.]+)/i],[m,[u,"Yandex"]],[/slbrowser\/([\w\.]+)/i],[m,[u,"Smart Lenovo "+b]],[/(avast|avg)\/([\w\.]+)/i],[[u,/(.+)/,"$1 Secure "+b],m],[/\bfocus\/([\w\.]+)/i],[m,[u,O+" Focus"]],[/\bopt\/([\w\.]+)/i],[m,[u,H+" Touch"]],[/coc_coc\w+\/([\w\.]+)/i],[m,[u,"Coc Coc"]],[/dolfin\/([\w\.]+)/i],[m,[u,"Dolphin"]],[/coast\/([\w\.]+)/i],[m,[u,H+" Coast"]],[/miuibrowser\/([\w\.]+)/i],[m,[u,"MIUI "+b]],[/fxios\/([-\w\.]+)/i],[m,[u,O]],[/\bqihu|(qi?ho?o?|360)browser/i],[[u,"360 "+b]],[/(oculus|sailfish|huawei|vivo)browser\/([\w\.]+)/i],[[u,/(.+)/,"$1 "+b],m],[/samsungbrowser\/([\w\.]+)/i],[m,[u,z+" Internet"]],[/(comodo_dragon)\/([\w\.]+)/i],[[u,/_/g," "],m],[/metasr[\/ ]?([\d\.]+)/i],[m,[u,"Sogou Explorer"]],[/(sogou)mo\w+\/([\d\.]+)/i],[[u,"Sogou Mobile"],m],[/(electron)\/([\w\.]+) safari/i,/(tesla)(?: qtcarbrowser|\/(20\d\d\.[-\w\.]+))/i,/m?(qqbrowser|2345Explorer)[\/ ]?([\w\.]+)/i],[u,m],[/(lbbrowser)/i,/\[(linkedin)app\]/i],[u],[/((?:fban\/fbios|fb_iab\/fb4a)(?!.+fbav)|;fbav\/([\w\.]+);)/i],[[u,me],m],[/(Klarna)\/([\w\.]+)/i,/(kakao(?:talk|story))[\/ ]([\w\.]+)/i,/(naver)\(.*?(\d+\.[\w\.]+).*\)/i,/safari (line)\/([\w\.]+)/i,/\b(line)\/([\w\.]+)\/iab/i,/(alipay)client\/([\w\.]+)/i,/(twitter)(?:and| f.+e\/([\w\.]+))/i,/(chromium|instagram|snapchat)[\/ ]([-\w\.]+)/i],[u,m],[/\bgsa\/([\w\.]+) .*safari\//i],[m,[u,"GSA"]],[/musical_ly(?:.+app_?version\/|_)([\w\.]+)/i],[m,[u,"TikTok"]],[/headlesschrome(?:\/([\w\.]+)| )/i],[m,[u,g+" Headless"]],[/ wv\).+(chrome)\/([\w\.]+)/i],[[u,g+" WebView"],m],[/droid.+ version\/([\w\.]+)\b.+(?:mobile safari|safari)/i],[m,[u,"Android "+b]],[/(chrome|omniweb|arora|[tizenoka]{5} ?browser)\/v?([\w\.]+)/i],[u,m],[/version\/([\w\.\,]+) .*mobile\/\w+ (safari)/i],[m,[u,"Mobile Safari"]],[/version\/([\w(\.|\,)]+) .*(mobile ?safari|safari)/i],[m,u],[/webkit.+?(mobile ?safari|safari)(\/[\w\.]+)/i],[u,[m,Ke,k_]],[/(webkit|khtml)\/([\w\.]+)/i],[u,m],[/(navigator|netscape\d?)\/([-\w\.]+)/i],[[u,"Netscape"],m],[/mobile vr; rv:([\w\.]+)\).+firefox/i],[m,[u,O+" Reality"]],[/ekiohf.+(flow)\/([\w\.]+)/i,/(swiftfox)/i,/(icedragon|iceweasel|camino|chimera|fennec|maemo browser|minimo|conkeror|klar)[\/ ]?([\w\.\+]+)/i,/(seamonkey|k-meleon|icecat|iceape|firebird|phoenix|palemoon|basilisk|waterfox)\/([-\w\.]+)$/i,/(firefox)\/([\w\.]+)/i,/(mozilla)\/([\w\.]+) .+rv\:.+gecko\/\d+/i,/(polaris|lynx|dillo|icab|doris|amaya|w3m|netsurf|sleipnir|obigo|mosaic|(?:go|ice|up)[\. ]?browser)[-\/ ]?v?([\w\.]+)/i,/(links) \(([\w\.]+)/i,/panasonic;(viera)/i],[u,m],[/(cobalt)\/([\w\.]+)/i],[u,[m,/master.|lts./,""]]],cpu:[[/(?:(amd|x(?:(?:86|64)[-_])?|wow|win)64)[;\)]/i],[[E,"amd64"]],[/(ia32(?=;))/i],[[E,_t]],[/((?:i[346]|x)86)[;\)]/i],[[E,"ia32"]],[/\b(aarch64|arm(v?8e?l?|_?64))\b/i],[[E,"arm64"]],[/\b(arm(?:v[67])?ht?n?[fl]p?)\b/i],[[E,"armhf"]],[/windows (ce|mobile); ppc;/i],[[E,"arm"]],[/((?:ppc|powerpc)(?:64)?)(?: mac|;|\))/i],[[E,/ower/,r,_t]],[/(sun4\w)[;\)]/i],[[E,"sparc"]],[/((?:avr32|ia64(?=;))|68k(?=\))|\barm(?=v(?:[1-7]|[5-7]1)l?|;|eabi)|(?=atmel )avr|(?:irix|mips|sparc)(?:64)?\b|pa-risc)/i],[[E,_t]]],device:[[/\b(sch-i[89]0\d|shw-m380s|sm-[ptx]\w{2,4}|gt-[pn]\d{2,4}|sgh-t8[56]9|nexus 10)/i],[l,[f,z],[p,S]],[/\b((?:s[cgp]h|gt|sm)-\w+|sc[g-]?[\d]+a?|galaxy nexus)/i,/samsung[- ]([-\w]+)/i,/sec-(sgh\w+)/i],[l,[f,z],[p,N]],[/(?:\/|\()(ip(?:hone|od)[\w, ]*)(?:\/|;)/i],[l,[f,$],[p,N]],[/\((ipad);[-\w\),; ]+apple/i,/applecoremedia\/[\w\.]+ \((ipad)/i,/\b(ipad)\d\d?,\d\d?[;\]].+ios/i],[l,[f,$],[p,S]],[/(macintosh);/i],[l,[f,$]],[/\b(sh-?[altvz]?\d\d[a-ekm]?)/i],[l,[f,Y],[p,N]],[/\b((?:ag[rs][23]?|bah2?|sht?|btv)-a?[lw]\d{2})\b(?!.+d\/s)/i],[l,[f,k],[p,S]],[/(?:huawei|honor)([-\w ]+)[;\)]/i,/\b(nexus 6p|\w{2,4}e?-[atu]?[ln][\dx][012359c][adn]?)\b(?!.+d\/s)/i],[l,[f,k],[p,N]],[/\b(poco[\w ]+|m2\d{3}j\d\d[a-z]{2})(?: bui|\))/i,/\b; (\w+) build\/hm\1/i,/\b(hm[-_ ]?note?[_ ]?(?:\d\w)?) bui/i,/\b(redmi[\-_ ]?(?:note|k)?[\w_ ]+)(?: bui|\))/i,/oid[^\)]+; (m?[12][0-389][01]\w{3,6}[c-y])( bui|; wv|\))/i,/\b(mi[-_ ]?(?:a\d|one|one[_ ]plus|note lte|max|cc)?[_ ]?(?:\d?\w?)[_ ]?(?:plus|se|lite)?)(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,N]],[/oid[^\)]+; (2\d{4}(283|rpbf)[cgl])( bui|\))/i,/\b(mi[-_ ]?(?:pad)(?:[\w_ ]+))(?: bui|\))/i],[[l,/_/g," "],[f,Oe],[p,S]],[/; (\w+) bui.+ oppo/i,/\b(cph[12]\d{3}|p(?:af|c[al]|d\w|e[ar])[mt]\d0|x9007|a101op)\b/i],[l,[f,"OPPO"],[p,N]],[/\b(opd2\d{3}a?) bui/i],[l,[f,"OPPO"],[p,S]],[/vivo (\w+)(?: bui|\))/i,/\b(v[12]\d{3}\w?[at])(?: bui|;)/i],[l,[f,"Vivo"],[p,N]],[/\b(rmx[1-3]\d{3})(?: bui|;|\))/i],[l,[f,"Realme"],[p,N]],[/\b(milestone|droid(?:[2-4x]| (?:bionic|x2|pro|razr))?:?( 4g)?)\b[\w ]+build\//i,/\bmot(?:orola)?[- ](\w*)/i,/((?:moto[\w\(\) ]+|xt\d{3,4}|nexus 6)(?= bui|\)))/i],[l,[f,L],[p,N]],[/\b(mz60\d|xoom[2 ]{0,2}) build\//i],[l,[f,L],[p,S]],[/((?=lg)?[vl]k\-?\d{3}) bui| 3\.[-\w; ]{10}lg?-([06cv9]{3,4})/i],[l,[f,C],[p,S]],[/(lm(?:-?f100[nv]?|-[\w\.]+)(?= bui|\))|nexus [45])/i,/\blg[-e;\/ ]+((?!browser|netcast|android tv)\w+)/i,/\blg-?([\d\w]+) bui/i],[l,[f,C],[p,N]],[/(ideatab[-\w ]+)/i,/lenovo ?(s[56]000[-\w]+|tab(?:[\w ]+)|yt[-\d\w]{6}|tb[-\d\w]{6})/i],[l,[f,"Lenovo"],[p,S]],[/(?:maemo|nokia).*(n900|lumia \d+)/i,/nokia[-_ ]?([-\w\.]*)/i],[[l,/_/g," "],[f,"Nokia"],[p,N]],[/(pixel c)\b/i],[l,[f,P],[p,S]],[/droid.+; (pixel[\daxl ]{0,6})(?: bui|\))/i],[l,[f,P],[p,N]],[/droid.+ (a?\d[0-2]{2}so|[c-g]\d{4}|so[-gl]\w+|xq-a\w[4-7][12])(?= bui|\).+chrome\/(?![1-6]{0,1}\d\.))/i],[l,[f,pe],[p,N]],[/sony tablet [ps]/i,/\b(?:sony)?sgp\w+(?: bui|\))/i],[[l,"Xperia Tablet"],[f,pe],[p,S]],[/ (kb2005|in20[12]5|be20[12][59])\b/i,/(?:one)?(?:plus)? (a\d0\d\d)(?: b|\))/i],[l,[f,"OnePlus"],[p,N]],[/(alexa)webm/i,/(kf[a-z]{2}wi|aeo[c-r]{2})( bui|\))/i,/(kf[a-z]+)( bui|\)).+silk\//i],[l,[f,V],[p,S]],[/((?:sd|kf)[0349hijorstuw]+)( bui|\)).+silk\//i],[[l,/(.+)/g,"Fire Phone $1"],[f,V],[p,N]],[/(playbook);[-\w\),; ]+(rim)/i],[l,f,[p,S]],[/\b((?:bb[a-f]|st[hv])100-\d)/i,/\(bb10; (\w+)/i],[l,[f,x],[p,N]],[/(?:\b|asus_)(transfo[prime ]{4,10} \w+|eeepc|slider \w+|nexus 7|padfone|p00[cj])/i],[l,[f,A],[p,S]],[/ (z[bes]6[027][012][km][ls]|zenfone \d\w?)\b/i],[l,[f,A],[p,N]],[/(nexus 9)/i],[l,[f,"HTC"],[p,S]],[/(htc)[-;_ ]{1,2}([\w ]+(?=\)| bui)|\w+)/i,/(zte)[- ]([\w ]+?)(?: bui|\/|\))/i,/(alcatel|geeksphone|nexian|panasonic(?!(?:;|\.))|sony(?!-bra))[-_ ]?([-\w]*)/i],[f,[l,/_/g," "],[p,N]],[/droid.+; ([ab][1-7]-?[0178a]\d\d?)/i],[l,[f,"Acer"],[p,S]],[/droid.+; (m[1-5] note) bui/i,/\bmz-([-\w]{2,})/i],[l,[f,"Meizu"],[p,N]],[/; ((?:power )?armor(?:[\w ]{0,8}))(?: bui|\))/i],[l,[f,"Ulefone"],[p,N]],[/(blackberry|benq|palm(?=\-)|sonyericsson|acer|asus|dell|meizu|motorola|polytron|infinix|tecno)[-_ ]?([-\w]*)/i,/(hp) ([\w ]+\w)/i,/(asus)-?(\w+)/i,/(microsoft); (lumia[\w ]+)/i,/(lenovo)[-_ ]?([-\w]+)/i,/(jolla)/i,/(oppo) ?([\w ]+) bui/i],[f,l,[p,N]],[/(kobo)\s(ereader|touch)/i,/(archos) (gamepad2?)/i,/(hp).+(touchpad(?!.+tablet)|tablet)/i,/(kindle)\/([\w\.]+)/i,/(nook)[\w ]+build\/(\w+)/i,/(dell) (strea[kpr\d ]*[\dko])/i,/(le[- ]+pan)[- ]+(\w{1,9}) bui/i,/(trinity)[- ]*(t\d{3}) bui/i,/(gigaset)[- ]+(q\w{1,9}) bui/i,/(vodafone) ([\w ]+)(?:\)| bui)/i],[f,l,[p,S]],[/(surface duo)/i],[l,[f,D],[p,S]],[/droid [\d\.]+; (fp\du?)(?: b|\))/i],[l,[f,"Fairphone"],[p,N]],[/(u304aa)/i],[l,[f,"AT&T"],[p,N]],[/\bsie-(\w*)/i],[l,[f,"Siemens"],[p,N]],[/\b(rct\w+) b/i],[l,[f,"RCA"],[p,S]],[/\b(venue[\d ]{2,7}) b/i],[l,[f,"Dell"],[p,S]],[/\b(q(?:mv|ta)\w+) b/i],[l,[f,"Verizon"],[p,S]],[/\b(?:barnes[& ]+noble |bn[rt])([\w\+ ]*) b/i],[l,[f,"Barnes & Noble"],[p,S]],[/\b(tm\d{3}\w+) b/i],[l,[f,"NuVision"],[p,S]],[/\b(k88) b/i],[l,[f,"ZTE"],[p,S]],[/\b(nx\d{3}j) b/i],[l,[f,"ZTE"],[p,N]],[/\b(gen\d{3}) b.+49h/i],[l,[f,"Swiss"],[p,N]],[/\b(zur\d{3}) b/i],[l,[f,"Swiss"],[p,S]],[/\b((zeki)?tb.*\b) b/i],[l,[f,"Zeki"],[p,S]],[/\b([yr]\d{2}) b/i,/\b(dragon[- ]+touch |dt)(\w{5}) b/i],[[f,"Dragon Touch"],l,[p,S]],[/\b(ns-?\w{0,9}) b/i],[l,[f,"Insignia"],[p,S]],[/\b((nxa|next)-?\w{0,9}) b/i],[l,[f,"NextBook"],[p,S]],[/\b(xtreme\_)?(v(1[045]|2[015]|[3469]0|7[05])) b/i],[[f,"Voice"],l,[p,N]],[/\b(lvtel\-)?(v1[12]) b/i],[[f,"LvTel"],l,[p,N]],[/\b(ph-1) /i],[l,[f,"Essential"],[p,N]],[/\b(v(100md|700na|7011|917g).*\b) b/i],[l,[f,"Envizen"],[p,S]],[/\b(trio[-\w\. ]+) b/i],[l,[f,"MachSpeed"],[p,S]],[/\btu_(1491) b/i],[l,[f,"Rotor"],[p,S]],[/(shield[\w ]+) b/i],[l,[f,"Nvidia"],[p,S]],[/(sprint) (\w+)/i],[f,l,[p,N]],[/(kin\.[onetw]{3})/i],[[l,/\./g," "],[f,D],[p,N]],[/droid.+; (cc6666?|et5[16]|mc[239][23]x?|vc8[03]x?)\)/i],[l,[f,Fe],[p,S]],[/droid.+; (ec30|ps20|tc[2-8]\d[kx])\)/i],[l,[f,Fe],[p,N]],[/smart-tv.+(samsung)/i],[f,[p,R]],[/hbbtv.+maple;(\d+)/i],[[l,/^/,"SmartTV"],[f,z],[p,R]],[/(nux; netcast.+smarttv|lg (netcast\.tv-201\d|android tv))/i],[[f,C],[p,R]],[/(apple) ?tv/i],[f,[l,$+" TV"],[p,R]],[/crkey/i],[[l,g+"cast"],[f,P],[p,R]],[/droid.+aft(\w+)( bui|\))/i],[l,[f,V],[p,R]],[/\(dtv[\);].+(aquos)/i,/(aquos-tv[\w ]+)\)/i],[l,[f,Y],[p,R]],[/(bravia[\w ]+)( bui|\))/i],[l,[f,pe],[p,R]],[/(mitv-\w{5}) bui/i],[l,[f,Oe],[p,R]],[/Hbbtv.*(technisat) (.*);/i],[f,l,[p,R]],[/\b(roku)[\dx]*[\)\/]((?:dvp-)?[\d\.]*)/i,/hbbtv\/\d+\.\d+\.\d+ +\([\w\+ ]*; *([\w\d][^;]*);([^;]*)/i],[[f,It],[l,It],[p,R]],[/\b(android tv|smart[- ]?tv|opera tv|tv; rv:)\b/i],[[p,R]],[/(ouya)/i,/(nintendo) ([wids3utch]+)/i],[f,l,[p,v]],[/droid.+; (shield) bui/i],[l,[f,"Nvidia"],[p,v]],[/(playstation [345portablevi]+)/i],[l,[f,pe],[p,v]],[/\b(xbox(?: one)?(?!; xbox))[\); ]/i],[l,[f,D],[p,v]],[/((pebble))app/i],[f,l,[p,M]],[/(watch)(?: ?os[,\/]|\d,\d\/)[\d\.]+/i],[l,[f,$],[p,M]],[/droid.+; (glass) \d/i],[l,[f,P],[p,M]],[/droid.+; (wt63?0{2,3})\)/i],[l,[f,Fe],[p,M]],[/(quest( \d| pro)?)/i],[l,[f,me],[p,M]],[/(tesla)(?: qtcarbrowser|\/[-\w\.]+)/i],[f,[p,K]],[/(aeobc)\b/i],[l,[f,V],[p,K]],[/droid .+?; ([^;]+?)(?: bui|; wv\)|\) applew).+? mobile safari/i],[l,[p,N]],[/droid .+?; ([^;]+?)(?: bui|\) applew).+?(?! mobile) safari/i],[l,[p,S]],[/\b((tablet|tab)[;\/]|focus\/\d(?!.+mobile))/i],[[p,S]],[/(phone|mobile(?:[;\/]| [ \w\/\.]*safari)|pda(?=.+windows ce))/i],[[p,N]],[/(android[-\w\. ]{0,9});.+buil/i],[l,[f,"Generic"]]],engine:[[/windows.+ edge\/([\w\.]+)/i],[m,[u,I+"HTML"]],[/webkit\/537\.36.+chrome\/(?!27)([\w\.]+)/i],[m,[u,"Blink"]],[/(presto)\/([\w\.]+)/i,/(webkit|trident|netfront|netsurf|amaya|lynx|w3m|goanna)\/([\w\.]+)/i,/ekioh(flow)\/([\w\.]+)/i,/(khtml|tasman|links)[\/ ]\(?([\w\.]+)/i,/(icab)[\/ ]([23]\.[\d\.]+)/i,/\b(libweb)/i],[u,m],[/rv\:([\w\.]{1,9})\b.+(gecko)/i],[m,u]],os:[[/microsoft (windows) (vista|xp)/i],[u,m],[/(windows (?:phone(?: os)?|mobile))[\/ ]?([\d\.\w ]*)/i],[u,[m,Ke,Ah]],[/windows nt 6\.2; (arm)/i,/windows[\/ ]?([ntce\d\. ]+\w)(?!.+xbox)/i,/(?:win(?=3|9|n)|win 9x )([nt\d\.]+)/i],[[m,Ke,Ah],[u,"Windows"]],[/ip[honead]{2,4}\b(?:.*os ([\w]+) like mac|; opera)/i,/(?:ios;fbsv\/|iphone.+ios[\/ ])([\d\.]+)/i,/cfnetwork\/.+darwin/i],[[m,/_/g,"."],[u,"iOS"]],[/(mac os x) ?([\w\. ]*)/i,/(macintosh|mac_powerpc\b)(?!.+haiku)/i],[[u,st],[m,/_/g,"."]],[/droid ([\w\.]+)\b.+(android[- ]x86|harmonyos)/i],[m,u],[/(android|webos|qnx|bada|rim tablet os|maemo|meego|sailfish)[-\/ ]?([\w\.]*)/i,/(blackberry)\w*\/([\w\.]*)/i,/(tizen|kaios)[\/ ]([\w\.]+)/i,/\((series40);/i],[u,m],[/\(bb(10);/i],[m,[u,x]],[/(?:symbian ?os|symbos|s60(?=;)|series60)[-\/ ]?([\w\.]*)/i],[m,[u,"Symbian"]],[/mozilla\/[\d\.]+ \((?:mobile|tablet|tv|mobile; [\w ]+); rv:.+ gecko\/([\w\.]+)/i],[m,[u,O+" OS"]],[/web0s;.+rt(tv)/i,/\b(?:hp)?wos(?:browser)?\/([\w\.]+)/i],[m,[u,"webOS"]],[/watch(?: ?os[,\/]|\d,\d\/)([\d\.]+)/i],[m,[u,"watchOS"]],[/crkey\/([\d\.]+)/i],[m,[u,g+"cast"]],[/(cros) [\w]+(?:\)| ([\w\.]+)\b)/i],[[u,we],m],[/panasonic;(viera)/i,/(netrange)mmh/i,/(nettv)\/(\d+\.[\w\.]+)/i,/(nintendo|playstation) ([wids345portablevuch]+)/i,/(xbox); +xbox ([^\);]+)/i,/\b(joli|palm)\b ?(?:os)?\/?([\w\.]*)/i,/(mint)[\/\(\) ]?(\w*)/i,/(mageia|vectorlinux)[; ]/i,/([kxln]?ubuntu|debian|suse|opensuse|gentoo|arch(?= linux)|slackware|fedora|mandriva|centos|pclinuxos|red ?hat|zenwalk|linpus|raspbian|plan 9|minix|risc os|contiki|deepin|manjaro|elementary os|sabayon|linspire)(?: gnu\/linux)?(?: enterprise)?(?:[- ]linux)?(?:-gnu)?[-\/ ]?(?!chrom|package)([-\w\.]*)/i,/(hurd|linux) ?([\w\.]*)/i,/(gnu) ?([\w\.]*)/i,/\b([-frentopcghs]{0,5}bsd|dragonfly)[\/ ]?(?!amd|[ix346]{1,2}86)([\w\.]*)/i,/(haiku) (\w+)/i],[u,m],[/(sunos) ?([\w\.\d]*)/i],[[u,"Solaris"],m],[/((?:open)?solaris)[-\/ ]?([\w\.]*)/i,/(aix) ((\d)(?=\.|\)| )[\w\.])*/i,/\b(beos|os\/2|amigaos|morphos|openvms|fuchsia|hp-ux|serenityos)/i,/(unix) ?([\w\.]*)/i],[u,m]]},tr=function(ve,ke){if(typeof ve===s&&(ke=ve,ve=e),!(this instanceof tr))return new tr(ve,ke).getResult();var fe=typeof t!==o&&t.navigator?t.navigator:e,He=ve||(fe&&fe.userAgent?fe.userAgent:r),rn=fe&&fe.userAgentData?fe.userAgentData:e,Mr=ke?Zi(Th,ke):Th,Re=fe&&fe.userAgent==He;return this.getBrowser=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.browser),ie[c]=yi(ie[m]),Re&&fe&&fe.brave&&typeof fe.brave.isBrave==i&&(ie[u]="Brave"),ie},this.getCPU=function(){var ie={};return ie[E]=e,Qe.call(ie,He,Mr.cpu),ie},this.getDevice=function(){var ie={};return ie[f]=e,ie[l]=e,ie[p]=e,Qe.call(ie,He,Mr.device),Re&&!ie[p]&&rn&&rn.mobile&&(ie[p]=N),Re&&ie[l]=="Macintosh"&&fe&&typeof fe.standalone!==o&&fe.maxTouchPoints&&fe.maxTouchPoints>2&&(ie[l]="iPad",ie[p]=S),ie},this.getEngine=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.engine),ie},this.getOS=function(){var ie={};return ie[u]=e,ie[m]=e,Qe.call(ie,He,Mr.os),Re&&!ie[u]&&rn&&rn.platform&&rn.platform!="Unknown"&&(ie[u]=rn.platform.replace(/chrome os/i,we).replace(/macos/i,st)),ie},this.getResult=function(){return{ua:this.getUA(),browser:this.getBrowser(),engine:this.getEngine(),os:this.getOS(),device:this.getDevice(),cpu:this.getCPU()}},this.getUA=function(){return He},this.setUA=function(ie){return He=typeof ie===a&&ie.length>B?It(ie,B):ie,this},this.setUA(He),this};tr.BROWSER=kn([u,m,c]),tr.CPU=kn([E]),tr.DEVICE=kn([l,f,p,v,N,R,S,M,K]),tr.ENGINE=tr.OS=kn([u,m]),typeof Ga!==o?(typeof Lu!==o&&Lu.exports&&(Ga=Lu.exports=tr),Ga.UAParser=tr):typeof define===i&&define.amd?define(function(){return tr}):typeof t!==o&&(t.UAParser=tr);var to=typeof t!==o&&(t.jQuery||t.Zepto);if(to&&!to.ua){var kc=new tr;to.ua=kc.getResult(),to.ua.get=function(){return kc.getUA()},to.ua.set=function(ve){kc.setUA(ve);var ke=kc.getResult();for(var fe in ke)to.ua[fe]=ke[fe]}}})(typeof window=="object"?window:Ga)});var zT,JT=ne(()=>{zT="x-hono-already-sent"});var YT,XT=ne(()=>{YT=t=>((...e)=>{if(typeof e[0]=="function"){let[r,n]=e;return async function(o,s){let a=await t(o,await r(o),n);if(a)return a;await s()}}else{let[r,n,i]=e;return(async()=>{let o=await t(r,n,i);if(!o)throw new Error("Failed to upgrade WebSocket");return o})()}})});var S_={};Cc(S_,{RequestError:()=>Ur,createAdaptorServer:()=>b_,getRequestListener:()=>T_,serve:()=>Jk,upgradeWebSocket:()=>zk});import{STATUS_CODES as ak,ServerResponse as ck,createServer as lk}from"node:http";import{Http2ServerRequest as hi,constants as uk}from"node:http2";import{Readable as QT}from"node:stream";async function Uk(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function h_(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(s,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function o(){t.read().then(s,i)}function s({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",o);else return t.read().then(s,i)}catch(l){i(l)}}}function o_(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:h_(t.getReader(),e)}var Ur,dk,pk,Td,ZT,e_,hh,c_,Eh,l_,fk,mk,hk,Ek,yk,gk,Ns,u_,vk,Ak,ah,lh,d_,yh,t_,Id,r_,Tk,Ei,Nn,Rs,Rc,p_,f_,wc,uh,dh,mi,_d,On,n_,Nc,xd,Oc,_k,Ik,xk,bk,Sk,wk,Nk,gh,Rk,i_,Ok,tn,kk,Xi,ph,ws,Rn,bd,en,Ck,Pk,Dk,fh,Sd,s_,Lk,Mk,E_,Kk,Hk,Fk,y_,wd,mh,g_,ch,v_,A_,Vk,T_,Bk,jk,Gk,__,I_,$k,x_,a_,qk,Wk,zk,b_,Jk,w_=ne(()=>{JT();XT();Ur=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},dk=new Set(["age","authorization","content-length","content-type","etag","expires","from","host","if-modified-since","if-unmodified-since","last-modified","location","max-forwards","proxy-authorization","referer","retry-after","server","user-agent"]),pk=/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/,Td=t=>t===9||t===10||t===13||t===32,ZT=t=>{if(!Td(t.charCodeAt(0))&&!Td(t.charCodeAt(t.length-1)))return t;let e=0,r=t.length;for(;e<r&&Td(t.charCodeAt(e));)e++;for(;r>e&&Td(t.charCodeAt(r-1));)r--;return t.slice(e,r)},e_=/[\0\r\n]/,hh=globalThis.Headers,c_=(t,e=hh)=>{let r=new e;for(let n=0;n<t.length;n+=2){let i=t[n];i.startsWith(":")||r.append(i,t[n+1])}return r},Eh=class{#e;#t;#r;#o;constructor(t){this.#e=t,t instanceof hi&&(this.#t=t.rawHeaders.slice())}get#i(){return this.#t??=this.#e.rawHeaders.slice()}get#n(){return this.#r||(this.#r=c_(this.#i),this.#t=void 0),this.#r}#c(t){if(typeof t=="string"){if(!pk.test(t))throw new TypeError(`Invalid header name: ${t}`);return t.toLowerCase()}}#s(t){let e=this.#e instanceof hi?void 0:this.#e.headers;if(!e||dk.has(t)||t==="set-cookie"||t==="__proto__")return;if(!Object.hasOwn(e,t))return null;let r=e[t];if(typeof r=="string"){let n=ZT(r);return e_.test(n)?void 0:n}}#a(t,e){let r=e==="cookie"?"; ":", ",n=null;for(let i=0;i<t.length;i+=2){let o=t[i];if(o.length===e.length&&o.toLowerCase()===e){let s=ZT(t[i+1]);if(e_.test(s)){this.#o=!0;return}n=n===null?s:n+r+s}}return n}append(t,e){this.#n.append(t,e)}delete(t){this.#n.delete(t)}get(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r;let n=this.#a(this.#i,e);if(n!==void 0)return n}return this.#n.get(t)}has(t){let e=this.#c(t);if(e&&!this.#r&&!this.#o){let r=this.#s(e);if(r!==void 0)return r!==null;let n=this.#a(this.#i,e);if(n!==void 0)return n!==null}return this.#n.has(t)}set(t,e){this.#n.set(t,e)}getSetCookie(){return this.#n.getSetCookie()}keys(){return this.#n.keys()}values(){return this.#n.values()}entries(){return this.#n.entries()}forEach(t,e){this.#n.forEach((r,n)=>{t.call(e,r,n,this)})}[Symbol.iterator](){return this.entries()}};Object.defineProperty(Eh.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Headers (lightweight) ${r(Object.fromEntries(this),{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(Eh.prototype,hh.prototype);l_=t=>globalThis.Headers===hh?new Eh(t):c_(t.rawHeaders,globalThis.Headers),fk=/^\/[!#$&-;=?-\[\]_a-z~]*$/,mk=/\/\.\.?(?:[/?#]|$)/,hk=/^[a-z0-9._-]+(?::(?:[1-5]\d{3,4}|[6-9]\d{3}))?$/,Ek=(t,e,r)=>{let n=`${t}://${e}${r}`;if(hk.test(e)){if(r.length===0)return n+"/";if(r.charCodeAt(0)!==47)throw new Ur("Invalid URL");return!fk.test(r)||mk.test(r)?new URL(n).href:n}else{let i=new URL(n);if(i.hostname.length!==e.length&&i.hostname!==(e.includes(":")?e.replace(/:\d+$/,""):e).toLowerCase())throw new Ur("Invalid host header");return i.href}},yk=t=>t instanceof Ur?t:new Ur(t.message,{cause:t}),gk=global.Request,Ns=class extends gk{constructor(t,e){if(typeof t=="object"&&Ei in t){let r=e!==void 0&&"body"in e&&e.body!=null;if(t[On]&&!r)throw new TypeError("Cannot construct a Request with a Request object that has already been used.");t=t[Ei]()}typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},u_=Symbol("wrapBodyStream"),vk=new Set(["latin1","binary","hex","base64","base64url"]),Ak=t=>t===null||vk.has(t),ah=Symbol("bodyBufferedBeforeDisconnect"),lh=Symbol("bodyBufferedLengthBeforeDisconnect"),d_=(t,e)=>Buffer.isBuffer(t)?t:Buffer.from(t,e??"utf8"),yh=t=>!(t instanceof hi)&&!!t.complete&&!!t.readableAborted&&typeof t.read=="function"&&Ak(t.readableEncoding),t_=t=>{if(t.readableDidRead||!yh(t))return;let e=t;e[lh]??=t.readableLength},Id=(t,e)=>{if(t.readableDidRead&&!e||!yh(t))return;let r=t;if(r[ah]!==void 0)return r[ah];let n,i=t.errored;if(i&&i.code!=="ECONNRESET")n=i;else if(r[lh]!==void 0&&t.readableLength!==r[lh])n=xd();else{let o=e??[],s=t.read();s!==null&&o.push(d_(s,t.readableEncoding));let a=o.length===1?o[0]:Buffer.concat(o);n=a;let c=t.headers["content-length"];if(typeof c=="string"&&/^\d+$/.test(c)){let l=Number(c);Number.isSafeInteger(l)&&a.length!==l&&(n=xd())}}return r[ah]=n,n},r_=(t,e)=>{if(e instanceof Error){t.error(e);return}e.length>0&&t.enqueue(e),t.close()},Tk=(t,e,r,n,i)=>{let o={method:t,headers:r,signal:i.signal};if(t==="TRACE"){o.method="GET";let s=new Ns(e,o);return Object.defineProperty(s,"method",{get(){return"TRACE"}}),s}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)o.body=new ReadableStream({start(s){s.enqueue(n.rawBody),s.close()}});else if(n[u_]){let s;o.body=new ReadableStream({async pull(a){try{if(!s){let u=Id(n);if(u!==void 0){r_(a,u);return}}s||=QT.toWeb(n).getReader();let{done:c,value:l}=await s.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else{let s=Id(n);s!==void 0?o.body=new ReadableStream({start(a){r_(a,s)}}):o.body=QT.toWeb(n)}return new Ns(e,o)},Ei=Symbol("getRequestCache"),Nn=Symbol("requestCache"),Rs=Symbol("incomingKey"),Rc=Symbol("urlKey"),p_=Symbol("methodKey"),f_=Symbol("headersKey"),wc=Symbol("abortControllerKey"),uh=Symbol("getAbortController"),dh=Symbol("abortRequest"),mi=Symbol("bodyBuffer"),_d=Symbol("bodyReadPromise"),On=Symbol("bodyConsumedDirectly"),n_=Symbol("bodyLockReader"),Nc=Symbol("abortReason"),xd=()=>new TypeError("Body is unusable"),Oc=()=>Promise.reject(xd()),_k=new TextDecoder,Ik=t=>{if(t[On])return Oc();t[On]=!0},xk=t=>t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength),bk=t=>(t[f_]||=l_(t[Rs])).get("content-type")||"",Sk=/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/,wk=t=>{if(typeof t!="string"||t.length===0)return"GET";switch(t){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"PATCH":case"POST":case"PUT":case"QUERY":return t}let e=t.toUpperCase();switch(e){case"DELETE":case"GET":case"HEAD":case"OPTIONS":case"POST":case"PUT":return e;default:return t}},Nk=t=>{if(!Sk.test(t))return new TypeError(`'${t}' is not a valid HTTP method.`);let e=t.toUpperCase();if(e==="CONNECT"||e==="TRACK"||e==="TRACE"&&t!=="TRACE")return new TypeError(`'${t}' HTTP method is unsupported.`)},gh=(t,e,r)=>{if(t[On])return Oc();let n=t.method;if(n==="GET"||n==="HEAD")return t[Ei]()[e]();let i=Nk(n);if(i)return Promise.reject(i);if(t[Nn]&&n!=="TRACE")return t[Nn][e]();let o=Ik(t);if(o)return o;let s=Rk(t);if(s){let a=Promise.resolve(r(s,t));return t[mi]=void 0,a}return Ok(t).then(a=>{let c=r(a,t);return t[mi]=void 0,c})},Rk=t=>{let e=t[Rs];if("rawBody"in e&&e.rawBody instanceof Buffer)return e.rawBody},i_=(t,e)=>{if(e.errored)return e.errored;let r=t[Nc];return r!==void 0?r instanceof Error?r:new Error(String(r)):new Error("Client connection prematurely closed.")},Ok=t=>{if(t[mi])return Promise.resolve(t[mi]);if(t[_d])return t[_d];let e=t[Rs];if(e.readableDidRead)return Oc();let r=Id(e);if(r!==void 0)return r instanceof Error?Promise.reject(r):(t[mi]=r,Promise.resolve(r));let n=new Promise((i,o)=>{let s=[],a=!1,c=v=>{a||(a=!0,E(),v())},l=v=>{let N=e.errored??v;return!yh(e)||N&&N.code!=="ECONNRESET"?!1:(c(()=>{let S=Id(e,s);S instanceof Error?o(S):S===void 0?o(v??i_(t,e)):(t[mi]=S,i(S))}),!0)},u=v=>{s.push(d_(v,e.readableEncoding))},p=()=>{c(()=>{let v=s.length===1?s[0]:Buffer.concat(s);t[mi]=v,i(v)})},f=v=>{l(v)||c(()=>{o(v)})},m=()=>{if(e.readableEnded){p();return}l()||c(()=>{o(i_(t,e))})},E=()=>{e.off("data",u),e.off("end",p),e.off("error",f),e.off("close",m),t[_d]=void 0};e.on("data",u),e.on("end",p),e.on("error",f),e.on("close",m),queueMicrotask(()=>{a||(e.readableEnded?p():e.errored?f(e.errored):e.destroyed&&m())})});return t[_d]=n,n},tn={get method(){return this[p_]},get url(){return this[Rc]},get headers(){return this[f_]||=l_(this[Rs])},[dh](t){this[Nc]===void 0&&(this[Nc]=t);let e=this[wc];e&&!e.signal.aborted&&e.abort(t)},[uh](){return this[wc]||=new AbortController,this[Nc]!==void 0&&!this[wc].signal.aborted&&this[wc].abort(this[Nc]),this[wc]},[Ei](){let t=this[uh]();if(this[Nn])return this[Nn];let e=this.method;if(this[On]&&!(e==="GET"||e==="HEAD")){this[mi]=void 0;let r={method:e==="TRACE"?"GET":e,headers:this.headers,signal:t.signal};e!=="TRACE"&&(r.body=new ReadableStream({start(i){i.close()}}),r.duplex="half");let n=new Ns(this[Rc],r);return e==="TRACE"&&Object.defineProperty(n,"method",{get(){return"TRACE"}}),this[Nn]=n}return this[Nn]=Tk(this.method,this[Rc],this.headers,this[Rs],t)},get body(){if(!this[On])return this[Ei]().body;let t=this[Ei]();return!this[n_]&&t.body&&(this[n_]=t.body.getReader()),t.body},get bodyUsed(){return this[On]?!0:this[Nn]?this[Nn].bodyUsed:!1}};Object.defineProperty(tn,"signal",{get(){return this[uh]().signal}});["cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","keepalive"].forEach(t=>{Object.defineProperty(tn,t,{get(){return this[Ei]()[t]}})});["clone","formData"].forEach(t=>{Object.defineProperty(tn,t,{value:function(){if(this[On]){if(t==="clone")throw xd();return Oc()}return this[Ei]()[t]()}})});Object.defineProperty(tn,"text",{value:function(){return gh(this,"text",t=>_k.decode(t))}});Object.defineProperty(tn,"arrayBuffer",{value:function(){return gh(this,"arrayBuffer",t=>xk(t))}});Object.defineProperty(tn,"blob",{value:function(){return gh(this,"blob",(t,e)=>{let r=bk(e),n=r?{headers:{"content-type":r}}:void 0;return new Response(t,n).blob()})}});Object.defineProperty(tn,"json",{value:function(){return this[On]?Oc():this.text().then(JSON.parse)}});Object.defineProperty(tn,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Request (lightweight) ${r({method:this.method,url:this.url,headers:this.headers,nativeRequest:this[Nn]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(tn,Ns.prototype);kk=(t,e)=>{let r=Object.create(tn);r[Rs]=t,r[p_]=wk(t.method);let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof hi)throw new Ur("Absolute URL for :path is not allowed in HTTP/2");try{r[Rc]=new URL(n).href}catch(s){throw new Ur("Invalid absolute URL",{cause:s})}return r}let i=(t instanceof hi?t.authority:t.headers.host)||e;if(!i)throw new Ur("Missing host header");let o;if(t instanceof hi){if(o=t.scheme,!(o==="http"||o==="https"))throw new Ur("Unsupported scheme")}else o=t.socket&&t.socket.encrypted?"https":"http";try{r[Rc]=Ek(o,i,n)}catch(s){throw s instanceof Ur?s:new Ur("Invalid URL",{cause:s})}return r},Xi="text/plain; charset=UTF-8",ph=Symbol("responseCache"),ws=Symbol("getResponseCache"),Rn=Symbol("cache"),bd=global.Response,en=class m_{#e;#t;[ws](){let e=this[Rn],r=e&&e[2]instanceof Headers?e[2]:void 0;return delete this[Rn],this[ph]||=new bd(this.#e,r?{status:this.#t?.status,statusText:this.#t?.statusText,headers:r}:this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof bd){let i=r[ph];if(i){this.#t=i,this[ws]();return}this.#t=r instanceof m_?r.#t:r,n=new Headers(r.headers)}else this.#t=r;(e==null||typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[Rn]=[r?.status||200,e??null,n||r?.headers])}get headers(){let e=this[Rn];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||(e[1]===null?void 0:{"content-type":Xi}))),e[2]):this[ws]().headers}get status(){return this[Rn]?.[0]??this[ws]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(en.prototype,t,{get(){return this[ws]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(en.prototype,t,{value:function(){return this[ws]()[t]()}})});Object.defineProperty(en.prototype,Symbol.for("nodejs.util.inspect.custom"),{value:function(t,e,r){return`Response (lightweight) ${r({status:this.status,headers:this.headers,ok:this.ok,nativeResponse:this[ph]},{...e,depth:t==null?null:t-1})}`}});Object.setPrototypeOf(en,bd);Object.setPrototypeOf(en.prototype,bd.prototype);Ck=/^https?:\/\/[!#-;=?-[\]_a-z~A-Z]+$/,Pk=t=>t instanceof URL?t.href:Ck.test(t)?t:new URL(t).href,Dk=new Set([301,302,303,307,308]);Object.defineProperty(en,"redirect",{value:function(e,r=302){if(!Dk.has(r))throw new RangeError("Invalid status code");return new en(null,{status:r,headers:{location:Pk(e)}})},writable:!0,configurable:!0});Object.defineProperty(en,"json",{value:function(e,r){let n=JSON.stringify(e);if(n===void 0)throw new TypeError("The data is not JSON serializable");let i=r?.headers,o;return i?(o=new Headers(i),o.has("content-type")||o.set("content-type","application/json")):o={"content-type":"application/json"},new en(n,{status:r?.status??200,statusText:r?.statusText,headers:o})},writable:!0,configurable:!0});fh=(t,e)=>{let r={};if(t instanceof Headers||(t=new Headers(t??void 0)),t.has("set-cookie")){let n=[];for(let[i,o]of t)i==="set-cookie"?n.push(o):r[i]=o;n.length>0&&(r["set-cookie"]=n)}else for(let[n,i]of t)r[n]=i;return e&&(r["content-type"]??=e),r},Sd=Symbol("outgoingEnded"),s_=Symbol("incomingDraining"),Lk=500,Mk=64*1024*1024,E_=t=>{let e=t;if(t.destroyed||e[s_])return;if(e[s_]=!0,t instanceof hi){try{t.stream?.close?.(uk.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(o),t.off("data",s),t.off("end",n),t.off("error",n)},i=()=>{n();let a=t.socket;a&&!a.destroyed&&(typeof a.destroySoon=="function"?a.destroySoon():typeof a.destroy=="function"&&a.destroy())},o=setTimeout(i,Lk);o.unref?.();let s=a=>{r+=a.length,r>Mk&&i()};t.on("data",s),t.on("end",n),t.on("error",n),t.resume()},Kk=(t,e,r,n)=>()=>{e.errored?(t_(e),t[dh](e.errored.toString())):r.writableFinished||(t_(e),t[dh]("Client connection prematurely closed.")),n&&!e.readableEnded&&setTimeout(()=>{e.readableEnded||setTimeout(()=>{E_(e)})})},Hk=t=>{if(!(Rn in t))return!1;let e=t[Rn][1];return e===null||typeof e=="string"||e instanceof Uint8Array},Fk=()=>new Response(null,{status:400}),y_=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),wd=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||(e instanceof ck&&(e._contentLength=null),e.writeHead(500,{"Content-Type":"text/plain"})),e.end(`Error: ${r.message}`),e.destroy(r))},mh=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},g_=(t,e,r)=>{let n=t;return n._contentLength===null&&n._hasBody&&n.useChunkedEncodingByDefault&&!n._removedContLen&&e>=200&&e!==204&&e!==304&&!t.hasHeader("content-length")&&!t.hasHeader("transfer-encoding")&&!t.hasHeader("trailer")?(n._contentLength=r,!0):!1},ch=(t,e,r)=>{g_(t,e,r)?t.writeHead(e,{"Content-Type":Xi}):t.writeHead(e,{"Content-Type":Xi,"Content-Length":r})},v_=async(t,e)=>{let[r,n,i]=t[Rn];if(!i){n===null?(e.writeHead(r),e.end()):typeof n=="string"?(ch(e,r,Buffer.byteLength(n)),e.end(n)):n instanceof Uint8Array?(ch(e,r,n.byteLength),e.end(n)):n instanceof Blob?(ch(e,r,n.size),e.end(new Uint8Array(await n.arrayBuffer()))):(e.writeHead(r,{"Content-Type":Xi}),mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.();return}let o=!1,s=!1,a=!0;if(i instanceof Headers)o=i.has("content-length"),i=fh(i,n===null?void 0:Xi);else if(Array.isArray(i)){let c=new Headers(i);o=c.has("content-length"),i=fh(c,n===null?void 0:Xi)}else{s=!0;for(let c in i){if(c.length===14&&c.toLowerCase()==="content-length"){o=!0;break}(c.length===17&&c.toLowerCase()==="transfer-encoding"||c.length===7&&c.toLowerCase()==="trailer")&&(a=!1)}}if(!o){let c;typeof n=="string"?c=Buffer.byteLength(n):n instanceof Uint8Array?c=n.byteLength:n instanceof Blob&&(c=n.size),c!==void 0&&(!s||!a||!g_(e,r,c))&&(s&&(i={...i}),i["Content-Length"]=c)}e.writeHead(r,i),n==null?e.end():typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):(mh(e),await o_(n,e)?.catch(c=>wd(c,e))),e[Sd]?.()},A_=t=>typeof t.then=="function",Vk=async(t,e,r={})=>{if(A_(t))if(r.errorHandler)try{t=await t}catch(i){let o=await r.errorHandler(i);if(!o)return;t=o}else t=await t.catch(y_);if(Rn in t)return v_(t,e);let n=fh(t.headers,t.body===null?void 0:Xi);if(t.body){let i=t.body.getReader(),o=[],s=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let u=await Uk(a).catch(p=>{console.error(p),s=!0});if(!u){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,u.value&&o.push(u.value),u.done){s=!0;break}}s&&!("content-length"in n)&&(n["content-length"]=o.reduce((l,u)=>l+u.length,0))}e.writeHead(t.status,n),o.forEach(c=>{e.write(c)}),s?e.end():(o.length===0&&mh(e),await h_(i,e,a))}else n[zT]||(e.writeHead(t.status,n),e.end());e[Sd]?.()},T_=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ns&&(Object.defineProperty(global,"Request",{value:Ns}),Object.defineProperty(global,"Response",{value:en})),async(n,i)=>{let o,s,a=!1,c=!1,l=()=>{!s||c||(c=!0,i.on("close",Kk(s,n,i,a)))};try{if(s=kk(n,e.hostname),a=r&&!(n.method==="GET"||n.method==="HEAD"),a&&(n[u_]=!0,n instanceof hi&&(i[Sd]=()=>{n.readableEnded||setTimeout(()=>{n.readableEnded||setTimeout(()=>{n.destroy(),i.destroy()})})})),o=t(s,{incoming:n,outgoing:i}),!A_(o)&&Hk(o))return a&&!n.readableEnded&&i.once("finish",()=>{n.readableEnded||E_(n)}),v_(o,i);l()}catch(u){if(o)return wd(u,i);if(e.errorHandler){if(l(),o=await e.errorHandler(s?u:yk(u)),!o)return}else s?o=y_(u):o=Fk()}try{return await Vk(o,i,e)}catch(u){return wd(u,i)}}},Bk=globalThis.CloseEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get wasClean(){return this.#e.wasClean??!1}get code(){return this.#e.code??0}get reason(){return this.#e.reason??""}},jk=globalThis.ErrorEvent??class extends Event{#e;constructor(t,e={}){super(t,e),this.#e=e}get message(){return this.#e.message??""}get filename(){return this.#e.filename??""}get lineno(){return this.#e.lineno??0}get colno(){return this.#e.colno??0}get error(){return this.#e.error??null}},Gk=()=>Symbol("connection"),__=Symbol("CONNECTION_SYMBOL_KEY"),I_=Symbol("WAIT_FOR_WEBSOCKET_SYMBOL"),$k=new Set(["connection","content-length","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","sec-websocket-accept","sec-websocket-extensions","sec-websocket-protocol"]),x_=(t,e)=>{e&&e.forEach((r,n)=>{$k.has(n.toLowerCase())||t.push(`${n}: ${r}`)})},a_=(t,e,r)=>{let n=["Connection: close","Content-Length: 0"];x_(n,r),t.end(`HTTP/1.1 ${e.toString()} ${ak[e]??""}\r
+${n.join(`\r
+`)}\r
+\r
+`)},qk=t=>{let e=t.socket.encrypted?"https":"http",r=new URL(t.url??"/",`${e}://${t.headers.host??"localhost"}`),n=new Headers;for(let i in t.headers){let o=t.headers[i];o&&n.append(i,Array.isArray(o)?o[0]:o)}return new Request(r,{headers:n})},Wk=t=>{let{server:e,fetchCallback:r,wss:n}=t,i=new Map;n.on("connection",(a,c)=>{let l=i.get(c);l&&(l.resolve(a),i.delete(c))});let o=a=>{let c=i.get(a);c&&(i.delete(a),c.reject(new Error("WebSocket handshake aborted")))},s=(a,c)=>new Promise((l,u)=>{i.set(a,{resolve:l,reject:u,connectionSymbol:c})});e.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let u={incoming:a,outgoing:void 0,wss:n,[I_]:s},p=400,f;try{let N=await r(qk(a),u);N instanceof Response&&(p=N.status,f=N.headers)}catch{e.listenerCount("upgrade")===1&&a_(c,500);return}let m=i.get(a);if(!m||m.connectionSymbol!==u[__]){o(a),e.listenerCount("upgrade")===1&&a_(c,p,f);return}let E=N=>{x_(N,f)},v=()=>o(a);c.once("close",v),n.on("headers",E);try{n.handleUpgrade(a,c,l,N=>{c.off("close",v),n.emit("connection",N,a)})}finally{n.off("headers",E)}}),e.on("close",()=>{n.close()})},zk=YT(async(t,e,r)=>{if(t.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=t.env,i=n[I_];if(!i||!n.incoming)return new Response(null,{status:500});let o=Gk();return n[__]=o,(async()=>{let s;try{s=await i(n.incoming,o)}catch{return}let a=[],c=(p,f)=>{a.push([p,f])};s.on("message",c);let l={binaryType:"arraybuffer",close(p,f){s.close(p,f)},protocol:s.protocol,raw:s,get readyState(){return s.readyState},send(p,f){s.send(p,{compress:f?.compress})},url:new URL(t.req.url)};try{e?.onOpen?.(new Event("open"),l)}catch(p){(r?.onError??console.error)(p)}let u=(p,f)=>{let m=Array.isArray(p)?p:[p];for(let E of m)try{e?.onMessage?.(new MessageEvent("message",{data:f?E instanceof ArrayBuffer?E:E.buffer.slice(E.byteOffset,E.byteOffset+E.byteLength):typeof E=="string"?E:Buffer.from(E).toString("utf-8")}),l)}catch(v){(r?.onError??console.error)(v)}};s.off("message",c);for(let p of a)u(...p);s.on("message",(p,f)=>{u(p,f)}),s.on("close",(p,f)=>{try{e?.onClose?.(new Bk("close",{code:p,reason:f.toString()}),l)}catch(m){(r?.onError??console.error)(m)}}),s.on("error",p=>{try{e?.onError?.(new jk("error",{error:p}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),b_=t=>{let e=t.fetch,r=T_(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming}),n=(t.createServer||lk)(t.serverOptions||{},r);if(t.websocket&&t.websocket.server){if(t.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");Wk({server:n,fetchCallback:e,wss:t.websocket.server})}return n},Jk=(t,e)=>{let r=b_(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var ro=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),F_=ro.READ|ro.WRITE|ro.DELETE|ro.APPROVE|ro.EXECUTE,rt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},rr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var V_=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function no(t){return V_?Object.freeze(t):t}function T(t,e){if(arguments.length===0)return no({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),no(r)}function d(t,e){let n={ok:!1,errors:no(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),no(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:s!=null,cursor:o,prevCursor:s,totalItems:a,estimatedTotal:c};return T(t,{...r,pagination:l})}function _(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function Q(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let o in r){if(o==="message"||o==="field")continue;let s=r[o];(typeof s=="string"||typeof s=="number")&&(n=n.replace(new RegExp(`\\{${o}\\}`,"g"),String(s)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function io(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=_("AUTH_NOT_AUTHENTICATED","Not authenticated"),nr=_("AUTH_MISSING_CREDENTIALS","Missing credentials"),qt=_("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Hr=_("AUTH_TOKEN_EXPIRED","Token expired"),nn=_("AUTH_TOKEN_MALFORMED","Token malformed"),Wt=_("PERM_DENIED","Permission denied"),Od=Q("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),gi=_("VALIDATION_ERROR","Validation failed"),oo=Q("INVALID_INPUT","Invalid input: {reason}"),Os=_("FORBIDDEN","Access forbidden"),kd=_("NOT_FOUND","Resource not found"),Cd=Q("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),ks=Q("ALREADY_EXISTS","{resource} already exists"),Cs=_("CONFLICT","Resource conflict"),vi=_("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),so=_("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:nr,InvalidCredentials:qt,TokenExpired:Hr,TokenMalformed:nn,PermissionDenied:Wt,BoundaryViolation:Od,Forbidden:Os,ValidationError:gi,InvalidInput:oo,NotFound:kd,ResourceNotFound:Cd,AlreadyExists:ks,Conflict:Cs,RateLimitExceeded:vi,InternalError:so};var Ot={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var Pc=class{getMask(e,r){return Ih(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return d(Wt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return T();let i=this.getMask(e,r.resource),o=this.checkCapability(i,r.action);return o.ok?this.checkBoundary(e,r.boundary,n):o}checkCapability(e,r){return(e&r)!==r?d(Wt()):T()}checkBoundary(e,r,n){if(r===rt.GLOBAL)return T();if(!n)return d(Wt({message:"Resource context required for boundary check"}));let i=n;switch(r){case rt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return d(Wt({message:"Tenant boundary violation"}));break;case rt.OWNER:case rt.SELF:if(i.ownerId!==e.id)return d(Wt({message:"Owner boundary violation"}));break;default:return d(Wt({message:`Unknown boundary type: ${r}`}))}return T()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(o=>(i&o)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(o=>(i&o)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let m=r.requireAllRoles?"ALL":"ANY",E=e.roles??[],v=r.requireAllRoles?r.roles.every(N=>E.includes(N)):r.roles.some(N=>E.includes(N));if(i.push(`Roles (${m}): ${r.roles.join(", ")} \u2014 user has: [${E.join(", ")}]`),!v)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
+`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let m=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),m)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
+`);i.push("Owner bypass: not owner, continuing to perm check")}let o=this.describeBits(r.action);i.push(`Required: ${o} (${r.action})`);let s=e.perms,a=s?.[r.resource],c=s?.["*"],l=a??c??0,u=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${u})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
+`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
+`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(`  User tenantId: ${e.tenantId||"undefined"}`),i.push(`  Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(`  User id: ${e.id}`),i.push(`  Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
+`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
+`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function Ai(){return new Pc}function Ih(t,e){return t?.[e]??t?.["*"]??0}var B_="AUTH_INVALID_CREDENTIALS",Dc=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[rr.JWT,rr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return d($t({message:"No auth methods configured"}));for(let i of n){let o=this.methods.get(i);if(!o)continue;let s=await o.authenticate(r);if(s.ok)return T({user:s.data,method:i});if(!s.errors||s.errors.length===0)continue;let a=s.errors[0];if(a?.code===B_)return d(a)}return d($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Ti(t,e={}){return new Dc(t,e)}var Ps={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function Cn(t,e){return{name:rr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return d(nr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return d(nn({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return d(nr({message:"Bearer token is empty"}));let o=await e(i,t);if(!o.ok){let a=o.errors[0];return a?.code===Ps.TOKEN_EXPIRED?d(Hr()):a?.code===Ps.TOKEN_MALFORMED?d(nn()):d(qt())}let s=o.data;return s.exp&&s.exp<Date.now()/1e3?d(Hr()):T({id:s.sub,perms:s.perms,tenantId:s.tid,tenantType:s.tty,roles:s.roles??[]})}}}function Uc(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function Pn(t){return{name:rr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return d(nr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?T({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):d(qt({message:"Invalid API key"}))}}}ra();function Sl(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var SI="x-gateway-auth";function Ro(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??SI;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let o=Sl(e);n=Vt({kty:"OKP",crv:"Ed25519",x:o},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:rr.GATEWAY_JWT,async authenticate(o){if(e!==void 0){let l=o.headers[r];if(!l)return d(nr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return d(qt({message:`${r} must use Bearer scheme`}));let u=l.slice(7);if(!u)return d(nr({message:"Gateway JWT is empty"}));let p;try{let f=await i(),{payload:m}=await Bn(u,f,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=m}catch(f){return f.code==="ERR_JWT_EXPIRED"?d(Hr({message:"Gateway JWT expired"})):d(qt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let f=typeof p.jti=="string"?p.jti:void 0;if(!f)return d(qt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(f))return d(qt({message:"Gateway JWT jti already used (replay)"}))}}let s=Uc(o.headers);if(s===null)return o.headers.authorization??o.headers.Authorization?d(nn({message:"Authorization header must use Bearer scheme"})):d(nr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(s,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Ps.TOKEN_EXPIRED?d(Hr()):l?.code===Ps.TOKEN_MALFORMED?d(nn()):d(qt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?d(Hr()):T({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var bM=globalThis.performance;ra();var jI="TOKEN_EXPIRED",WE="TOKEN_MALFORMED";function GI(t){return"secret"in t}function $I(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function qI(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=Sl(t);return Vt({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function zE(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function WI(t){try{let e=atob(t);return zE(e)}catch{return null}}async function zI(t){if(GI(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=zE(e);if(n)return Vt(n,r);let i=WI(e);return i?Vt(i,r):r==="EdDSA"&&$I(e)?qI(e):bl(e,r)}function JI(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function Ar(t){let e=null;return async(r,n)=>{try{e||(e=zI(t));let i=await e,{payload:o}=await Bn(r,i,JI(t));return T(o)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?d({code:jI,message:"Token has expired"}):d({code:WE,message:i.message}):d({code:WE,message:"JWT verification failed"})}}}function gp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Cn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as YI}from"crypto";async function vp(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??YI();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function dn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:io(t)}:{status:e?.error??400,body:io(t)}}var Oo=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function ko(t,e){let r=e?.name;return function(i){if(i.ok)return dn(i);let o=i.errors[0]?.code;if(!o||!(o in t))throw new Oo(o,i,r);let s=t[o];return dn(i,{error:s})}}function Co(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof Oo)return dn(n.result,{error:e});throw n}}}var XI={...Ot},j1=Co(ko(XI),400);var lK=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var QE=Symbol();var ZE=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,r=>r.toLowerCase())}}).formData();var ix=1e4,Ol=t=>"headers"in t,ry=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,i=(Ol(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?ox(t,{all:r,dot:n}):{}};async function ox(t,e){if(!Ol(t)&&t.bodyCache.formData)return ey(await t.bodyCache.formData,e);let r=Ol(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),i=ZE(n,r.get("Content-Type")||"");Ol(t)||(t.bodyCache.formData=i);let o=await i;return o?ey(o,e):{}}function ey(t,e){let r=Object.create(null),n={count:0};return t.forEach((i,o)=>{e.all||o.endsWith("[]")?sx(r,o,i):r[o]=i}),e.dot&&Object.entries(r).forEach(([i,o])=>{i.includes(".")&&(ax(r,i,o,n),delete r[i])}),r}var sx=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},ax=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let i=t,o=e.split(".",34);o.length>33&&ty(),o.forEach((s,a)=>{a===o.length-1?i[s]=r:((!i[s]||typeof i[s]!="object"||Array.isArray(i[s])||i[s]instanceof File)&&(n.count++>=ix&&ty(),i[s]=Object.create(null)),i=i[s])})},ty=()=>{throw new Error("Nesting limit exceeded")};var Tp=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ny=t=>{let{groups:e,path:r}=cx(t),n=Tp(r);return lx(n,e)},cx=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},lx=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},kl={},iy=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return kl[n]||(r[2]?kl[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:kl[n]=[t,r[1],!0]),kl[n]}return null},oy=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},ux=t=>oy(t,decodeURI),_p=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let o=e.indexOf("?",n),s=e.indexOf("#",n),a=o===-1?s===-1?void 0:s:s===-1?o:Math.min(o,s),c=e.slice(r,a);return ux(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var sy=t=>{let e=_p(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},$n=(t,e,...r)=>(r.length&&(e=$n(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Cl=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(i.charCodeAt(i.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let o=i.slice(0,-1);n+="/"+o,r.push(n)}else n+="/"+i}),r.filter((i,o,s)=>s.indexOf(i)===o)},Do=t=>t.indexOf("%")!==-1?oy(t,dx):t,Ap=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Do(t)),ay=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let i;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let a=t.indexOf("?",8);if(a===-1)return;for(t.startsWith(e,a+1)||(a=t.indexOf(`&${e}`,a+1));a!==-1;){let c=t.charCodeAt(a+e.length+1);if(c===61){let l=a+e.length+2,u=t.indexOf("&",l);return Ap(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";a=t.indexOf(`&${e}`,a+1)}if(i=/[%+]/.test(t),!i)return}let o=Object.create(null);i??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let a=t.indexOf("&",s+1),c=t.indexOf("=",s);c>a&&a!==-1&&(c=-1);let l=t.slice(s+1,c===-1?a===-1?void 0:a:c);if(i&&(l=Ap(l)),s=a,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,a===-1?void 0:a),i&&(u=Ap(u))),r?(o[l]&&Array.isArray(o[l])||(o[l]=[]),o[l].push(u)):o[l]??=u}return e?o[e]:o},cy=ay,ly=(t,e)=>ay(t,e,!0),dx=decodeURIComponent;var uy=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r}param(t){return t?this.#r(t):this.#o()}#r(t){let e=this.#t[0][this.routeIndex]?.[1][t],r=this.#i(e);return r&&Do(r)}#o(){let t={},e=Object.keys(this.#t[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#i(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Do(n))}return t}#i(t){return this.#t[1]?this.#t[1][t]:t}query(t){return cy(this.url,t)}queries(t){return ly(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return ry(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let i in e)return e[i].then(o=>{i==="json"&&(o=JSON.stringify(o));let s=i==="formData"?void 0:r.headers.get("content-type");return new Response(o,{headers:s?{"Content-Type":s}:void 0})[t]()});return e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){(this.#e??={})[t]=e}valid(t){return this.#e?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[QE](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var dy={Stringify:1,BeforeStream:2,Stream:3},px=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var Ip=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let o=t.callbacks;if(!o?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let s=Promise.all(o.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Ip(c,e,!1,n,i))).then(()=>i[0]));return r?px(await s,o):s};var fx="text/plain; charset=UTF-8",xp=(t,e)=>({"Content-Type":t,...e}),ia=(t,e)=>new Response(t,e),bp=class{#e;#t;env={};#r;finalized=!1;error;#o;#i;#n;#c;#s;#a;#u;#d;#p;constructor(t,e){this.#e=t,e&&(this.#i=e.executionCtx,this.env=e.env,this.#a=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new uy(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#i&&"respondWith"in this.#i)return this.#i;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#i)return this.#i;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=ia(null,{headers:this.#u??=new Headers})}set res(t){if(this.#n&&t){t=ia(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#s??=e=>this.html(e),this.#s(...t));setLayout=t=>this.#c=t;getLayout=()=>this.#c;setRenderer=t=>{this.#s=t};header=(t,e,r)=>{this.finalized&&(this.#n=ia(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#u??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#o=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#l(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#u;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[o,s]of new Headers(e.headers))o==="set-cookie"?n.append(o,s):n.set(o,s)}if(r){if(!n){let o=0;for(let s in r)if(++o>1||typeof r[s]!="string"){n=new Headers;break}}if(n)for(let o in r){let s=r[o];if(typeof s=="string")n.set(o,s);else{n.delete(o);for(let a of s)n.append(o,a)}}}let i=typeof e=="number"?e:e?.status??this.#o;return ia(t,{status:i,headers:n??r})}newResponse=(...t)=>this.#l(...t);body=(t,e,r)=>this.#l(t,e,r);text=(t,e,r)=>!this.#u&&!this.#o&&!e&&!r&&!this.finalized?new Response(t):this.#l(t,e,xp(fx,r));json=(t,e,r)=>this.#l(JSON.stringify(t),e,xp("application/json",r));html=(t,e,r)=>{let n=i=>this.#l(i,e,xp("text/html; charset=UTF-8",r));return typeof t=="object"?Ip(t,dy.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#a??=()=>ia(),this.#a(this))};var Sp=(t,e,r)=>(n,i)=>{let o=-1;return s(0);async function s(a){if(a<=o)throw new Error("next() called multiple times");o=a;let c,l=!1,u;if(t[a]?(u=t[a][0][0],n.req.routeIndex=a):u=a===t.length&&i||void 0,u)try{c=await u(n,()=>s(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var py=["get","post","put","delete","options","patch","query"],Pl="Can not add a route since the matcher is already built.",Dl=class extends Error{};var fy="__COMPOSED_HANDLER";var mx=t=>t.text("404 Not Found",404),my=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},hy=class Ey{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...py,"all"].forEach(i=>{this[i]=(o,...s)=>{let a=i.toUpperCase();return typeof o=="string"?this.#e=o:this.#o(a,this.#e,o),s.forEach(c=>{this.#o(a,this.#e,c)}),this}}),this.on=(i,o,...s)=>{for(let a of[o].flat()){this.#e=a;for(let c of[i].flat()){let l=c.toUpperCase();for(let u of s)this.#o(l,this.#e,u)}}return this},this.use=(i,...o)=>(typeof i=="string"?this.#e=i:(this.#e="*",o.unshift(i)),o.forEach(s=>{this.#o("ALL",this.#e,s)}),this);let{strict:r,...n}=e;Object.assign(this,n),this.getPath=r??!0?e.getPath??_p:sy}#t(){let e=new Ey({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=mx;errorHandler=my;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let o;r.errorHandler===my?o=i.handler:(o=async(s,a)=>(await Sp([],r.errorHandler)(s,()=>i.handler(s,a))).res,o[fy]=i.handler),n.#o(i.method,i.path,o,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=$n(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,o;n&&(typeof n=="function"?o=n:(o=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let s=o?c=>{let l=o(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=$n(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(i(c.req.raw),...s(c));if(u)return u;await l()};return this.#o("ALL",$n(e,"*"),a),this}#o(e,r,n,i){r=$n(this._basePath,r);let o={basePath:i!==void 0?$n(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,o]),this.routes.push(o)}#i(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let o=this.getPath(e,{env:n}),s=this.router.match(i,o),a=new bp(e,{path:o,matchResult:s,env:n,executionCtx:r,notFoundHandler:this.#r});if(s[0].length===1){let l;try{l=s[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#i(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#i(u,a)):l??this.#r(a)}let c=Sp(s[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#i(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${$n("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var ut=()=>Object.create(null);var Ul=[];function wp(t,e){let r=this.buildAllMatchers(),n=((i,o)=>{let s=r[i]||r.ALL,a=s[2][o];if(a)return a;let c=o.match(s[0]);if(!c)return[[],Ul];let l=c.indexOf("",1);return[s[1][l],c]});return this.match=n,n(t,e)}var Rp="[^/]+";var Op="(?:|/.*)",qn=Symbol(),yy=new Set(".\\+*[^]$()");function hx(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===".*"||t==="(?:|/.*)"?e==="(?:|/.*)"?-1:1:e===".*"||e==="(?:|/.*)"?-1:t==="[^/]+"?1:e==="[^/]+"?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var gy=class Np{#e;#t;#r=ut();insert(e,r,n,i,o){let s=this;for(let a=0,c=e.length;a<c;a++){let l=e[a],u=l.length===1?l==="*"?a===c-1?["","",".*"]:["","",Rp]:null:l==="/*"?["","",Op]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(u){let f=u[1],m=u[2]||"[^/]+";if(f&&u[2]&&(m===".*"||(m=m.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(m))||m.length===1&&yy.has(m)))throw qn;if(p=s.#r[m],!p){if(m!==".*"&&m!=="(?:|/.*)"){for(let E in s.#r)if((m.length>1||E.length>1)&&E!==".*"&&E!=="(?:|/.*)")throw qn}p=s.#r[m]=new Np}f!==""&&(p.#t??=i.varIndex++,n.push([f,p.#t]))}else if(p=s.#r[l],!p){for(let f in s.#r)if(f.length>1&&f!==".*"&&f!=="(?:|/.*)")throw qn;p=s.#r[l]=new Np}s=p}if(s.#e!==void 0)throw qn;s.#e=o?-1:r}buildRegExpStr(){let e=Object.keys(this.#r).sort(hx).map(r=>{let n=this.#r[r],i=n.buildRegExpStr();return i===""?"":(typeof n.#t=="number"?`(${r})@${n.#t}`:yy.has(r)?`\\${r}`:r)+i}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&e.unshift(`#${this.#e}`),e.length===0?"":e.length===1?e[0]:"(?:"+e.join("|")+")"}};var kp=class{#e={varIndex:0};#t=new gy;#r=0;paths=ut();insert(t,e){if(e){this.#t.insert(t.split(""),0,[],this.#e,!0);return}let r=[],n=[],i=t;for(let s=0;;){let a=!1;if(i=i.replace(/\{[^}]+\}/g,c=>{let l=`@\\${s}`;return n[s]=[l,c],s++,a=!0,l}),!a)break}let o=i.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let s=n.length-1;s>=0;s--){let[a]=n[s];for(let c=o.length-1;c>=0;c--)if(o[c].indexOf(a)!==-1){o[c]=o[c].replace(a,n[s][1]);break}}this.#t.insert(o,this.#r,r,this.#e,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,o,s)=>o!==void 0?(r[++e]=Number(o),"$()"):(s!==void 0&&(n[Number(s)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var vy=ut();function Ay(t){return vy[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?Op:e==="*"?".*":`/:${Rp}`)}$`)}function Ll(t,e){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Ay(r).test(e))return[...t[r]]}var Ml=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={ALL:ut()},this.#t={ALL:ut()},this.#r={ALL:new kp}}#o(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===qn?new Dl(e):r}}add(t,e,r){let n=this.#e,i=this.#t;if(!n)throw new Error(Pl);if(!n[t]){this.#r[t]=new kp;for(let a of[n,i]){a[t]=ut();for(let c in a.ALL)a[t][c]=[...a.ALL[c]],this.#o(t,c)}}e==="/*"&&(e="*");let o=t==="ALL"?Object.keys(n):[t];if(/\*$/.test(e)){let a=Ay(e);for(let c of o)n[c][e]||(this.#o(c,e),n[c][e]=Ll(n[c],e)||Ll(n.ALL,e)||[]);for(let c of[n,i])for(let l of o)for(let u in c[l])a.test(u)&&c[l][u].push([r,e]);return}let s=Cl(e)||[e];for(let a of s)for(let c of o)i[c][a]||(this.#o(c,a),i[c][a]=Ll(n[c],a)||Ll(n.ALL,a)||[]),i[c][a].push([r,a])}match=wp;buildAllMatchers(){let t=ut();for(let e of Object.keys(this.#t))t[e]=this.#i(e);return this.#e=this.#t=this.#r=void 0,vy=ut(),t}#i(t){let e=this.#e[t],r=this.#t[t],n=this.#r[t],i=ut(),o=[],[s,a,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let p=l[u],f=n.paths[u];if(!f){i[u]=[p.map(([m])=>[m,ut()]),Ul];continue}o[f[0]]=p.map(([m,E])=>[m,n.paths[E][1].reduceRight((v,[N],S)=>(v[N]=c[f[1][S][1]],v),ut())])}return[s,a.map(l=>o[l]),i]}};var Ty=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Pl);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,o=0,s;for(;o<i;o++){let a=r[o];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);s=a.match(t,e)}catch(c){if(c instanceof Dl)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(o===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,s}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var Cp=ut(),Ex=0,_y=class Iy{#e=[];#t=ut();#r=[];#o;#i=Cp;insert(e,r,n){let i=this,o=ny(r),s=new Set,a=0;for(let c of o){let l=o[++a],u=iy(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),p=Array.isArray(u),f=p?u[0]:u||c,m=i.#t[f]||=new Iy;u&&!m.#o&&(m.#o=u,i.#r.push(m)),i=m,p&&s.add(u[1])}i.#e.push({[e]:{handler:n,possibleKeys:[...s],score:++Ex}})}#n(e,r,n,i,o){for(let s=0,a=r.#e.length;s<a;s++){let c=r.#e[s],l=c[n]||c.ALL;if(l){l.params=ut(),e.push(l);for(let u=0,p=l.possibleKeys.length;u<p;u++){let f=l.possibleKeys[u];l.params[f]=o?.[f]&&!u?o[f]:i[f]??o?.[f]}}}}search(e,r){let n=[];this.#i=Cp;let i=[this],o=Tp(r),s=[],a=o.length,c=null;for(let l=0;l<a;l++){let u=o[l],p=l===a-1,f=[];for(let E=0,v=i.length;E<v;E++){let N=i[E],S=N.#t[u];S&&(S.#i=N.#i,p?(S.#t["*"]&&this.#n(n,S.#t["*"],e,N.#i),this.#n(n,S,e,N.#i)):f.push(S));for(let R of N.#r){let M=R.#o,K=N.#i===Cp?{}:{...N.#i};if(typeof M=="string"){(M==="*"||u.startsWith(M.slice(0,-1)))&&(this.#n(n,R,e,N.#i),M==="*"&&(R.#i=K,f.push(R)));continue}let[,B,V]=M;if(!(!u&&V===!0)){if(V!==!0){if(!c){c=[];let x=r[0]==="/"?1:0;for(let b=0;b<a;b++)c[b]=x,x+=o[b].length+1}let $=r.slice(c[l]),A=V.exec($);if(A){K[B]=A[0],this.#n(n,R,e,N.#i,K),A[0].length===$.length&&R.#t["*"]&&this.#n(n,R.#t["*"],e,N.#i,K);for(let x in R.#t){R.#i=K;let b=A[0].match(/\//g)?.length??0;(s[b]||=[]).push(R);break}continue}}(V===!0||V.test(u))&&(K[B]=u,p?(this.#n(n,R,e,K,N.#i),R.#t["*"]&&this.#n(n,R.#t["*"],e,K,N.#i)):(R.#i=K,f.push(R)))}}}let m=s.shift();i=m?f.concat(m):f}return n[1]&&n.sort((l,u)=>l.score-u.score),[n.map(({handler:l,params:u})=>[l,u])]}};var Pp=class{name="TrieRouter";#e=new _y;add(t,e,r){for(let n of Cl(e)||[e])this.#e.insert(t,n,r)}match(t,e){return this.#e.search(t,e)}};var Gr=class extends hy{constructor(t={}){super(t),this.router=t.router??new Ty({routers:[new Ml,new Pp]})}};function Dp(t){let e=[];if(t.auth.jwt){let o=t.auth.jwt,s=o.verify??Ar(o);e.push(Cn(o,s))}t.auth.apiKey&&e.push(Pn(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Ti(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=Ai(),i=t.errorHttpMap?{...Ot,...t.errorHttpMap}:{...Ot};return{auth:r,permission:n,errorHttpMap:i}}function or(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var Up={...Ot},xy=Co(ko(Up),400);function Lp(t){Up={...Ot,...t},xy=Co(ko(Up),400)}function by(){return xy}function Ge(t,e,r){let{traceId:n,successStatus:i,adapter:o=by()}=r??{},s=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:s}},l=o(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let u=e.ok?T(e.data,a):{...e,meta:a},p=io(u);return t.json(p,l)}async function yx(t){let e={};t.req.raw.headers.forEach((s,a)=>{e[a]=s});let r={},n=t.req.query();for(let[s,a]of Object.entries(n))r[s]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function oa(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,o)=>{let s=or(i);try{let a=await yx(i),c=await e.resolve(n,a);if(!c.ok){if(r){await o();return}return Ge(i,d($t()),{traceId:s})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await o()}catch{if(r){await o();return}return Ge(i,d($t()),{traceId:s})}}}function Mp(t){return async(e,r)=>{let n=or(e),i=e.get("authResult");if(!i)return Ge(e,d($t()),{traceId:n});let{user:o}=i,s;if(t.loadResource){let l=e.req.param(),u=await t.loadResource(l,o);if(u===null)return Ge(e,d(Wt({message:"Resource not found for boundary check"})),{traceId:n});s=u}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(o,a,s);if(!c.ok)return Ge(e,c,{traceId:n});await r()}}function sa(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?d(r.issues.map(n=>{let i=n.path?.map(o=>typeof o=="object"?o.key:o).join(".")??"";return gi({message:i?`${i}: ${n.message}`:n.message})})):T(r.value)}function aa(t){return async(e,r)=>{let n=or(e);try{let i={};if(t.body){let o;try{o=await e.req.json()}catch{return Ge(e,d(oo({reason:"Request body is not valid JSON"})),{traceId:n})}let s=sa(t.body,o);if(!s.ok)return Ge(e,s,{traceId:n});i.body=s.data}if(t.params){let o=sa(t.params,e.req.param());if(!o.ok)return Ge(e,o,{traceId:n});i.params=o.data}if(t.query){let o=sa(t.query,e.req.query());if(!o.ok)return Ge(e,o,{traceId:n});i.query=o.data}if(t.headers){let o={};e.req.raw.headers.forEach((a,c)=>{o[c]=a});let s=sa(t.headers,o);if(!s.ok)return Ge(e,s,{traceId:n});i.headers=s.data}e.set("validatedData",i),await r()}catch(i){let o={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return Ge(e,d(gi(),o),{traceId:n})}}}function ca(t){return t.get("validatedData")?.body}function la(t){return t.get("validatedData")?.params}function ua(t){return t.get("validatedData")?.query}var t2=_("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function gx(t,e){let r=[...t,e];return async(n,i)=>{let o,s=async a=>{if(o||a>=r.length){!o&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await s(a+1)});l instanceof Response&&(o=l)};return await s(0),o}}function X(t,e){let r=[];if(e.auth!==!1){let o=Array.isArray(e.auth)?e.auth:void 0;r.push(oa({engine:t.auth,methods:o}))}e.permission&&r.push(Mp({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(o,s)=>{let a={body:void 0,query:void 0,params:o,user:s};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(aa({body:e.input.body,query:e.input.query,params:e.input.params}));let i=gx(r,async o=>{let s=or(o);try{let a=o.get("authResult"),c={body:ca(o),query:ua(o),params:la(o),user:a?.user,tenantContext:o.get("tenantContext"),traceId:s},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},u=await e.handler(l),p=e.successStatus??200;return Ge(o,u,{traceId:s,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:s,route:`${e.method} ${e.path}`,error:{message:c}})),Ge(o,d(so()),{traceId:s})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function Kp(t,e){let r=new Gr;for(let n of e){let{method:i,path:o}=n.routeMeta,s=o==="/"?t:`${t}${o}`;switch(i){case"GET":r.get(s,n);break;case"POST":r.post(s,n);break;case"PUT":r.put(s,n);break;case"PATCH":r.patch(s,n);break;case"DELETE":r.delete(s,n);break}}return r}var Sy={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var Kl,vx={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function Ax(t){return!t&&!Kl?vx:{lang:t?.lang??Kl?.lang,message:t?.message,abortEarly:t?.abortEarly??Kl?.abortEarly,abortPipeEarly:t?.abortPipeEarly??Kl?.abortPipeEarly}}var Tx;function _x(t){return Tx?.get(t)}var Ix;function xx(t){return Ix?.get(t)}var bx;function Sx(t,e){return bx?.get(t)?.get(e)}function Ri(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function dt(t,e,r,n,i){let o=i&&"input"in i?i.input:r.value,s=i?.expected??t.expects??null,a=i?.received??Ri(o),c={kind:t.kind,type:t.type,input:o,expected:s,received:a,message:`Invalid ${e}: ${s?`Expected ${s} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",u=i?.message??t.message??Sx(t.reference,c.lang)??(l?xx(c.lang):null)??n.message??_x(c.lang);u!==void 0&&(c.message=typeof u=="function"?u(c):u),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}function wx(t,e){return t===e||Number.isNaN(t)&&Number.isNaN(e)}function Nx(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function Ny(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}function Jt(t){return t["~standard"]={version:1,vendor:"valibot",validate:e=>t["~run"]({value:e},Ax())},t}var Rx=/^[\w+-]+(?:\.[\w+-]+)*@[\da-zA-Z]+(?:[.-][\da-zA-Z]+)*\.[a-zA-Z]{2,}$/u;function Hl(t,e){return{kind:"validation",type:"check",reference:Hl,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&dt(this,"input",r,n),r}}}function pn(t){return{kind:"validation",type:"email",reference:pn,expects:null,async:!1,requirement:Rx,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&dt(this,"email",e,r),e}}}function Wn(t){return{kind:"validation",type:"integer",reference:Wn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&dt(this,"integer",e,r),e}}}function Pt(t,e){return{kind:"validation",type:"max_length",reference:Pt,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Uo(t,e){return{kind:"validation",type:"max_value",reference:Uo,async:!1,expects:`<=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Hp(t,e){return{kind:"validation",type:"min_length",reference:Hp,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&dt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function Lo(t,e){return{kind:"validation",type:"min_value",reference:Lo,async:!1,expects:`>=${t instanceof Date?t.toJSON():Ri(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&dt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():Ri(r.value)}),r}}}function Mo(t){return{kind:"transformation",type:"transform",reference:Mo,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function Ox(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function Fp(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return Jt({kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let o=0;o<i.length;o++){let s=i[o],a=this.item["~run"]({value:s},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:o,value:s};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else dt(this,"type",r,n);return r}})}function yt(t){return Jt({kind:"schema",type:"boolean",reference:yt,expects:"boolean",async:!1,message:t,"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:dt(this,"type",e,r),e}})}function Ko(t,e){return Jt({kind:"schema",type:"literal",reference:Ko,expects:Ri(t),async:!1,literal:t,message:e,"~run"(r,n){return wx(r.value,this.literal)?r.typed=!0:dt(this,"type",r,n),r}})}function Oi(t,e){return Jt({kind:"schema",type:"nullable",reference:Oi,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function qe(t){return Jt({kind:"schema",type:"number",reference:qe,expects:"number",async:!1,message:t,"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:dt(this,"type",e,r),e}})}function F(t,e){return Jt({kind:"schema",type:"object",reference:F,expects:"Object",async:!1,entries:t,message:e,"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let o in this.entries){let s=this.entries[o];if(o in i||(s.type==="exact_optional"||s.type==="optional"||s.type==="nullish")&&s.default!==void 0){let a=o in i?i[o]:Fp(s),c=s["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:o,value:a};for(let u of c.issues)u.path?u.path.unshift(l):u.path=[l],r.issues?.push(u);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[o]=c.value}else if(s.fallback!==void 0)r.value[o]=Ox(s);else if(s.type!=="exact_optional"&&s.type!=="optional"&&s.type!=="nullish"&&(dt(this,"key",r,n,{input:void 0,expected:`"${o}"`,path:[{type:"object",origin:"key",input:i,key:o,value:i[o]}]}),n.abortEarly))break}}else dt(this,"type",r,n);return r}})}function w(t,e){return Jt({kind:"schema",type:"optional",reference:w,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=Fp(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}})}function Yt(t,e){return Jt({kind:"schema",type:"picklist",reference:Yt,expects:Ny(t.map(Ri),"|"),async:!1,options:t,message:e,"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:dt(this,"type",r,n),r}})}function Ee(t,e,r){return Jt({kind:"schema",type:"record",reference:Ee,expects:"Object",async:!1,key:t,value:e,message:r,"~run"(n,i){let o=n.value;if(o&&typeof o=="object"){n.typed=!0,n.value={};for(let s in o)if(Nx(o,s)){let a=o[s],c=this.key["~run"]({value:s},i);if(c.issues){let u={type:"object",origin:"key",input:o,key:s,value:a};for(let p of c.issues)p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let u={type:"object",origin:"value",input:o,key:s,value:a};for(let p of l.issues)p.path?p.path.unshift(u):p.path=[u],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else dt(this,"type",n,i);return n}})}function y(t){return Jt({kind:"schema",type:"string",reference:y,expects:"string",async:!1,message:t,"~run"(e,r){return typeof e.value=="string"?e.typed=!0:dt(this,"type",e,r),e}})}function wy(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function da(t,e){return Jt({kind:"schema",type:"union",reference:da,expects:Ny(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,"~run"(r,n){let i,o,s;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)o?o.push(c):o=[c];else{i=c;break}else s?s.push(c):s=[c]}if(i)return i;if(o){if(o.length===1)return o[0];dt(this,"type",r,n,{issues:wy(o)}),r.typed=!0}else{if(s?.length===1)return s[0];dt(this,"type",r,n,{issues:wy(s)})}return r}})}function ge(){return Jt({kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,"~run"(t){return t.typed=!0,t}})}function Ue(...t){return Jt({...t[0],pipe:t,"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}})}var Vp=F({maskedRecipient:w(y()),expiresAt:y()}),Bp=F({userId:y(),verification:w(F({channel:y(),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y()}))});var Dt=F({message:w(y())}),Ry=F({accessToken:y(),refreshToken:w(y()),expiresAt:qe()}),Oy=F({requiresChallenge:Ko(!0),challenge:F({type:w(y()),phase:w(y()),expiresAt:w(da([y(),qe()])),data:Ee(y(),ge())})}),ky=F({requiresMfa:Ko(!0),mfa:F({phase:w(y()),challengeId:y(),methods:Z(y()),method:w(y()),expiresAt:da([y(),qe()]),userId:y()})}),Cy=F({requiresVerification:Ko(!0),verification:F({channel:Ko("email"),challengeId:y(),expiresAt:y(),identityType:y(),identityValue:y(),userId:y()})}),ki=da([Oy,ky,Cy,Ry]),pa=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),username:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:y(),updatedAt:y()}),fa=F({challengeId:y(),expiresAt:y()});var Bt=(t=100)=>Ue(y(),Pt(t)),Fl=Ue(y(),Pt(320)),zn=Ue(y(),Pt(4096)),ma=(t=256)=>Ue(y(),Pt(t)),jp=(t=8192)=>Ue(y(),Pt(t)),ha=Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100));var kx={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:w(zn),metadata:w(Ee(Bt(),ge())),country:w(Bt()),city:w(Bt())}),response:ki},Cx={method:"POST",path:"/auth/register",kind:"data",public:!0,body:F({identityType:Bt(),identityValue:Fl,credentialType:Bt(),credentialValue:zn,displayName:w(ma()),givenName:w(ma()),familyName:w(ma()),avatarUrl:w(jp(2048)),locale:w(Bt()),metadata:w(Ee(Bt(),ge()))}),response:Bp},Px={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:F({challengeId:y(),code:y()}),response:ki},Dx={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:F({challengeId:y(),method:y(),code:y()}),response:ki},Ux={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:F({challengeId:y(),method:y(),userId:y()}),response:Vp},Lx={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},Mx={method:"POST",path:"/auth/logout",kind:"logout",public:!0},Kx={method:"GET",path:"/auth/me",kind:"data",response:pa},Hx={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:F({tenantId:y()})},Ut={authenticate:kx,register:Cx,completeChallenge:Px,completeMfaChallenge:Dx,issueMfaChallenge:Ux,refresh:Lx,logout:Mx,me:Kx,selectTenant:Hx};var Gp=F({method:y(),data:Ee(y(),ge())}),$p=F({method:y(),verified:yt(),data:Ee(y(),ge())}),Py=F({method:y(),verifiedAt:Oi(y()),createdAt:y(),id:w(y()),label:w(y()),lastUsedAt:w(y())}),qp=F({authenticators:Z(Py),total:qe()});var Fx={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:F({method:y(),data:w(Ee(y(),ge()))}),response:Gp},Vx={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:F({method:y(),data:w(Ee(y(),ge())),authenticatorId:w(y())}),response:$p},Bx={method:"GET",path:"/mfa/authenticators",kind:"data",query:F({method:w(y()),verifiedOnly:w(yt())}),response:qp},jx={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:F({method:y(),authenticatorId:w(y()),password:w(y())}),response:F({message:w(y())})},Gx={method:"PATCH",path:"/mfa/settings",kind:"data",body:F({mfaRequired:w(yt()),mfaMethods:w(Z(y())),password:w(y())}),response:F({mfaRequired:w(yt()),mfaMethods:w(Z(y()))})},Tr={setupAuthenticator:Fx,verifyAuthenticator:Vx,listAuthenticators:Bx,removeAuthenticator:jx,updateMfaSettings:Gx};var Wp=F({state:y()}),Dy=F({provider:y(),providerId:w(y()),email:w(y()),linkedAt:w(y())}),zp=Z(Dy);var $x={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:Wp},qx={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:F({provider:Ue(y(),Pt(100)),code:w(Ue(y(),Pt(8192))),credential:w(Ue(y(),Pt(8192))),state:w(Ue(y(),Pt(1024))),tenantId:w(Ue(y(),Pt(100)))}),response:ki},Wx={method:"POST",path:"/oauth/link",kind:"data",body:F({provider:y(),code:w(y())}),response:Dt},zx={method:"POST",path:"/oauth/unlink",kind:"data",body:F({provider:y()}),response:Dt},Jx={method:"GET",path:"/oauth/providers",kind:"data",response:zp},mn={oauthState:$x,oauthCallback:qx,linkProvider:Wx,unlinkProvider:zx,getProviders:Jx};var Yx={method:"PATCH",path:"/password/change",kind:"data",body:F({currentPassword:zn,newPassword:zn}),response:Dt},Xx={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:F({email:Ue(y(),Pt(320),pn())}),response:fa},Qx={method:"POST",path:"/password/reset",kind:"data",public:!0,body:F({challengeId:Bt(),code:Bt(),newPassword:zn}),response:Dt},hn={changePassword:Yx,forgotPassword:Xx,resetPassword:Qx};var Uy=F({id:y(),tokenId:y(),tenantId:w(y()),deviceLabel:w(y()),country:w(y()),city:w(y()),createdAt:y(),expiresAt:y(),lastUsedAt:y(),revokedAt:w(Oi(y())),metadata:w(Ee(y(),ge())),isCurrent:w(yt())}),Jp=Z(Uy);var Ly=F({id:y(),tenantId:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),status:y(),roles:w(Z(y())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),invitedBy:w(ge()),createdAt:y(),updatedAt:y(),expiresAt:y()}),Yp=Z(Ly),Xp=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),My=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Qp=F({members:Z(My)}),Vl=F({userId:y(),tenantId:y(),status:y(),roles:w(Z(y())),authPerms:Z(y()),isOwner:yt(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),jobTitle:w(y()),contactEmail:w(y()),contactPhone:w(y()),bio:w(y()),locale:w(y()),metadata:w(Ee(y(),ge())),createdAt:w(y()),memberUpdatedAt:w(y()),profileUpdatedAt:w(y())}),Zp=F({tenantId:y(),roles:w(Z(y())),authPerms:Z(y())});var ef=F({userId:y(),identityType:y(),identityValue:y(),verifiedAt:y()});var eb={method:"GET",path:"/sessions",kind:"data",query:F({includeRevoked:w(Yt(["true","false"])),limit:w(ha),cursor:w(y())}),response:Jp},tb={method:"DELETE",path:"/sessions",kind:"data",body:F({sessionId:y()}),response:Dt},rb={method:"POST",path:"/sessions/revoke",kind:"data",body:F({refreshToken:y()}),response:Dt},En={listSessions:eb,deleteSession:tb,revokeToken:rb};var nb={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Vl},ib={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Vl},ob={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:Xp},sb={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:F({status:w(y()),limit:w(ha),cursor:w(y())}),response:Yp},ab={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Zp},cb={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:F({inviteId:w(y()),inviteToken:w(y())}),response:Dt},lb={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:F({inviteId:y()}),response:Dt},ub={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:F({limit:w(ha),cursor:w(y())}),response:Qp},db={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),response:Dt},pb={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:F({userId:y()}),response:Dt},tf={getTenantProfile:nb,updateTenantProfile:ib,createInvite:ob,listInvites:sb,acceptInvite:ab,declineInvite:cb,revokeInvite:lb,listMembers:ub,updateMember:db,removeMember:pb};var fb={method:"PATCH",path:"/users/profile",kind:"data",body:F({email:w(Ue(y(),pn())),phone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),metadata:w(Ee(y(),ge()))}),response:pa},Ea={updateProfile:fb};var mb={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:F({challengeId:y(),code:y()}),response:ef},hb={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:F({channel:Yt(["sms","email"]),identityValue:y(),previousChallengeId:w(y())}),response:fa},Ci={verifyCode:mb,resendVerification:hb};var JV={...Ut,...hn,...Ci,...En,...Tr,...mn,...Ea,...tf};var q={VALIDATION_ERROR:_("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:_("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:_("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:_("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:_("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:_("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:_("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:_("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:_("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:_("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:_("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:_("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:_("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:_("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:_("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function Ho(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function Jn(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:o,device:s}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=s?.deviceLabel,u={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...s?.country&&{country:s.country},...s?.city&&{city:s.city},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}},p=await e.plugins.database.sessions.create(u);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d(q.DATABASE_ERROR());let f=p.data,m=Ho(n,e.security),E=await e.plugins.token.signAccessToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i},...o?.roles&&{roles:o.roles},...o?.perms!==void 0&&{perms:o.perms}}),v=await e.plugins.token.signRefreshToken({sub:r,sid:f.id,jti:f.tokenId,...m&&{aud:m},...n&&{tid:n},...i&&{tty:i}});return T({accessToken:E.token,refreshToken:v.token,expiresAt:E.expiresAt,...n&&{tenantId:n}})}var ya={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};function Ky(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function ga(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?d(ya.USER_NOT_FOUND()):T(Ky(r.data))}var rf={SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:q.DATABASE_ERROR};async function Bl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return T();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(rf.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?T():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(rf.DATABASE_ERROR()):T():T()}var Yn={INVALID_TOKEN:_("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:_("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_SUSPENDED:q.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var yn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(yn||(yn={}));async function jl(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return d(Yn.INVALID_TOKEN());if(r.typ!==yn.Refresh)return d(Yn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return d(q.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return d(Yn.INVALID_TOKEN());let o=Date.now(),s=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&o-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!s&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?d(q.DATABASE_ERROR()):d(Yn.INVALID_TOKEN());if(a&&!s){let E=Ho(i.tenantId,e.security),v=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),N=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...E&&{aud:E},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),T({accessToken:v.token,refreshToken:N.token,expiresAt:v.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:o,expiresAt:new Date(o+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return d(q.DATABASE_ERROR());let u=Ho(i.tenantId,e.security);if(l.data===!1){let E=await e.plugins.database.sessions.get(i.id);if(E.ok===!1)return d(q.DATABASE_ERROR());let v=E.data;if(!v||v.revokedAt)return d(Yn.INVALID_TOKEN());let N=await e.plugins.token.signAccessToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType},...v.perms!==void 0&&{perms:v.perms},...v.roles&&{roles:v.roles}}),S=await e.plugins.token.signRefreshToken({sub:v.userId,sid:v.id,jti:v.tokenId,...u&&{aud:u},...v.tenantId&&{tid:v.tenantId},...v.tenantType&&{tty:v.tenantType}});return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),f=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...u&&{aud:u},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),m={accessToken:p.token,refreshToken:f.token,expiresAt:p.expiresAt};return T(m)}var bt={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:_("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:Q("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:Q("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:Q("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:_("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:Q("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR,ACCOUNT_DELETED:q.ACCOUNT_DELETED};var Ve={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},_r={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},xe={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var sr={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function nf(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Gl(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let s=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(s)}var Ze={SMS:"sms",EMAIL:"email"},Pi={PHONE:"phone",EMAIL:"email"},Di={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Xn={type:Ze.EMAIL,purpose:xe.EMAIL_VERIFICATION,identityType:Pi.EMAIL,template:Di.EMAIL_CODE};var Qn={type:Ze.SMS,purpose:xe.PHONE_VERIFICATION,identityType:Pi.PHONE,template:Di.SMS_CODE};var Ne={CHANNEL_NOT_CONFIGURED:_("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:_("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:_("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:_("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:_("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:_("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:_("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:_("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function gn(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function $r(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return Eb(n)}async function Fo(t,e){let r=await $r(t);return r.length!==e.length?!1:yb(r,e)}function Eb(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function yb(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function gb(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Vo(t,e){let r=gb(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,o=await e.plugins.database.identities.get(r.identityType,i);if(!o.ok||!o.data)return d(Ne.IDENTITY_NOT_FOUND());let s=o.data;if(s.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let a=s.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,u=t.previousChallengeId===void 0&&l===c;if(!l)return d(Ne.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return d(p.errors,p.meta);let f=p.data;if(f&&(f.status!==Ve.PENDING||f.userId!==s.userId||f.purpose!==r.purpose||f.method!==r.type||f.identityType!==r.identityType||f.identityValue!==i))return d(Ne.CHALLENGE_NOT_FOUND());if(!f&&!u)return d(Ne.CHALLENGE_NOT_FOUND());let m=e.security.verificationResendCooldownSeconds*1e3,E=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(f?.createdAt.getTime()??0)+m;if(m>0&&Date.now()<E)return d(Ne.RESEND_COOLDOWN_ACTIVE());let v=gn(6),N=await $r(v),S=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),R=e.plugins.database.challenges.generateChallengeId(),M=await e.plugins.database.challenges.create({id:R,userId:s.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:N,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:S});if(M.ok===!1)return d(M.errors,M.meta);let K=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,B=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:R,purpose:r.purpose,channel:r.type,expiresAt:S,resendAvailableAt:K}});return B.ok===!1?(await e.plugins.database.challenges.remove(R),d(B.errors,B.meta)):(await vb(t.channel,i,v,r.template,R,S,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(R),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),d(Ne.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:s.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:R,previousChallengeId:l}})]),T({challengeId:R,expiresAt:S}))}async function vb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}function Ab(t){switch(t){case Ze.SMS:return Qn;case Ze.EMAIL:return Xn}}async function Bo(t,e){let r=Ab(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return d(Ne.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return d(Ne.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return d(Ne.IDENTITY_ALREADY_VERIFIED());let o=i.guards.email_verification;if(o?.lockedUntil&&new Date(o.lockedUntil)>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let s=i.pendingVerification,a=s&&s.purpose===r.purpose&&s.channel===r.type&&s.expiresAt>new Date?s.challengeId:null;if(s?.resendAvailableAt&&s.purpose===r.purpose&&s.channel===r.type&&s.resendAvailableAt>new Date)return d(Ne.VERIFICATION_COOLDOWN_ACTIVE());let c=gn(6),l=await $r(c),u=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),f=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Ve.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:u});if(f.ok===!1)return d(f.errors,f.meta);let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:u,resendAvailableAt:E}});return v.ok===!1?(await e.plugins.database.challenges.remove(p),d(v.errors,v.meta)):(await Tb(t.channel,t.identityValue,c,r.template,p,u,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:s??null}),d(Ne.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),T({challengeId:p,expiresAt:u}))}async function Tb(t,e,r,n,i,o,s,a,c){let l={code:r,challengeId:i,expiresAt:o.toISOString(),purpose:s,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):d(Ne.CHANNEL_NOT_CONFIGURED())}var _b=[xe.PHONE_VERIFICATION,xe.EMAIL_VERIFICATION];async function jo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(Ne.CHALLENGE_NOT_FOUND());let n=r.data;if(!_b.includes(n.purpose))return d(Ne.CHALLENGE_NOT_FOUND());if(n.status!==Ve.PENDING)return d(Ne.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return d(Ne.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?d(Ne.TOO_MANY_ATTEMPTS()):d(i.errors,i.meta);if(!n.codeHash)return d(Ne.INVALID_CODE());if(!await Fo(t.code,n.codeHash))return d(Ne.INVALID_CODE());let s=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:s,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),T({userId:n.userId,identityType:a,identityValue:c,verifiedAt:s})}async function Hy(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:o,codeHash:s,challengeId:a,expiresAt:c,...l}=t.nextStepData,u={id:r,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:_r.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(u.tenantId=t.tenantId),t.deviceLabel!==void 0&&(u.deviceLabel=t.deviceLabel),t.country!==void 0&&(u.country=t.country),t.city!==void 0&&(u.city=t.city),i!==void 0&&(u.codeHash=i),(await e.plugins.database.challenges.create(u)).ok===!1?d([q.DATABASE_ERROR()]):T({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:u.phase})}async function $l(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,o=t.userHasMethods.length===1&&t.deliveryMethods.length===0,s=i?t.deliveryMethods[0]:o?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:xe.LOGIN,status:Ve.PENDING,phase:s?_r.VERIFY_MFA:_r.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),s!==void 0&&(a.method=s),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return d(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...s!==void 0&&{selectedMethod:s}};return T(l)}var it={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"},va={OWNER:"owner"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var of={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},ql={ACCOUNT_DELETED:q.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:_(of.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:_(of.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_(of.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function qr(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return d(ql.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return d(ql.ACCOUNT_SUSPENDED());let o,s,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return d(ql.NO_ACCESS_TO_TENANT());let u=l.data;if(u.status!==it.ACTIVE)return d(ql.SUSPENDED_IN_TENANT());if(s=u.roles,o=u.isOwner?{"*":-1}:u.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return o!==void 0&&(c.perms=o),s!==void 0&&(c.roles=s),a!==void 0&&(c.tenantType=a),T(c)}function Aa(t,e){return e[t]??null}function Fy(t,e){return e[t]??null}async function Vy(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function By(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,o=r.security.maxFailedAttempts||5,s=i>=o,a=null;if(s){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>o){let u=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*u**(i-o),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function jy(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Ta(t,e){let r=t.tid,n=Aa(t.identityType,e.plugins.identity);if(!n)return d(bt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return d(bt.INVALID_IDENTITY_FORMAT());let o=n.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,o);if(s.ok===!1||!s.data)return d(bt.INVALID_CREDENTIALS());let a=s.data;if(!a.loginEnabled)return d(bt.LOGIN_DISABLED());let c=nf(a,t.credentialType);if(c.locked)return d(bt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=Fy(t.credentialType,e.plugins.credential);if(!l)return d(bt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let u=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=u.ok?u.data:null,f=await l.verify({userId:a.userId,identityValue:o,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(f.ok===!1)return await By(a,t.credentialType,e),d(bt.INVALID_CREDENTIALS());let{userId:m,nextStep:E,intents:v}=f.data;v&&v.length>0&&await Vy(v,e);let N;if(t.userAgent&&e.plugins.deviceParser){let O=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),P=O.browser||"Unknown Browser",k=O.os||"Unknown OS";N=`${P} - ${k}`}if(E){let O={userId:m,credentialType:t.credentialType,identityType:t.identityType,identityValue:o,nextStepData:E.data,nextStepType:E.type};t.tid!==void 0&&(O.tenantId=t.tid),N!==void 0&&(O.deviceLabel=N),t.country!==void 0&&(O.country=t.country),t.city!==void 0&&(O.city=t.city);let P=await Hy(O,e);if(P.ok===!1)return d(P.errors,P.meta);if(!P.ok)return d(bt.INTERNAL_ERROR());let{challengeId:k,expiresAt:C,displayData:D,challengeType:L,phase:H}=P.data;return T({requiresChallenge:!0,challenge:{type:L,phase:H,expiresAt:C,data:{challengeId:k,expiresAt:C,...D}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return d(bt.IDENTITY_NOT_VERIFIED());let O=a.pendingVerification;if(!!O&&O.purpose===xe.EMAIL_VERIFICATION&&O.channel==="email"&&O.expiresAt>new Date&&O)return T({requiresVerification:!0,verification:{channel:"email",challengeId:O.challengeId,expiresAt:O.expiresAt,identityType:t.identityType,identityValue:o,userId:m}});let k=await Bo({channel:"email",identityValue:o,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!k.ok){let C=await e.plugins.database.identities.get(t.identityType,o),D=C.ok&&C.data?C.data.pendingVerification:null;return D&&D.purpose===xe.EMAIL_VERIFICATION&&D.channel==="email"&&D.expiresAt>new Date?T({requiresVerification:!0,verification:{channel:"email",challengeId:D.challengeId,expiresAt:D.expiresAt,identityType:t.identityType,identityValue:o,userId:m}}):d(bt.IDENTITY_NOT_VERIFIED())}return T({requiresVerification:!0,verification:{channel:"email",challengeId:k.data.challengeId,expiresAt:k.data.expiresAt,identityType:t.identityType,identityValue:o,userId:m}})}let S=await e.plugins.database.userAuths.get(m);if(S.ok===!1||!S.data)return d(bt.USER_AUTH_NOT_FOUND());let R=S.data,M={userStatus:R.userStatus,userId:m,...r&&{tenantId:r}},K=await qr(M,e);if(K.ok===!1)return d(K.errors,K.meta);if(!K.ok)return d(q.DATABASE_ERROR());let{perms:B,roles:V,tenantType:$}=K.data;if(R.mfaRequired){let O=R.mfaMethods;if(!(!O||O.length===0)){let P=O.filter(k=>e.plugins.mfa?.[k]);if(P.length!==0){let k=P.filter(me=>e.plugins.mfa?.[me]?.requiresServerDelivery),C=P.filter(me=>!e.plugins.mfa?.[me]?.requiresServerDelivery),D={};N!==void 0&&(D.deviceLabel=N),t.country!==void 0&&(D.country=t.country),t.city!==void 0&&(D.city=t.city);let L={userId:m,availableMethods:P,deliveryMethods:k,userHasMethods:C,device:D};t.tid!==void 0&&(L.tenantId=t.tid);let H=await $l(L,e);if(H.ok===!1)return d(H.errors,H.meta);if(!H.ok)return d(bt.INTERNAL_ERROR());let{challengeId:z,expiresAt:Y,phase:pe,selectedMethod:Oe,availableMethods:Fe}=H.data;return T({requiresMfa:!0,mfa:{phase:pe,challengeId:z,methods:Fe,...Oe&&{method:Oe},expiresAt:Y,userId:m}})}}}let A={userId:m,...r&&{tenantId:r},...$&&{tenantType:$},...B!==void 0||V?{permissions:{...V&&{roles:V},...B!==void 0&&{perms:B}}}:{},...N||t.country||t.city?{device:{...N&&{deviceLabel:N},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await Jn(A,e);if(x.ok===!1)return d(x.errors,x.meta);if(!x.ok)return d(q.DATABASE_ERROR());let{accessToken:b,refreshToken:g,expiresAt:I}=x.data;return await Gl(m,e),await jy(a,t.credentialType,e),T({accessToken:b,refreshToken:g,expiresAt:I})}var gt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:_("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};var Ib={CHALLENGE_CREATE_FAILED:_("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function Wy(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:o,device:s}=t;if(!r)return T({requiresMfa:!1});if(!n||n.length===0)return T({requiresMfa:!1});let a=n.filter(S=>e.plugins.mfa?.[S]);if(a.length===0)return T({requiresMfa:!1});let c=a.filter(S=>e.plugins.mfa?.[S]?.requiresServerDelivery),l=a.filter(S=>!e.plugins.mfa?.[S]?.requiresServerDelivery),u={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};o!==void 0&&(u.tenantId=o),s!==void 0&&(u.device=s);let p=await $l(u,e);if(p.ok===!1)return d(p.errors,p.meta);if(!p.ok)return d([Ib.CHALLENGE_CREATE_FAILED()]);let{challengeId:f,expiresAt:m,phase:E,selectedMethod:v,availableMethods:N}=p.data;return T({requiresMfa:!0,mfa:{phase:E,challengeId:f,methods:N,...v&&{method:v},expiresAt:m,userId:i}})}async function _a(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return d(gt.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Ve.PENDING)return d(gt.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_CREDENTIAL)return d(gt.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(gt.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(gt.CHALLENGE_EXPIRED());let o=n.method;if(!o)return d(gt.INTERNAL_ERROR());let s=e.plugins.credential[o];if(!s)return d(gt.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(I=>I.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Ve.EXPIRED}),d(gt.MAX_ATTEMPTS_EXCEEDED())):d(a.errors,a.meta);if((await s.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return d(gt.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return d(gt.USER_AUTH_NOT_FOUND());let u=l.data,p={userStatus:u.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let f=await qr(p,e);if(f.ok===!1)return d(f.errors,f.meta);if(!f.ok)return d(gt.INTERNAL_ERROR());let{perms:m,roles:E,tenantType:v}=f.data,N=n.deviceLabel,S=n.country,R=n.city,M={};N!==void 0&&(M.deviceLabel=N),S!==void 0&&(M.country=S),R!==void 0&&(M.city=R);let K={mfaRequired:u.mfaRequired,...u.mfaMethods&&{mfaMethods:u.mfaMethods},userId:n.userId,device:M},B=await Wy(K,e);if(B.ok===!1)return d(B.errors,B.meta);if(!B.ok)return d(gt.INTERNAL_ERROR());if(B.data.requiresMfa){let I={requiresMfa:!0,mfa:B.data.mfa};return T(I)}let V={};m!==void 0&&(V.perms=m),E!==void 0&&(V.roles=E);let $={userId:n.userId,permissions:V,device:M};i!==void 0&&($.tenantId=i),v!==void 0&&($.tenantType=v);let A=await Jn($,e);if(A.ok===!1)return d(A.errors,A.meta);if(!A.ok)return d(gt.INTERNAL_ERROR());let{accessToken:x,refreshToken:b,expiresAt:g}=A.data;return T({accessToken:x,refreshToken:b,expiresAt:g})}var ot={MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:_("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:_("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:_("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:_("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:q.VALIDATION_ERROR,DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Ia(t,e){if(!e.plugins.mfa)return d(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,o=n.deviceLabel,s=n.country,a=n.city;if(n.status!==Ve.PENDING)return d(ot.INVALID_CHALLENGE_STATE());if(n.phase!==_r.VERIFY_MFA)return d(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==xe.LOGIN)return d(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),d(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return d(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return d(ot.MFA_METHOD_NOT_SUPPORTED());let u=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(u.ok===!1)return u.errors.some($=>$.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(ot.TOO_MANY_ATTEMPTS())):d(u.errors,u.meta);if(l.requiresServerDelivery){if(!n.codeHash)return d(ot.INVALID_CHALLENGE_STATE());if(!await Fo(t.code,n.codeHash))return d(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return d(ot.MFA_METHOD_NOT_SUPPORTED());let $=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if($.ok===!1||!$.data)return d(ot.INVALID_MFA_CODE());let A=$.data;if(!A.verifiedAt)return d(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return d(ot.INVALID_MFA_CODE());let b=x.data.data?.usedBackupCodeHash;if(b){let I=(A.data.backupCodeHashes??[]).filter(O=>O!==b);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:I}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return d(ot.USER_AUTH_NOT_FOUND());let m={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},E=await qr(m,e);if(E.ok===!1)return d(E.errors,E.meta);if(!E.ok)return d(q.DATABASE_ERROR());let{perms:v,roles:N,tenantType:S}=E.data,R={userId:n.userId,...i&&{tenantId:i},...S&&{tenantType:S},...v!==void 0||N?{permissions:{...N&&{roles:N},...v!==void 0&&{perms:v}}}:{},...o||s||a?{device:{...o&&{deviceLabel:o},...s&&{country:s},...a&&{city:a}}}:{}},M=await Jn(R,e);if(M.ok===!1)return d(M.errors,M.meta);if(!M.ok)return d(q.DATABASE_ERROR());let{accessToken:K,refreshToken:B,expiresAt:V}=M.data;return T({accessToken:K,refreshToken:B,expiresAt:V})}var vt={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:Q("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:Q("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:Q("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:Q("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:_("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:_("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:_("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function xa(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return d(vt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Ve.PENDING)return d(vt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return d(vt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return d(vt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return d(vt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return d(vt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let o=await e.plugins.database.userAuths.get(t.userId);if(!o.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let s=o.data;if(!s)return d(vt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(f=>f.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),d(vt.TOO_MANY_ISSUES())):d(a.errors,a.meta);if(!i.sendCode)return d(vt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:s},e);if(!c.ok)return d(vt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,u=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:_r.VERIFY_MFA,codeHash:l})).ok===!1?d(vt.CHALLENGE_UPDATE_FAILED()):T({maskedRecipient:u,expiresAt:n.expiresAt})}var $e={IDENTITY_PLUGIN_NOT_FOUND:Q("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:Q("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:Q("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:Q("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:_("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:_("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:_("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:_("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:_("INTERNAL_ERROR","Internal error occurred during registration")};function xb(t,e){return e[t]}function bb(t,e){return e[t]}async function ba(t,e){let r=xb(t.identityType,e.plugins.identity);if(!r)return d($e.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return d($e.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,i);if(o.ok===!1)return d($e.DATABASE_ERROR());if(o.data)return d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let s=bb(t.credentialType,e.plugins.credential);if(!s)return d($e.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await s.create({value:t.credentialValue});if(a.ok===!1)return d($e.INVALID_CREDENTIAL());if(!a.ok)return d($e.INTERNAL_ERROR());let{value:c,data:l}=a.data,u=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let f={id:u,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===sr.EMAIL&&{contactEmail:t.identityValue},...t.identityType===sr.PHONE&&{contactPhone:t.identityValue},...t.identityType===sr.USERNAME&&{username:t.identityValue}},m={userId:u,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},E={type:t.identityType,value:i,userId:u,loginEnabled:!0,verifiedAt:null,guards:{}},v={userId:u,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===sr.EMAIL&&e.plugins.database.registration){let B=await Sb({profileData:{...f,id:u},userAuthData:m,identityData:E,credentialRepoData:v,identityValue:i},e);return B.ok===!1?B.errors.some(V=>V.code==="UNIQUE_CONSTRAINT_VIOLATION")?d($e.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):d(B.errors,B.meta):B.ok?T({userId:u,verification:{channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}):d($e.INTERNAL_ERROR())}let N=await e.plugins.database.users.create(f);if(N.ok===!1||!N.data)return d($e.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(m)).ok===!1)return await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(E)).ok===!1)return await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let M=await e.plugins.database.credentials.create(v);if(M.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.USER_CREATION_FAILED());let K;if(t.identityType===sr.EMAIL){let B=await Rb({userId:u,identityType:t.identityType,identityValue:i},e);if(B.ok===!1)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d(B.errors,B.meta);if(!B.ok)return await e.plugins.database.credentials.remove(M.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(u),await e.plugins.database.users.remove(u),d($e.INTERNAL_ERROR());K={channel:"email",challengeId:B.data.challengeId,expiresAt:B.data.expiresAt,identityType:t.identityType,identityValue:i}}return T({userId:u,...K&&{verification:K}})}async function Sb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await wb(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?d($e.USER_CREATION_FAILED()):((await Nb({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),T({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function wb(t,e,r){let n=gn(6),i=await $r(n),o=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),s=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:s,userId:t,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:sr.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:o},pendingVerification:{challengeId:s,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:o,resendAvailableAt:a}}}async function Nb(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?d($e.VERIFICATION_EMAIL_SEND_FAILED()):T(void 0):d($e.EMAIL_SYSTEM_NOT_AVAILABLE())}async function Rb(t,e){if(!e.plugins.emailSystem)return d($e.EMAIL_SYSTEM_NOT_AVAILABLE());let r=gn(6),n=await $r(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),o=e.plugins.database.challenges.generateChallengeId(),s=await e.plugins.database.challenges.create({id:o,userId:t.userId,purpose:xe.EMAIL_VERIFICATION,status:Ve.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(s.ok===!1)return d(s.errors,s.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:o,purpose:xe.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(o),d(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:o,expiresAt:i.toISOString(),purpose:xe.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(o),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),d($e.VERIFICATION_EMAIL_SEND_FAILED())):T({challengeId:o,expiresAt:i})}var Zn={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function Sa(t,e){let{sessionId:r,userId:n,tenantId:i}=t,o=await e.plugins.database.sessions.get(r);if(o.ok===!1)return d(o.errors,o.meta);if(!o.data)return d(Zn.SESSION_NOT_FOUND());let s=o.data;if(s.revokedAt)return d(Zn.SESSION_REVOKED());if(s.userId!==n)return d(Zn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return d(a.errors,a.meta);if(!a.data)return d(Zn.USER_NOT_FOUND());let c=a.data,l=await qr({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return d(l.errors,l.meta);if(!l.ok)return d(q.DATABASE_ERROR());let{perms:u,roles:p,tenantType:f}=l.data,m=e.plugins.database.sessions.generateTokenId(),E=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:m,...u!==void 0&&{perms:u},...p&&{roles:p},...f&&{tenantType:f}});if(E.ok===!1)return d(E.errors,E.meta);let v=Ho(i,e.security),N=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f},...u!==void 0&&{perms:u},...p&&{roles:p}}),S=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:m,...v&&{aud:v},tid:i,...f&&{tty:f}});return T({accessToken:N.token,refreshToken:S.token,expiresAt:N.expiresAt,tenantId:i})}var Ob=/^[\w!#$%&'*.^`|~+-]+$/,kb=/^[!#-:<>-[\]-~]+$/,Cb=/^[ !#-:<-[\]-~]*$/,zy=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},sf=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let o=i.indexOf("=");if(o===-1)continue;let s=zy(i.substring(0,o));if(e&&e!==s||!kb.test(s)||s in n)continue;let a=zy(i.substring(o+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),Cb.test(a)&&(n[s]=Do(a),e))break}return n};var Pb=(t,e,r={})=>{if(!Ob.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Wl=(t,e,r)=>(e=encodeURIComponent(e),Pb(t,e,r));var af=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let i=e;return r==="secure"?i="__Secure-"+e:r==="host"&&(i="__Host-"+e),sf(n,i)[i]}return n?sf(n):{}};var Db=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Wl("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Wl("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Wl(t,e,{path:"/",...r}),n},wa=(t,e,r,n)=>{let i=Db(e,r,n);t.header("Set-Cookie",i,{append:!0})};var Na=(t,e,r)=>{let n=af(t,e,r?.prefix);return wa(t,e,"",{...r,maxAge:0}),n};function cf(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function zl(t){return t==="cookie"||t==="both"}function Ub(t){let e=t.tokenStrategy;return typeof e=="string"?zl(e):Object.values(e).some(r=>r!==void 0&&zl(r))}function lf(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function Lb(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function Jy(t,e,r,n,i){let o=r.refreshTokenCookie??{},s=i??Lb(r,n),a=cf(r,s),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=lf(r,s);Mb(t,c,{...o,name:l})}if(a==="cookie"){let{refreshToken:l,...u}=e;return u}return e}function Yy(t,e,r){if(!(r?zl(cf(e,r)):Ub(e)))return;let i=e.refreshTokenCookie??{},o={path:i.path??"/",...i.domain?{domain:i.domain}:{}},s=e.audienceCookieNames?.cookieNames;if(s&&!r){let c=i.name??"refresh_token",l=new Set([s.customer??c,s.tenant??c,s.system??c]);for(let u of l)Na(t,u,o);return}let a=lf(e,r);Na(t,a,o)}function Jl(t,e,r){let n=cf(e,r);if(!zl(n)||!t)return;let i=lf(e,r);return Kb(t,i)}function Mb(t,e,r){wa(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function Kb(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var Xy=new Set(["customer","tenant","system"]);function Le(t,e){let r=[];if(e.auth!==!1&&r.push(oa({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(aa(a))}let n=async a=>{let c=or(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let u=a.get("authResult"),p={body:ca(a),query:ua(a),params:la(a),user:u?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},f=await e.handler(p),m=e.successStatus;if(f.ok&&f.data!==void 0&&e.tokenMode==="auth"){let E=f.data,v=typeof E.tenantId=="string"?E.tenantId:void 0,N=p.authContextHeader,S=v!==void 0?void 0:typeof N=="string"&&Xy.has(N)?N:void 0,R=Jy(a,E,t,v,S),M={...f,data:R};return Ge(a,M,{traceId:c,...m!==void 0?{successStatus:m}:{}})}if(f.ok&&e.tokenMode==="logout"){let E=p.authContextHeader,v=typeof E=="string"&&Xy.has(E)?E:void 0;Yy(a,t,v)}return Ge(a,f,{traceId:c,...m!==void 0?{successStatus:m}:{}})}catch(l){let u=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:u}})),Ge(a,d(oe.InternalError()),{traceId:c})}},i=[...r,n],s=async(a,c)=>{let l,u=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let f=i[p],m=await f(a,async()=>{await u(p+1)});m instanceof Response&&(l=m)};return await u(0),l};return s.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},s}function Wr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function Qy(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function Zy(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function eg(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function tg(t){return{plugins:{database:t.plugins.database}}}function rg(t){return Le(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Ut.authenticate.body},handler:async e=>{let r=Wr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Ta(n,r)}})}function ng(t){return Le(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeChallenge.body},handler:async e=>{let r=Wr(t.auth);return _a({challengeId:e.body.challengeId,code:e.body.code},r)}})}function ig(t){return Le(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Ut.completeMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return Ia({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function og(t){return Le(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Ut.issueMfaChallenge.body},handler:async e=>{let r=Wr(t.auth);return xa({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function Yl(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var Hb=new Set(["customer","tenant","system"]);function sg(t){return Le(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Hb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=Zy(t.auth);return Bl({refreshToken:a},c)}})}function Fb(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function ei(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=Fb(e);return typeof r?.sid=="string"?r.sid:void 0}function ag(t){return Le(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return d(oe.NotAuthenticated())}let n=tg(t.auth);return ga({userId:e.user.id},n)}})}var Vb=new Set(["customer","tenant","system"]);function cg(t){return Le(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&Vb.has(r)?r:void 0,i=Jl(e.cookieHeader,t,n),o=e.rawBody?.refreshToken,s=typeof o=="string"?o:void 0;if(!s&&i&&!Yl(e.originHeader,t.trustedOrigins))return d(oe.NotAuthenticated());let a=s??i;if(!a)return d(oe.ValidationError());let c=eg(t.auth);return jl({refreshToken:a},c)}})}function lg(t){return Le(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Ut.register.body},handler:async e=>{let r=Qy(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),ba(n,r)}})}function ug(t){return Le(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Ut.selectTenant.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=ei(e.authorizationHeader);if(!r)return d(oe.NotAuthenticated());let n=Wr(t.auth);return Sa({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Ra={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function Xl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ra.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return d(Ra.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return d(i.errors,i.meta);let o=i.data??[];t.verifiedOnly&&(o=o.filter(a=>a.verifiedAt!==null));let s=o.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return T({authenticators:s,total:s.length})}var vn={USER_AUTH_NOT_FOUND:Q("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:Q("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:Q("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:Q("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:Q("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:Q("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:Q("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:Q("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var An={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Ql(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(vn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(vn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(vn.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok||!i.data)return d(vn.AUTHENTICATOR_NOT_FOUND());let o=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(o.ok===!1)return d(o.errors,o.meta);let s=o.data??[],a=s.filter(v=>v.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return d(vn.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let v=await e.plugins.database.credentials.getByUserIdAndType(t.userId,An.PASSWORD);if(v.ok===!1)return d(v.errors,v.meta);let N=v.data;if(N&&N.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:N.value,data:N.data??{}},credentialValue:t.password})).ok===!1)return d(vn.INVALID_PASSWORD())}let u=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(u.ok===!1)return d(u.errors,u.meta);let f=s.filter(v=>v.method===t.method&&(v.id!==t.authenticatorId||v.method!==t.method)).length,m=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:m,remainingCount:f}});let E={method:t.method,mfaStillEnabled:m,remainingCount:f};return t.authenticatorId!==void 0&&(E.authenticatorId=t.authenticatorId),T(E)}var Tn={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function Zl(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Tn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Tn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Tn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return d(Tn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return d(Tn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let o=await i.setup({userId:t.userId,data:t.data||{}},e);if(o.ok===!1)return d(o.errors,o.meta);if(!o.ok)return d(Tn.INTERNAL_ERROR());let s=o.data;if(s.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:s.credentialData});if(l.ok===!1)return d(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=s;return T({method:t.method,data:c})}var pt={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:_("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:_("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:_("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:_("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:Q("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:Q("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:_("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:q.INTERNAL_ERROR};var dg=["totp","webauthn","passkey","hardware"],pg=["email","sms","phone"],Bb=new Set([...dg,...pg]);async function eu(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return d(pt.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!Bb.has(i))return d(pt.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return d(pt.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(pt.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(pt.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(pt.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return d(pt.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return d(pt.MFA_NOT_ENABLED());if(!t.password)return d(pt.PASSWORD_REQUIRED());let i=await jb(t.userId,t.password,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await Gb(t.userId,t.mfaMethods,e);if(i.ok===!1)return d(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return d(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return d(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),T()}async function jb(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,An.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(pt.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return d(pt.PASSWORD_PLUGIN_NOT_CONFIGURED());let o=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return o.ok===!1?d(o.errors,o.meta):T()}async function Gb(t,e,r){let n=e.filter(o=>dg.includes(o)),i=e.filter(o=>pg.includes(o));if(n.length>0){let o=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let o=await r.plugins.database.identities.getByUserId(t);if(o.ok===!1)return d(o.errors,o.meta);let s=new Set((o.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!s.has(a))return d(pt.METHOD_NOT_VERIFIED({method:a}))}return T()}var Ir={MFA_NOT_AVAILABLE:_("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:Q("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:_("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:_("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:_("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:q.DATABASE_ERROR,INTERNAL_ERROR:q.INTERNAL_ERROR};async function tu(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return d(r.errors,r.meta);if(!r.ok||!r.data)return d(Ir.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return d(Ir.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return d(Ir.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return d(i.errors,i.meta);if(!i.ok)return d(Ir.INTERNAL_ERROR());let o=i.data;if(!o)return d(Ir.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return d(Ir.MFA_NOT_AVAILABLE());let s=e.plugins.mfa[t.method];if(!s?.verifyWithCredentials)return d(Ir.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await s.verifyWithCredentials({credentialData:o.data,data:t.data||{}});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(Ir.INTERNAL_ERROR());let c=a.data;if(!c.verified)return T({method:t.method,verified:!1,data:c.data||{}});if(!o.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return d(l.errors,l.meta);let u=n.mfaMethods||[];if(!u.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...u,t.method]);if(p.ok===!1)return d(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),T({method:t.method,verified:!0,data:c.data||{}})}function Oa(t){return{system:{systemId:t.system.system.systemId}}}function fg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function mg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function hg(t){return{plugins:{database:t.plugins.database},system:Oa(t)}}function Eg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function yg(t){let e={plugins:{database:t.plugins.database},system:Oa(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function gg(t){return X(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=hg(t.auth);return Xl({userId:e.user.id},r)}})}function vg(t){return X(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:Tr.removeAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Eg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Ql(n,r)}})}function Ag(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:Tr.setupAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=fg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),Zl(n,r)}})}function Tg(t){return X(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:Tr.updateMfaSettings.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=yg(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),eu(n,r)}})}function _g(t){return X(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:Tr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=mg(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),tu(n,r)}})}var ru={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found")};async function nu(t,e){if(!await e.plugins.database.users.getById(t.userId))return d(ru.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(!i)return T([]);let o=i.map(s=>{let a={provider:s.provider,externalId:s.externalId,linkedAt:s.createdAt};return s.externalEmail&&(a.externalEmail=s.externalEmail),s.externalName&&(a.externalName=s.externalName),a});return T(o)}var At={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:_("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:_("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:_("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:_("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:_("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function $b(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return d(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return d(q.DATABASE_ERROR());let u=l.data;if(u.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(u.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let f=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(f.ok===!1)return d(f.errors,f.meta)}return T(c)}let o=null;if(t.email){let c=Aa(sr.EMAIL,e.plugins.identity);if(!c)return d(q.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),u=await e.plugins.database.identities.get(sr.EMAIL,l);if(u.ok===!1)return d(q.DATABASE_ERROR());if(u.data){if(t.emailVerified!==!0)return d(At.EMAIL_NOT_VERIFIED_BY_PROVIDER());o=u.data.userId;let p=await e.plugins.database.userAuths.get(o);if(!p.ok||!p.data)return d(q.DATABASE_ERROR());let f=p.data;if(f.userStatus===ye.DELETED)return d(q.ACCOUNT_DELETED());if(f.userStatus===ye.SUSPENDED)return d(q.ACCOUNT_SUSPENDED())}}if(!o){if(!t.email)return d(At.EMAIL_REQUIRED());o=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let N=t.name.trim().split(/\s+/);c=N[0]||"",l=N.slice(1).join(" ")||""}let u={id:o,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(u)).ok)return d(q.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:o,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(o),d(q.DATABASE_ERROR());let m=Aa(sr.EMAIL,e.plugins.identity);if(!m)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(q.PLUGIN_NOT_FOUND());let E=m.normalize(t.email),v=await e.plugins.database.identities.create({type:sr.EMAIL,value:E,userId:o,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(v.ok===!1)return await e.plugins.database.userAuths.remove(o),await e.plugins.database.users.remove(o),d(v.errors,v.meta)}let s={userId:o,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(s.externalEmail=t.email),t.name!==void 0&&(s.externalName=t.name),t.avatarUrl!==void 0&&(s.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(s);return a.ok===!1?d(a.errors,a.meta):T(o)}async function iu(t,e){if(!t.provider)return d(At.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return d(At.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return d(At.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return d(At.PROVIDER_NOT_FOUND());let v=await r.verifyCredential(t.credential);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}else if(t.code){let v=await r.exchangeCodeForToken(t.code);if(v.ok===!1)return d(At.CODE_EXCHANGE_FAILED());let N=v.data;if(!N)return d(At.CODE_EXCHANGE_FAILED());i=N.accessToken}if(!n){if(!i)return d(At.INVALID_ACCESS_TOKEN());let v=await r.getUserProfile(i);if(v.ok===!1)return d(At.PROFILE_FETCH_FAILED());if(n=v.data,!n)return d(At.PROFILE_FETCH_FAILED())}let o=await $b(n,e,t);if(!o.ok)return d(o.errors,o.meta);let s=o.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(s);if(!c.ok||!c.data)return d(q.DATABASE_ERROR());let l=await qr({userStatus:c.data.userStatus,userId:s,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return d(l.errors,l.meta);let{perms:u,roles:p,tenantType:f}=l.data,m={userId:s,...t.tenantId&&{tenantId:t.tenantId},...f&&{tenantType:f},...u!==void 0||p?{permissions:{...p&&{roles:p},...u!==void 0&&{perms:u}}}:{}},E=await Jn(m,a);return E.ok===!1?d(E.errors,E.meta):(await _e(e,{event:"oauth_login_success",userId:s,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Gl(s,e),T({accessToken:E.data.accessToken,refreshToken:E.data.refreshToken,expiresAt:E.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),d(At.PROFILE_FETCH_FAILED())}}var Lt={PROVIDER_NOT_FOUND:_("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:_("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:_("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:_("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:_("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:_("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:_("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function ou(t,e){if(!t.code)return d(Lt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return d(Lt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return d(Lt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let f=await n.exchangeCodeForToken(t.code);if(f.ok===!1)return d(Lt.CODE_EXCHANGE_FAILED());let m=f.data;if(!m)return d(Lt.CODE_EXCHANGE_FAILED());i=m.accessToken}if(!i)return d(Lt.INVALID_ACCESS_TOKEN());let o=await n.getUserProfile(i);if(o.ok===!1)return d(Lt.PROFILE_FETCH_FAILED());let s=o.data;if(!s)return d(Lt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,s.id);if(a.ok===!1)return d(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?d(Lt.PROVIDER_ALREADY_LINKED()):d(Lt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:s.id,createdAt:new Date};s.email!==void 0&&(l.externalEmail=s.email),s.name!==void 0&&(l.externalName=s.name),s.avatarUrl!==void 0&&(l.externalAvatarUrl=s.avatarUrl);let u=await e.plugins.database.userProviders.create(l);if(u.ok===!1)return d(u.errors,u.meta);let p=u.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:s.id}}),T(p)):d(Lt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),d(Lt.PROFILE_FETCH_FAILED())}}var Go={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:_("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:_("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function su(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return d(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return d(Go.PROVIDER_NOT_LINKED());let i=n.find(s=>s.provider===t.provider);if(!i)return d(Go.PROVIDER_NOT_LINKED());if(n.length<=1){let s=await e.plugins.database.identities.getByUserId(t.userId);if(!(s.ok&&s.data&&s.data.length>0))return d(Go.CANNOT_UNLINK_LAST_PROVIDER())}let o=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return o.ok===!1?d(o.errors,o.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),T())}function Ig(t){return X(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return nu({userId:e.user.id},r)}})}function xg(t){return X(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:mn.linkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),ou(n,r)}})}function bg(t){return Le(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:mn.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),iu(n,r)}})}function Sg(t){return X(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:mn.unlinkProvider.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth;return su({userId:e.user.id,provider:e.body.provider},r)}})}var St={PASSWORD_PLUGIN_NOT_CONFIGURED:_("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:_("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:_("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:_("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:_("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:_("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:_("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:_("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:_("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},xr={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:St.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:St.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:St.SAME_PASSWORD},Ui={EMAIL_SYSTEM_NOT_AVAILABLE:St.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:St.SEND_EMAIL_ERROR},jt={PASSWORD_PLUGIN_NOT_CONFIGURED:St.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:St.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:St.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:St.CHALLENGE_ALREADY_USED,INVALID_CODE:St.INVALID_CODE,TOO_MANY_ATTEMPTS:St.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:St.AUTH_SCOPE_MISMATCH};async function $o(t,e){if(!e.plugins.credential?.password)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,An.PASSWORD);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return d(xr.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return d(xr.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return d(xr.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(xr.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return d(l.errors,l.meta);let u=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return u.ok===!1&&console.error("Failed to revoke sessions after password change:",u.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),T()}async function qo(t,e){if(!e.plugins.emailSystem)return d(Ui.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=gn(6),o=await $r(i),s=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return T({challengeId:`fake_challenge_${Date.now()}`,expiresAt:s});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===xe.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return T({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),u=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:xe.PASSWORD_RESET,status:Ve.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:o,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:s});if(u.ok===!1)return d(u.errors,u.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:s.toISOString(),purpose:xe.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),d(Ui.SEND_EMAIL_ERROR());let f=Math.max(0,e.security.verificationResendCooldownSeconds),m=f>0?new Date(Date.now()+f*1e3):null,E=!c||c.purpose===xe.PASSWORD_RESET;return await Promise.all([E?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:xe.PASSWORD_RESET,channel:"email",expiresAt:s,resendAvailableAt:m}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),T({challengeId:l,expiresAt:s})}async function Wo(t,e){if(!e.plugins.credential?.password)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return d(n.errors,n.meta);if(!n.ok||!n.data)return d(jt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==xe.PASSWORD_RESET)return d(jt.CHALLENGE_NOT_FOUND());if(i.status!==Ve.PENDING)return d(jt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return d(jt.CHALLENGE_EXPIRED());let o=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(o.ok===!1)return o.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?d(jt.TOO_MANY_ATTEMPTS()):d(o.errors,o.meta);if(!i.codeHash)return d(jt.INVALID_CODE());if(!await Fo(t.code,i.codeHash))return d(jt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return d(a.errors,a.meta);if(!a.ok)return d(jt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,An.PASSWORD);if(l.ok===!1)return d(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return d(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:An.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return d(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let u=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return u.ok===!1&&console.error("Failed to revoke sessions after password reset:",u.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),T()}var au={NO_CHANGES_PROVIDED:_("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function cu(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return d(au.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return d(q.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return d(q.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let s=await e.plugins.database.users.getById(t.userId);return!s.ok||s.data===null?d(q.NOT_FOUND()):T(s.data)}function zo(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function wg(t){return Le(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:hn.changePassword.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=zo(t.auth),n=e.body,i=ei(e.authorizationHeader);return $o({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function Ng(t){return Le(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:hn.forgotPassword.body},handler:async e=>{let r=zo(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),qo(n,r)}})}function Rg(t){return X(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:hn.resetPassword.body},handler:async e=>{let r=zo(t.auth);return Wo({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var ka={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:_("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to delete session")};async function Ca(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?d(ka.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),T())}var Pa={DATABASE_ERROR:_("DATABASE_ERROR","Failed to retrieve sessions")};async function Da(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return d(Pa.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return T(a,i.meta)}var Jo={INVALID_TOKEN:_("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:_("DATABASE_ERROR","Failed to revoke token")};async function Ua(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?d(Jo.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),T()):d(Jo.INVALID_TOKEN())}function Og(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function kg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Cg(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function Pg(t){return X(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:En.deleteSession.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=kg(t.auth);return Ca({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function Dg(t){return Le(t,{method:"GET",path:"/sessions",auth:!0,input:{query:En.listSessions.query},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Og(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Da(n,r);if(!i.ok)return i;let o=ei(e.authorizationHeader);if(o&&i.data){let s=i.data.map(a=>a.id===o?{...a,isCurrent:!0}:a);return T(s,i.meta)}return i}})}function Ug(t){return X(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:En.revokeToken.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=Cg(t.auth);return Ua({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},La=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Ma(t,e){return t===void 0?!1:(t&e)===e}var uf={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},Lg=Object.fromEntries(Object.entries(uf).map(([t,e])=>[e,Number(t)]));function Xt(t){return t?Object.entries(uf).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function ti(t){let e=0;for(let r of t){let n=Lg[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Qt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var br={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:_("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","This invite grants permissions the inviter is not entitled to confer"),DATABASE_ERROR:q.DATABASE_ERROR};var qb={IDENTITY_NOT_FOUND:_("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:_("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:_("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:_("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:_("IDENTITY_ALREADY_EXISTS","This identity is already registered")},Wb={GUARD_LOCKED:_("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:_("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},zb={INVALID_CREDENTIALS:_("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:_("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:_("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:_("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:_("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},Jb={CHALLENGE_NOT_FOUND:_("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:_("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:_("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:_("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:_("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:_("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},Yb={USER_AUTH_NOT_FOUND:_("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:_("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:_("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:_("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},Xb={MFA_NOT_CONFIGURED:_("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:_("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:_("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:_("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:_("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:_("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:_("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:_("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Qb={SESSION_NOT_FOUND:_("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:_("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:_("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:_("INVALID_SESSION","Invalid session")},Zb={TOKEN_NOT_FOUND:_("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:_("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:_("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:_("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:_("TOKEN_VERIFICATION_FAILED","Token verification failed")},wt={NOT_MEMBER_OF_TENANT:_("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:_("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:_("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:_("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:_("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:_("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},wW={...qb,...Wb,...zb,...Jb,...Yb,...Xb,...Qb,...Zb,...wt};async function lu(t,e,r,n={}){let{requireVerified:i=!0}=n;if(t.inviteeUserId)return T(t.inviteeUserId===e?null:"user-mismatch");if(t.inviteeEmail||t.inviteePhone){let o=await r.getByUserId(e);if(!o.ok)return d(o.errors,o.meta);let s=i?o.data.filter(p=>p.verifiedAt!==null):o.data,a=(p,f)=>p==="phone"?f.replace(/[\s()\-.]/g,""):f.trim().toLowerCase(),c=(p,f)=>{let m=a(p,f);return m?s.some(E=>E.type===p&&a(p,E.value)===m):!1},l=t.inviteeEmail?c("email",t.inviteeEmail):!1,u=t.inviteePhone?c("phone",t.inviteePhone):!1;return!l&&!u?T("identity-mismatch"):T(null)}return T("identity-mismatch")}function ri(t,e){let{authPerm:r,roles:n,perms:i}=e;if(t.isOwner)return!1;if(r!==void 0&&(r&~(t.authPerm??0))!==0||r!==void 0&&(r&se.CHANGE_MEMBER_PERMISSION)!==0||n?.some(o=>o.trim().toLowerCase()===va.OWNER))return!0;if(i!==void 0){let o=t.perms??{},s=(c,l)=>c[l]??c["*"]??0,a=new Set([...Object.keys(i),...Object.keys(o),"*"]);for(let c of a)if((s(i,c)&~s(o,c))!==0)return!0}return!1}async function Yo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(br.INVITE_IDENTIFIER_REQUIRED());let s=null,a=!1;if(r){let M=await o.tenantInvites.getById(r);if(!M.ok)return d(M.errors,M.meta);s=M.data}else if(n){let M=await o.tenantInvites.getByToken(n);if(!M.ok)return d(M.errors,M.meta);s=M.data,a=!0}if(!s)return d(br.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(br.INVITE_NOT_PENDING());if(s.expiresAt<new Date)return d(br.INVITE_EXPIRED());let c=await lu(s,i,o.identities,{requireVerified:!a});if(!c.ok)return d(c.errors,c.meta);if(c.data==="user-mismatch")return d(br.INVITE_USER_MISMATCH());if(c.data==="identity-mismatch")return d(br.INVITE_IDENTITY_MISMATCH());let l=await o.tenantMembers.get(s.tenantId,i);if(!l.ok)return d(l.errors,l.meta);if(l.data&&l.data.status!==it.REMOVED)return d(br.ALREADY_MEMBER());let u=await o.tenants.get(s.tenantId);if(!u.ok)return d(u.errors,u.meta);if(s.authPerm!==void 0&&(s.authPerm&La)!==0){if(!u.data)return d(wt.TENANT_NOT_FOUND());if(u.data.type!==Qt.SYSTEM)return d(wt.ACCOUNT_PERMS_SYSTEM_ONLY())}let p={tenantId:s.tenantId,userId:i,status:it.ACTIVE,isOwner:!1,tenantType:s.tenantType};if(u.data?.parentTenantId!==void 0&&(p.parentTenantId=u.data.parentTenantId),s.authPerm!==void 0||s.roles!==void 0||s.perms!==void 0){let M=await o.tenantMembers.get(s.tenantId,s.invitedById);if(!M.ok)return d(M.errors,M.meta);let K=M.data,B=K&&K.status===it.ACTIVE?K:{isOwner:!1,authPerm:0,perms:{}};if(ri(B,{authPerm:s.authPerm,roles:s.roles,perms:s.perms}))return d(br.CANNOT_ESCALATE_PERMISSIONS())}s.roles!==void 0&&(p.roles=s.roles),s.perms!==void 0&&(p.perms=s.perms),s.authPerm!==void 0&&(p.authPerm=s.authPerm);let m=await o.tenantMembers.create(p);if(!m.ok)return d(m.errors,m.meta);let E={tenantId:s.tenantId,userId:i},v=await o.users.getById(i);v.ok&&v.data&&(v.data.contactEmail&&(E.contactEmail=v.data.contactEmail),v.data.contactPhone&&(E.contactPhone=v.data.contactPhone),v.data.displayName&&(E.displayName=v.data.displayName),v.data.givenName&&(E.givenName=v.data.givenName),v.data.familyName&&(E.familyName=v.data.familyName),v.data.avatarUrl&&(E.avatarUrl=v.data.avatarUrl),v.data.locale&&(E.locale=v.data.locale)),s.displayName&&(E.displayName=s.displayName),s.givenName&&(E.givenName=s.givenName),s.familyName&&(E.familyName=s.familyName),s.jobTitle&&(E.jobTitle=s.jobTitle);let N=await o.userTenantProfiles.create(E);if(!N.ok)return d(N.errors,N.meta);let S=await o.tenantInvites.updateStatus(s.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!S.ok)return d(S.errors,S.meta);let R={tenantId:s.tenantId};return s.roles!==void 0&&(R.roles=s.roles),s.perms!==void 0&&(R.perms=s.perms),s.authPerm!==void 0&&(R.authPerm=s.authPerm),T(R)}var Li={USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:_("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function Mi(t,e,r){if(t===void 0||(t&La)===0)return T(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T(void 0):d(wt.TENANT_NOT_FOUND()):d(n.errors,n.meta)}var uu={NOT_MEMBER:wt.NOT_MEMBER_OF_TENANT,SUSPENDED:wt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:wt.INSUFFICIENT_TENANT_PERMISSIONS};async function lt(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,o=await e.tenantMembers.get(r,n);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(uu.NOT_MEMBER());let s=o.data;return s.status!==it.ACTIVE?d(uu.SUSPENDED()):s.isOwner?T(s):Ma(s.authPerm,i)?T(s):d(uu.INSUFFICIENT_PERMISSIONS())}async function du(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(ri(s.data,{authPerm:t.authPerm,roles:t.roles,perms:t.perms}))return d(Li.CANNOT_ESCALATE_PERMISSIONS());let a=await Mi(t.authPerm,r,o.tenants);if(!a.ok)return d(a.errors,a.meta);let c=await o.users.getById(n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Li.USER_NOT_FOUND());let l=c.data,u=await o.tenantMembers.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(u.data&&u.data.status!==it.REMOVED)return d(Li.ALREADY_MEMBER());let p=await o.tenants.get(r);if(!p.ok)return d(p.errors,p.meta);if(!p.data)return d(Li.TENANT_NOT_FOUND());let f=p.data,m={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!1,tenantType:f.type};f.parentTenantId!==void 0&&(m.parentTenantId=f.parentTenantId),t.roles!==void 0&&(m.roles=t.roles),t.perms!==void 0&&(m.perms=t.perms),t.authPerm!==void 0&&(m.authPerm=t.authPerm);let E=await o.tenantMembers.create(m);if(!E.ok)return d(E.errors,E.meta);let v={tenantId:r,userId:n};l.contactEmail&&(v.contactEmail=l.contactEmail),l.contactPhone&&(v.contactPhone=l.contactPhone),l.displayName&&(v.displayName=l.displayName),l.givenName&&(v.givenName=l.givenName),l.familyName&&(v.familyName=l.familyName),l.avatarUrl&&(v.avatarUrl=l.avatarUrl),l.locale&&(v.locale=l.locale),t.contactEmail!==void 0&&(v.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(v.contactPhone=t.contactPhone),t.displayName!==void 0&&(v.displayName=t.displayName),t.givenName!==void 0&&(v.givenName=t.givenName),t.familyName!==void 0&&(v.familyName=t.familyName),t.avatarUrl!==void 0&&(v.avatarUrl=t.avatarUrl),t.locale!==void 0&&(v.locale=t.locale),t.jobTitle!==void 0&&(v.jobTitle=t.jobTitle),t.bio!==void 0&&(v.bio=t.bio),t.metadata!==void 0&&(v.metadata=t.metadata);let N=await o.userTenantProfiles.create(v);return N.ok?T({tenantId:r,userId:n}):d(N.errors,N.meta)}var Xo={TENANT_ALREADY_HAS_OWNER:_("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:_("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:_("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:q.DATABASE_ERROR};async function pu(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:o,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N}=t,S=e.plugins.database,R=i??"org";if(R===Qt.SYSTEM)return d(Xo.SYSTEM_TYPE_FORBIDDEN());let M=await S.users.getById(n);if(!M.ok)return d(M.errors,M.meta);if(!M.data)return d(Xo.USER_NOT_FOUND());let K=await S.tenants.get(r);if(!K.ok)return d(K.errors,K.meta);if(!K.data){let b={id:r,type:R,ownerId:n};o!==void 0&&(b.parentTenantId=o);let g=await S.tenants.create(b);if(!g.ok)return d(g.errors,g.meta)}let B=await S.tenantMembers.hasOwner(r);if(!B.ok)return d(B.errors,B.meta);if(B.data)return d(Xo.TENANT_ALREADY_HAS_OWNER());let V=K.data?.parentTenantId??o,$={tenantId:r,userId:n,status:it.ACTIVE,isOwner:!0,tenantType:R};V!==void 0&&($.parentTenantId=V);let A=await S.tenantMembers.create($);if(!A.ok)return d(A.errors,A.meta);let x=await S.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:s,contactPhone:a,displayName:c,displayNameSource:l,givenName:u,familyName:p,avatarUrl:f,locale:m,jobTitle:E,bio:v,metadata:N});return x.ok?T({tenantId:r,userId:n}):d(x.errors,x.meta)}async function fu(t,e){let{email:r,phone:n}=t,i=e.plugins.database,o=[],s=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return d(a.errors,a.meta);for(let c of a.data)if(!s.has(c.id)){s.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),o.push(l)}}return T({pendingInvites:o})}var ni={INVITE_IDENTIFIER_REQUIRED:_("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:_("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:_("INVITE_IDENTITY_MISMATCH","This invite was sent to an identity you do not own"),DATABASE_ERROR:q.DATABASE_ERROR};async function Qo(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,o=e.plugins.database;if(!r&&!n)return d(ni.INVITE_IDENTIFIER_REQUIRED());let s=null;if(r){let l=await o.tenantInvites.getById(r);if(!l.ok)return d(l.errors,l.meta);s=l.data}else if(n){let l=await o.tenantInvites.getByToken(n);if(!l.ok)return d(l.errors,l.meta);s=l.data}if(!s)return d(ni.INVITE_NOT_FOUND());if(s.status!==ar.PENDING)return d(ni.INVITE_NOT_PENDING());let a=await lu(s,i,o.identities,{requireVerified:!1});if(!a.ok)return d(a.errors,a.meta);if(a.data==="user-mismatch")return d(ni.INVITE_USER_MISMATCH());if(a.data==="identity-mismatch")return d(ni.INVITE_IDENTITY_MISMATCH());let c=await o.tenantInvites.updateStatus(s.id,{status:ar.DECLINED,declinedAt:new Date});return c.ok?T(void 0):d(c.errors,c.meta)}async function Ki(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[o,s]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(wt.NOT_MEMBER_OF_TENANT());if(!s.ok)return d(s.errors,s.meta);let a=o.data,c=s.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),T(l)}var Zt={INVITEE_REQUIRED:_("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:Q("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:_("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:_("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:Q("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};function eS(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function Zo(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:o,inviteePhone:s,role:a,perms:c,authPerm:l,displayName:u,givenName:p,familyName:f,jobTitle:m}=t,E=t.roles??(a!==void 0?[a]:void 0),v=e.plugins.database,N=await lt({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!N.ok)return d(N.errors,N.meta);if(ri(N.data,{authPerm:l,roles:E,perms:c}))return d(Zt.CANNOT_ESCALATE_PERMISSIONS());let S=await Mi(l,r,v.tenants);if(!S.ok)return d(S.errors,S.meta);if(!i&&!o&&!s)return d(Zt.INVITEE_REQUIRED());if(i){let k=await v.users.getById(i);if(!k.ok)return d(k.errors,k.meta);if(!k.data)return d(Zt.INVITEE_USER_NOT_FOUND({userId:i}));let C=await v.tenantMembers.get(r,i);if(!C.ok)return d(C.errors,C.meta);if(C.data&&C.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER());let D=await v.tenantInvites.findByTenantAndUserId(r,i);if(!D.ok)return d(D.errors,D.meta);if(D.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(o){let k=await v.identities.get("email",o);if(!k.ok)return d(k.errors,k.meta);if(k.data){let D=await v.tenantMembers.get(r,k.data.userId);if(!D.ok)return d(D.errors,D.meta);if(D.data&&D.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndEmail(r,o);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}if(s){let k=await v.identities.get("phone",s);if(!k.ok)return d(k.errors,k.meta);if(k.data){let D=await v.tenantMembers.get(r,k.data.userId);if(!D.ok)return d(D.errors,D.meta);if(D.data&&D.data.status!==it.REMOVED)return d(Zt.ALREADY_MEMBER())}let C=await v.tenantInvites.findByTenantAndPhone(r,s);if(!C.ok)return d(C.errors,C.meta);if(C.data)return d(Zt.INVITE_ALREADY_EXISTS())}let R=await v.tenantInvites.countPendingByTenant(r);if(!R.ok)return d(R.errors,R.meta);if(R.data>=e.security.maxPendingInvitesPerTenant)return d(Zt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let M,K,B,V=await v.users.getById(n);V.ok&&V.data&&(V.data.displayName!==void 0&&(M=V.data.displayName),V.data.contactEmail!==void 0&&(K=V.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(M=$.data.displayName),$.data.jobTitle!==void 0&&(B=$.data.jobTitle));let A=Qt.DEFAULT,x=await v.tenants.get(r);x.ok&&x.data&&(A=x.data.type);let b=v.tenantInvites.generateInviteId(),g=eS(),I=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),O={id:b,tenantId:r,tenantType:A,invitedById:n,status:ar.PENDING,inviteToken:g,expiresAt:I};M!==void 0&&(O.invitedByName=M),K!==void 0&&(O.invitedByEmail=K),B!==void 0&&(O.invitedByJobTitle=B),i!==void 0&&(O.inviteeUserId=i),o!==void 0&&(O.inviteeEmail=o),s!==void 0&&(O.inviteePhone=s),E!==void 0&&(O.roles=E),c!==void 0&&(O.perms=c),l!==void 0&&(O.authPerm=l),u!==void 0&&(O.displayName=u),p!==void 0&&(O.givenName=p),f!==void 0&&(O.familyName=f),m!==void 0&&(O.jobTitle=m);let P=await v.tenantInvites.create(O);return P.ok?T({inviteId:b,inviteToken:g,expiresAt:I}):d(P.errors,P.meta)}async function es(t,e){let{tenantId:r,actorUserId:n,status:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await o.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?T(c.data,c.meta):d(c.errors,c.meta)}async function ts(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,o=await lt({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return d(o.errors,o.meta);let s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(s).length>0?s:void 0);return a.ok?T(a.data,a.meta):d(a.errors,a.meta)}async function mu(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let o=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return o.ok?T(o.data,o.meta):d(o.errors,o.meta)}var Hi={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:_("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:_("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:q.DATABASE_ERROR};async function rs(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,o=e.plugins.database,s=await lt({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:o.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(i===n)return d(Hi.CANNOT_REMOVE_SELF());let a=await o.tenantMembers.get(r,n);if(!a.ok)return d(a.errors,a.meta);if(!a.data)return d(Hi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!s.data.isOwner)return d(Hi.CANNOT_MODIFY_OWNER());if(c.isOwner){let u=await o.tenantMembers.listByTenant(r);if(!u.ok)return d(u.errors,u.meta);if(u.data.filter(f=>f.isOwner&&f.status===it.ACTIVE).length<=1)return d(Hi.CANNOT_REMOVE_LAST_OWNER())}let l=await o.tenantMembers.remove(r,n);return l.ok?(await o.userTenantProfiles.remove(r,n),T(void 0)):d(l.errors,l.meta)}var Ka={INVITE_NOT_FOUND:_("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:_("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:q.DATABASE_ERROR};async function ns(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,o=await i.tenantInvites.getById(r);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(Ka.INVITE_NOT_FOUND());let s=await lt({tenantId:o.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return d(s.errors,s.meta);if(o.data.status!==ar.PENDING)return d(Ka.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?T(void 0):d(a.errors,a.meta)}var ii={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:_("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:q.DATABASE_ERROR};async function is(t,e){let{tenantId:r,userId:n,actorUserId:i,role:o,perms:s,authPerm:a}=t,c=t.roles??(o!==void 0?[o]:void 0),l=e.plugins.database,u=await lt({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!u.ok)return d(u.errors,u.meta);let p=u.data;if(i===n)return d(ii.CANNOT_MODIFY_SELF());let f=await l.tenantMembers.get(r,n);if(!f.ok)return d(f.errors,f.meta);if(!f.data)return d(ii.MEMBER_NOT_FOUND());if(f.data.isOwner)return d(ii.CANNOT_MODIFY_OWNER());let m=f.data,E=a===void 0?void 0:a&~(m.authPerm??0),v=V=>V.trim().toLowerCase(),N=new Set(m.roles?.map(v)),S=c?.filter(V=>v(V)===va.OWNER||!N.has(v(V))),R=(V,$)=>V?.[$]??V?.["*"]??0,M=s===void 0?void 0:Object.fromEntries([...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].map(V=>{let $=R(s,V);return[V,$&~R(m.perms,V)]}));if(ri(p,{authPerm:E,roles:S,perms:M}))return d(ii.CANNOT_ESCALATE_PERMISSIONS());if(!p.isOwner){let V=a===void 0?0:(m.authPerm??0)&~a,$=s===void 0?[]:[...new Set([...Object.keys(s),...Object.keys(m.perms??{}),"*"])].filter(O=>(R(m.perms,O)&~R(s,O))!==0),A=new Set(p.roles?.map(v)),x=c===void 0?[]:(m.roles??[]).filter(O=>!c.some(P=>v(P)===v(O))),b=(V&~(p.authPerm??0))!==0,g=$.some(O=>(R(m.perms,O)&~R(s,O)&~R(p.perms,O))!==0),I=x.some(O=>!A.has(v(O)));if(b||g||I)return d(ii.CANNOT_ESCALATE_PERMISSIONS())}let K=await Mi(a,r,l.tenants);if(!K.ok)return d(K.errors,K.meta);let B={};if(c!==void 0&&(B.roles=c),s!==void 0&&(B.perms=s),a!==void 0&&(B.authPerm=a),Object.keys(B).length>0){let V=await l.tenantMembers.updatePermissions(r,n,B);if(!V.ok)return d(V.errors,V.meta)}return T(void 0)}var Ha={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:_("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:q.DATABASE_ERROR};async function df(t,e){let{tenantId:r,userId:n,actorUserId:i,status:o}=t,s=e.plugins.database,a=await lt({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:s.tenantMembers});if(!a.ok)return d(a.errors,a.meta);if(i===n)return d(Ha.CANNOT_MODIFY_SELF());let c=await s.tenantMembers.get(r,n);if(!c.ok)return d(c.errors,c.meta);if(!c.data)return d(Ha.MEMBER_NOT_FOUND());if(c.data.isOwner)return d(Ha.CANNOT_MODIFY_OWNER());let l=await s.tenantMembers.updateStatus(r,n,o);return l.ok?T(void 0):d(l.errors,l.meta)}var hu={MEMBER_NOT_FOUND:_("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:_("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:q.DATABASE_ERROR};async function os(t,e){let{tenantId:r,userId:n,...i}=t,o=e.plugins.database,s=await o.tenantMembers.get(r,n);if(!s.ok)return d(s.errors,s.meta);if(!s.data)return d(hu.MEMBER_NOT_FOUND());let a=s.data,c=a.isOwner||Ma(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let u=await o.userTenantProfiles.get(r,n);if(!u.ok)return d(u.errors,u.meta);if(!u.data){let f=await o.userTenantProfiles.create({tenantId:r,userId:n,...l});return f.ok?T(void 0):d(f.errors,f.meta)}let p=await o.userTenantProfiles.update(r,n,l);return p.ok?T(void 0):d(p.errors,p.meta)}var tS=10080,rS=100;function nS(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??tS,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??rS}}}var zr=F({tenantId:Ue(y(),Hp(1))}),iS=F({limit:w(Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100))),cursor:w(y())}),oS=Ue(F({inviteeEmail:w(Ue(y(),pn())),inviteeUserId:w(y()),inviteePhone:w(y()),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),Hl(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),Mg=Ue(F({inviteId:w(y()),inviteToken:w(y())}),Hl(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),sS=F({inviteId:y()}),aS=F({status:w(y()),limit:w(Ue(ge(),Mo(Number),qe(),Wn(),Lo(1),Uo(100))),cursor:w(y())}),cS=F({userId:y(),role:w(y()),roles:w(Z(y())),authPerms:w(Z(y()))}),lS=F({userId:y()}),uS=F({contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))});function Kg(t){let{auth:e,policy:r}=t,n=X(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr},handler:async m=>{let E=await Ki({tenantId:m.params.tenantId,userId:m.user.id},e);if(!E.ok)return E;let v=E.data;if(!v)return T({});let{authPerm:N,...S}=v;return T({...S,authPerms:Xt(N)})}}),i=X(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:uS},handler:async m=>{let E=m.params.tenantId,v=m.user.id,N={tenantId:E,userId:v},S=m.body;S.contactEmail!==void 0&&(N.contactEmail=S.contactEmail),S.contactPhone!==void 0&&(N.contactPhone=S.contactPhone),S.displayName!==void 0&&(N.displayName=S.displayName),S.givenName!==void 0&&(N.givenName=S.givenName),S.familyName!==void 0&&(N.familyName=S.familyName),S.avatarUrl!==void 0&&(N.avatarUrl=S.avatarUrl),S.locale!==void 0&&(N.locale=S.locale),S.bio!==void 0&&(N.bio=S.bio),S.jobTitle!==void 0&&(N.jobTitle=S.jobTitle),S.metadata!==void 0&&(N.metadata=S.metadata);let R=await os(N,e);if(!R.ok)return R;let M=await Ki({tenantId:E,userId:v},e);if(!M.ok)return M;let K=M.data;if(!K)return T({});let{authPerm:B,...V}=K;return T({...V,authPerms:Xt(B)})}}),o=X(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:oS},handler:async m=>{let{inviteeEmail:E,inviteeUserId:v,inviteePhone:N,role:S,roles:R,authPerms:M,displayName:K,givenName:B,familyName:V,jobTitle:$}=m.body,A={tenantId:m.params.tenantId,invitedBy:m.user.id};return E!==void 0&&(A.inviteeEmail=E),v!==void 0&&(A.inviteeUserId=v),N!==void 0&&(A.inviteePhone=N),S!==void 0&&(A.role=S),R!==void 0&&(A.roles=R),M!==void 0&&(A.authPerm=ti(M)),K!==void 0&&(A.displayName=K),B!==void 0&&(A.givenName=B),V!==void 0&&(A.familyName=V),$!==void 0&&(A.jobTitle=$),Zo(A,nS(t))}}),s=X(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:aS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.status!==void 0&&(E.status=m.query.status),m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await es(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T(N,v.meta)}}),a=X(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken);let v=await Yo(E,e);if(!v.ok)return v;let N=v.data;if(!N)return v;let{authPerm:S,...R}=N;return T({...R,authPerms:Xt(S)})}}),c=X(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.GLOBAL},input:{params:zr,body:Mg},handler:async m=>{let E={userId:m.user.id};return m.body.inviteId!==void 0&&(E.inviteId=m.body.inviteId),m.body.inviteToken!==void 0&&(E.inviteToken=m.body.inviteToken),Qo(E,e)}}),l=X(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:sS},handler:async m=>ns({inviteId:m.body.inviteId,revokedBy:m.user.id},e)}),u=X(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,query:iS},handler:async m=>{let E={tenantId:m.params.tenantId,actorUserId:m.user.id};m.query.limit!==void 0&&(E.limit=m.query.limit),m.query.cursor!==void 0&&(E.cursor=m.query.cursor);let v=await ts(E,e);if(!v.ok)return v;let N=v.data.map(({authPerm:S,...R})=>({...R,authPerms:Xt(S)}));return T({members:N},v.meta)}}),p=X(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:cS},handler:async m=>{let E={tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id};return m.body.role!==void 0&&(E.role=m.body.role),m.body.roles!==void 0&&(E.roles=m.body.roles),m.body.authPerms!==void 0&&(E.authPerm=ti(m.body.authPerms)),is(E,e)}}),f=X(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:rt.TENANT},loadResource:async m=>({tenantId:m.params.tenantId}),input:{params:zr,body:lS},handler:async m=>rs({tenantId:m.params.tenantId,userId:m.body.userId,actorUserId:m.user.id},e)});return Kp("/tenants",[n,i,o,s,a,c,l,u,p,f])}function Hg(t){return X(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Ea.updateProfile.body},handler:async e=>{if(!e.user)return d(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),cu(n,r)}})}function Eu(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function Fg(t){return Le(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:Ci.resendVerification.body},handler:async e=>{let r=Eu(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),Vo(n,r)}})}function Vg(t){return X(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:Ci.verifyCode.body},handler:async e=>{let r=Eu(t.auth);return jo({challengeId:e.body.challengeId,code:e.body.code},r)}})}var pf="oauth_state",dS=600;function Bg(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function jg(t,e,r){wa(t,pf,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:dS})}function pS(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function Gg(t,e){let r=af(t,pf);return Na(t,pf,{path:"/"}),!r||!e?!1:pS(r,e)}function fS(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function mS(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function $g(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:o=[]}=e;return async(s,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=fS(s),u=await mS(s,o),p=[`${i}:ip:${l}`];u&&p.push(`${i}:id:${u}`);for(let f of p){let m=await c.consume(f,{limit:r,windowMs:n});if(!m.allowed){let E=Math.ceil(m.retryAfterMs/1e3);return s.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(E)})}}return a()}}function Me(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function qg(t,e,r={}){let n=Object.keys(r).length===0,i=s=>n||r[s]!==!1;t.get("/health",s=>s.json({ok:!0},200));let o=(s,a)=>t.use(s,$g(e.auth,a));if(o("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),o("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),o("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),o("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),o("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),o("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),o("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),o("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),o("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),o("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Me(t,rg(e)),Me(t,lg(e)),Me(t,sg(e)),Me(t,cg(e)),Me(t,ag(e)),Me(t,ug(e)),Me(t,ng(e)),Me(t,ig(e)),Me(t,og(e))),i("password")&&(Me(t,wg(e)),Me(t,Ng(e)),Me(t,Rg(e))),i("verification")&&(Me(t,Vg(e)),Me(t,Fg(e))),i("sessions")&&(Me(t,Dg(e)),Me(t,Pg(e)),Me(t,Ug(e))),i("mfa")&&(Me(t,Ag(e)),Me(t,_g(e)),Me(t,gg(e)),Me(t,vg(e)),Me(t,Tg(e))),i("oauth")){let s=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=Bg();return jg(a,c,s),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let u=await a.req.raw.clone().json();typeof u.state=="string"&&(l=u.state)}catch{l=void 0}return l!==void 0&&!Gg(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Me(t,bg(e)),Me(t,xg(e)),Me(t,Sg(e)),Me(t,Ig(e))}i("users")&&Me(t,Hg(e)),i("tenants")&&t.route("",Kg(e))}function ff(t){Lp(Sy);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:o,features:s}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),o&&o.length>0&&(a.trustedOrigins=o);let c=e.security.tokenAudiences?.cookieNames;if(c){let u={cookieNames:c};e.security.systemTenantId&&(u.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=u}let l=new Gr;return qg(l,a,s),l}var Sr=F({message:w(y())}),Wg=F({message:w(y()),tenantId:y(),userId:y()}),mf={tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))},zg=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),memberUpdatedAt:y(),profileUpdatedAt:w(y())}),hS=F({...mf,createdAt:y(),updatedAt:y()}),ES=F({tenantId:y(),userId:y(),status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),isOwner:yt(),createdAt:y(),updatedAt:y(),tenantProfile:w(hS)}),Jg=Z(ES),Yg=F({tenantId:y(),userId:y()}),yS=F({...mf,status:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerm:w(qe()),isOwner:yt(),createdAt:y(),updatedAt:y()}),Xg=Z(yS),gS=F({id:y(),name:w(y()),email:w(y()),jobTitle:w(y())}),Qg=F({id:y(),tenantId:y(),invitedBy:gS,inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:Z(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y()),status:y(),expiresAt:y(),createdAt:y(),updatedAt:y()}),Zg=Z(Qg),ev=F({inviteId:y(),inviteToken:y(),expiresAt:y()}),tv=F({tenantId:y(),userId:y()}),rv=F({invites:Z(Qg)}),vS=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y()}),nv=Z(vS),iv=F({id:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),status:y(),createdAt:y(),updatedAt:y(),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),username:w(y()),metadata:w(Ee(y(),ge())),mfaRequired:yt(),mfaMethods:Oi(Z(y()))});var yu={limit:w(Ue(qe(),Wn())),cursor:w(y())},AS={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:F({tenantId:y(),userId:y(),tenantType:w(y()),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),displayNameSource:w(Yt(["user","admin","system"])),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Wg},TS={method:"POST",path:"/tenant/profile",kind:"data",body:F({tenantId:y(),userId:y()}),response:zg},_S={method:"POST",path:"/tenant/profile/update",kind:"data",body:F({tenantId:y(),userId:y(),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),bio:w(y()),jobTitle:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},IS={method:"POST",path:"/tenant/members/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),...yu}),response:Jg},xS={method:"POST",path:"/tenant/members/update-status",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),status:Yt(["invited","active","suspended","removed"])}),response:Sr},bS={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y()))}),response:Sr},SS={method:"POST",path:"/tenant/members/remove",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y()}),response:Sr},wS={method:"POST",path:"/tenant/members/add",kind:"data",body:F({tenantId:y(),userId:y(),actorUserId:y(),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),contactEmail:w(y()),contactPhone:w(y()),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),jobTitle:w(y()),bio:w(y()),metadata:w(Ee(y(),ge()))}),response:Yg},NS={method:"POST",path:"/tenant/invites/list",kind:"data",body:F({tenantId:y(),actorUserId:y(),status:w(Yt(["pending","accepted","declined","revoked","expired"])),...yu}),response:Zg},RS={method:"POST",path:"/tenant/invites/create",kind:"data",body:F({tenantId:y(),invitedBy:y(),inviteeUserId:w(y()),inviteeEmail:w(y()),inviteePhone:w(y()),roles:w(Z(y())),perms:w(Ee(y(),qe())),authPerms:w(Z(y())),displayName:w(y()),givenName:w(y()),familyName:w(y()),jobTitle:w(y())}),response:ev},sv=F({userId:y(),inviteId:w(y()),inviteToken:w(y())}),OS={method:"POST",path:"/tenant/invites/accept",kind:"data",body:sv,response:tv},kS={method:"POST",path:"/tenant/invites/decline",kind:"data",body:sv,response:Sr},CS={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:F({inviteId:y(),revokedBy:y()}),response:Sr},PS={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:F({email:w(y()),phone:w(y())}),response:rv},DS={method:"POST",path:"/user/tenants/list",kind:"data",body:F({userId:y(),tenantType:w(y()),parentTenantId:w(y()),...yu}),response:Xg},ss={actorUserId:y(),systemTenantId:y()},US={method:"POST",path:"/accounts/list",kind:"data",body:F({...ss,status:w(Yt(["active","inactive"])),...yu}),response:nv},LS={method:"POST",path:"/accounts/get",kind:"data",body:F({...ss,userId:y()}),response:iv},MS={method:"POST",path:"/accounts/update-profile",kind:"data",body:F({...ss,userId:y(),displayName:w(y()),givenName:w(y()),familyName:w(y()),avatarUrl:w(y()),locale:w(y()),contactEmail:w(y()),contactPhone:w(y()),metadata:w(Ee(y(),ge()))}),response:Sr},KS={method:"POST",path:"/accounts/update-status",kind:"data",body:F({...ss,userId:y(),status:Yt(["active","suspended","deleted"])}),response:Sr},HS={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:F({...ss,userId:y(),credentialType:w(y())}),response:Sr},FS={method:"POST",path:"/accounts/remove",kind:"data",body:F({...ss,userId:y()}),response:Sr},Je={bootstrapTenantOwner:AS,getTenantProfile:TS,updateTenantProfile:_S,listTenantMembers:IS,updateTenantMemberStatus:xS,updateTenantMemberPermission:bS,removeTenantMember:SS,addMemberToTenant:wS,listTenantInvites:NS,inviteToTenant:RS,acceptInvite:OS,declineInvite:kS,revokeInvite:CS,checkPendingInvites:PS,listUserTenants:DS,listAccounts:US,getAccount:LS,updateAccountProfile:MS,updateAccountStatus:KS,resetAccountCredentials:HS,removeAccount:FS};async function oi(t,e,r,n){let i=await lt({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return d(i.errors,i.meta);let o=await n.tenants.get(e);return o.ok?o.data?o.data.type!==Qt.SYSTEM?d(wt.ACCOUNT_PERMS_SYSTEM_ONLY()):T({actor:i.data}):d(wt.TENANT_NOT_FOUND()):d(o.errors,o.meta)}var _n={CANNOT_REMOVE_ACTIVE_ACCOUNT:_("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:_("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:_("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:_("NO_CHANGES","At least one field must be provided")};var VS=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function hf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=t.status??"active",o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let s=await r.users.getByStatus(i,o);if(!s.ok)return d(s.errors,s.meta);let a=[];for(let c of s.data){let l=await r.users.getById(c);if(l.ok&&l.data){let u=l.data,p={id:u.id,status:u.status,createdAt:u.createdAt,updatedAt:u.updatedAt};u.contactEmail!==void 0&&(p.contactEmail=u.contactEmail),u.contactPhone!==void 0&&(p.contactPhone=u.contactPhone),u.displayName!==void 0&&(p.displayName=u.displayName),a.push(p)}}return T(a,s.meta)}async function Ef(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return d(i.errors,i.meta);if(!i.data)return d(q.NOT_FOUND());let o=i.data,s=await r.userAuths.get(t.userId),a={id:o.id,status:o.status,createdAt:o.createdAt,updatedAt:o.updatedAt,mfaRequired:s.ok&&s.data?s.data.mfaRequired:!1,mfaMethods:s.ok&&s.data?s.data.mfaMethods:null};return o.contactEmail!==void 0&&(a.contactEmail=o.contactEmail),o.contactPhone!==void 0&&(a.contactPhone=o.contactPhone),o.displayName!==void 0&&(a.displayName=o.displayName),o.givenName!==void 0&&(a.givenName=o.givenName),o.familyName!==void 0&&(a.familyName=o.familyName),o.avatarUrl!==void 0&&(a.avatarUrl=o.avatarUrl),o.locale!==void 0&&(a.locale=o.locale),o.username!==void 0&&(a.username=o.username),o.metadata!==void 0&&(a.metadata=o.metadata),T(a)}async function yf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return d(_n.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?T(void 0):d(c.errors,c.meta)}async function gf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);if(!VS.has(t.status))return d(_n.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.userAuths.updateStatus(t.userId,t.status);if(!s.ok)return d(s.errors,s.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?T(void 0):d(a.errors,a.meta)}async function vf(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.userAuths.get(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());let s=await r.credentials.getByUserId(t.userId);if(!s.ok)return d(s.errors,s.meta);for(let a of s.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return d(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return d(a.errors,a.meta)}return T(void 0)}async function Af(t,e){let r=e.plugins.database,n=await oi(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return d(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return d(_n.CANNOT_MODIFY_OWNER());let o=await r.users.getById(t.userId);if(!o.ok)return d(o.errors,o.meta);if(!o.data)return d(q.NOT_FOUND());if(o.data.status===ye.ACTIVE)return d(_n.CANNOT_REMOVE_ACTIVE_ACCOUNT());let s=await r.credentials.getByUserId(t.userId);if(s.ok)for(let l of s.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?T(void 0):d(c.errors,c.meta)}var BS=3,jS=10080,GS=100;function $S(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??jS,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??GS}}}function as(t){return{plugins:{database:t.plugins.database}}}function qS(t){return Dp({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Tf(t){let{auth:e,internal:r}=t,n=qS(r),i=new Gr;i.use("/*",async(g,I)=>{let O=g.req.header("Authorization");if(!O){await I();return}let P=O.match(/^Bearer\s+(.+)$/i);if(!P){await I();return}let C=P[1].split(".");if(C.length!==3||!C[1]){await I();return}let D;try{let L=C[1].replace(/-/g,"+").replace(/_/g,"/");D=JSON.parse(atob(L))}catch{await I();return}if(D.typ!==BS)return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let L=D.roles,H=Array.isArray(L)?L:[];if(!r.requiredRoles.some(Y=>H.includes(Y)))return g.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await I()});let o=X(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId};return g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.displayNameSource!==void 0&&(I.displayNameSource=g.body.displayNameSource),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),pu(I,e)}}),s=X(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async g=>{let I=await Ki({tenantId:g.body.tenantId,userId:g.body.userId},e);if(!I.ok)return I;let O=I.data;if(!O)return I;let{authPerm:P,...k}=O;return T({...k,authPerms:Xt(P)})}}),a=X(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async g=>{let{tenantId:I,userId:O,...P}=g.body,k={tenantId:I,userId:O};return P.contactEmail!==void 0&&(k.contactEmail=P.contactEmail),P.contactPhone!==void 0&&(k.contactPhone=P.contactPhone),P.displayName!==void 0&&(k.displayName=P.displayName),P.givenName!==void 0&&(k.givenName=P.givenName),P.familyName!==void 0&&(k.familyName=P.familyName),P.avatarUrl!==void 0&&(k.avatarUrl=P.avatarUrl),P.locale!==void 0&&(k.locale=P.locale),P.bio!==void 0&&(k.bio=P.bio),P.jobTitle!==void 0&&(k.jobTitle=P.jobTitle),P.metadata!==void 0&&(k.metadata=P.metadata),os(k,e)}}),c=X(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await ts(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),l=X(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async g=>df({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId,status:g.body.status},e)}),u=X(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),is(I,e)}}),p=X(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async g=>rs({tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId},e)}),f=X(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,userId:g.body.userId,actorUserId:g.body.actorUserId};return g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.contactEmail!==void 0&&(I.contactEmail=g.body.contactEmail),g.body.contactPhone!==void 0&&(I.contactPhone=g.body.contactPhone),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.avatarUrl!==void 0&&(I.avatarUrl=g.body.avatarUrl),g.body.locale!==void 0&&(I.locale=g.body.locale),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),g.body.bio!==void 0&&(I.bio=g.body.bio),g.body.metadata!==void 0&&(I.metadata=g.body.metadata),du(I,e)}}),m=X(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async g=>{let I={tenantId:g.body.tenantId,actorUserId:g.body.actorUserId};g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await es(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),E=X(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async g=>{let I={tenantId:g.body.tenantId,invitedBy:g.body.invitedBy};return g.body.inviteeUserId!==void 0&&(I.inviteeUserId=g.body.inviteeUserId),g.body.inviteeEmail!==void 0&&(I.inviteeEmail=g.body.inviteeEmail),g.body.inviteePhone!==void 0&&(I.inviteePhone=g.body.inviteePhone),g.body.roles!==void 0&&(I.roles=g.body.roles),g.body.perms!==void 0&&(I.perms=g.body.perms),g.body.authPerms!==void 0&&(I.authPerm=ti(g.body.authPerms)),g.body.displayName!==void 0&&(I.displayName=g.body.displayName),g.body.givenName!==void 0&&(I.givenName=g.body.givenName),g.body.familyName!==void 0&&(I.familyName=g.body.familyName),g.body.jobTitle!==void 0&&(I.jobTitle=g.body.jobTitle),Zo(I,$S(e))}}),v=X(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async g=>{let I={userId:g.body.userId};g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken);let O=await Yo(I,e);if(!O.ok)return O;let P=O.data;if(!P)return O;let{authPerm:k,...C}=P;return T({...C,authPerms:Xt(k)})}}),N=X(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async g=>{let I={userId:g.body.userId};return g.body.inviteId!==void 0&&(I.inviteId=g.body.inviteId),g.body.inviteToken!==void 0&&(I.inviteToken=g.body.inviteToken),Qo(I,e)}}),S=X(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async g=>ns({inviteId:g.body.inviteId,revokedBy:g.body.revokedBy},e)}),R=X(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async g=>{let I={};return g.body.email!==void 0&&(I.email=g.body.email),g.body.phone!==void 0&&(I.phone=g.body.phone),fu(I,e)}}),M=X(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async g=>{let I={userId:g.body.userId};g.body.tenantType!==void 0&&(I.tenantType=g.body.tenantType),g.body.parentTenantId!==void 0&&(I.parentTenantId=g.body.parentTenantId),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor);let O=await mu(I,e);if(!O.ok)return O;let P=O.data.map(({authPerm:k,...C})=>({...C,authPerms:Xt(k)}));return T(P,O.meta)}}),K=X(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId};return g.body.status!==void 0&&(I.status=g.body.status),g.body.limit!==void 0&&(I.limit=g.body.limit),g.body.cursor!==void 0&&(I.cursor=g.body.cursor),hf(I,as(e))}}),B=X(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async g=>Ef({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))}),V=X(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async g=>{let{actorUserId:I,systemTenantId:O,userId:P,...k}=g.body,C={actorUserId:I,systemTenantId:O,userId:P};return k.displayName!==void 0&&(C.displayName=k.displayName),k.givenName!==void 0&&(C.givenName=k.givenName),k.familyName!==void 0&&(C.familyName=k.familyName),k.avatarUrl!==void 0&&(C.avatarUrl=k.avatarUrl),k.locale!==void 0&&(C.locale=k.locale),k.contactEmail!==void 0&&(C.contactEmail=k.contactEmail),k.contactPhone!==void 0&&(C.contactPhone=k.contactPhone),k.metadata!==void 0&&(C.metadata=k.metadata),yf(C,as(e))}}),$=X(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async g=>gf({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId,status:g.body.status},as(e))}),A=X(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async g=>{let I={actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId};return g.body.credentialType!==void 0&&(I.credentialType=g.body.credentialType),vf(I,as(e))}}),x=X(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async g=>Af({actorUserId:g.body.actorUserId,systemTenantId:g.body.systemTenantId,userId:g.body.userId},as(e))});function b(g){let{method:I,path:O}=g.routeMeta,P=I.toLowerCase();i[P](O,g)}return b(o),b(s),b(a),b(c),b(l),b(u),b(p),b(f),b(m),b(E),b(v),b(N),b(S),b(R),b(M),b(K),b(B),b(V),b($),b(A),b(x),i}var av=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},cv=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,o=e.length-1;i<=n;i++,o--)r[i]=e.charCodeAt(i),r[o]=e.charCodeAt(o);return r};function Fa(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var WS=t=>t.requestContext;var _f=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=rw(r),o,s;try{o=i.createRequest(r),s=WS(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(o,{event:r,requestContext:s,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},gu=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=`https://${this.getDomainName(t)}${this.getPath(t)}`,n=e?`${r}?${e}`:r,i=this.getHeaders(t),o={headers:i,method:this.getMethod(t)};if(t.body){let s=t.isBase64Encoded?cv(t.body):new TextEncoder().encode(t.body);o.body=s,i.set("content-length",s.length.toString())}return new Request(n,o)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??lv,o=!!(n&&i(n));if(!o){let a=e.headers.get("content-encoding");o=sw(a)}let s={body:o?av(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:o,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,s),s.multiValueHeaders?e.headers.forEach((a,c)=>{s.multiValueHeaders[c]=[a]}):e.headers.forEach((a,c)=>{s.headers[c]=a}),s}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},zS=class extends gu{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},JS=new zS,YS=class extends gu{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.multiValueHeaders)for(let[r,n]of Object.entries(t.multiValueHeaders))n&&n.forEach(i=>e.append(r,Fa(i)));if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&!e.has(r)&&e.set(r,Fa(n));return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},XS=new YS,QS=class extends gu{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=Fa(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,Fa(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e!==void 0).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},ZS=new QS,ew=class extends gu{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers)for(let[r,n]of Object.entries(t.headers))n&&n.forEach(i=>e.append(r,Fa(i)));return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},tw=new ew,rw=t=>nw(t)?ZS:iw(t)?JS:ow(t)?tw:XS,nw=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,iw=t=>Object.hasOwn(t,"rawPath")&&Object.hasOwn(t.requestContext??{},"http"),ow=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,lv=t=>/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(t)?!0:!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(t),sw=t=>!!t&&!/^identity$/i.test(t);var uv=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,i=(s=>typeof s=="string"?s==="*"?()=>s:a=>s===a?a:null:typeof s=="function"?s:a=>s.includes(a)?a:null)(e.origin),o=(s=>{if(typeof s=="function")return async(a,c)=>(await s(a,c)).join(",");if(Array.isArray(s)){let a=s.join(",");return()=>a}else return()=>""})(e.allowMethods);return async function(a,c){function l(p,f){a.res.headers.set(p,f)}let u=await i(a.req.header("origin")||"",a);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){e.origin!=="*"&&a.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await o(a.req.header("origin")||"",a);p&&l("Access-Control-Allow-Methods",p);let f=n;if(!f){let m=a.req.header("Access-Control-Request-Headers");m&&(f=m.split(",").map(E=>E.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};var aw={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function Fi(t={}){let e={...aw,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var If={LOW:Fi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:Fi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:Fi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:Fi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var dv={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function xf(t,e={}){return{system:t,policy:{...dv.policy,...e.policy??{}},version:e.version??dv.version,...e.email&&{email:e.email}}}var pv=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],fv=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],bf=[...pv,...fv];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function mv(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function hv(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Ev={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function yv(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",o=typeof r.parseUserAgent=="function";if(!i&&!o)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Ev[e];n&&hv(t,String(e),n)}function Sf(t,e){mv(t,String(e)),yv(t,e)}var gv={debug:0,info:1,warn:2,error:3},vu=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=gv[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&gv[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),o=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${o} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function vv(t){return new vu(t)}var Au=new vu({enabled:!1});function cs(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Vi(t,e){let r=cs(t),n=cs(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Av(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Vi(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&Vi(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=cs(r),i=cs(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Vi(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Vi(t,e.slice(2))>=0:e.startsWith(">")?Vi(t,e.slice(1))>0:e.startsWith("<=")?Vi(t,e.slice(2))<=0:e.startsWith("<")?Vi(t,e.slice(1))<0:!1}function cw(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function lw(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function ls(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())wf(n,i);return t}let e=[];if(cw(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,o]=n;wf(i,o),r.set(i,o)}return r}function wf(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");lw(t,e)}function Nf(t,e){wf(t,e)}function Tu(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function _u(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Rf(t,e={},r,n=Au,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let o=new Map;for(let E of t)o.set(E.name,E);let s=new Map,a=new Map;for(let E of o.keys())s.set(E,0),a.set(E,[]);for(let E of o.values()){let v=E.dependencies??[];for(let N of v){let S=typeof N=="string"?N:N.name,R=typeof N=="string"?void 0:N.version;if(!o.has(S))throw new Error(`Plugin '${String(E.name)}' depends on '${String(S)}' which is not defined`);if(R){let M=o.get(S);if(M.version&&!Av(M.version,R))throw new Error(`Plugin '${String(E.name)}' requires '${String(S)}' ${R}, but version ${M.version} is provided`)}a.get(S).push(E.name),s.set(E.name,(s.get(E.name)??0)+1)}}let c=[];for(let[E,v]of s.entries())v===0&&c.push(E);let l=[];for(;c.length>0;){let E=c.shift();l.push(E);for(let v of a.get(E)??[]){let N=(s.get(v)??0)-1;s.set(v,N),N===0&&c.push(v)}}if(l.length!==o.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let u={},p={get(E){if(!u[E])throw new Error(`Plugin '${String(E)}' not found or not yet initialized`);return u[E]},has(E){return E in u},getRegistry(){return u}};for(let E of l){n.group(`Initializing plugin: ${String(E)}`),n.time(`Plugin: ${String(E)}`);let v=o.get(E),N=e[E],S=null;if(N!==void 0?(n.debug("Using override"),Tu(N)?(n.debug("Creating from factory wrapper"),S=await N.create(p)):_u(N)?(n.debug("Lazy loading plugin"),S=await N.load()):(n.debug("Using direct instance"),S=N)):v.factory?(n.debug("Creating from descriptor factory"),S=await v.factory(p)):v.instance&&(n.debug("Using descriptor instance"),S=v.instance),!S&&v.required)throw new Error(`Required plugin '${String(E)}' is missing`);if(S){if(E==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{Sf(S,E),n.debug("Validation passed")}catch(K){throw n.error("Validation failed:",K),new Error(`Plugin '${String(E)}' validation failed: ${K instanceof Error?K.message:String(K)}`)}}u[E]=S;let M=S;M.initialize&&(n.debug("Calling plugin initialize()"),await M.initialize()),n.info(`Plugin '${String(E)}' initialized successfully`)}else n.warn(`Plugin '${String(E)}' is null/undefined`);n.timeEnd(`Plugin: ${String(E)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),u.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),u.credential=e.credential),i.extraEntries&&Object.assign(u,i.extraEntries),!uw(u))throw new Error("Plugin registry is incomplete - missing required plugins");let f=u,m=ls(f.oauthProviders);if(!m){let E=e.oauthProviders;E!==void 0&&!Tu(E)&&!_u(E)?m=ls(E)??new Map:m=new Map}return f.oauthProviders=m,await r?.afterInit?.(f),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),f}function uw(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function Of(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function Va(t){let e=t.debug?vv({enabled:!0,prefix:"[auth-core SDK]"}):Au;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=ls(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Rf(bf,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let o=Fi(t.security??{});e.debug("Security level:",o.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let s=xf({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",s.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:o,system:s,async healthCheck(){let a=[];for(let[l,u]of Object.entries(i)){if(!u||typeof u!="object")continue;let p=u,f={name:String(l),healthy:!0};if(p.health)try{let m=await p.health();f.healthy=m,m||(f.error=`Plugin '${l}' health check failed`)}catch(m){f.healthy=!1,f.error=m instanceof Error?m.message:"Health check threw error"}a.push(f)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await Of(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");Nf(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var xu=[];function Ba(t){let e=process.env[t];return e||(xu.push(t),"")}function kf(t,e){return e?Ba(t):process.env[t]??""}function Tv(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function mw(t){let e=Tv(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var hw=process.env.SMTP_MODE==="smtp"?"smtp":"console",Bi=process.env.EMAIL_MODE;if(Bi&&Bi!=="queue"&&Bi!=="smtp"&&Bi!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Bi}`);var us=Bi||hw,Ew=us==="console"?"console":"smtp",Cf=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",bu=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(us==="queue"&&Cf!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Cf}`);if(bu!=="generic"&&bu!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${bu}`);function Iu(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function yw(){let t=Iu(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=Iu(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=Iu(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=Iu(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var ja=yw(),gw=typeof ja=="string"?ja==="cookie"||ja==="both":Object.values(ja).some(t=>t==="cookie"||t==="both"),j={dynamodbTableName:Ba("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:Ba("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:Ba("JWT_PRIVATE_KEY"),jwtPublicKey:Ba("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:kf("SMTP_USER",us==="smtp"),pass:kf("SMTP_PASS",us==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Ew},email:{mode:us,queue:{provider:Cf,url:kf("EMAIL_QUEUE_URL",us==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:bu,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:mw("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:Tv("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:ja,...gw?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function _v(){if(xu.length>0){let t=xu.map(e=>`  - ${e}`).join(`
+`);throw new Error(`Missing required environment variables (${xu.length}):
+${t}`)}if(j.nodeEnv==="production"&&!j.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Pf(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function vw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Su(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return vw(r)}async function Df(t,e){let r=await Su(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Aw="otp",Iv={INVALID_CODE:_("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:_("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function Tw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function xv(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Aw,challengeType:"verification-code",async create(){return T({value:"",data:null})},async update(){return T({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let s=Pf(e),a=await Su(s),c=new Date(Date.now()+r*60*1e3);return T({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:s,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:Tw(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Df(n.credentialValue,i)?T({userId:n.userId,intents:[]}):d(Iv.INVALID_CODE()):d(Iv.MISSING_CHALLENGE_CONTEXT())}}}function bv(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}var wu=t=>t?`"${t}" `:"";function Ye(t,e=""){if(typeof t!="number")throw new TypeError(wu(e)+"expected number, got "+typeof t);if(!Number.isSafeInteger(t)||t<0)throw new RangeError(wu(e)+"expected integer >= 0, got "+t);return t}function wv(t,e=""){if(typeof t!="boolean")throw new TypeError(wu(e)+"expected boolean, got type="+typeof t);return t}function In(t,e,r=""){if(bv(t)&&(e===void 0||t.length===e))return t;e!==void 0&&Ye(e,"length");let n=bv(t),i=e!==void 0?` of length ${e}`:"",o=n?`length=${t.length}`:`type=${typeof t}`,s=wu(r)+"expected Uint8Array"+i+", got "+o;throw n?new RangeError(s):new TypeError(s)}function Nu(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("expected hash wrapped by utils.createHasher");if(Ye(t.outputLen),Ye(t.blockLen),t.outputLen<1||t.blockLen<1)throw new Error("hash blockLen / outputLen must be >= 1")}var _w=(t,e)=>{if(t===null||typeof t!="object"||Array.isArray(t))throw new TypeError((e==="object"?"":`"${e}" `)+"expected object, got type="+typeof t)},Sv=(t,e)=>{_w(t,e);let r=Object.getPrototypeOf(t);if(r!==Object.prototype&&r!==null)throw new TypeError(`"${e}" expected plain object`);if(Object.hasOwn(t,"__proto__"))throw new TypeError(`"${e}.__proto__" is not allowed`)};function xn(t,e=!0){if(t.destroyed)throw new Error("hash was destroyed");if(e&&t.finished)throw new Error("digest() was already called")}function ds(t,e){In(t,void 0,"output");let r=e.outputLen;if(!(t.length>=r))throw new RangeError('"output" expected length >= '+r)}function ji(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Nt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function ps(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function wr(t,e){return t<<32-e|t>>>e}function be(t,e){return t<<e|t>>>32-e>>>0}var Iw=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function xw(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function bw(t){for(let e=0;e<t.length;e++)t[e]=xw(t[e]);return t}var fs=Iw?t=>t:bw;function Sw(t){if(typeof t!="string")throw new TypeError("string expected");let e=new TextEncoder().encode(t);try{return new Uint8Array(e)}finally{Nt(e)}}function Uf(t,e=""){return typeof t=="string"?Sw(t):In(t,void 0,e)}function ms(t,e,r="opts"){return Sv(t,"defaults"),e!==void 0&&Sv(e,r),Object.assign(Object.create(null),t,e)}function Ru(t,e={}){if(typeof t!="function")throw new TypeError('"hashCons" expected function, got type='+typeof t);e=ms({},e,"info");let r=(i,o)=>t(o).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function Lf(t=32){Ye(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var Ou=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var ku=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(Nu(e),In(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("expected Hash instance");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let o=0;o<i.length;o++)i[o]^=54;this.iHash.update(i),this.oHash=e.create();for(let o=0;o<i.length;o++)i[o]^=106;this.oHash.update(i),Nt(i)}update(e){return xn(this),this.iHash.update(e),this}digestInto(e){xn(this),ds(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:o,blockLen:s,outputLen:a,canXOF:c}=this;return e=e,e.finished=i,e.destroyed=o,e.blockLen=s,e.outputLen=a,e.canXOF=c,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Nv=(()=>{let t=((e,r,n)=>new ku(e,r).update(n).digest());return t.create=(e,r)=>new ku(e,r),t})();function Nw(t,e,r,n){Nu(t);let i=ms({dkLen:32,asyncTick:10},n),{c:o,dkLen:s,asyncTick:a}=i;if(Ye(o,"c"),Ye(s,"dkLen"),Ye(a,"asyncTick"),o<1)throw new Error('"c" (iterations) must be >= 1');if(s<1)throw new Error('"dkLen" must be >= 1');if(s>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Uf(e,"password");try{let l=Uf(r,"salt");try{let u=new Uint8Array(s),{iHash:p,oHash:f,outputLen:m}=Nv.create(t,c),E=new Uint8Array(m),v=Rw(p,f,l,E);return{c:o,dkLen:s,asyncTick:a,DK:u,outputLen:m,eng:v}}finally{typeof r=="string"&&Nt(l)}}finally{typeof e=="string"&&Nt(c)}}function Rw(t,e,r,n){let i=new Uint8Array(4),o=ps(i),s=t._cloneInto().update(r),a=e._cloneInto(),c=t._cloneInto,l=e._cloneInto;return{u1:(u,p)=>{o.setInt32(0,u,!1),s._cloneInto(a).update(i).digestInto(n),e._cloneInto(a).update(n).digestInto(n),p.set(n.subarray(0,p.length))},rounds:(u,p)=>{for(let f=1;f<u;f++){c.call(t,a).update(n).digestInto(n),l.call(e,a).update(n).digestInto(n);for(let m=0;m<p.length;m++)p[m]^=n[m]}},output:u=>(t.destroy(),e.destroy(),s.destroy(),a.destroy(),Nt(n),u)}}function Mf(t,e,r,n){let{c:i,dkLen:o,DK:s,outputLen:a,eng:c}=Nw(t,e,r,n);for(let l=1,u=0;u<o;l++,u+=a){let p=s.subarray(u,u+a);c.u1(l,p),c.rounds(i,p)}return c.output(s)}var Cu=BigInt(4294967295),Rv=BigInt(32);function Ow(t,e=!1){return e?{h:Number(t&Cu),l:Number(t>>Rv&Cu)}:{h:Number(t>>Rv&Cu)|0,l:Number(t&Cu)|0}}function Ov(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let o=0;o<r;o++){let{h:s,l:a}=Ow(t[o],e);[n[o],i[o]]=[s,a]}return[n,i]}var kw=t=>t/2**32|0,Cw=t=>t>>>0;function kv(t,e,r,n){let i=kw(r),o=Cw(r);t.setUint32(e,n?o:i,n),t.setUint32(e+4,n?i:o,n)}function Cv(t,e,r){return t&e^~t&r}function Pv(t,e,r){return t&e^t&r^e&r}var Pu=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=ps(this.buffer)}update(e){xn(this),In(e);let{view:r,buffer:n,blockLen:i}=this,o=e.length,s=!1;for(let a=0;a<o;){let c=Math.min(i-this.pos,o-a);if(c===i){let l=ps(e);for(;i<=o-a;a+=i)this.process(l,a);s=!0;continue}n.set(a===0&&c===o?e:e.subarray(a,a+c),this.pos),this.pos+=c,a+=c,this.pos===i&&(this.process(r,0),this.pos=0,s=!0)}return this.length+=e.length,s&&this.roundClean(),this}digestInto(e){xn(this),ds(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:o}=this,{pos:s}=this;r[s++]=128,r.fill(0,s),this.padOffset>i-s&&(this.process(n,0),r.fill(0)),kv(n,i-8,this.length*8,o),this.process(n,0),this.roundClean();let a=e===r?n:ps(e),c=this.outputLen,l=c/4,u=this.get();if(c%4||l>u.length)throw new Error("invalid outputLen");for(let p=0;p<l;p++)a.setUint32(4*p,u[p],o)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneIntoMeta(e){let{buffer:r,length:n,finished:i,destroyed:o,pos:s}=this;return e.destroyed=o,e.finished=i,e.length=n,e.pos=s,s&&e.buffer.set(r),e}clone(){return this._cloneInto()}},Dv=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var Pw=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),si=new Uint32Array(64),Kf=class extends Pu{A=0;B=0;C=0;D=0;E=0;F=0;G=0;H=0;constructor(e,r){super(64,e,8,!1),this.A=r[0]|0,this.B=r[1]|0,this.C=r[2]|0,this.D=r[3]|0,this.E=r[4]|0,this.F=r[5]|0,this.G=r[6]|0,this.H=r[7]|0}get(){let{A:e,B:r,C:n,D:i,E:o,F:s,G:a,H:c}=this;return[e,r,n,i,o,s,a,c]}set(e,r,n,i,o,s,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=o|0,this.F=s|0,this.G=a|0,this.H=c|0}_cloneInto(e){return(e||=new this.constructor).set(...this.get()),this._cloneIntoMeta(e)}process(e,r){for(let p=0;p<16;p++,r+=4)si[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let f=si[p-15],m=si[p-2],E=wr(f,7)^wr(f,18)^f>>>3,v=wr(m,17)^wr(m,19)^m>>>10;si[p]=v+si[p-7]+E+si[p-16]|0}let{A:n,B:i,C:o,D:s,E:a,F:c,G:l,H:u}=this;for(let p=0;p<64;p++){let f=wr(a,6)^wr(a,11)^wr(a,25),m=u+f+Cv(a,c,l)+Pw[p]+si[p]|0,v=(wr(n,2)^wr(n,13)^wr(n,22))+Pv(n,i,o)|0;u=l,l=c,c=a,a=s+m|0,s=o,o=i,i=n,n=m+v|0}n=n+this.A|0,i=i+this.B|0,o=o+this.C|0,s=s+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,u=u+this.H|0,this.set(n,i,o,s,a,c,l,u)}roundClean(){Nt(si)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),Nt(this.buffer)}},Hf=class extends Kf{constructor(){super(32,Dv)}};var Ff=Ru(()=>new Hf,Ou(1));function Uv(t,e,r,n,i,o){let s=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],u=t[e++]^r[n++],p=t[e++]^r[n++],f=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],N=t[e++]^r[n++],S=t[e++]^r[n++],R=t[e++]^r[n++],M=t[e++]^r[n++],K=t[e++]^r[n++],B=t[e++]^r[n++],V=s,$=a,A=c,x=l,b=u,g=p,I=f,O=m,P=E,k=v,C=N,D=S,L=R,H=M,z=K,Y=B;for(let pe=0;pe<8;pe+=2)b^=be(V+L|0,7),P^=be(b+V|0,9),L^=be(P+b|0,13),V^=be(L+P|0,18),k^=be(g+$|0,7),H^=be(k+g|0,9),$^=be(H+k|0,13),g^=be($+H|0,18),z^=be(C+I|0,7),A^=be(z+C|0,9),I^=be(A+z|0,13),C^=be(I+A|0,18),x^=be(Y+D|0,7),O^=be(x+Y|0,9),D^=be(O+x|0,13),Y^=be(D+O|0,18),$^=be(V+x|0,7),A^=be($+V|0,9),x^=be(A+$|0,13),V^=be(x+A|0,18),I^=be(g+b|0,7),O^=be(I+g|0,9),b^=be(O+I|0,13),g^=be(b+O|0,18),D^=be(C+k|0,7),P^=be(D+C|0,9),k^=be(P+D|0,13),C^=be(k+P|0,18),L^=be(Y+z|0,7),H^=be(L+Y|0,9),z^=be(H+L|0,13),Y^=be(z+H|0,18);i[o++]=s+V|0,i[o++]=a+$|0,i[o++]=c+A|0,i[o++]=l+x|0,i[o++]=u+b|0,i[o++]=p+g|0,i[o++]=f+I|0,i[o++]=m+O|0,i[o++]=E+P|0,i[o++]=v+k|0,i[o++]=N+C|0,i[o++]=S+D|0,i[o++]=R+L|0,i[o++]=M+H|0,i[o++]=K+z|0,i[o++]=B+Y|0}function Vf(t,e,r,n,i){let o=n+0,s=n+16*i;for(let a=0;a<16;a++)r[s+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,o+=16,e+=16)Uv(r,s,t,e,r,o),a>0&&(s+=16),Uv(r,o,t,e+=16,r,s)}var Dw=1024*(2**20+1+1);function Uw(t,e,r){let n=ms({dkLen:32,asyncTick:10,maxmem:Dw},r),{N:i,r:o,p:s,dkLen:a,asyncTick:c,maxmem:l,onProgress:u}=n;if(Ye(i,"N"),Ye(o,"r"),Ye(s,"p"),Ye(a,"dkLen"),Ye(c,"asyncTick"),Ye(l,"maxmem"),u!==void 0&&typeof u!="function")throw new Error('"onProgress" must be a function');if(o<1)throw new Error('"r" expected integer >= 1');let p=128*o,f=p/4,m=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>m)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(s<1||s>(m-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(m-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let E=p*(i+s+1);if(E>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+E+", maxmem="+l);let v=Mf(Ff,t,e,{c:1,dkLen:p*s}),N=ji(v),S=ji(new Uint8Array(p*i)),R=ji(new Uint8Array(p)),M=()=>{};if(u){let K=2*i*s,B=Math.max(Math.floor(K/1e4),1),V=0;M=()=>{if(V++,u&&(!(V%B)||V===K))try{u(V/K)}catch($){throw Nt(v,S,R),$}}}return{N:i,r:o,p:s,dkLen:a,blockSize32:f,V:S,B32:N,B:v,tmp:R,blockMixCb:M,asyncTick:c}}function Lw(t,e,r,n,i){let o=Mf(Ff,t,r,{c:1,dkLen:e});return Nt(r,n,i),o}function Du(t,e,r){let{N:n,r:i,p:o,dkLen:s,blockSize32:a,V:c,B32:l,B:u,tmp:p,blockMixCb:f}=Uw(t,e,r);fs(l);for(let m=0;m<o;m++){let E=a*m;for(let v=0;v<a;v++)c[v]=l[E+v];for(let v=0,N=0;v<n-1;v++)Vf(c,N,c,N+=a,i),f();Vf(c,(n-1)*a,l,E,i),f();for(let v=0;v<n;v++){let N=(l[E+a-16]&n-1)>>>0;for(let S=0;S<a;S++)p[S]=l[E+S]^c[N*a+S];Vf(p,0,l,E,i),f()}}return fs(l),Lw(t,s,u,c,p)}var Mw={N:2**15,r:8,p:1,dkLen:32,saltLength:32},Kw={N:2**14,r:8,p:1};function Lv(t,e,r){return`${t.N}.${t.r}.${t.p}.${Mv(e)}.${Mv(r)}`}function Hw(t){let e=t.split(".");if(e.length===5){let[r,n,i,o,s]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Uu(o),expected:Uu(s)}}if(e.length===2){let[r,n]=e;return{params:Kw,salt:Uu(r),expected:Uu(n)}}return null}function Mv(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Uu(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Kv(t={}){let e={...Mw,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=Lf(e.saltLength),o=await Du(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),s=Lv({N:e.N,r:e.r,p:e.p},i,o);return T({value:s,data:n.metadata??null})}catch(i){let o=i instanceof Error?i.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async update(n,i){if(!n.value)return T({});try{if(typeof n.value!="string"||n.value.length===0)return d([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let o=Lf(e.saltLength),s=await Du(r.encode(n.value),o,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Lv({N:e.N,r:e.r,p:e.p},o,s);return T({value:a,...n.data&&{data:n.data}})}catch(o){let s=o instanceof Error?o.message:"Unknown error";return d([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async verify(n){try{if(!n.credential?.value)return d([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return d([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=Hw(n.credential.value);if(!i)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:o,salt:s,expected:a}=i;if(s.length!==e.saltLength||a.length!==e.dkLen)return d([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Du(r.encode(n.credentialValue),s,{N:o.N,r:o.r,p:o.p,dkLen:e.dkLen});if(c.length!==a.length)return d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?T({userId:n.userId,credentialId:"password"}):d([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),d([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var Fv=H_(Hv(),1);function Vv(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new Fv.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let o=r.browser.name??"",s=r.os.name??"";return{deviceName:i,browser:o,os:s,browserName:o,osName:s}}}}import{createHash as Fw}from"node:crypto";import{SendMessageCommand as Vw,SQSClient as Bw}from"@aws-sdk/client-sqs";var jw={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Mu=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new Bw(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new Vw({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:Gw(n)})}return T(void 0)}catch(r){return d({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},o=this.config.eventTypeMap?.[e.template]??jw[e.template]??e.template,s=Gi(i.eventId)??Gi(i.challengeId)??crypto.randomUUID(),a=n?`${s}:${$w(r)}`:s,c=Gi(i.locale),l=Gi(i.traceId)??a,u=qw(this.config.defaultMetadata,i),p=Ww(i);if(this.config.envelope==="snapshot-auth-v1"){let f=Gi(u?.tenantId),m=Gi(u?.tenantType),E=Gi(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:o,to:r,...E?{userId:E}:{},...f?{tenantId:f}:{},...m?{tenantType:m}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:o,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...u?{metadata:u}:{},data:p}}};function Gi(t){return typeof t=="string"&&t.length>0?t:void 0}function Gw(t){return t.split("@")[1]||"(unknown)"}function $w(t){return Fw("sha256").update(t).digest("hex").slice(0,16)}function qw(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function Ww(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var $a=class t{static createAwsSqs(e){return new Mu(e)}static create(e){return t.createAwsSqs(e.sqs)}};import{EventEmitter as SR}from"node:events";import nN from"node:net";import Wf from"node:url";var zw=/^xn--/,Jw=/[^\0-\x7F]/,Yw=/[\x2E\u3002\uFF0E\uFF61]/g,Xw={overflow:"Overflow: input needs wider integers to process","not-basic":"Illegal input >= 0x80 (not a basic code point)","invalid-input":"Invalid input"},Bf=35,Jr=Math.floor,jf=String.fromCharCode;function ai(t){throw new RangeError(Xw[t])}function Qw(t,e){let r=[],n=t.length;for(;n--;)r[n]=e(t[n]);return r}function jv(t,e){let r=t.split("@"),n="";r.length>1&&(n=r[0]+"@",t=r[1]),t=t.replace(Yw,".");let i=t.split("."),o=Qw(i,e).join(".");return n+o}function Zw(t){let e=[],r=0,n=t.length;for(;r<n;){let i=t.charCodeAt(r++);if(i>=55296&&i<=56319&&r<n){let o=t.charCodeAt(r++);(o&64512)==56320?e.push(((i&1023)<<10)+(o&1023)+65536):(e.push(i),r--)}else e.push(i)}return e}var eN=function(t){return t>=48&&t<58?26+(t-48):t>=65&&t<91?t-65:t>=97&&t<123?t-97:36},Bv=function(t,e){return t+22+75*+(t<26)-(+(e!=0)<<5)},Gv=function(t,e,r){let n=0;for(t=r?Jr(t/700):t>>1,t+=Jr(t/e);t>Bf*26>>1;n+=36)t=Jr(t/Bf);return Jr(n+(Bf+1)*t/(t+38))},tN=function(t){let e=[],r=t.length,n=0,i=128,o=72,s=t.lastIndexOf("-");s<0&&(s=0);for(let a=0;a<s;++a)t.charCodeAt(a)>=128&&ai("not-basic"),e.push(t.charCodeAt(a));for(let a=s>0?s+1:0;a<r;){let c=n;for(let u=1,p=36;;p+=36){a>=r&&ai("invalid-input");let f=eN(t.charCodeAt(a++));f>=36&&ai("invalid-input"),f>Jr((2147483647-n)/u)&&ai("overflow"),n+=f*u;let m=p<=o?1:p>=o+26?26:p-o;if(f<m)break;let E=36-m;u>Jr(2147483647/E)&&ai("overflow"),u*=E}let l=e.length+1;o=Gv(n-c,l,c==0),Jr(n/l)>2147483647-i&&ai("overflow"),i+=Jr(n/l),n%=l,e.splice(n++,0,i)}return String.fromCodePoint(...e)},rN=function(t){let e=[],r=Zw(t),n=r.length,i=128,o=0,s=72;for(let l of r)l<128&&e.push(jf(l));let a=e.length,c=a;for(a&&e.push("-");c<n;){let l=2147483647;for(let p of r)p>=i&&p<l&&(l=p);let u=c+1;l-i>Jr((2147483647-o)/u)&&ai("overflow"),o+=(l-i)*u,i=l;for(let p of r)if(p<i&&++o>2147483647&&ai("overflow"),p===i){let f=o;for(let m=36;;m+=36){let E=m<=s?1:m>=s+26?26:m-s;if(f<E)break;let v=f-E,N=36-E;e.push(jf(Bv(E+v%N,0))),f=Jr(v/N)}e.push(jf(Bv(f,0))),s=Gv(o,u,c===a),o=0,++c}++o,++i}return e.join("")},$v=function(t){return jv(t,function(e){return zw.test(e)?tN(e.slice(4).toLowerCase()):e})},hs=function(t){return jv(t,function(e){return Jw.test(e)?"xn--"+rN(e):e})};var iN=/^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/,oN=/^[\x00-\x20]+|[\x00-\x20]+$/g,sN=/^[\x00-\x20\u00a0\ufeff]+/,aN=/^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/,cN=/[\x00-\x20#/:<>?@[\\\]^|\x7f]/,lN=/[\x00-\x1f\x7f]/;function uN(t){let e=new TypeError("Invalid URL");return e.code="ERR_INVALID_URL",e.input=t,e}function $f(t,e,r,n){let i=Wf.parse(t,e,n),o=aN.exec(t.replace(sN,""));if(o&&(o[1]||i.hostname!==null)){let c=o[2].slice(o[2].lastIndexOf("@")+1);if(!c||lN.test(c)||(i.host||"").toLowerCase()!==hs(c.toLowerCase())||c.charAt(0)==="["&&!nN.isIPv6(c.slice(1,c.indexOf("]"))))throw r}else if(i.hostname!==null)throw r;let s=i.auth===null||i.auth===void 0?null:i.auth.split(":"),a=i;return a.username=s?s.shift():null,a.password=s&&s.length?s.join(":"):null,a}function qf(t){try{return decodeURIComponent(t)}catch{return t}}function dN(t,e){let r=t||"";if(!r)return"";if(r.charAt(0)==="["&&r.charAt(r.length-1)==="]")return r.slice(1,-1);let n=qf(r),i=cN.test(n)?"":Wf.domainToASCII(n);if(!i)throw uN(e);return i}var Nr=(t,e)=>{t=(t||"").replace(oN,"");let r=iN.exec(t),n=r?r[1]+"//"+r[2]:t,i;try{i=new URL(n)}catch(m){return $f(n,e,m)}let o=dN(i.hostname,i.href),s=i.port||null,a=i.pathname||null,c=i.search||null,l=null,u=null,p=null;(i.username||i.password)&&(u=qf(i.username),p=i.password?qf(i.password):null,l=u+(p!==null?":"+p:""));let f;if(e){let m=Object.create(null);i.searchParams.forEach((E,v)=>{if(Object.prototype.hasOwnProperty.call(m,v)){let N=m[v];Array.isArray(N)?N.push(E):m[v]=[N,E]}else m[v]=E}),f=m}else f=c?c.slice(1):null;return{protocol:i.protocol||null,host:i.host||null,hostname:o,port:s,pathname:a,search:c,path:(a||"")+(c||"")||null,href:i.href,auth:l,username:u,password:p,query:f}},qv=(t,e)=>{try{return new URL(e,t).href}catch(r){return $f(t,!1,r,!0),$f(e,!1,r,!0),Wf.resolve(t,e)}};import _N from"node:util";import IN from"node:fs";import mN from"node:http";import hN from"node:https";import EN from"node:zlib";import{PassThrough as yN}from"node:stream";import pN from"node:net";var Wv=1800,zf=class{constructor(e){this.options=e||{},this.cookies=[]}set(e,r){let n=Nr(r||""),i=this.parse(e),o;return i.domain?(o=i.domain.replace(/^\./,""),(n.hostname.length<o.length||o.indexOf(".")<0||o.endsWith(".")||pN.isIP(n.hostname)||!("."+n.hostname).endsWith("."+o))&&(i.domain=n.hostname)):i.domain=n.hostname,i.path||(i.path=this.getPath(n.pathname)),i.expires||(i.expires=new Date(Date.now()+(Number(this.options.sessionTimeout||Wv)||Wv)*1e3)),this.add(i)}get(e){return this.list(e).map(r=>r.name+"="+r.value).join("; ")}list(e){let r=[];for(let n=this.cookies.length-1;n>=0;n--){let i=this.cookies[n];if(this.isExpired(i)){this.cookies.splice(n,1);continue}this.match(i,e)&&r.unshift(i)}return r}parse(e){let r={},n=!1;return(e||"").toString().split(";").forEach(i=>{if(!i.trim())return;let o=i.split("="),s=o.shift().trim(),a=o.join("=").trim(),c;if(!n){n=!0,s&&(r.name=s,r.value=a);return}switch(s.toLowerCase()){case"expires":{let l=new Date(a);l.toString()!=="Invalid Date"&&(r.expires=l);break}case"path":r.path=a;break;case"domain":c=a.toLowerCase(),c.length&&c.charAt(0)!=="."&&(c="."+c),r.domain=c;break;case"max-age":r.expires=new Date(Date.now()+(Number(a)||0)*1e3);break;case"secure":r.secure=!0;break;case"httponly":r.httponly=!0;break}}),r}match(e,r){let n=Nr(r||"");if(n.hostname!==e.domain&&(e.domain.charAt(0)!=="."||("."+n.hostname).substr(-e.domain.length)!==e.domain))return!1;let i=n.pathname||"/",o=e.path;return!(!(i===o||i.startsWith(o)&&(o.endsWith("/")||i.charAt(o.length)==="/"))||e.secure&&n.protocol!=="https:")}add(e){if(!e||!e.name)return!1;for(let r=0,n=this.cookies.length;r<n;r++)if(this.compare(this.cookies[r],e))return this.isExpired(e)?(this.cookies.splice(r,1),!1):(this.cookies[r]=e,!0);return this.isExpired(e)||this.cookies.push(e),!0}compare(e,r){return e.name===r.name&&e.path===r.path&&e.domain===r.domain&&e.secure===r.secure&&e.httponly===r.httponly}isExpired(e){return e.expires&&e.expires<new Date||!e.value}getPath(e){let r=(e||"/").split("/");r.pop();let n=r.join("/").trim();return n.charAt(0)!=="/"?"/":n}},Jf=zf;var Ku="nodemailer",Xe="10.1.0",zv="https://nodemailer.com/";import gN from"node:net";var Hu="ECONNECTION",Yf="ETIMEDOUT",fN="ESOCKET";var Jv="EENVELOPE",Yv="EMESSAGE",Fu="ESTREAM";var Vu="ENOAUTH",ci="EOAUTH2",Bu="EMAXLIMIT",Xv="EMAXRECIPIENTS",ju="ESENDMAIL",Qv="ESES",Es="ECONFIG",li="EPROXY",Gu="EFILEACCESS",$u="EURLACCESS",qu="EFETCH",Wa=t=>t.responseCode===421||t.code===Hu||t.code===fN||t.code===Yf,Wu="ERR_ACCESS_DENIED";var Rr=t=>t==="__proto__",et=(t,e,r)=>(Object.keys(e||{}).forEach(n=>{Rr(n)||r&&r(n)||(t[n]=e[n])}),t);var vN=5,eA=60*1e3,AN=64*1024*1024,TN=["ALPNProtocols","ca","cert","checkServerIdentity","ciphers","crl","dhparam","ecdhCurve","honorCipherOrder","key","maxVersion","minVersion","passphrase","pfx","rejectUnauthorized","secureContext","secureOptions","secureProtocol","servername","sessionIdContext","sigalgs"];function Xf(t){t.code!==Wu&&(t.code=qu)}function Zv(t){let e;try{e=Nr(t)}catch{return!1}return e.protocol!=="http:"&&e.protocol!=="https:"?!1:e}function zu(t,e){e=e||{},e.fetchRes=e.fetchRes||new yN,e.cookies=e.cookies||new Jf,e.redirects=e.redirects||0,e.maxRedirects=isNaN(e.maxRedirects)?vN:e.maxRedirects;let r=e.fetchRes,n=Zv(t);if(!n)return e.body&&typeof e.body.destroy=="function"&&(e.body.on("error",()=>!1),e.body.destroy()),setImmediate(()=>{let E=new Error("Unsupported protocol for URL "+t);E.code=qu,E.sourceUrl=t,r.emit("error",E)}),r;e.cookie&&([].concat(e.cookie||[]).forEach(E=>{e.cookies.set(E,t)}),e.cookie=!1);let i=(e.method||"").toString().trim().toUpperCase()||"GET",o=!1,s,a,c=n.protocol==="https:"?hN:mN,l={"accept-encoding":"gzip,deflate","user-agent":"nodemailer/"+Xe};if(Object.keys(e.headers||{}).forEach(E=>{Rr(E.toLowerCase().trim())||(l[E.toLowerCase().trim()]=e.headers[E])}),e.userAgent&&(l["user-agent"]=e.userAgent),n.auth&&(l.Authorization="Basic "+Buffer.from(n.auth).toString("base64")),(s=e.cookies.get(t))&&(l.cookie=s),e.body){if(e.contentType!==!1&&(l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded"),typeof e.body.pipe=="function")l["Transfer-Encoding"]="chunked",a=e.body,a.on("error",E=>{o||(o=!0,Xf(E),E.sourceUrl=t,r.emit("error",E))});else{if(e.body instanceof Buffer)a=e.body;else if(typeof e.body=="object")try{a=Buffer.from(Object.keys(e.body).map(E=>{let v=e.body[E].toString().trim();return encodeURIComponent(E)+"="+encodeURIComponent(v)}).join("&"))}catch(E){return o=!0,E.code=qu,E.sourceUrl=t,setImmediate(()=>r.emit("error",E)),r}else a=Buffer.from(e.body.toString().trim());l["Content-Type"]=e.contentType||"application/x-www-form-urlencoded",l["Content-Length"]=a.length}i=(e.method||"").toString().trim().toUpperCase()||"POST"}let u,p={method:i,host:n.hostname,path:n.path,port:n.port?n.port:n.protocol==="https:"?443:80,headers:l,rejectUnauthorized:!0,agent:!1};e.tls&&Object.keys(e.tls).forEach(E=>{TN.includes(E)&&(p[E]=e.tls[E])}),n.protocol==="https:"&&n.hostname&&n.hostname!==p.host&&!gN.isIP(n.hostname)&&!p.servername&&(p.servername=n.hostname);try{u=c.request(p)}catch(E){return o=!0,setImmediate(()=>{Xf(E),E.sourceUrl=t,r.emit("error",E)}),r}let f=(E,v=t)=>{o||(o=!0,Xf(E),E.sourceUrl=v,r.emit("error",E),u.abort())},m=typeof e.timeout=="number"&&e.timeout>=0?e.timeout:eA;return m&&u.setTimeout(m,()=>f(new Error("Request Timeout"))),u.on("error",E=>f(E)),r.once("close",()=>{o||r.readableEnded||(o=!0,u.destroy())}),u.on("response",E=>{let v;if(o)return;switch(E.headers["content-encoding"]){case"gzip":case"deflate":v=EN.createUnzip();break}if(E.headers["set-cookie"]&&[].concat(E.headers["set-cookie"]||[]).forEach(M=>{e.cookies.set(M,t)}),[301,302,303,307,308].includes(E.statusCode)&&E.headers.location){if(e.redirects++,e.redirects>e.maxRedirects)return f(new Error("Maximum redirect count exceeded"));e.method="GET",e.body=!1;let M;try{M=qv(t,E.headers.location)}catch{M=E.headers.location}let K=Zv(M);if(!K)return f(new Error("Unsupported protocol for URL "+M),M);let B=K.hostname!==n.hostname,V=n.protocol==="https:"&&K.protocol==="http:";if(e.headers&&(B||V)){let $=["authorization","cookie","proxy-authorization"];Object.keys(e.headers).forEach(A=>{$.includes(A.toLowerCase())&&delete e.headers[A]})}return o=!0,E.resume(),u.abort(),zu(M,e)}if(r.statusCode=E.statusCode,r.headers=E.headers,E.statusCode>=300&&!e.allowErrorResponse)return f(new Error("Invalid status code "+E.statusCode));E.on("error",M=>f(M));let N=typeof e.maxBytes=="number"&&e.maxBytes>0?e.maxBytes:AN,S=v||E,R=0;S.on("data",M=>{R+=M.length,!(R<=N||o)&&(S.unpipe(r),f(new Error("Response size exceeds the allowed "+N+" bytes")))}),v?(E.pipe(v).pipe(r),v.on("error",M=>f(M))):E.pipe(r)}),setImmediate(()=>{if(a)try{if(typeof a.pipe=="function")return a.pipe(u);u.write(a)}catch(E){return f(E)}u.end()}),r}zu.Cookies=Jf;zu.DEFAULT_TIMEOUT=eA;var ui=zu;import lr from"node:dns";import xN from"node:net";import bN from"node:os";import{finished as SN}from"node:stream";var Qf=300*1e3,wN=30*1e3,tA=1e3,rA=0;var nA,iA=!1,NN=()=>{if(!iA){iA=!0;try{nA=bN.networkInterfaces()}catch{}}return nA},oA=(t,e)=>{let r=Object.values(NN()||{}).flat();return r.length?r.filter(n=>!n.internal||e).some(n=>n.family==="IPv"+t||n.family===t):!0},RN=(t,e,r,n)=>{if(r=r||{},!oA(t,r.allowInternalNetworkInterfaces))return n(null,[]),null;let i=lr.Resolver?new lr.Resolver(r):lr;return i["resolve"+t](e,(o,s)=>{if(o){switch(o.code){case lr.NODATA:case lr.NOTFOUND:case lr.NOTIMP:case lr.SERVFAIL:case lr.CONNREFUSED:case lr.REFUSED:case"EAI_AGAIN":return n(null,[])}return n(o)}return n(null,Array.isArray(s)?s:[].concat(s||[]))}),lr.Resolver?i:null},Xr=new Map,ys=(t,e)=>{if(!t)return Object.assign({},e||{});let r=t.addresses||[],n=r.length>0?r[Math.floor(Math.random()*r.length)]:null;return Object.assign({host:n,_addresses:r},e||{})},sA=(t,e)=>{if(t=t||{},!t.host&&t.servername&&(t.host=t.servername),!t.host||xN.isIP(t.host)){let S={addresses:[t.host]};return e(null,ys(S,{servername:t.servername||!1,cached:!1}))}let r=t.host,n=t.servername||r,i;if(Xr.has(t.host)){i=Xr.get(t.host);let S=Date.now();if(S-rA>wN){rA=S;for(let[R,M]of Xr.entries())M.expires&&M.expires<S&&Xr.delete(R);if(Xr.size>tA){let R=Math.floor(tA*.1);Array.from(Xr.keys()).slice(0,R).forEach(K=>Xr.delete(K))}}if(!i.expires||i.expires>=S)return e(null,ys(i.value,{servername:n,cached:!0}))}let o=!1,s,a=(S,R)=>{o||(o=!0,clearTimeout(s),e(S,R))},c=S=>i?(Xr.set(r,{value:i.value,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(i.value,{servername:n,cached:!0,error:S})),!0):!1,l=[],u=Number(t.timeout)||0;u>0&&(s=setTimeout(()=>{for(let R of l)typeof R.cancel=="function"&&R.cancel();let S=new Error("DNS lookup for "+r+" timed out");S.code=lr.TIMEOUT,c(S)||a(S)},u));let p=[],f=[],m=null,E=null,v=2,N=()=>{if(--v||o)return;let S=p.concat(f);if(S.length){let R={addresses:S};return Xr.set(r,{value:R,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(R,{servername:n,cached:!1}))}if(!(m&&E&&c(m)))try{lr.lookup(r,{all:!0},(R,M)=>{if(R)return c(R)?void 0:a(R);let K=M?M.filter(V=>oA(V.family)).map(V=>V.address):[];if(M&&M.length&&!K.length&&console.warn(`Failed to resolve IPv${M[0].family} addresses with current network`),!K.length&&i)return a(null,ys(i.value,{servername:n,cached:!0}));let B={addresses:K.length?K:[r]};return Xr.set(r,{value:B,expires:Date.now()+(t.dnsTtl||Qf)}),a(null,ys(B,{servername:n,cached:!1}))})}catch(R){return c(R)?void 0:a(m||E||R)}};for(let S of[4,6]){let R=RN(S,r,t,(M,K)=>{S===4?(m=M,p=K||[]):(E=M,f=K||[]),N()});R&&l.push(R)}},gs=t=>{t=t||"";let e={},r=Nr(t,!0);switch(r.protocol){case"smtp:":e.secure=!1;break;case"smtps:":e.secure=!0;break;case"direct:":e.direct=!0;break}return!isNaN(r.port)&&Number(r.port)&&(e.port=Number(r.port)),r.hostname&&(e.host=r.hostname),(r.username||r.password)&&(e.auth={user:r.username||"",pass:r.password||""}),Object.keys(r.query||{}).forEach(n=>{let i=e,o=n,s=r.query[n];switch(isNaN(s)||(s=Number(s)),s){case"true":s=!0;break;case"false":s=!1;break}if(n.indexOf("tls.")===0)o=n.substr(4),e.tls||(e.tls={}),i=e.tls;else if(n.indexOf(".")>=0)return;!Rr(o)&&!(o in i)&&(i[o]=s)}),e},ON=(t,e,r,n,i,...o)=>{let s=Object.assign({},r||{},n||{});delete s.level;let a=e;typeof t[a]!="function"&&(a=["info","debug","log","trace","warn","error"].find(c=>typeof t[c]=="function")),a&&t[a](s,i,...o)},ft=(t,e)=>{t=t||{};let r={},n=["trace","debug","info","warn","error","fatal"];if(!t.logger)return n.forEach(o=>{r[o]=()=>!1}),r;let i=t.logger===!0?CN(n):t.logger;return n.forEach(o=>{r[o]=(...s)=>{let a=typeof s[0]=="string"?void 0:s.shift();ON(i,o,e,a,...s)}}),r},Mt=(t,e)=>function(...r){let n=r.shift();n?e(n):t(...r)},em=t=>{if(typeof t!="string"||!t.startsWith("data:"))return null;let e=t.indexOf(",");if(e===-1)return null;let r=t.substring(e+1),n=t.substring(5,e),i,o=n.split(";");if(o.length>0){let l=o[o.length-1].toLowerCase().trim();["base64","utf8","utf-8"].includes(l)&&l.indexOf("=")===-1&&(i=l,o.pop())}let s=o.length>0?o.shift():"application/octet-stream",a={};for(let l=0;l<o.length;l++){let u=o[l],p=u.indexOf("=");if(p>0){let f=u.substring(0,p).trim(),m=u.substring(p+1).trim();f&&!Rr(f)&&(a[f]=m)}}let c;try{if(i==="base64")c=Buffer.from(r,"base64");else try{c=Buffer.from(decodeURIComponent(r))}catch{c=Buffer.from(r)}}catch{c=Buffer.alloc(0)}return{data:c,encoding:i||null,contentType:s||"application/octet-stream",params:a}};function tm(t,e,r,n){!n&&typeof r=="function"&&(n=r,r=!1),r=r||{};let i;return n||(i=new Promise((o,s)=>{n=Mt(o,s)})),kN(t,e,r,n),i}function kN(t,e,r,n){let i=t&&t[e]&&t[e].content||t[e],o=(typeof t[e]=="object"&&t[e].encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,"");if(!i)return n(null,i);if(typeof i=="object"){if(typeof i.pipe=="function")return za(i,(s,a)=>{if(s)return n(s);t[e].content?t[e].content=a:t[e]=a,n(null,a)});if(/^data:/i.test(i.path||i.href)){let s=em(i.path||i.href);return n(null,s&&s.data?s.data:Buffer.alloc(0))}else if(i.href||/^https?:\/\//i.test(i.path)){let s=i.href||i.path;if(r.disableUrlAccess){setImmediate(()=>{let a=new Error("Url access rejected for "+s);a.code=$u,n(a)});return}return za(ui(s,{headers:i.httpHeaders,tls:i.tls}),n)}else if(i.path){if(r.disableFileAccess){setImmediate(()=>{let s=new Error("File access rejected for "+i.path);s.code=Gu,n(s)});return}return za(IN.createReadStream(i.path),n)}}typeof t[e].content=="string"&&!["utf8","usascii","ascii"].includes(o)&&(i=Buffer.from(t[e].content,o)),setImmediate(()=>n(null,i))}var Or=function(...t){let e=t.shift()||{};return t.forEach(r=>{Object.keys(r||{}).forEach(n=>{Rr(n)||(["tls","auth"].includes(n)&&r[n]&&typeof r[n]=="object"?e[n]=et(e[n]||{},r[n]):e[n]=r[n])})}),e},Ja=t=>{if(!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(t))return t;let e=Buffer.from(t),r="";for(let n=0,i=e.length;n<i;n++){let o=e[n];o<33||o>126||o===43||o===61?r+="+"+(o<16?"0":"")+o.toString(16).toUpperCase():r+=String.fromCharCode(o)}return r},Zf=new WeakMap;function rm(t){t.on("error",e=>{Zf.has(t)||Zf.set(t,e)})}function $i(t){let e=t;e&&typeof e.pipe=="function"&&typeof e.destroy=="function"&&!e.destroyed&&e.destroy()}function nm(t){let e=Zf.get(t)||t.errored;if(e)return e;if(t.readableEnded||t.destroyed){let r=new Error("Content stream was already read or destroyed");return r.code=Fu,r}return null}function za(t,e){let r=!1,n=(a,c)=>{r||(r=!0,e(a,c))},i=nm(t);if(i){t.on("error",()=>!1),setImmediate(()=>n(i));return}let o=[],s=0;t.on("data",a=>{typeof a=="string"&&(a=Buffer.from(a)),o.push(a),s+=a.length}),SN(t,{writable:!1},a=>{if(a)return n(a);let c;try{c=Buffer.concat(o,s)}catch(l){return n(l)}n(null,c)})}function CN(t){let e=t.reduce((o,s)=>Math.max(o,s.length),0),r=new Map;t.forEach(o=>{let s=o.toUpperCase();s.length<e&&(s+=" ".repeat(e-s.length)),r.set(o,s)});let n=(o,s,a,...c)=>{let l="";s&&(s.tnx==="server"?l="S: ":s.tnx==="client"&&(l="C: "),s.sid&&(l="["+s.sid+"] "+l),s.cid&&(l="[#"+s.cid+"] "+l)),a=_N.format(a,...c),a.split(/\r?\n/).forEach(u=>{console.log("[%s] %s %s",new Date().toISOString().substr(0,19).replace(/T/," "),r.get(o),l+u)})},i={};return t.forEach(o=>{i[o]=n.bind(null,o)}),i}import PN from"node:path";var aA="application/octet-stream",DN="bin",cA=new Map([["application/acad","dwg"],["application/applixware","aw"],["application/arj","arj"],["application/atom+xml","xml"],["application/atomcat+xml","atomcat"],["application/atomsvc+xml","atomsvc"],["application/base64",["mm","mme"]],["application/binhex","hqx"],["application/binhex4","hqx"],["application/book",["book","boo"]],["application/ccxml+xml,","ccxml"],["application/cdf","cdf"],["application/cdmi-capability","cdmia"],["application/cdmi-container","cdmic"],["application/cdmi-domain","cdmid"],["application/cdmi-object","cdmio"],["application/cdmi-queue","cdmiq"],["application/clariscad","ccad"],["application/commonground","dp"],["application/cu-seeme","cu"],["application/davmount+xml","davmount"],["application/drafting","drw"],["application/dsptype","tsp"],["application/dssc+der","dssc"],["application/dssc+xml","xdssc"],["application/dxf","dxf"],["application/ecmascript",["js","es"]],["application/emma+xml","emma"],["application/envoy","evy"],["application/epub+zip","epub"],["application/excel",["xls","xl","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/exi","exi"],["application/font-tdpfr","pfr"],["application/fractals","fif"],["application/freeloader","frl"],["application/futuresplash","spl"],["application/geo+json","geojson"],["application/gnutar","tgz"],["application/groupwise","vew"],["application/hlp","hlp"],["application/hta","hta"],["application/hyperstudio","stk"],["application/i-deas","unv"],["application/iges",["iges","igs"]],["application/inf","inf"],["application/internet-property-stream","acx"],["application/ipfix","ipfix"],["application/java","class"],["application/java-archive","jar"],["application/java-byte-code","class"],["application/java-serialized-object","ser"],["application/java-vm","class"],["application/javascript","js"],["application/json","json"],["application/lha","lha"],["application/lzx","lzx"],["application/mac-binary","bin"],["application/mac-binhex","hqx"],["application/mac-binhex40","hqx"],["application/mac-compactpro","cpt"],["application/macbinary","bin"],["application/mads+xml","mads"],["application/marc","mrc"],["application/marcxml+xml","mrcx"],["application/mathematica","ma"],["application/mathml+xml","mathml"],["application/mbedlet","mbd"],["application/mbox","mbox"],["application/mcad","mcd"],["application/mediaservercontrol+xml","mscml"],["application/metalink4+xml","meta4"],["application/mets+xml","mets"],["application/mime","aps"],["application/mods+xml","mods"],["application/mp21","m21"],["application/mp4","mp4"],["application/mspowerpoint",["ppt","pot","pps","ppz"]],["application/msword",["doc","dot","w6w","wiz","word"]],["application/mswrite","wri"],["application/mxf","mxf"],["application/netmc","mcp"],["application/octet-stream",["*"]],["application/oda","oda"],["application/oebps-package+xml","opf"],["application/ogg","ogx"],["application/olescript","axs"],["application/onenote","onetoc"],["application/patch-ops-error+xml","xer"],["application/pdf","pdf"],["application/pgp-encrypted","asc"],["application/pgp-signature","pgp"],["application/pics-rules","prf"],["application/pkcs-12","p12"],["application/pkcs-crl","crl"],["application/pkcs10","p10"],["application/pkcs7-mime",["p7c","p7m"]],["application/pkcs7-signature","p7s"],["application/pkcs8","p8"],["application/pkix-attr-cert","ac"],["application/pkix-cert",["cer","crt"]],["application/pkix-crl","crl"],["application/pkix-pkipath","pkipath"],["application/pkixcmp","pki"],["application/plain","text"],["application/pls+xml","pls"],["application/postscript",["ps","ai","eps"]],["application/powerpoint","ppt"],["application/pro_eng",["part","prt"]],["application/prs.cww","cww"],["application/pskc+xml","pskcxml"],["application/rdf+xml","rdf"],["application/reginfo+xml","rif"],["application/relax-ng-compact-syntax","rnc"],["application/resource-lists+xml","rl"],["application/resource-lists-diff+xml","rld"],["application/ringing-tones","rng"],["application/rls-services+xml","rs"],["application/rsd+xml","rsd"],["application/rss+xml","xml"],["application/rtf",["rtf","rtx"]],["application/sbml+xml","sbml"],["application/scvp-cv-request","scq"],["application/scvp-cv-response","scs"],["application/scvp-vp-request","spq"],["application/scvp-vp-response","spp"],["application/sdp","sdp"],["application/sea","sea"],["application/set","set"],["application/set-payment-initiation","setpay"],["application/set-registration-initiation","setreg"],["application/shf+xml","shf"],["application/sla","stl"],["application/smil",["smi","smil"]],["application/smil+xml","smi"],["application/solids","sol"],["application/sounder","sdr"],["application/sparql-query","rq"],["application/sparql-results+xml","srx"],["application/srgs","gram"],["application/srgs+xml","grxml"],["application/sru+xml","sru"],["application/ssml+xml","ssml"],["application/step",["step","stp"]],["application/streamingmedia","ssm"],["application/tei+xml","tei"],["application/thraud+xml","tfi"],["application/timestamped-data","tsd"],["application/toolbook","tbk"],["application/vda","vda"],["application/vnd.3gpp.pic-bw-large","plb"],["application/vnd.3gpp.pic-bw-small","psb"],["application/vnd.3gpp.pic-bw-var","pvb"],["application/vnd.3gpp2.tcap","tcap"],["application/vnd.3m.post-it-notes","pwn"],["application/vnd.accpac.simply.aso","aso"],["application/vnd.accpac.simply.imp","imp"],["application/vnd.acucobol","acu"],["application/vnd.acucorp","atc"],["application/vnd.adobe.air-application-installer-package+zip","air"],["application/vnd.adobe.fxp","fxp"],["application/vnd.adobe.xdp+xml","xdp"],["application/vnd.adobe.xfdf","xfdf"],["application/vnd.ahead.space","ahead"],["application/vnd.airzip.filesecure.azf","azf"],["application/vnd.airzip.filesecure.azs","azs"],["application/vnd.amazon.ebook","azw"],["application/vnd.americandynamics.acc","acc"],["application/vnd.amiga.ami","ami"],["application/vnd.android.package-archive","apk"],["application/vnd.anser-web-certificate-issue-initiation","cii"],["application/vnd.anser-web-funds-transfer-initiation","fti"],["application/vnd.antix.game-component","atx"],["application/vnd.apple.installer+xml","mpkg"],["application/vnd.apple.mpegurl","m3u8"],["application/vnd.aristanetworks.swi","swi"],["application/vnd.audiograph","aep"],["application/vnd.blueice.multipass","mpm"],["application/vnd.bmi","bmi"],["application/vnd.businessobjects","rep"],["application/vnd.chemdraw+xml","cdxml"],["application/vnd.chipnuts.karaoke-mmd","mmd"],["application/vnd.cinderella","cdy"],["application/vnd.claymore","cla"],["application/vnd.cloanto.rp9","rp9"],["application/vnd.clonk.c4group","c4g"],["application/vnd.cluetrust.cartomobile-config","c11amc"],["application/vnd.cluetrust.cartomobile-config-pkg","c11amz"],["application/vnd.commonspace","csp"],["application/vnd.contact.cmsg","cdbcmsg"],["application/vnd.cosmocaller","cmc"],["application/vnd.crick.clicker","clkx"],["application/vnd.crick.clicker.keyboard","clkk"],["application/vnd.crick.clicker.palette","clkp"],["application/vnd.crick.clicker.template","clkt"],["application/vnd.crick.clicker.wordbank","clkw"],["application/vnd.criticaltools.wbs+xml","wbs"],["application/vnd.ctc-posml","pml"],["application/vnd.cups-ppd","ppd"],["application/vnd.curl.car","car"],["application/vnd.curl.pcurl","pcurl"],["application/vnd.data-vision.rdz","rdz"],["application/vnd.denovo.fcselayout-link","fe_launch"],["application/vnd.dna","dna"],["application/vnd.dolby.mlp","mlp"],["application/vnd.dpgraph","dpg"],["application/vnd.dreamfactory","dfac"],["application/vnd.dvb.ait","ait"],["application/vnd.dvb.service","svc"],["application/vnd.dynageo","geo"],["application/vnd.ecowin.chart","mag"],["application/vnd.enliven","nml"],["application/vnd.epson.esf","esf"],["application/vnd.epson.msf","msf"],["application/vnd.epson.quickanime","qam"],["application/vnd.epson.salt","slt"],["application/vnd.epson.ssf","ssf"],["application/vnd.eszigno3+xml","es3"],["application/vnd.ezpix-album","ez2"],["application/vnd.ezpix-package","ez3"],["application/vnd.fdf","fdf"],["application/vnd.fdsn.seed","seed"],["application/vnd.flographit","gph"],["application/vnd.fluxtime.clip","ftc"],["application/vnd.framemaker","fm"],["application/vnd.frogans.fnc","fnc"],["application/vnd.frogans.ltf","ltf"],["application/vnd.fsc.weblaunch","fsc"],["application/vnd.fujitsu.oasys","oas"],["application/vnd.fujitsu.oasys2","oa2"],["application/vnd.fujitsu.oasys3","oa3"],["application/vnd.fujitsu.oasysgp","fg5"],["application/vnd.fujitsu.oasysprs","bh2"],["application/vnd.fujixerox.ddd","ddd"],["application/vnd.fujixerox.docuworks","xdw"],["application/vnd.fujixerox.docuworks.binder","xbd"],["application/vnd.fuzzysheet","fzs"],["application/vnd.genomatix.tuxedo","txd"],["application/vnd.geogebra.file","ggb"],["application/vnd.geogebra.tool","ggt"],["application/vnd.geometry-explorer","gex"],["application/vnd.geonext","gxt"],["application/vnd.geoplan","g2w"],["application/vnd.geospace","g3w"],["application/vnd.gmx","gmx"],["application/vnd.google-earth.kml+xml","kml"],["application/vnd.google-earth.kmz","kmz"],["application/vnd.grafeq","gqf"],["application/vnd.groove-account","gac"],["application/vnd.groove-help","ghf"],["application/vnd.groove-identity-message","gim"],["application/vnd.groove-injector","grv"],["application/vnd.groove-tool-message","gtm"],["application/vnd.groove-tool-template","tpl"],["application/vnd.groove-vcard","vcg"],["application/vnd.hal+xml","hal"],["application/vnd.handheld-entertainment+xml","zmm"],["application/vnd.hbci","hbci"],["application/vnd.hhe.lesson-player","les"],["application/vnd.hp-hpgl",["hgl","hpg","hpgl"]],["application/vnd.hp-hpid","hpid"],["application/vnd.hp-hps","hps"],["application/vnd.hp-jlyt","jlt"],["application/vnd.hp-pcl","pcl"],["application/vnd.hp-pclxl","pclxl"],["application/vnd.hydrostatix.sof-data","sfd-hdstx"],["application/vnd.hzn-3d-crossword","x3d"],["application/vnd.ibm.minipay","mpy"],["application/vnd.ibm.modcap","afp"],["application/vnd.ibm.rights-management","irm"],["application/vnd.ibm.secure-container","sc"],["application/vnd.iccprofile","icc"],["application/vnd.igloader","igl"],["application/vnd.immervision-ivp","ivp"],["application/vnd.immervision-ivu","ivu"],["application/vnd.insors.igm","igm"],["application/vnd.intercon.formnet","xpw"],["application/vnd.intergeo","i2g"],["application/vnd.intu.qbo","qbo"],["application/vnd.intu.qfx","qfx"],["application/vnd.ipunplugged.rcprofile","rcprofile"],["application/vnd.irepository.package+xml","irp"],["application/vnd.is-xpr","xpr"],["application/vnd.isac.fcs","fcs"],["application/vnd.jam","jam"],["application/vnd.jcp.javame.midlet-rms","rms"],["application/vnd.jisp","jisp"],["application/vnd.joost.joda-archive","joda"],["application/vnd.kahootz","ktz"],["application/vnd.kde.karbon","karbon"],["application/vnd.kde.kchart","chrt"],["application/vnd.kde.kformula","kfo"],["application/vnd.kde.kivio","flw"],["application/vnd.kde.kontour","kon"],["application/vnd.kde.kpresenter","kpr"],["application/vnd.kde.kspread","ksp"],["application/vnd.kde.kword","kwd"],["application/vnd.kenameaapp","htke"],["application/vnd.kidspiration","kia"],["application/vnd.kinar","kne"],["application/vnd.koan","skp"],["application/vnd.kodak-descriptor","sse"],["application/vnd.las.las+xml","lasxml"],["application/vnd.llamagraphics.life-balance.desktop","lbd"],["application/vnd.llamagraphics.life-balance.exchange+xml","lbe"],["application/vnd.lotus-1-2-3","123"],["application/vnd.lotus-approach","apr"],["application/vnd.lotus-freelance","pre"],["application/vnd.lotus-notes","nsf"],["application/vnd.lotus-organizer","org"],["application/vnd.lotus-screencam","scm"],["application/vnd.lotus-wordpro","lwp"],["application/vnd.macports.portpkg","portpkg"],["application/vnd.mcd","mcd"],["application/vnd.medcalcdata","mc1"],["application/vnd.mediastation.cdkey","cdkey"],["application/vnd.mfer","mwf"],["application/vnd.mfmp","mfm"],["application/vnd.micrografx.flo","flo"],["application/vnd.micrografx.igx","igx"],["application/vnd.mif","mif"],["application/vnd.mobius.daf","daf"],["application/vnd.mobius.dis","dis"],["application/vnd.mobius.mbk","mbk"],["application/vnd.mobius.mqy","mqy"],["application/vnd.mobius.msl","msl"],["application/vnd.mobius.plc","plc"],["application/vnd.mobius.txf","txf"],["application/vnd.mophun.application","mpn"],["application/vnd.mophun.certificate","mpc"],["application/vnd.mozilla.xul+xml","xul"],["application/vnd.ms-artgalry","cil"],["application/vnd.ms-cab-compressed","cab"],["application/vnd.ms-excel",["xls","xla","xlc","xlm","xlt","xlw","xlb","xll"]],["application/vnd.ms-excel.addin.macroenabled.12","xlam"],["application/vnd.ms-excel.sheet.binary.macroenabled.12","xlsb"],["application/vnd.ms-excel.sheet.macroenabled.12","xlsm"],["application/vnd.ms-excel.template.macroenabled.12","xltm"],["application/vnd.ms-fontobject","eot"],["application/vnd.ms-htmlhelp","chm"],["application/vnd.ms-ims","ims"],["application/vnd.ms-lrm","lrm"],["application/vnd.ms-officetheme","thmx"],["application/vnd.ms-outlook","msg"],["application/vnd.ms-pki.certstore","sst"],["application/vnd.ms-pki.pko","pko"],["application/vnd.ms-pki.seccat","cat"],["application/vnd.ms-pki.stl","stl"],["application/vnd.ms-pkicertstore","sst"],["application/vnd.ms-pkiseccat","cat"],["application/vnd.ms-pkistl","stl"],["application/vnd.ms-powerpoint",["ppt","pot","pps","ppa","pwz"]],["application/vnd.ms-powerpoint.addin.macroenabled.12","ppam"],["application/vnd.ms-powerpoint.presentation.macroenabled.12","pptm"],["application/vnd.ms-powerpoint.slide.macroenabled.12","sldm"],["application/vnd.ms-powerpoint.slideshow.macroenabled.12","ppsm"],["application/vnd.ms-powerpoint.template.macroenabled.12","potm"],["application/vnd.ms-project","mpp"],["application/vnd.ms-word.document.macroenabled.12","docm"],["application/vnd.ms-word.template.macroenabled.12","dotm"],["application/vnd.ms-works",["wks","wcm","wdb","wps"]],["application/vnd.ms-wpl","wpl"],["application/vnd.ms-xpsdocument","xps"],["application/vnd.mseq","mseq"],["application/vnd.musician","mus"],["application/vnd.muvee.style","msty"],["application/vnd.neurolanguage.nlu","nlu"],["application/vnd.noblenet-directory","nnd"],["application/vnd.noblenet-sealer","nns"],["application/vnd.noblenet-web","nnw"],["application/vnd.nokia.configuration-message","ncm"],["application/vnd.nokia.n-gage.data","ngdat"],["application/vnd.nokia.n-gage.symbian.install","n-gage"],["application/vnd.nokia.radio-preset","rpst"],["application/vnd.nokia.radio-presets","rpss"],["application/vnd.nokia.ringing-tone","rng"],["application/vnd.novadigm.edm","edm"],["application/vnd.novadigm.edx","edx"],["application/vnd.novadigm.ext","ext"],["application/vnd.oasis.opendocument.chart","odc"],["application/vnd.oasis.opendocument.chart-template","otc"],["application/vnd.oasis.opendocument.database","odb"],["application/vnd.oasis.opendocument.formula","odf"],["application/vnd.oasis.opendocument.formula-template","odft"],["application/vnd.oasis.opendocument.graphics","odg"],["application/vnd.oasis.opendocument.graphics-template","otg"],["application/vnd.oasis.opendocument.image","odi"],["application/vnd.oasis.opendocument.image-template","oti"],["application/vnd.oasis.opendocument.presentation","odp"],["application/vnd.oasis.opendocument.presentation-template","otp"],["application/vnd.oasis.opendocument.spreadsheet","ods"],["application/vnd.oasis.opendocument.spreadsheet-template","ots"],["application/vnd.oasis.opendocument.text","odt"],["application/vnd.oasis.opendocument.text-master","odm"],["application/vnd.oasis.opendocument.text-template","ott"],["application/vnd.oasis.opendocument.text-web","oth"],["application/vnd.olpc-sugar","xo"],["application/vnd.oma.dd2+xml","dd2"],["application/vnd.openofficeorg.extension","oxt"],["application/vnd.openxmlformats-officedocument.presentationml.presentation","pptx"],["application/vnd.openxmlformats-officedocument.presentationml.slide","sldx"],["application/vnd.openxmlformats-officedocument.presentationml.slideshow","ppsx"],["application/vnd.openxmlformats-officedocument.presentationml.template","potx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet","xlsx"],["application/vnd.openxmlformats-officedocument.spreadsheetml.template","xltx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.document","docx"],["application/vnd.openxmlformats-officedocument.wordprocessingml.template","dotx"],["application/vnd.osgeo.mapguide.package","mgp"],["application/vnd.osgi.dp","dp"],["application/vnd.palm","pdb"],["application/vnd.pawaafile","paw"],["application/vnd.pg.format","str"],["application/vnd.pg.osasli","ei6"],["application/vnd.picsel","efif"],["application/vnd.pmi.widget","wg"],["application/vnd.pocketlearn","plf"],["application/vnd.powerbuilder6","pbd"],["application/vnd.previewsystems.box","box"],["application/vnd.proteus.magazine","mgz"],["application/vnd.publishare-delta-tree","qps"],["application/vnd.pvi.ptid1","ptid"],["application/vnd.quark.quarkxpress","qxd"],["application/vnd.realvnc.bed","bed"],["application/vnd.recordare.musicxml","mxl"],["application/vnd.recordare.musicxml+xml","musicxml"],["application/vnd.rig.cryptonote","cryptonote"],["application/vnd.rim.cod","cod"],["application/vnd.rn-realmedia","rm"],["application/vnd.rn-realplayer","rnx"],["application/vnd.route66.link66+xml","link66"],["application/vnd.sailingtracker.track","st"],["application/vnd.seemail","see"],["application/vnd.sema","sema"],["application/vnd.semd","semd"],["application/vnd.semf","semf"],["application/vnd.shana.informed.formdata","ifm"],["application/vnd.shana.informed.formtemplate","itp"],["application/vnd.shana.informed.interchange","iif"],["application/vnd.shana.informed.package","ipk"],["application/vnd.simtech-mindmapper","twd"],["application/vnd.smaf","mmf"],["application/vnd.smart.teacher","teacher"],["application/vnd.solent.sdkm+xml","sdkm"],["application/vnd.spotfire.dxp","dxp"],["application/vnd.spotfire.sfs","sfs"],["application/vnd.stardivision.calc","sdc"],["application/vnd.stardivision.draw","sda"],["application/vnd.stardivision.impress","sdd"],["application/vnd.stardivision.math","smf"],["application/vnd.stardivision.writer","sdw"],["application/vnd.stardivision.writer-global","sgl"],["application/vnd.stepmania.stepchart","sm"],["application/vnd.sun.xml.calc","sxc"],["application/vnd.sun.xml.calc.template","stc"],["application/vnd.sun.xml.draw","sxd"],["application/vnd.sun.xml.draw.template","std"],["application/vnd.sun.xml.impress","sxi"],["application/vnd.sun.xml.impress.template","sti"],["application/vnd.sun.xml.math","sxm"],["application/vnd.sun.xml.writer","sxw"],["application/vnd.sun.xml.writer.global","sxg"],["application/vnd.sun.xml.writer.template","stw"],["application/vnd.sus-calendar","sus"],["application/vnd.svd","svd"],["application/vnd.symbian.install","sis"],["application/vnd.syncml+xml","xsm"],["application/vnd.syncml.dm+wbxml","bdm"],["application/vnd.syncml.dm+xml","xdm"],["application/vnd.tao.intent-module-archive","tao"],["application/vnd.tmobile-livetv","tmo"],["application/vnd.trid.tpt","tpt"],["application/vnd.triscape.mxs","mxs"],["application/vnd.trueapp","tra"],["application/vnd.ufdl","ufd"],["application/vnd.uiq.theme","utz"],["application/vnd.umajin","umj"],["application/vnd.unity","unityweb"],["application/vnd.uoml+xml","uoml"],["application/vnd.vcx","vcx"],["application/vnd.visio","vsd"],["application/vnd.visionary","vis"],["application/vnd.vsf","vsf"],["application/vnd.wap.wbxml","wbxml"],["application/vnd.wap.wmlc","wmlc"],["application/vnd.wap.wmlscriptc","wmlsc"],["application/vnd.webturbo","wtb"],["application/vnd.wolfram.player","nbp"],["application/vnd.wordperfect","wpd"],["application/vnd.wqd","wqd"],["application/vnd.wt.stf","stf"],["application/vnd.xara",["web","xar"]],["application/vnd.xfdl","xfdl"],["application/vnd.yamaha.hv-dic","hvd"],["application/vnd.yamaha.hv-script","hvs"],["application/vnd.yamaha.hv-voice","hvp"],["application/vnd.yamaha.openscoreformat","osf"],["application/vnd.yamaha.openscoreformat.osfpvg+xml","osfpvg"],["application/vnd.yamaha.smaf-audio","saf"],["application/vnd.yamaha.smaf-phrase","spf"],["application/vnd.yellowriver-custom-menu","cmp"],["application/vnd.zul","zir"],["application/vnd.zzazz.deck+xml","zaz"],["application/vocaltec-media-desc","vmd"],["application/vocaltec-media-file","vmf"],["application/voicexml+xml","vxml"],["application/widget","wgt"],["application/winhlp","hlp"],["application/wordperfect",["wp","wp5","wp6","wpd"]],["application/wordperfect6.0",["w60","wp5"]],["application/wordperfect6.1","w61"],["application/wsdl+xml","wsdl"],["application/wspolicy+xml","wspolicy"],["application/x-123","wk1"],["application/x-7z-compressed","7z"],["application/x-abiword","abw"],["application/x-ace-compressed","ace"],["application/x-aim","aim"],["application/x-authorware-bin","aab"],["application/x-authorware-map","aam"],["application/x-authorware-seg","aas"],["application/x-bcpio","bcpio"],["application/x-binary","bin"],["application/x-binhex40","hqx"],["application/x-bittorrent","torrent"],["application/x-bsh",["bsh","sh","shar"]],["application/x-bytecode.elisp","elc"],["application/x-bytecode.python","pyc"],["application/x-bzip","bz"],["application/x-bzip2",["boz","bz2"]],["application/x-cdf","cdf"],["application/x-cdlink","vcd"],["application/x-chat",["cha","chat"]],["application/x-chess-pgn","pgn"],["application/x-cmu-raster","ras"],["application/x-cocoa","cco"],["application/x-compactpro","cpt"],["application/x-compress","z"],["application/x-compressed",["tgz","gz","z","zip"]],["application/x-conference","nsc"],["application/x-cpio","cpio"],["application/x-cpt","cpt"],["application/x-csh","csh"],["application/x-debian-package","deb"],["application/x-deepv","deepv"],["application/x-director",["dir","dcr","dxr"]],["application/x-doom","wad"],["application/x-dtbncx+xml","ncx"],["application/x-dtbook+xml","dtb"],["application/x-dtbresource+xml","res"],["application/x-dvi","dvi"],["application/x-elc","elc"],["application/x-envoy",["env","evy"]],["application/x-esrehber","es"],["application/x-excel",["xls","xla","xlb","xlc","xld","xlk","xll","xlm","xlt","xlv","xlw"]],["application/x-font-bdf","bdf"],["application/x-font-ghostscript","gsf"],["application/x-font-linux-psf","psf"],["application/x-font-otf","otf"],["application/x-font-pcf","pcf"],["application/x-font-snf","snf"],["application/x-font-ttf","ttf"],["application/x-font-type1","pfa"],["application/x-font-woff","woff"],["application/x-frame","mif"],["application/x-freelance","pre"],["application/x-futuresplash","spl"],["application/x-gnumeric","gnumeric"],["application/x-gsp","gsp"],["application/x-gss","gss"],["application/x-gtar","gtar"],["application/x-gzip",["gz","gzip"]],["application/x-hdf","hdf"],["application/x-helpfile",["help","hlp"]],["application/x-httpd-imap","imap"],["application/x-ima","ima"],["application/x-internet-signup",["ins","isp"]],["application/x-internett-signup","ins"],["application/x-inventor","iv"],["application/x-ip2","ip"],["application/x-iphone","iii"],["application/x-java-class","class"],["application/x-java-commerce","jcm"],["application/x-java-jnlp-file","jnlp"],["application/x-javascript","js"],["application/x-koan",["skd","skm","skp","skt"]],["application/x-ksh","ksh"],["application/x-latex",["latex","ltx"]],["application/x-lha","lha"],["application/x-lisp","lsp"],["application/x-livescreen","ivy"],["application/x-lotus","wq1"],["application/x-lotusscreencam","scm"],["application/x-lzh","lzh"],["application/x-lzx","lzx"],["application/x-mac-binhex40","hqx"],["application/x-macbinary","bin"],["application/x-magic-cap-package-1.0","mc$"],["application/x-mathcad","mcd"],["application/x-meme","mm"],["application/x-midi",["mid","midi"]],["application/x-mif","mif"],["application/x-mix-transfer","nix"],["application/x-mobipocket-ebook","prc"],["application/x-mplayer2","asx"],["application/x-ms-application","application"],["application/x-ms-wmd","wmd"],["application/x-ms-wmz","wmz"],["application/x-ms-xbap","xbap"],["application/x-msaccess","mdb"],["application/x-msbinder","obd"],["application/x-mscardfile","crd"],["application/x-msclip","clp"],["application/x-msdownload",["exe","dll"]],["application/x-msexcel",["xls","xla","xlw"]],["application/x-msmediaview",["mvb","m13","m14"]],["application/x-msmetafile","wmf"],["application/x-msmoney","mny"],["application/x-mspowerpoint","ppt"],["application/x-mspublisher","pub"],["application/x-msschedule","scd"],["application/x-msterminal","trm"],["application/x-mswrite","wri"],["application/x-navi-animation","ani"],["application/x-navidoc","nvd"],["application/x-navimap","map"],["application/x-navistyle","stl"],["application/x-netcdf",["cdf","nc"]],["application/x-newton-compatible-pkg","pkg"],["application/x-nokia-9000-communicator-add-on-software","aos"],["application/x-omc","omc"],["application/x-omcdatamaker","omcd"],["application/x-omcregerator","omcr"],["application/x-pagemaker",["pm4","pm5"]],["application/x-pcl","pcl"],["application/x-perfmon",["pma","pmc","pml","pmr","pmw"]],["application/x-pixclscript","plx"],["application/x-pkcs10","p10"],["application/x-pkcs12",["p12","pfx"]],["application/x-pkcs7-certificates",["p7b","spc"]],["application/x-pkcs7-certreqresp","p7r"],["application/x-pkcs7-mime",["p7m","p7c"]],["application/x-pkcs7-signature",["p7s","p7a"]],["application/x-pointplus","css"],["application/x-portable-anymap","pnm"],["application/x-project",["mpc","mpt","mpv","mpx"]],["application/x-qpro","wb1"],["application/x-rar-compressed","rar"],["application/x-rtf","rtf"],["application/x-sdp","sdp"],["application/x-sea","sea"],["application/x-seelogo","sl"],["application/x-sh","sh"],["application/x-shar",["shar","sh"]],["application/x-shockwave-flash","swf"],["application/x-silverlight-app","xap"],["application/x-sit","sit"],["application/x-sprite",["spr","sprite"]],["application/x-stuffit","sit"],["application/x-stuffitx","sitx"],["application/x-sv4cpio","sv4cpio"],["application/x-sv4crc","sv4crc"],["application/x-tar","tar"],["application/x-tbook",["sbk","tbk"]],["application/x-tcl","tcl"],["application/x-tex","tex"],["application/x-tex-tfm","tfm"],["application/x-texinfo",["texi","texinfo"]],["application/x-troff",["roff","t","tr"]],["application/x-troff-man","man"],["application/x-troff-me","me"],["application/x-troff-ms","ms"],["application/x-troff-msvideo","avi"],["application/x-ustar","ustar"],["application/x-visio",["vsd","vst","vsw"]],["application/x-vnd.audioexplosion.mzz","mzz"],["application/x-vnd.ls-xpix","xpix"],["application/x-vrml","vrml"],["application/x-wais-source",["src","wsrc"]],["application/x-winhelp","hlp"],["application/x-wintalk","wtk"],["application/x-world",["wrl","svr"]],["application/x-wpwin","wpd"],["application/x-wri","wri"],["application/x-x509-ca-cert",["cer","crt","der"]],["application/x-x509-user-cert","crt"],["application/x-xfig","fig"],["application/x-xpinstall","xpi"],["application/x-zip-compressed","zip"],["application/xcap-diff+xml","xdf"],["application/xenc+xml","xenc"],["application/xhtml+xml","xhtml"],["application/xml","xml"],["application/xml-dtd","dtd"],["application/xop+xml","xop"],["application/xslt+xml","xslt"],["application/xspf+xml","xspf"],["application/xv+xml","mxml"],["application/yang","yang"],["application/yin+xml","yin"],["application/ynd.ms-pkipko","pko"],["application/zip","zip"],["audio/adpcm","adp"],["audio/aiff",["aiff","aif","aifc"]],["audio/basic",["snd","au"]],["audio/it","it"],["audio/make",["funk","my","pfunk"]],["audio/make.my.funk","pfunk"],["audio/mid",["mid","rmi"]],["audio/midi",["midi","kar","mid"]],["audio/mod","mod"],["audio/mp4","mp4a"],["audio/mpeg",["mpga","mp3","m2a","mp2","mpa","mpg"]],["audio/mpeg3","mp3"],["audio/nspaudio",["la","lma"]],["audio/ogg","oga"],["audio/s3m","s3m"],["audio/tsp-audio","tsi"],["audio/tsplayer","tsp"],["audio/vnd.dece.audio","uva"],["audio/vnd.digital-winds","eol"],["audio/vnd.dra","dra"],["audio/vnd.dts","dts"],["audio/vnd.dts.hd","dtshd"],["audio/vnd.lucent.voice","lvp"],["audio/vnd.ms-playready.media.pya","pya"],["audio/vnd.nuera.ecelp4800","ecelp4800"],["audio/vnd.nuera.ecelp7470","ecelp7470"],["audio/vnd.nuera.ecelp9600","ecelp9600"],["audio/vnd.qcelp","qcp"],["audio/vnd.rip","rip"],["audio/voc","voc"],["audio/voxware","vox"],["audio/wav","wav"],["audio/webm","weba"],["audio/x-aac","aac"],["audio/x-adpcm","snd"],["audio/x-aiff",["aiff","aif","aifc"]],["audio/x-au","au"],["audio/x-gsm",["gsd","gsm"]],["audio/x-jam","jam"],["audio/x-liveaudio","lam"],["audio/x-mid",["mid","midi"]],["audio/x-midi",["midi","mid"]],["audio/x-mod","mod"],["audio/x-mpeg","mp2"],["audio/x-mpeg-3","mp3"],["audio/x-mpegurl","m3u"],["audio/x-mpequrl","m3u"],["audio/x-ms-wax","wax"],["audio/x-ms-wma","wma"],["audio/x-nspaudio",["la","lma"]],["audio/x-pn-realaudio",["ra","ram","rm","rmm","rmp"]],["audio/x-pn-realaudio-plugin",["ra","rmp","rpm"]],["audio/x-psid","sid"],["audio/x-realaudio","ra"],["audio/x-twinvq","vqf"],["audio/x-twinvq-plugin",["vqe","vql"]],["audio/x-vnd.audioexplosion.mjuicemediafile","mjf"],["audio/x-voc","voc"],["audio/x-wav","wav"],["audio/xm","xm"],["chemical/x-cdx","cdx"],["chemical/x-cif","cif"],["chemical/x-cmdf","cmdf"],["chemical/x-cml","cml"],["chemical/x-csml","csml"],["chemical/x-pdb",["pdb","xyz"]],["chemical/x-xyz","xyz"],["drawing/x-dwf","dwf"],["i-world/i-vrml","ivr"],["image/bmp",["bmp","bm"]],["image/cgm","cgm"],["image/cis-cod","cod"],["image/cmu-raster",["ras","rast"]],["image/fif","fif"],["image/florian",["flo","turbot"]],["image/g3fax","g3"],["image/gif","gif"],["image/ief",["ief","iefs"]],["image/jpeg",["jpeg","jpe","jpg","jfif","jfif-tbnl"]],["image/jutvision","jut"],["image/ktx","ktx"],["image/naplps",["nap","naplps"]],["image/pict",["pic","pict"]],["image/pipeg","jfif"],["image/pjpeg",["jfif","jpe","jpeg","jpg"]],["image/png",["png","x-png"]],["image/prs.btif","btif"],["image/svg+xml","svg"],["image/tiff",["tif","tiff"]],["image/vasa","mcf"],["image/vnd.adobe.photoshop","psd"],["image/vnd.dece.graphic","uvi"],["image/vnd.djvu","djvu"],["image/vnd.dvb.subtitle","sub"],["image/vnd.dwg",["dwg","dxf","svf"]],["image/vnd.dxf","dxf"],["image/vnd.fastbidsheet","fbs"],["image/vnd.fpx","fpx"],["image/vnd.fst","fst"],["image/vnd.fujixerox.edmics-mmr","mmr"],["image/vnd.fujixerox.edmics-rlc","rlc"],["image/vnd.ms-modi","mdi"],["image/vnd.net-fpx",["fpx","npx"]],["image/vnd.rn-realflash","rf"],["image/vnd.rn-realpix","rp"],["image/vnd.wap.wbmp","wbmp"],["image/vnd.xiff","xif"],["image/webp","webp"],["image/x-cmu-raster","ras"],["image/x-cmx","cmx"],["image/x-dwg",["dwg","dxf","svf"]],["image/x-freehand","fh"],["image/x-icon","ico"],["image/x-jg","art"],["image/x-jps","jps"],["image/x-niff",["niff","nif"]],["image/x-pcx","pcx"],["image/x-pict",["pct","pic"]],["image/x-portable-anymap","pnm"],["image/x-portable-bitmap","pbm"],["image/x-portable-graymap","pgm"],["image/x-portable-greymap","pgm"],["image/x-portable-pixmap","ppm"],["image/x-quicktime",["qif","qti","qtif"]],["image/x-rgb","rgb"],["image/x-tiff",["tif","tiff"]],["image/x-windows-bmp","bmp"],["image/x-xbitmap","xbm"],["image/x-xbm","xbm"],["image/x-xpixmap",["xpm","pm"]],["image/x-xwd","xwd"],["image/x-xwindowdump","xwd"],["image/xbm","xbm"],["image/xpm","xpm"],["message/rfc822",["eml","mht","mhtml","nws","mime"]],["model/iges",["iges","igs"]],["model/mesh","msh"],["model/vnd.collada+xml","dae"],["model/vnd.dwf","dwf"],["model/vnd.gdl","gdl"],["model/vnd.gtw","gtw"],["model/vnd.mts","mts"],["model/vnd.vtu","vtu"],["model/vrml",["vrml","wrl","wrz"]],["model/x-pov","pov"],["multipart/x-gzip","gzip"],["multipart/x-ustar","ustar"],["multipart/x-zip","zip"],["music/crescendo",["mid","midi"]],["music/x-karaoke","kar"],["paleovu/x-pv","pvu"],["text/asp","asp"],["text/calendar","ics"],["text/css","css"],["text/csv","csv"],["text/ecmascript","js"],["text/h323","323"],["text/html",["html","htm","stm","acgi","htmls","htx","shtml"]],["text/iuls","uls"],["text/javascript","js"],["text/mcf","mcf"],["text/n3","n3"],["text/pascal","pas"],["text/plain",["txt","bas","c","h","c++","cc","com","conf","cxx","def","f","f90","for","g","hh","idc","jav","java","list","log","lst","m","mar","pl","sdml","text"]],["text/plain-bas","par"],["text/prs.lines.tag","dsc"],["text/richtext",["rtx","rt","rtf"]],["text/scriplet","wsc"],["text/scriptlet","sct"],["text/sgml",["sgm","sgml"]],["text/tab-separated-values","tsv"],["text/troff","t"],["text/turtle","ttl"],["text/uri-list",["uni","unis","uri","uris"]],["text/vnd.abc","abc"],["text/vnd.curl","curl"],["text/vnd.curl.dcurl","dcurl"],["text/vnd.curl.mcurl","mcurl"],["text/vnd.curl.scurl","scurl"],["text/vnd.fly","fly"],["text/vnd.fmi.flexstor","flx"],["text/vnd.graphviz","gv"],["text/vnd.in3d.3dml","3dml"],["text/vnd.in3d.spot","spot"],["text/vnd.rn-realtext","rt"],["text/vnd.sun.j2me.app-descriptor","jad"],["text/vnd.wap.wml","wml"],["text/vnd.wap.wmlscript","wmls"],["text/webviewhtml","htt"],["text/x-asm",["asm","s"]],["text/x-audiosoft-intra","aip"],["text/x-c",["c","cc","cpp"]],["text/x-component","htc"],["text/x-fortran",["for","f","f77","f90"]],["text/x-h",["h","hh"]],["text/x-java-source",["java","jav"]],["text/x-java-source,java","java"],["text/x-la-asf","lsx"],["text/x-m","m"],["text/x-pascal","p"],["text/x-script","hlb"],["text/x-script.csh","csh"],["text/x-script.elisp","el"],["text/x-script.guile","scm"],["text/x-script.ksh","ksh"],["text/x-script.lisp","lsp"],["text/x-script.perl","pl"],["text/x-script.perl-module","pm"],["text/x-script.phyton","py"],["text/x-script.rexx","rexx"],["text/x-script.scheme","scm"],["text/x-script.sh","sh"],["text/x-script.tcl","tcl"],["text/x-script.tcsh","tcsh"],["text/x-script.zsh","zsh"],["text/x-server-parsed-html",["shtml","ssi"]],["text/x-setext","etx"],["text/x-sgml",["sgm","sgml"]],["text/x-speech",["spc","talk"]],["text/x-uil","uil"],["text/x-uuencode",["uu","uue"]],["text/x-vcalendar","vcs"],["text/x-vcard","vcf"],["text/xml","xml"],["video/3gpp","3gp"],["video/3gpp2","3g2"],["video/animaflex","afl"],["video/avi","avi"],["video/avs-video","avs"],["video/dl","dl"],["video/fli","fli"],["video/gl","gl"],["video/h261","h261"],["video/h263","h263"],["video/h264","h264"],["video/jpeg","jpgv"],["video/jpm","jpm"],["video/mj2","mj2"],["video/mp4","mp4"],["video/mpeg",["mpeg","mp2","mpa","mpe","mpg","mpv2","m1v","m2v","mp3"]],["video/msvideo","avi"],["video/ogg","ogv"],["video/quicktime",["mov","qt","moov"]],["video/vdo","vdo"],["video/vivo",["viv","vivo"]],["video/vnd.dece.hd","uvh"],["video/vnd.dece.mobile","uvm"],["video/vnd.dece.pd","uvp"],["video/vnd.dece.sd","uvs"],["video/vnd.dece.video","uvv"],["video/vnd.fvt","fvt"],["video/vnd.mpegurl","mxu"],["video/vnd.ms-playready.media.pyv","pyv"],["video/vnd.rn-realvideo","rv"],["video/vnd.uvvu.mp4","uvu"],["video/vnd.vivo",["viv","vivo"]],["video/vosaic","vos"],["video/webm","webm"],["video/x-amt-demorun","xdr"],["video/x-amt-showrun","xsr"],["video/x-atomic3d-feature","fmf"],["video/x-dl","dl"],["video/x-dv",["dif","dv"]],["video/x-f4v","f4v"],["video/x-fli","fli"],["video/x-flv","flv"],["video/x-gl","gl"],["video/x-isvideo","isu"],["video/x-la-asf",["lsf","lsx"]],["video/x-m4v","m4v"],["video/x-motion-jpeg","mjpg"],["video/x-mpeg",["mp3","mp2"]],["video/x-mpeq2a","mp2"],["video/x-ms-asf",["asf","asr","asx"]],["video/x-ms-asf-plugin","asx"],["video/x-ms-wm","wm"],["video/x-ms-wmv","wmv"],["video/x-ms-wmx","wmx"],["video/x-ms-wvx","wvx"],["video/x-msvideo","avi"],["video/x-qtc","qtc"],["video/x-scm","scm"],["video/x-sgi-movie",["movie","mv"]],["windows/metafile","wmf"],["www/mime","mime"],["x-conference/x-cooltalk","ice"],["x-music/x-midi",["mid","midi"]],["x-world/x-3dmf",["3dm","3dmf","qd3","qd3d"]],["x-world/x-svr","svr"],["x-world/x-vrml",["flr","vrml","wrl","wrz","xaf","xof"]],["x-world/x-vrt","vrt"],["xgl/drawing","xgz"],["xgl/movie","xmz"]]),lA=new Map([["123","application/vnd.lotus-1-2-3"],["323","text/h323"],["*","application/octet-stream"],["3dm","x-world/x-3dmf"],["3dmf","x-world/x-3dmf"],["3dml","text/vnd.in3d.3dml"],["3g2","video/3gpp2"],["3gp","video/3gpp"],["7z","application/x-7z-compressed"],["a","application/octet-stream"],["aab","application/x-authorware-bin"],["aac","audio/x-aac"],["aam","application/x-authorware-map"],["aas","application/x-authorware-seg"],["abc","text/vnd.abc"],["abw","application/x-abiword"],["ac","application/pkix-attr-cert"],["acc","application/vnd.americandynamics.acc"],["ace","application/x-ace-compressed"],["acgi","text/html"],["acu","application/vnd.acucobol"],["acx","application/internet-property-stream"],["adp","audio/adpcm"],["aep","application/vnd.audiograph"],["afl","video/animaflex"],["afp","application/vnd.ibm.modcap"],["ahead","application/vnd.ahead.space"],["ai","application/postscript"],["aif",["audio/aiff","audio/x-aiff"]],["aifc",["audio/aiff","audio/x-aiff"]],["aiff",["audio/aiff","audio/x-aiff"]],["aim","application/x-aim"],["aip","text/x-audiosoft-intra"],["air","application/vnd.adobe.air-application-installer-package+zip"],["ait","application/vnd.dvb.ait"],["ami","application/vnd.amiga.ami"],["ani","application/x-navi-animation"],["aos","application/x-nokia-9000-communicator-add-on-software"],["apk","application/vnd.android.package-archive"],["application","application/x-ms-application"],["apr","application/vnd.lotus-approach"],["aps","application/mime"],["arc","application/octet-stream"],["arj",["application/arj","application/octet-stream"]],["art","image/x-jg"],["asf","video/x-ms-asf"],["asm","text/x-asm"],["aso","application/vnd.accpac.simply.aso"],["asp","text/asp"],["asr","video/x-ms-asf"],["asx",["video/x-ms-asf","application/x-mplayer2","video/x-ms-asf-plugin"]],["atc","application/vnd.acucorp"],["atomcat","application/atomcat+xml"],["atomsvc","application/atomsvc+xml"],["atx","application/vnd.antix.game-component"],["au",["audio/basic","audio/x-au"]],["avi",["video/avi","video/msvideo","application/x-troff-msvideo","video/x-msvideo"]],["avs","video/avs-video"],["aw","application/applixware"],["axs","application/olescript"],["azf","application/vnd.airzip.filesecure.azf"],["azs","application/vnd.airzip.filesecure.azs"],["azw","application/vnd.amazon.ebook"],["bas","text/plain"],["bcpio","application/x-bcpio"],["bdf","application/x-font-bdf"],["bdm","application/vnd.syncml.dm+wbxml"],["bed","application/vnd.realvnc.bed"],["bh2","application/vnd.fujitsu.oasysprs"],["bin",["application/octet-stream","application/mac-binary","application/macbinary","application/x-macbinary","application/x-binary"]],["bm","image/bmp"],["bmi","application/vnd.bmi"],["bmp",["image/bmp","image/x-windows-bmp"]],["boo","application/book"],["book","application/book"],["box","application/vnd.previewsystems.box"],["boz","application/x-bzip2"],["bsh","application/x-bsh"],["btif","image/prs.btif"],["bz","application/x-bzip"],["bz2","application/x-bzip2"],["c",["text/plain","text/x-c"]],["c++","text/plain"],["c11amc","application/vnd.cluetrust.cartomobile-config"],["c11amz","application/vnd.cluetrust.cartomobile-config-pkg"],["c4g","application/vnd.clonk.c4group"],["cab","application/vnd.ms-cab-compressed"],["car","application/vnd.curl.car"],["cat",["application/vnd.ms-pkiseccat","application/vnd.ms-pki.seccat"]],["cc",["text/plain","text/x-c"]],["ccad","application/clariscad"],["cco","application/x-cocoa"],["ccxml","application/ccxml+xml,"],["cdbcmsg","application/vnd.contact.cmsg"],["cdf",["application/cdf","application/x-cdf","application/x-netcdf"]],["cdkey","application/vnd.mediastation.cdkey"],["cdmia","application/cdmi-capability"],["cdmic","application/cdmi-container"],["cdmid","application/cdmi-domain"],["cdmio","application/cdmi-object"],["cdmiq","application/cdmi-queue"],["cdx","chemical/x-cdx"],["cdxml","application/vnd.chemdraw+xml"],["cdy","application/vnd.cinderella"],["cer",["application/pkix-cert","application/x-x509-ca-cert"]],["cgm","image/cgm"],["cha","application/x-chat"],["chat","application/x-chat"],["chm","application/vnd.ms-htmlhelp"],["chrt","application/vnd.kde.kchart"],["cif","chemical/x-cif"],["cii","application/vnd.anser-web-certificate-issue-initiation"],["cil","application/vnd.ms-artgalry"],["cla","application/vnd.claymore"],["class",["application/octet-stream","application/java","application/java-byte-code","application/java-vm","application/x-java-class"]],["clkk","application/vnd.crick.clicker.keyboard"],["clkp","application/vnd.crick.clicker.palette"],["clkt","application/vnd.crick.clicker.template"],["clkw","application/vnd.crick.clicker.wordbank"],["clkx","application/vnd.crick.clicker"],["clp","application/x-msclip"],["cmc","application/vnd.cosmocaller"],["cmdf","chemical/x-cmdf"],["cml","chemical/x-cml"],["cmp","application/vnd.yellowriver-custom-menu"],["cmx","image/x-cmx"],["cod",["image/cis-cod","application/vnd.rim.cod"]],["com",["application/octet-stream","text/plain"]],["conf","text/plain"],["cpio","application/x-cpio"],["cpp","text/x-c"],["cpt",["application/mac-compactpro","application/x-compactpro","application/x-cpt"]],["crd","application/x-mscardfile"],["crl",["application/pkix-crl","application/pkcs-crl"]],["crt",["application/pkix-cert","application/x-x509-user-cert","application/x-x509-ca-cert"]],["cryptonote","application/vnd.rig.cryptonote"],["csh",["text/x-script.csh","application/x-csh"]],["csml","chemical/x-csml"],["csp","application/vnd.commonspace"],["css",["text/css","application/x-pointplus"]],["csv","text/csv"],["cu","application/cu-seeme"],["curl","text/vnd.curl"],["cww","application/prs.cww"],["cxx","text/plain"],["dae","model/vnd.collada+xml"],["daf","application/vnd.mobius.daf"],["davmount","application/davmount+xml"],["dcr","application/x-director"],["dcurl","text/vnd.curl.dcurl"],["dd2","application/vnd.oma.dd2+xml"],["ddd","application/vnd.fujixerox.ddd"],["deb","application/x-debian-package"],["deepv","application/x-deepv"],["def","text/plain"],["der","application/x-x509-ca-cert"],["dfac","application/vnd.dreamfactory"],["dif","video/x-dv"],["dir","application/x-director"],["dis","application/vnd.mobius.dis"],["djvu","image/vnd.djvu"],["dl",["video/dl","video/x-dl"]],["dll","application/x-msdownload"],["dms","application/octet-stream"],["dna","application/vnd.dna"],["doc","application/msword"],["docm","application/vnd.ms-word.document.macroenabled.12"],["docx","application/vnd.openxmlformats-officedocument.wordprocessingml.document"],["dot","application/msword"],["dotm","application/vnd.ms-word.template.macroenabled.12"],["dotx","application/vnd.openxmlformats-officedocument.wordprocessingml.template"],["dp",["application/commonground","application/vnd.osgi.dp"]],["dpg","application/vnd.dpgraph"],["dra","audio/vnd.dra"],["drw","application/drafting"],["dsc","text/prs.lines.tag"],["dssc","application/dssc+der"],["dtb","application/x-dtbook+xml"],["dtd","application/xml-dtd"],["dts","audio/vnd.dts"],["dtshd","audio/vnd.dts.hd"],["dump","application/octet-stream"],["dv","video/x-dv"],["dvi","application/x-dvi"],["dwf",["model/vnd.dwf","drawing/x-dwf"]],["dwg",["application/acad","image/vnd.dwg","image/x-dwg"]],["dxf",["application/dxf","image/vnd.dwg","image/vnd.dxf","image/x-dwg"]],["dxp","application/vnd.spotfire.dxp"],["dxr","application/x-director"],["ecelp4800","audio/vnd.nuera.ecelp4800"],["ecelp7470","audio/vnd.nuera.ecelp7470"],["ecelp9600","audio/vnd.nuera.ecelp9600"],["edm","application/vnd.novadigm.edm"],["edx","application/vnd.novadigm.edx"],["efif","application/vnd.picsel"],["ei6","application/vnd.pg.osasli"],["el","text/x-script.elisp"],["elc",["application/x-elc","application/x-bytecode.elisp"]],["eml","message/rfc822"],["emma","application/emma+xml"],["env","application/x-envoy"],["eol","audio/vnd.digital-winds"],["eot","application/vnd.ms-fontobject"],["eps","application/postscript"],["epub","application/epub+zip"],["es",["application/ecmascript","application/x-esrehber"]],["es3","application/vnd.eszigno3+xml"],["esf","application/vnd.epson.esf"],["etx","text/x-setext"],["evy",["application/envoy","application/x-envoy"]],["exe",["application/octet-stream","application/x-msdownload"]],["exi","application/exi"],["ext","application/vnd.novadigm.ext"],["ez2","application/vnd.ezpix-album"],["ez3","application/vnd.ezpix-package"],["f",["text/plain","text/x-fortran"]],["f4v","video/x-f4v"],["f77","text/x-fortran"],["f90",["text/plain","text/x-fortran"]],["fbs","image/vnd.fastbidsheet"],["fcs","application/vnd.isac.fcs"],["fdf","application/vnd.fdf"],["fe_launch","application/vnd.denovo.fcselayout-link"],["fg5","application/vnd.fujitsu.oasysgp"],["fh","image/x-freehand"],["fif",["application/fractals","image/fif"]],["fig","application/x-xfig"],["fli",["video/fli","video/x-fli"]],["flo",["image/florian","application/vnd.micrografx.flo"]],["flr","x-world/x-vrml"],["flv","video/x-flv"],["flw","application/vnd.kde.kivio"],["flx","text/vnd.fmi.flexstor"],["fly","text/vnd.fly"],["fm","application/vnd.framemaker"],["fmf","video/x-atomic3d-feature"],["fnc","application/vnd.frogans.fnc"],["for",["text/plain","text/x-fortran"]],["fpx",["image/vnd.fpx","image/vnd.net-fpx"]],["frl","application/freeloader"],["fsc","application/vnd.fsc.weblaunch"],["fst","image/vnd.fst"],["ftc","application/vnd.fluxtime.clip"],["fti","application/vnd.anser-web-funds-transfer-initiation"],["funk","audio/make"],["fvt","video/vnd.fvt"],["fxp","application/vnd.adobe.fxp"],["fzs","application/vnd.fuzzysheet"],["g","text/plain"],["g2w","application/vnd.geoplan"],["g3","image/g3fax"],["g3w","application/vnd.geospace"],["gac","application/vnd.groove-account"],["gdl","model/vnd.gdl"],["geo","application/vnd.dynageo"],["geojson","application/geo+json"],["gex","application/vnd.geometry-explorer"],["ggb","application/vnd.geogebra.file"],["ggt","application/vnd.geogebra.tool"],["ghf","application/vnd.groove-help"],["gif","image/gif"],["gim","application/vnd.groove-identity-message"],["gl",["video/gl","video/x-gl"]],["gmx","application/vnd.gmx"],["gnumeric","application/x-gnumeric"],["gph","application/vnd.flographit"],["gqf","application/vnd.grafeq"],["gram","application/srgs"],["grv","application/vnd.groove-injector"],["grxml","application/srgs+xml"],["gsd","audio/x-gsm"],["gsf","application/x-font-ghostscript"],["gsm","audio/x-gsm"],["gsp","application/x-gsp"],["gss","application/x-gss"],["gtar","application/x-gtar"],["gtm","application/vnd.groove-tool-message"],["gtw","model/vnd.gtw"],["gv","text/vnd.graphviz"],["gxt","application/vnd.geonext"],["gz",["application/x-gzip","application/x-compressed"]],["gzip",["multipart/x-gzip","application/x-gzip"]],["h",["text/plain","text/x-h"]],["h261","video/h261"],["h263","video/h263"],["h264","video/h264"],["hal","application/vnd.hal+xml"],["hbci","application/vnd.hbci"],["hdf","application/x-hdf"],["help","application/x-helpfile"],["hgl","application/vnd.hp-hpgl"],["hh",["text/plain","text/x-h"]],["hlb","text/x-script"],["hlp",["application/winhlp","application/hlp","application/x-helpfile","application/x-winhelp"]],["hpg","application/vnd.hp-hpgl"],["hpgl","application/vnd.hp-hpgl"],["hpid","application/vnd.hp-hpid"],["hps","application/vnd.hp-hps"],["hqx",["application/mac-binhex40","application/binhex","application/binhex4","application/mac-binhex","application/x-binhex40","application/x-mac-binhex40"]],["hta","application/hta"],["htc","text/x-component"],["htke","application/vnd.kenameaapp"],["htm","text/html"],["html","text/html"],["htmls","text/html"],["htt","text/webviewhtml"],["htx","text/html"],["hvd","application/vnd.yamaha.hv-dic"],["hvp","application/vnd.yamaha.hv-voice"],["hvs","application/vnd.yamaha.hv-script"],["i2g","application/vnd.intergeo"],["icc","application/vnd.iccprofile"],["ice","x-conference/x-cooltalk"],["ico","image/x-icon"],["ics","text/calendar"],["idc","text/plain"],["ief","image/ief"],["iefs","image/ief"],["ifm","application/vnd.shana.informed.formdata"],["iges",["application/iges","model/iges"]],["igl","application/vnd.igloader"],["igm","application/vnd.insors.igm"],["igs",["application/iges","model/iges"]],["igx","application/vnd.micrografx.igx"],["iif","application/vnd.shana.informed.interchange"],["iii","application/x-iphone"],["ima","application/x-ima"],["imap","application/x-httpd-imap"],["imp","application/vnd.accpac.simply.imp"],["ims","application/vnd.ms-ims"],["inf","application/inf"],["ins",["application/x-internet-signup","application/x-internett-signup"]],["ip","application/x-ip2"],["ipfix","application/ipfix"],["ipk","application/vnd.shana.informed.package"],["irm","application/vnd.ibm.rights-management"],["irp","application/vnd.irepository.package+xml"],["isp","application/x-internet-signup"],["isu","video/x-isvideo"],["it","audio/it"],["itp","application/vnd.shana.informed.formtemplate"],["iv","application/x-inventor"],["ivp","application/vnd.immervision-ivp"],["ivr","i-world/i-vrml"],["ivu","application/vnd.immervision-ivu"],["ivy","application/x-livescreen"],["jad","text/vnd.sun.j2me.app-descriptor"],["jam",["application/vnd.jam","audio/x-jam"]],["jar","application/java-archive"],["jav",["text/plain","text/x-java-source"]],["java",["text/plain","text/x-java-source,java","text/x-java-source"]],["jcm","application/x-java-commerce"],["jfif",["image/pipeg","image/jpeg","image/pjpeg"]],["jfif-tbnl","image/jpeg"],["jisp","application/vnd.jisp"],["jlt","application/vnd.hp-jlyt"],["jnlp","application/x-java-jnlp-file"],["joda","application/vnd.joost.joda-archive"],["jpe",["image/jpeg","image/pjpeg"]],["jpeg",["image/jpeg","image/pjpeg"]],["jpg",["image/jpeg","image/pjpeg"]],["jpgv","video/jpeg"],["jpm","video/jpm"],["jps","image/x-jps"],["js",["application/javascript","application/ecmascript","text/javascript","text/ecmascript","application/x-javascript"]],["json","application/json"],["jut","image/jutvision"],["kar",["audio/midi","music/x-karaoke"]],["karbon","application/vnd.kde.karbon"],["kfo","application/vnd.kde.kformula"],["kia","application/vnd.kidspiration"],["kml","application/vnd.google-earth.kml+xml"],["kmz","application/vnd.google-earth.kmz"],["kne","application/vnd.kinar"],["kon","application/vnd.kde.kontour"],["kpr","application/vnd.kde.kpresenter"],["ksh",["application/x-ksh","text/x-script.ksh"]],["ksp","application/vnd.kde.kspread"],["ktx","image/ktx"],["ktz","application/vnd.kahootz"],["kwd","application/vnd.kde.kword"],["la",["audio/nspaudio","audio/x-nspaudio"]],["lam","audio/x-liveaudio"],["lasxml","application/vnd.las.las+xml"],["latex","application/x-latex"],["lbd","application/vnd.llamagraphics.life-balance.desktop"],["lbe","application/vnd.llamagraphics.life-balance.exchange+xml"],["les","application/vnd.hhe.lesson-player"],["lha",["application/octet-stream","application/lha","application/x-lha"]],["lhx","application/octet-stream"],["link66","application/vnd.route66.link66+xml"],["list","text/plain"],["lma",["audio/nspaudio","audio/x-nspaudio"]],["log","text/plain"],["lrm","application/vnd.ms-lrm"],["lsf","video/x-la-asf"],["lsp",["application/x-lisp","text/x-script.lisp"]],["lst","text/plain"],["lsx",["video/x-la-asf","text/x-la-asf"]],["ltf","application/vnd.frogans.ltf"],["ltx","application/x-latex"],["lvp","audio/vnd.lucent.voice"],["lwp","application/vnd.lotus-wordpro"],["lzh",["application/octet-stream","application/x-lzh"]],["lzx",["application/lzx","application/octet-stream","application/x-lzx"]],["m",["text/plain","text/x-m"]],["m13","application/x-msmediaview"],["m14","application/x-msmediaview"],["m1v","video/mpeg"],["m21","application/mp21"],["m2a","audio/mpeg"],["m2v","video/mpeg"],["m3u",["audio/x-mpegurl","audio/x-mpequrl"]],["m3u8","application/vnd.apple.mpegurl"],["m4v","video/x-m4v"],["ma","application/mathematica"],["mads","application/mads+xml"],["mag","application/vnd.ecowin.chart"],["man","application/x-troff-man"],["map","application/x-navimap"],["mar","text/plain"],["mathml","application/mathml+xml"],["mbd","application/mbedlet"],["mbk","application/vnd.mobius.mbk"],["mbox","application/mbox"],["mc$","application/x-magic-cap-package-1.0"],["mc1","application/vnd.medcalcdata"],["mcd",["application/mcad","application/vnd.mcd","application/x-mathcad"]],["mcf",["image/vasa","text/mcf"]],["mcp","application/netmc"],["mcurl","text/vnd.curl.mcurl"],["mdb","application/x-msaccess"],["mdi","image/vnd.ms-modi"],["me","application/x-troff-me"],["meta4","application/metalink4+xml"],["mets","application/mets+xml"],["mfm","application/vnd.mfmp"],["mgp","application/vnd.osgeo.mapguide.package"],["mgz","application/vnd.proteus.magazine"],["mht","message/rfc822"],["mhtml","message/rfc822"],["mid",["audio/mid","audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["midi",["audio/midi","music/crescendo","x-music/x-midi","audio/x-midi","application/x-midi","audio/x-mid"]],["mif",["application/vnd.mif","application/x-mif","application/x-frame"]],["mime",["message/rfc822","www/mime"]],["mj2","video/mj2"],["mjf","audio/x-vnd.audioexplosion.mjuicemediafile"],["mjpg","video/x-motion-jpeg"],["mlp","application/vnd.dolby.mlp"],["mm",["application/base64","application/x-meme"]],["mmd","application/vnd.chipnuts.karaoke-mmd"],["mme","application/base64"],["mmf","application/vnd.smaf"],["mmr","image/vnd.fujixerox.edmics-mmr"],["mny","application/x-msmoney"],["mod",["audio/mod","audio/x-mod"]],["mods","application/mods+xml"],["moov","video/quicktime"],["mov","video/quicktime"],["movie","video/x-sgi-movie"],["mp2",["video/mpeg","audio/mpeg","video/x-mpeg","audio/x-mpeg","video/x-mpeq2a"]],["mp3",["audio/mpeg","audio/mpeg3","video/mpeg","audio/x-mpeg-3","video/x-mpeg"]],["mp4",["video/mp4","application/mp4"]],["mp4a","audio/mp4"],["mpa",["video/mpeg","audio/mpeg"]],["mpc",["application/vnd.mophun.certificate","application/x-project"]],["mpe","video/mpeg"],["mpeg","video/mpeg"],["mpg",["video/mpeg","audio/mpeg"]],["mpga","audio/mpeg"],["mpkg","application/vnd.apple.installer+xml"],["mpm","application/vnd.blueice.multipass"],["mpn","application/vnd.mophun.application"],["mpp","application/vnd.ms-project"],["mpt","application/x-project"],["mpv","application/x-project"],["mpv2","video/mpeg"],["mpx","application/x-project"],["mpy","application/vnd.ibm.minipay"],["mqy","application/vnd.mobius.mqy"],["mrc","application/marc"],["mrcx","application/marcxml+xml"],["ms","application/x-troff-ms"],["mscml","application/mediaservercontrol+xml"],["mseq","application/vnd.mseq"],["msf","application/vnd.epson.msf"],["msg","application/vnd.ms-outlook"],["msh","model/mesh"],["msl","application/vnd.mobius.msl"],["msty","application/vnd.muvee.style"],["mts","model/vnd.mts"],["mus","application/vnd.musician"],["musicxml","application/vnd.recordare.musicxml+xml"],["mv","video/x-sgi-movie"],["mvb","application/x-msmediaview"],["mwf","application/vnd.mfer"],["mxf","application/mxf"],["mxl","application/vnd.recordare.musicxml"],["mxml","application/xv+xml"],["mxs","application/vnd.triscape.mxs"],["mxu","video/vnd.mpegurl"],["my","audio/make"],["mzz","application/x-vnd.audioexplosion.mzz"],["n-gage","application/vnd.nokia.n-gage.symbian.install"],["n3","text/n3"],["nap","image/naplps"],["naplps","image/naplps"],["nbp","application/vnd.wolfram.player"],["nc","application/x-netcdf"],["ncm","application/vnd.nokia.configuration-message"],["ncx","application/x-dtbncx+xml"],["ngdat","application/vnd.nokia.n-gage.data"],["nif","image/x-niff"],["niff","image/x-niff"],["nix","application/x-mix-transfer"],["nlu","application/vnd.neurolanguage.nlu"],["nml","application/vnd.enliven"],["nnd","application/vnd.noblenet-directory"],["nns","application/vnd.noblenet-sealer"],["nnw","application/vnd.noblenet-web"],["npx","image/vnd.net-fpx"],["nsc","application/x-conference"],["nsf","application/vnd.lotus-notes"],["nvd","application/x-navidoc"],["nws","message/rfc822"],["o","application/octet-stream"],["oa2","application/vnd.fujitsu.oasys2"],["oa3","application/vnd.fujitsu.oasys3"],["oas","application/vnd.fujitsu.oasys"],["obd","application/x-msbinder"],["oda","application/oda"],["odb","application/vnd.oasis.opendocument.database"],["odc","application/vnd.oasis.opendocument.chart"],["odf","application/vnd.oasis.opendocument.formula"],["odft","application/vnd.oasis.opendocument.formula-template"],["odg","application/vnd.oasis.opendocument.graphics"],["odi","application/vnd.oasis.opendocument.image"],["odm","application/vnd.oasis.opendocument.text-master"],["odp","application/vnd.oasis.opendocument.presentation"],["ods","application/vnd.oasis.opendocument.spreadsheet"],["odt","application/vnd.oasis.opendocument.text"],["oga","audio/ogg"],["ogv","video/ogg"],["ogx","application/ogg"],["omc","application/x-omc"],["omcd","application/x-omcdatamaker"],["omcr","application/x-omcregerator"],["onetoc","application/onenote"],["opf","application/oebps-package+xml"],["org","application/vnd.lotus-organizer"],["osf","application/vnd.yamaha.openscoreformat"],["osfpvg","application/vnd.yamaha.openscoreformat.osfpvg+xml"],["otc","application/vnd.oasis.opendocument.chart-template"],["otf","application/x-font-otf"],["otg","application/vnd.oasis.opendocument.graphics-template"],["oth","application/vnd.oasis.opendocument.text-web"],["oti","application/vnd.oasis.opendocument.image-template"],["otp","application/vnd.oasis.opendocument.presentation-template"],["ots","application/vnd.oasis.opendocument.spreadsheet-template"],["ott","application/vnd.oasis.opendocument.text-template"],["oxt","application/vnd.openofficeorg.extension"],["p","text/x-pascal"],["p10",["application/pkcs10","application/x-pkcs10"]],["p12",["application/pkcs-12","application/x-pkcs12"]],["p7a","application/x-pkcs7-signature"],["p7b","application/x-pkcs7-certificates"],["p7c",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7m",["application/pkcs7-mime","application/x-pkcs7-mime"]],["p7r","application/x-pkcs7-certreqresp"],["p7s",["application/pkcs7-signature","application/x-pkcs7-signature"]],["p8","application/pkcs8"],["par","text/plain-bas"],["part","application/pro_eng"],["pas","text/pascal"],["paw","application/vnd.pawaafile"],["pbd","application/vnd.powerbuilder6"],["pbm","image/x-portable-bitmap"],["pcf","application/x-font-pcf"],["pcl",["application/vnd.hp-pcl","application/x-pcl"]],["pclxl","application/vnd.hp-pclxl"],["pct","image/x-pict"],["pcurl","application/vnd.curl.pcurl"],["pcx","image/x-pcx"],["pdb",["application/vnd.palm","chemical/x-pdb"]],["pdf","application/pdf"],["pfa","application/x-font-type1"],["pfr","application/font-tdpfr"],["pfunk",["audio/make","audio/make.my.funk"]],["pfx","application/x-pkcs12"],["pgm",["image/x-portable-graymap","image/x-portable-greymap"]],["pgn","application/x-chess-pgn"],["pgp","application/pgp-signature"],["pic",["image/pict","image/x-pict"]],["pict","image/pict"],["pkg","application/x-newton-compatible-pkg"],["pki","application/pkixcmp"],["pkipath","application/pkix-pkipath"],["pko",["application/ynd.ms-pkipko","application/vnd.ms-pki.pko"]],["pl",["text/plain","text/x-script.perl"]],["plb","application/vnd.3gpp.pic-bw-large"],["plc","application/vnd.mobius.plc"],["plf","application/vnd.pocketlearn"],["pls","application/pls+xml"],["plx","application/x-pixclscript"],["pm",["text/x-script.perl-module","image/x-xpixmap"]],["pm4","application/x-pagemaker"],["pm5","application/x-pagemaker"],["pma","application/x-perfmon"],["pmc","application/x-perfmon"],["pml",["application/vnd.ctc-posml","application/x-perfmon"]],["pmr","application/x-perfmon"],["pmw","application/x-perfmon"],["png","image/png"],["pnm",["application/x-portable-anymap","image/x-portable-anymap"]],["portpkg","application/vnd.macports.portpkg"],["pot",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["potm","application/vnd.ms-powerpoint.template.macroenabled.12"],["potx","application/vnd.openxmlformats-officedocument.presentationml.template"],["pov","model/x-pov"],["ppa","application/vnd.ms-powerpoint"],["ppam","application/vnd.ms-powerpoint.addin.macroenabled.12"],["ppd","application/vnd.cups-ppd"],["ppm","image/x-portable-pixmap"],["pps",["application/vnd.ms-powerpoint","application/mspowerpoint"]],["ppsm","application/vnd.ms-powerpoint.slideshow.macroenabled.12"],["ppsx","application/vnd.openxmlformats-officedocument.presentationml.slideshow"],["ppt",["application/vnd.ms-powerpoint","application/mspowerpoint","application/powerpoint","application/x-mspowerpoint"]],["pptm","application/vnd.ms-powerpoint.presentation.macroenabled.12"],["pptx","application/vnd.openxmlformats-officedocument.presentationml.presentation"],["ppz","application/mspowerpoint"],["prc","application/x-mobipocket-ebook"],["pre",["application/vnd.lotus-freelance","application/x-freelance"]],["prf","application/pics-rules"],["prt","application/pro_eng"],["ps","application/postscript"],["psb","application/vnd.3gpp.pic-bw-small"],["psd",["application/octet-stream","image/vnd.adobe.photoshop"]],["psf","application/x-font-linux-psf"],["pskcxml","application/pskc+xml"],["ptid","application/vnd.pvi.ptid1"],["pub","application/x-mspublisher"],["pvb","application/vnd.3gpp.pic-bw-var"],["pvu","paleovu/x-pv"],["pwn","application/vnd.3m.post-it-notes"],["pwz","application/vnd.ms-powerpoint"],["py","text/x-script.phyton"],["pya","audio/vnd.ms-playready.media.pya"],["pyc","application/x-bytecode.python"],["pyv","video/vnd.ms-playready.media.pyv"],["qam","application/vnd.epson.quickanime"],["qbo","application/vnd.intu.qbo"],["qcp","audio/vnd.qcelp"],["qd3","x-world/x-3dmf"],["qd3d","x-world/x-3dmf"],["qfx","application/vnd.intu.qfx"],["qif","image/x-quicktime"],["qps","application/vnd.publishare-delta-tree"],["qt","video/quicktime"],["qtc","video/x-qtc"],["qti","image/x-quicktime"],["qtif","image/x-quicktime"],["qxd","application/vnd.quark.quarkxpress"],["ra",["audio/x-realaudio","audio/x-pn-realaudio","audio/x-pn-realaudio-plugin"]],["ram","audio/x-pn-realaudio"],["rar","application/x-rar-compressed"],["ras",["image/cmu-raster","application/x-cmu-raster","image/x-cmu-raster"]],["rast","image/cmu-raster"],["rcprofile","application/vnd.ipunplugged.rcprofile"],["rdf","application/rdf+xml"],["rdz","application/vnd.data-vision.rdz"],["rep","application/vnd.businessobjects"],["res","application/x-dtbresource+xml"],["rexx","text/x-script.rexx"],["rf","image/vnd.rn-realflash"],["rgb","image/x-rgb"],["rif","application/reginfo+xml"],["rip","audio/vnd.rip"],["rl","application/resource-lists+xml"],["rlc","image/vnd.fujixerox.edmics-rlc"],["rld","application/resource-lists-diff+xml"],["rm",["application/vnd.rn-realmedia","audio/x-pn-realaudio"]],["rmi","audio/mid"],["rmm","audio/x-pn-realaudio"],["rmp",["audio/x-pn-realaudio-plugin","audio/x-pn-realaudio"]],["rms","application/vnd.jcp.javame.midlet-rms"],["rnc","application/relax-ng-compact-syntax"],["rng",["application/ringing-tones","application/vnd.nokia.ringing-tone"]],["rnx","application/vnd.rn-realplayer"],["roff","application/x-troff"],["rp","image/vnd.rn-realpix"],["rp9","application/vnd.cloanto.rp9"],["rpm","audio/x-pn-realaudio-plugin"],["rpss","application/vnd.nokia.radio-presets"],["rpst","application/vnd.nokia.radio-preset"],["rq","application/sparql-query"],["rs","application/rls-services+xml"],["rsd","application/rsd+xml"],["rt",["text/richtext","text/vnd.rn-realtext"]],["rtf",["application/rtf","text/richtext","application/x-rtf"]],["rtx",["text/richtext","application/rtf"]],["rv","video/vnd.rn-realvideo"],["s","text/x-asm"],["s3m","audio/s3m"],["saf","application/vnd.yamaha.smaf-audio"],["saveme","application/octet-stream"],["sbk","application/x-tbook"],["sbml","application/sbml+xml"],["sc","application/vnd.ibm.secure-container"],["scd","application/x-msschedule"],["scm",["application/vnd.lotus-screencam","video/x-scm","text/x-script.guile","application/x-lotusscreencam","text/x-script.scheme"]],["scq","application/scvp-cv-request"],["scs","application/scvp-cv-response"],["sct","text/scriptlet"],["scurl","text/vnd.curl.scurl"],["sda","application/vnd.stardivision.draw"],["sdc","application/vnd.stardivision.calc"],["sdd","application/vnd.stardivision.impress"],["sdkm","application/vnd.solent.sdkm+xml"],["sdml","text/plain"],["sdp",["application/sdp","application/x-sdp"]],["sdr","application/sounder"],["sdw","application/vnd.stardivision.writer"],["sea",["application/sea","application/x-sea"]],["see","application/vnd.seemail"],["seed","application/vnd.fdsn.seed"],["sema","application/vnd.sema"],["semd","application/vnd.semd"],["semf","application/vnd.semf"],["ser","application/java-serialized-object"],["set","application/set"],["setpay","application/set-payment-initiation"],["setreg","application/set-registration-initiation"],["sfd-hdstx","application/vnd.hydrostatix.sof-data"],["sfs","application/vnd.spotfire.sfs"],["sgl","application/vnd.stardivision.writer-global"],["sgm",["text/sgml","text/x-sgml"]],["sgml",["text/sgml","text/x-sgml"]],["sh",["application/x-shar","application/x-bsh","application/x-sh","text/x-script.sh"]],["shar",["application/x-bsh","application/x-shar"]],["shf","application/shf+xml"],["shtml",["text/html","text/x-server-parsed-html"]],["sid","audio/x-psid"],["sis","application/vnd.symbian.install"],["sit",["application/x-stuffit","application/x-sit"]],["sitx","application/x-stuffitx"],["skd","application/x-koan"],["skm","application/x-koan"],["skp",["application/vnd.koan","application/x-koan"]],["skt","application/x-koan"],["sl","application/x-seelogo"],["sldm","application/vnd.ms-powerpoint.slide.macroenabled.12"],["sldx","application/vnd.openxmlformats-officedocument.presentationml.slide"],["slt","application/vnd.epson.salt"],["sm","application/vnd.stepmania.stepchart"],["smf","application/vnd.stardivision.math"],["smi",["application/smil","application/smil+xml"]],["smil","application/smil"],["snd",["audio/basic","audio/x-adpcm"]],["snf","application/x-font-snf"],["sol","application/solids"],["spc",["text/x-speech","application/x-pkcs7-certificates"]],["spf","application/vnd.yamaha.smaf-phrase"],["spl",["application/futuresplash","application/x-futuresplash"]],["spot","text/vnd.in3d.spot"],["spp","application/scvp-vp-response"],["spq","application/scvp-vp-request"],["spr","application/x-sprite"],["sprite","application/x-sprite"],["src","application/x-wais-source"],["sru","application/sru+xml"],["srx","application/sparql-results+xml"],["sse","application/vnd.kodak-descriptor"],["ssf","application/vnd.epson.ssf"],["ssi","text/x-server-parsed-html"],["ssm","application/streamingmedia"],["ssml","application/ssml+xml"],["sst",["application/vnd.ms-pkicertstore","application/vnd.ms-pki.certstore"]],["st","application/vnd.sailingtracker.track"],["stc","application/vnd.sun.xml.calc.template"],["std","application/vnd.sun.xml.draw.template"],["step","application/step"],["stf","application/vnd.wt.stf"],["sti","application/vnd.sun.xml.impress.template"],["stk","application/hyperstudio"],["stl",["application/vnd.ms-pkistl","application/sla","application/vnd.ms-pki.stl","application/x-navistyle"]],["stm","text/html"],["stp","application/step"],["str","application/vnd.pg.format"],["stw","application/vnd.sun.xml.writer.template"],["sub","image/vnd.dvb.subtitle"],["sus","application/vnd.sus-calendar"],["sv4cpio","application/x-sv4cpio"],["sv4crc","application/x-sv4crc"],["svc","application/vnd.dvb.service"],["svd","application/vnd.svd"],["svf",["image/vnd.dwg","image/x-dwg"]],["svg","image/svg+xml"],["svr",["x-world/x-svr","application/x-world"]],["swf","application/x-shockwave-flash"],["swi","application/vnd.aristanetworks.swi"],["sxc","application/vnd.sun.xml.calc"],["sxd","application/vnd.sun.xml.draw"],["sxg","application/vnd.sun.xml.writer.global"],["sxi","application/vnd.sun.xml.impress"],["sxm","application/vnd.sun.xml.math"],["sxw","application/vnd.sun.xml.writer"],["t",["text/troff","application/x-troff"]],["talk","text/x-speech"],["tao","application/vnd.tao.intent-module-archive"],["tar","application/x-tar"],["tbk",["application/toolbook","application/x-tbook"]],["tcap","application/vnd.3gpp2.tcap"],["tcl",["text/x-script.tcl","application/x-tcl"]],["tcsh","text/x-script.tcsh"],["teacher","application/vnd.smart.teacher"],["tei","application/tei+xml"],["tex","application/x-tex"],["texi","application/x-texinfo"],["texinfo","application/x-texinfo"],["text",["application/plain","text/plain"]],["tfi","application/thraud+xml"],["tfm","application/x-tex-tfm"],["tgz",["application/gnutar","application/x-compressed"]],["thmx","application/vnd.ms-officetheme"],["tif",["image/tiff","image/x-tiff"]],["tiff",["image/tiff","image/x-tiff"]],["tmo","application/vnd.tmobile-livetv"],["torrent","application/x-bittorrent"],["tpl","application/vnd.groove-tool-template"],["tpt","application/vnd.trid.tpt"],["tr","application/x-troff"],["tra","application/vnd.trueapp"],["trm","application/x-msterminal"],["tsd","application/timestamped-data"],["tsi","audio/tsp-audio"],["tsp",["application/dsptype","audio/tsplayer"]],["tsv","text/tab-separated-values"],["ttf","application/x-font-ttf"],["ttl","text/turtle"],["turbot","image/florian"],["twd","application/vnd.simtech-mindmapper"],["txd","application/vnd.genomatix.tuxedo"],["txf","application/vnd.mobius.txf"],["txt","text/plain"],["ufd","application/vnd.ufdl"],["uil","text/x-uil"],["uls","text/iuls"],["umj","application/vnd.umajin"],["uni","text/uri-list"],["unis","text/uri-list"],["unityweb","application/vnd.unity"],["unv","application/i-deas"],["uoml","application/vnd.uoml+xml"],["uri","text/uri-list"],["uris","text/uri-list"],["ustar",["application/x-ustar","multipart/x-ustar"]],["utz","application/vnd.uiq.theme"],["uu",["application/octet-stream","text/x-uuencode"]],["uue","text/x-uuencode"],["uva","audio/vnd.dece.audio"],["uvh","video/vnd.dece.hd"],["uvi","image/vnd.dece.graphic"],["uvm","video/vnd.dece.mobile"],["uvp","video/vnd.dece.pd"],["uvs","video/vnd.dece.sd"],["uvu","video/vnd.uvvu.mp4"],["uvv","video/vnd.dece.video"],["vcd","application/x-cdlink"],["vcf","text/x-vcard"],["vcg","application/vnd.groove-vcard"],["vcs","text/x-vcalendar"],["vcx","application/vnd.vcx"],["vda","application/vda"],["vdo","video/vdo"],["vew","application/groupwise"],["vis","application/vnd.visionary"],["viv",["video/vivo","video/vnd.vivo"]],["vivo",["video/vivo","video/vnd.vivo"]],["vmd","application/vocaltec-media-desc"],["vmf","application/vocaltec-media-file"],["voc",["audio/voc","audio/x-voc"]],["vos","video/vosaic"],["vox","audio/voxware"],["vqe","audio/x-twinvq-plugin"],["vqf","audio/x-twinvq"],["vql","audio/x-twinvq-plugin"],["vrml",["model/vrml","x-world/x-vrml","application/x-vrml"]],["vrt","x-world/x-vrt"],["vsd",["application/vnd.visio","application/x-visio"]],["vsf","application/vnd.vsf"],["vst","application/x-visio"],["vsw","application/x-visio"],["vtu","model/vnd.vtu"],["vxml","application/voicexml+xml"],["w60","application/wordperfect6.0"],["w61","application/wordperfect6.1"],["w6w","application/msword"],["wad","application/x-doom"],["wav",["audio/wav","audio/x-wav"]],["wax","audio/x-ms-wax"],["wb1","application/x-qpro"],["wbmp","image/vnd.wap.wbmp"],["wbs","application/vnd.criticaltools.wbs+xml"],["wbxml","application/vnd.wap.wbxml"],["wcm","application/vnd.ms-works"],["wdb","application/vnd.ms-works"],["web","application/vnd.xara"],["weba","audio/webm"],["webm","video/webm"],["webp","image/webp"],["wg","application/vnd.pmi.widget"],["wgt","application/widget"],["wiz","application/msword"],["wk1","application/x-123"],["wks","application/vnd.ms-works"],["wm","video/x-ms-wm"],["wma","audio/x-ms-wma"],["wmd","application/x-ms-wmd"],["wmf",["windows/metafile","application/x-msmetafile"]],["wml","text/vnd.wap.wml"],["wmlc","application/vnd.wap.wmlc"],["wmls","text/vnd.wap.wmlscript"],["wmlsc","application/vnd.wap.wmlscriptc"],["wmv","video/x-ms-wmv"],["wmx","video/x-ms-wmx"],["wmz","application/x-ms-wmz"],["woff","application/x-font-woff"],["word","application/msword"],["wp","application/wordperfect"],["wp5",["application/wordperfect","application/wordperfect6.0"]],["wp6","application/wordperfect"],["wpd",["application/wordperfect","application/vnd.wordperfect","application/x-wpwin"]],["wpl","application/vnd.ms-wpl"],["wps","application/vnd.ms-works"],["wq1","application/x-lotus"],["wqd","application/vnd.wqd"],["wri",["application/mswrite","application/x-wri","application/x-mswrite"]],["wrl",["model/vrml","x-world/x-vrml","application/x-world"]],["wrz",["model/vrml","x-world/x-vrml"]],["wsc","text/scriplet"],["wsdl","application/wsdl+xml"],["wspolicy","application/wspolicy+xml"],["wsrc","application/x-wais-source"],["wtb","application/vnd.webturbo"],["wtk","application/x-wintalk"],["wvx","video/x-ms-wvx"],["x-png","image/png"],["x3d","application/vnd.hzn-3d-crossword"],["xaf","x-world/x-vrml"],["xap","application/x-silverlight-app"],["xar","application/vnd.xara"],["xbap","application/x-ms-xbap"],["xbd","application/vnd.fujixerox.docuworks.binder"],["xbm",["image/xbm","image/x-xbm","image/x-xbitmap"]],["xdf","application/xcap-diff+xml"],["xdm","application/vnd.syncml.dm+xml"],["xdp","application/vnd.adobe.xdp+xml"],["xdr","video/x-amt-demorun"],["xdssc","application/dssc+xml"],["xdw","application/vnd.fujixerox.docuworks"],["xenc","application/xenc+xml"],["xer","application/patch-ops-error+xml"],["xfdf","application/vnd.adobe.xfdf"],["xfdl","application/vnd.xfdl"],["xgz","xgl/drawing"],["xhtml","application/xhtml+xml"],["xif","image/vnd.xiff"],["xl","application/excel"],["xla",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlam","application/vnd.ms-excel.addin.macroenabled.12"],["xlb",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlc",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xld",["application/excel","application/x-excel"]],["xlk",["application/excel","application/x-excel"]],["xll",["application/excel","application/vnd.ms-excel","application/x-excel"]],["xlm",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xls",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xlsb","application/vnd.ms-excel.sheet.binary.macroenabled.12"],["xlsm","application/vnd.ms-excel.sheet.macroenabled.12"],["xlsx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"],["xlt",["application/vnd.ms-excel","application/excel","application/x-excel"]],["xltm","application/vnd.ms-excel.template.macroenabled.12"],["xltx","application/vnd.openxmlformats-officedocument.spreadsheetml.template"],["xlv",["application/excel","application/x-excel"]],["xlw",["application/vnd.ms-excel","application/excel","application/x-msexcel","application/x-excel"]],["xm","audio/xm"],["xml",["application/xml","text/xml","application/atom+xml","application/rss+xml"]],["xmz","xgl/movie"],["xo","application/vnd.olpc-sugar"],["xof","x-world/x-vrml"],["xop","application/xop+xml"],["xpi","application/x-xpinstall"],["xpix","application/x-vnd.ls-xpix"],["xpm",["image/xpm","image/x-xpixmap"]],["xpr","application/vnd.is-xpr"],["xps","application/vnd.ms-xpsdocument"],["xpw","application/vnd.intercon.formnet"],["xslt","application/xslt+xml"],["xsm","application/vnd.syncml+xml"],["xspf","application/xspf+xml"],["xsr","video/x-amt-showrun"],["xul","application/vnd.mozilla.xul+xml"],["xwd",["image/x-xwd","image/x-xwindowdump"]],["xyz",["chemical/x-xyz","chemical/x-pdb"]],["yang","application/yang"],["yin","application/yin+xml"],["z",["application/x-compressed","application/x-compress"]],["zaz","application/vnd.zzazz.deck+xml"],["zip",["application/zip","multipart/x-zip","application/x-zip-compressed","application/x-compressed"]],["zir","application/vnd.zul"],["zmm","application/vnd.handheld-entertainment+xml"],["zoo","application/octet-stream"],["zsh","text/x-script.zsh"]]);function uA(t){if(!t)return aA;let e=PN.parse(t),r=(e.ext.substr(1)||e.name||"").split("?").shift().trim().toLowerCase(),n=lA.has(r)?lA.get(r):aA;return Array.isArray(n)?n[0]:n}function Ju(t){if(!t)return DN;let e=t.toLowerCase().trim().split("/"),r=e.shift().trim(),n=e.join("/").trim();if(cA.has(r+"/"+n)){let i=cA.get(r+"/"+n);return Array.isArray(i)?i[0]:i}return r==="text"?"txt":"bin"}import um from"node:crypto";import aR from"node:fs";import{PassThrough as Za,finished as td,pipeline as dm}from"node:stream";import rd from"node:url";import{Transform as UN}from"node:stream";function qi(t){return typeof t=="string"&&(t=Buffer.from(t,"utf-8")),t.toString("base64")}function LN(t){let e=Math.floor(Number(t));return Number.isFinite(e)&&e>=1?e:76}function MN(t,e,r){let n=Math.ceil(t.length/e),i=Math.max(n-1,0),o=t.length-i*e,s=Buffer.allocUnsafe(i*(e+2)+(r?o:0)),a=0;for(let c=0;c<i*e;c+=e)t.copy(s,a,c,c+e),a+=e,s[a++]=13,s[a++]=10;if(r&&(a+=t.copy(s,a,i*e),o=0),a!==s.length)throw new Error("Unexpected wrapped length");return{output:s,rest:o}}var Yu=class extends UN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=LN(this.options.lineLength)),this._curLine="",this._remainingBytes=!1,this.inputBytes=0,this.outputBytes=0}_emit(e,r){let n=Buffer.from(this._curLine+e,"latin1");if(!n.length)return;let i=n;if(this.options.lineLength){let o=MN(n,this.options.lineLength,r);i=o.output,this._curLine=o.rest?n.toString("latin1",n.length-o.rest):""}else this._curLine="";i.length&&(this.outputBytes+=i.length,this.push(i))}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length%3;o&&(this._remainingBytes=i.subarray(i.length-o),i=i.subarray(0,i.length-o)),this._emit(qi(i),!1),n()}_flush(e){this._emit(this._remainingBytes?qi(this._remainingBytes):"",!0),this._remainingBytes=!1,e()}};import{Transform as KN}from"node:stream";var HN=4,FN=[[9],[10],[13],[32,60],[62,126]],mA=new Uint8Array(256);for(let t=0;t<256;t++)mA[t]=BN(t,FN)?1:0;var fA=Buffer.from("0123456789ABCDEF","latin1"),hA=t=>t===32||t===9;function EA(t){return om(typeof t=="string"?Buffer.from(t,"utf-8"):t)}function om(t,e,r,n){let i=t.length,o=Buffer.allocUnsafe(i*3),s=0;for(let a=0;a<i;a++){let c=t[a],l=a+1<i?t[a+1]:e,u=r&&(c===13||c===10)?c===13?l===10:(a>0?t[a-1]:n)===13:!0;if(mA[c]&&u&&!(hA(c)&&(l===void 0||l===10||l===13))){o[s++]=c;continue}o[s++]=61,o[s++]=fA[Math.floor(c/16)],o[s++]=fA[c%16]}return o.toString("latin1",0,s)}function VN(t,e){if(t=(t||"").toString(),e=Math.max(Number(e)||76,HN),t.length<=e)return t;let r=0,n=t.length,i,o,s,a=Math.floor(e/3),c="";for(;r<n;){if(s=t.substr(r,e),i=s.match(/\r\n/)){s=s.substr(0,i.index+i[0].length),c+=s,r+=s.length;continue}if(s.substr(-1)===`
+`){c+=s,r+=s.length;continue}if(i=s.substr(-a).match(/\n.*?$/)){s=s.substr(0,s.length-(i[0].length-1)),c+=s,r+=s.length;continue}if(s.length>e-a&&(i=s.substr(-a).match(/[ \t.,!?][^ \t.,!?]*$/)))s=s.substr(0,s.length-(i[0].length-1));else if(s.match(/[=][\da-f]{0,2}$/i))for((i=s.match(/[=][\da-f]{0,1}$/i))&&(s=s.substr(0,s.length-i[0].length));s.length>3&&s.length<n-r&&!s.match(/^(?:=[\da-f]{2}){1,4}$/i)&&(i=s.match(/[=][\da-f]{2}$/gi))&&(o=parseInt(i[0].substr(1,2),16),!(o<128||(s=s.substr(0,s.length-3),o>=192))););s.length||(s=t.substr(r,e)),r+s.length<n&&s.substr(-1)!==`
+`?(s.length===e&&s.match(/[=][\da-f]{2}$/i)?s=s.substr(0,s.length-3):s.length===e&&(s=s.substr(0,s.length-1)),r+=s.length,s+=`=\r
+`):r+=s.length,c+=s}return c}function BN(t,e){for(let r=e.length-1;r>=0;r--){let n=e[r];if(n.length&&(n.length===1&&t===n[0]||n.length===2&&t>=n[0]&&t<=n[1]))return!0}return!1}var im=64*1024,Xu=class extends KN{constructor(e){super(),this.options=e||{},this.options.lineLength!==!1&&(this.options.lineLength=this.options.lineLength||76),this._curLine="",this._remainingBytes=!1,this._lastByte=void 0,this.inputBytes=0,this.outputBytes=0}_transform(e,r,n){let i=r!=="buffer"?Buffer.from(e,r):e;if(!i||!i.length)return n();this.inputBytes+=i.length,this._remainingBytes&&(i=Buffer.concat([this._remainingBytes,i],this._remainingBytes.length+i.length),this._remainingBytes=!1);let o=i.length;for(;o>0&&(hA(i[o-1])||this.options.binary&&i[o-1]===13);)o--;i.length-o<=im&&(this._remainingBytes=o<i.length?Buffer.from(i.subarray(o)):!1,i=i.subarray(0,o)),this._encodeSlices(i),n()}_flush(e){this._remainingBytes&&(this._encodeSlices(this._remainingBytes),this._remainingBytes=!1),this._curLine&&(this.outputBytes+=this._curLine.length,this.push(this._curLine,"ascii"),this._curLine=""),e()}_encodeSlices(e){for(let r=0;r<e.length;r+=im){let n=Math.min(r+im,e.length);this._encodeSlice(e.subarray(r,n),n<e.length?e[n]:void 0),this._lastByte=e[n-1]}}_encodeSlice(e,r){let n;if(this.options.lineLength){n=VN(this._curLine+om(e,r,this.options.binary,this._lastByte),this.options.lineLength);let i=n.lastIndexOf(`
+`);this._curLine=n.substring(i+1),n=n.substring(0,i+1),n&&(this.outputBytes+=n.length,this.push(n,"ascii"))}else n=om(e,r,this.options.binary,this._lastByte),this.outputBytes+=n.length,this.push(n,"ascii")}};function vs(t,e){return typeof t=="string"&&!(e?/[\x00-\x1f\x7f"\u0080-\uFFFF]/:/[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/).test(t)}function Ya(t){return'"'+(t||"").toString().replace(/["\\]/g,"\\$&")+'"'}function vA(t,e){return t.length>128*1024?!0:new RegExp("^.{"+(e+1)+",}","m").test(t)}function bn(t,e,r){e=(e||"Q").toString().toUpperCase().trim().charAt(0),r=r||0;let n,i="UTF-8";if(r&&r>7+i.length&&(r-=7+i.length),e==="Q"?n=EA(t).replace(/[^a-z0-9!*+\-/=]/gi,o=>{let s=o.charCodeAt(0).toString(16).toUpperCase();return o===" "?"_":"="+(s.length===1?"0"+s:s)}):e==="B"&&(n=typeof t=="string"?t:t.toString("utf-8"),r=r?Math.max(3,(r-r%4)/4*3):0),r&&(e!=="B"?n:qi(t)).length>r)if(e==="Q")n=qN(n,r).join("?= =?"+i+"?"+e+"?");else{let o=[],s="";for(let a=0,c=n.length;a<c;a++){let l=n.charAt(a);/[\ud800-\udbff]/.test(l)&&/[\udc00-\udfff]/.test(n.charAt(a+1))&&(l+=n.charAt(++a)),Buffer.byteLength(s+l)<=r||a===0?s+=l:(o.push(qi(s)),s=l)}s&&o.push(qi(s)),o.length>1?n=o.join("?= =?"+i+"?"+e+"?"):n=o.join("")}else e==="B"&&(n=qi(t));return"=?"+i+"?"+e+"?"+n+(n.substr(-2)==="?="?"":"?=")}function AA(t,e,r,n){r=r||0;let i=t.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);if(!i)return t;if(n)return bn(t,e,r);let o=t.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);if(!o)return t;let s=i.index+(i[0].match(/[^\s]/)||{index:0}).index,a=o.index+(o[1]||"").length;return(s?t.substr(0,s):"")+bn(t.substring(s,a),e||"Q",r)+(a<t.length?t.substr(a):"")}function sm(t){let e=[];return Object.keys(t.params||{}).forEach(n=>{let i=t.params[n],o=n.replace(/[\x00-\x1f\x7f]/g,"");!vs(i,!0)||i.length>=75?jN(o,i,50).forEach(s=>{!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(s.value)||s.key.substr(-1)==="*"?e.push(s.key+"="+s.value):e.push(s.key+"="+JSON.stringify(s.value))}):!i.length||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(i)?e.push(o+"="+JSON.stringify(i)):e.push(o+"="+i)}),(typeof t.value=="string"?t.value.replace(/[\x00-\x1f\x7f]/g,""):t.value)+(e.length?"; "+e.join("; "):"")}function jN(t,e,r){let n=[],i=typeof e=="string"?e:(e||"").toString(),o,s,a=0,c,l;if(r=r||50,vs(e,!0)){if(i.length<=r)return[{key:t,value:i}];i=i.replace(new RegExp(".{"+r+"}","g"),u=>(n.push({line:u}),"")),i&&n.push({line:i})}else{if(/[\uD800-\uDBFF]/.test(i)){let p=[];for(c=0,l=i.length;c<l;c++)o=i.charAt(c),/[\ud800-\udbff]/.test(o)&&/[\udc00-\udfff]/.test(i.charAt(c+1))?(o+=i.charAt(c+1),p.push(o),c++):p.push(o);i=p}s="utf-8''";let u=!0;for(a=0,c=0,l=i.length;c<l;c++){if(o=i[c],u)o=Qu(o);else if(o=o===" "?o:Qu(o),o!==i[c])if((Qu(s)+o).length>=r)n.push({line:s,encoded:u}),s="",u=!0;else{u=!0,c=a,s="";continue}(s+o).length>=r?(n.push({line:s,encoded:u}),s=o=i[c]===" "?" ":Qu(i[c]),o===i[c]?(u=!1,a=c-1):u=!0):s+=o}s&&n.push({line:s,encoded:u})}return n.map((u,p)=>({key:t+"*"+p+(u.encoded?"*":""),value:u.line}))}var GN=/^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;function gA(t){return!!t&&!Rr(t)}function am(t){let e={value:"",params:{}},r=(S,R)=>{S=S.toLowerCase(),gA(S)&&!Object.prototype.hasOwnProperty.call(e.params,S)&&(e.params[S]=R)},n=!1,i="",o="value",s=!1,a=!1,c,l="",u=!1,p=()=>{i.length&&(i+=l),l=""},f=S=>{p(),i+=S},m=()=>{let S=i;return i="",l="",u=!1,S},E=()=>{let S=m();n===!1?e.value=S:r(n,S)},v=()=>{r(m().trim(),"")};for(let S=0,R=t.length;S<R;S++)if(c=t.charAt(S),o==="key"){if(c==="="){n=m().trim(),o="value";continue}if(c===";"){v();continue}i+=c}else{if(u&&c!==";"){a=!1;continue}if(a)f(c);else if(s&&c==="\\"){a=!0;continue}else s&&c===s?(s=!1,u=!0):!s&&c==='"'?(s=c,p()):!s&&c===";"?(E(),o="key"):!s&&(c===" "||c==="	")?l+=c:f(c);a=!1}o==="value"?E():v();let N=new Map;return Object.keys(e.params).forEach(S=>{let R=S.match(/(\*(\d+)|\*(\d+)\*|\*)$/);if(!R)return;let M=S.substr(0,R.index),K=Number(R[2]||R[3])||0,B=R[0].substr(-1)==="*",V=e.params[S];if(delete e.params[S],!gA(M))return;let $=N.get(M);$||($={charset:!1,sections:[]},N.set(M,$));let A=K===0&&B?V.match(/^([^']*)'[^']*'(.*)$/):null;A&&($.charset=GN.test(A[1])?A[1]:"iso-8859-1",V=A[2]),$.sections.push({nr:K,value:V,encoded:B})}),N.forEach((S,R)=>{if(!Object.prototype.hasOwnProperty.call(e.params,R)){if(S.sections.sort((M,K)=>M.nr-K.nr),!S.charset){e.params[R]=S.sections.map(M=>M.value).join("");return}e.params[R]="=?"+S.charset+"?Q?"+S.sections.map($N).join("")+"?="}}),e}function $N(t){let e=t.encoded?/[=?_\s]/g:/[=?_\s%]/g;return t.value.replace(e,r=>{let n=r.charCodeAt(0).toString(16);return r===" "?"_":"%"+(n.length<2?"0":"")+n}).replace(/%/g,"=")}function Zu(t){return Ju(t)}function Wi(t){return uA(t)}function Xa(t,e,r){t=(t||"").toString(),e=e||76;let n=0,i=t.length,o="",s,a;for(;n<i;){if(s=t.substr(n,e),s.length<e){o+=s;break}if(a=s.match(/^[^\n\r]*(\r?\n|\r)/)){s=a[0],o+=s,n+=s.length;continue}else(a=s.match(/(\s+)[^\s]*$/))&&a[0].length-(r?(a[1]||"").length:0)<s.length?s=s.substr(0,s.length-(a[0].length-(r?(a[1]||"").length:0))):(a=t.substr(n+s.length).match(/^[^\s]+(\s*)/))&&(s=s+a[0].substr(0,a[0].length-(r?0:(a[1]||"").length)));o+=s,n+=s.length,n<i&&(o+=`\r
+`)}return o}function qN(t,e){let r=[],n,i,o,s,a;for(e=Math.max(e||0,12);t.length;){for(n=t.substr(0,e),(o=n.match(/[=][0-9A-F]?$/i))&&(n=n.substr(0,o.index)),i=n.length?n:t.substr(0,e),a=!1;!a&&n.length;)a=!0,(o=t.substr(n.length).match(/^[=]([0-9A-F]{2})/i))&&(s=parseInt(o[1],16),s<194&&s>127&&(n=n.substr(0,n.length-3),a=!1));n.length||(n=i),r.push(n),t=t.substr(n.length)}return r}function WN(t){let e="",r=t.charCodeAt(0).toString(16).toUpperCase();if(r.length%2&&(r="0"+r),r.length>2)for(let n=0,i=r.length/2;n<i;n++)e+="%"+r.substr(n,2);else e+="%"+r;return e}function Qu(t){t=(t||"").toString();try{t=encodeURIComponent(t)}catch{t=encodeURIComponent(Buffer.from(t,"utf-8").toString("utf-8"))}return t.replace(/[\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]/g,e=>WN(e))}function zN(t){let e=t.lastIndexOf("@");if(e<0)return t;let r=t.substr(0,e);return/^[^\s"(),:;<>@[\\\]]+$/.test(r)||/^"(?:[^"\\]|\\[\s\S])*"$/.test(r)?t:'"'+r.replace(/["\\]/g,"\\$&")+'"@'+t.substr(e+1)}var JN=/\s/,YN=/^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/,bA=/^[^@\s]+@[^@\s]+$/,XN=/^[^@\s]+@\S+$/,TA=/\s*\b[^@\s]+@[^\s]+\b\s*/y;function cm(t){return t===32||t>=9&&t<=13||t===160||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288||t===65279}function _A(t){return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===95}function IA(t,e){return _A(t.charCodeAt(e-1))!==_A(t.charCodeAt(e))}function xA(t,e,r){for(let n=e;n<r;n++)if(t.charCodeAt(n)===64)return n;return-1}function QN(t){let e=t.length,r=0;for(;r<e;){for(;r<e&&cm(t.charCodeAt(r));)r++;if(r>=e)break;let n=r,i=r;for(;i<e&&!cm(t.charCodeAt(i));)i++;let o=xA(t,n,i);if(o>=0){let s=-1;for(let c=i;c>n;c--)if(IA(t,c)){s=c;break}let a=n;for(;s>=0&&o>=0;){if(o>a&&i>o+1&&s>o+1){for(let c=a;c<o;c++)if(IA(t,c)){if(c>n)return c;let l=n;for(;l>0&&cm(t.charCodeAt(l-1));)l--;return l}}a=o+1,o=xA(t,a,i)}}r=i}return-1}function ZN(t){if(!JN.test(t.address))return;let e,r,n=t.address.match(YN);if(n){if(!n[2])return;e=n[1],r=[n[2]]}else{if(t.address.indexOf('"')>=0)return;let i=t.address.split(/\s+/),o=i.findIndex(s=>bA.test(s));if(o<0&&(o=i.findIndex(s=>XN.test(s))),o<0)return;e=i.splice(o,1)[0],r=i}t.address=e,t.text=[t.text].concat(r).filter(i=>i).join(" ")}function eR(t){let e=[],r="",n="",i=0,o="",s="";for(let a=0,c=t.length;a<c;a++){let l=t.charAt(a);if(i){l==="\\"&&a<c-1?n+=t.charAt(++a):l==="("?(i++,n+=l):l===")"&&!--i?(e.push(n.trim()),n="",s!=="@"&&t.charAt(a+1)!=="@"&&(r+=" ",s=" ")):n+=l;continue}if(o){if(l==="\\"&&o==='"'&&a<c-1){r+=l+t.charAt(++a),s=t.charAt(a);continue}l===o&&(o="")}else if(l==='"')o='"';else if(l==="[")o="]";else if(l==="("){i=1;continue}r+=l,s=l}return i&&e.push(n.trim()),{address:r.trim(),comments:e.filter(a=>a)}}function tR(t,e){let r=!1,n="text",i=[],o={address:[],comment:[],group:[],text:[],textWasQuoted:[]},s=!1,a={address:"",comment:"",group:"",text:""};for(let c=0,l=t.length;c<l;c++){let u=t[c],p=c?t[c-1]:null;if(u.type==="operator")switch(u.value){case"<":n="address",s=!1;break;case"(":n="comment",s=!1;break;case":":n="group",r=!0,s=!1;break;case'"':s=!s,n="text";break;default:n="text",s=!1;break}else if(u.value){let f=c>1?t[c-2]:null,m=p?.type==="operator"&&p.value==='"'&&!!p.noBreak&&f?.type==="operator"&&f.value==='"';n==="address"&&(u.value=u.value.replace(/^[^<]*<\s*/,""));let E=o[n];p&&p.noBreak&&E.length&&(p.value!==")"||a[n]==="@"||u.value.charAt(0)==="@")?(o[n][o[n].length-1]+=u.value,u.value&&(a[n]=u.value.charAt(u.value.length-1)),n==="text"&&s&&(o.textWasQuoted[o.textWasQuoted.length-1]=!0)):(o[n].push(u.value),a[n]=u.value.charAt(u.value.length-1),n==="text"&&o.textWasQuoted.push(s||m))}}if(!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),r){o.text=o.text.join(" ");let c=[];o.group.length&&SA(o.group.join(","),e+1).forEach(u=>{u.group?c=c.concat(u.group):c.push(u)}),i.push({name:o.text||"",group:c})}else{let c=[],l=[];for(let f of o.address){if(f.indexOf("(")<0){l.push(f);continue}let m=eR(f);for(let E of m.comments)c.push(E);m.address&&l.push(m.address)}if(o.address=l,!o.address.length&&o.text.length){for(let f=o.text.length-1;f>=0;f--)if(!o.textWasQuoted[f]&&bA.test(o.text[f])){o.address=o.text.splice(f,1),o.textWasQuoted.splice(f,1);break}if(!o.address.length){let f=!1;for(let m=o.text.length-1;m>=0;m--)if(!o.textWasQuoted[m]){let E=o.text[m],v=E,N=QN(E);if(N>=0){TA.lastIndex=N;let S=TA.exec(E);S&&(o.address=[S[0].trim()],f=!0,v=E.slice(0,N)+" "+E.slice(N+S[0].length))}if(o.text[m]=v.trim(),f)break}}}!o.text.length&&o.comment.length&&(o.text=o.comment,o.comment=[]),o.address.length>1&&(o.text=o.text.concat(o.address.splice(1)));let u=!o.address.length&&o.textWasQuoted.some(f=>f);o.text=o.text.join(" "),o.address=o.address.join(" "),u&&o.text.indexOf("@")>=0&&(o.address=zN(o.text),o.text=""),ZN(o),!o.text&&c.length&&(o.text=c.join(" "));let p={address:o.address||o.text||"",name:o.text||o.address||""};p.address===p.name&&(/@/.test(p.address||"")?p.name="":p.address=""),i.push(p)}return i}var lm=class{constructor(e){this.str=(e||"").toString(),this.operatorCurrent="",this.operatorExpecting="",this.node=null,this.escaped=!1,this.inDomainLiteral=!1,this.afterAt=!1,this.list=[],this.operators={'"':'"',"(":")","<":">",",":"",":":";",";":""}}tokenize(){let e=[];for(let r=0,n=this.str.length;r<n;r++){let i=this.str.charAt(r),o=r<n-1?this.str.charAt(r+1):null;this.checkChar(i,o)}return this.list.forEach(r=>{r.value=(r.value||"").toString().trim(),r.value&&e.push(r)}),e}checkChar(e,r){if(!this.escaped&&!this.operatorExpecting&&(!this.inDomainLiteral&&e==="["&&this.afterAt?this.inDomainLiteral=!0:this.inDomainLiteral&&(e==="]"||e===","||e===";")&&(this.inDomainLiteral=!1)),!this.escaped){if(e===this.operatorExpecting){this.node={type:"operator",value:e},r&&![" ","	","\r",`
+`,",",";"].includes(r)&&(this.node.noBreak=!0),this.list.push(this.node),this.node=null,e!==")"&&(this.afterAt=!1),this.operatorExpecting="",this.escaped=!1;return}else if(!this.operatorExpecting&&!(this.inDomainLiteral&&e===":")&&e in this.operators){this.node={type:"operator",value:e},this.list.push(this.node),this.node=null,e!=="("&&(this.afterAt=!1),this.operatorExpecting=this.operators[e],this.escaped=!1;return}else if(['"',"'",")"].includes(this.operatorExpecting)&&e==="\\"){this.escaped=!0;return}}this.node||(this.node={type:"text",value:""},this.list.push(this.node)),e===`
+`&&(e=" "),(e.charCodeAt(0)>=33||[" ","	"].includes(e))&&(this.node.value+=e,!this.operatorExpecting&&e!==" "&&e!=="	"&&(this.afterAt=e==="@")),this.escaped=!1}},rR=50;function SA(t,e){if(e>rR)return[];let n=new lm(t).tokenize(),i=[],o=[],s=[];n.forEach(c=>{c.type==="operator"&&(c.value===","||c.value===";")?(o.length&&i.push(o),o=[]):o.push(c)}),o.length&&i.push(o),i.forEach(c=>{let l=tR(c,e);for(let u=0;u<l.length;u++)s.push(l[u])});let a=[];for(let c=s.length-1;c>=0;c--){let l=s[c],u=a.length?a[a.length-1]:null;u&&l.address===""&&l.name&&!l.group&&u.address&&u.name?u.name=l.name+", "+u.name:a.push(l)}return a.reverse(),a}function nR(t,e){let r=SA(t,0);if(e?.flatten){let n=[],i=o=>{o.forEach(s=>{if(s.group)return i(s.group);n.push(s)})};return i(r),n}return r}var wA=nR;import{Transform as iR}from"node:stream";var Qa=class extends iR{constructor(){super(),this.lastByte=!1}_transform(e,r,n){e.length&&(this.lastByte=e[e.length-1]),this.push(e),n()}_flush(e){return this.lastByte===10?e():this.lastByte===13?(this.push(Buffer.from(`
 `)),e()):(this.push(Buffer.from(`\r
-`)),e())}};Ug.exports=_p});var xp=he((X7,Mg)=>{"use strict";var{Transform:JS}=ee("stream"),Ip=class extends JS{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>s&&(i=e.slice(s,o),this.push(i)),this.push(Buffer.from(`\r
-`)),s=o+1);s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),this.lastByte=e[e.length-1],n()}};Mg.exports=Ip});var Hg=he((Q7,Kg)=>{"use strict";var{Transform:YS}=ee("stream"),bp=class extends YS{constructor(e){super(e)}_transform(e,r,n){let i,s=0;for(let o=0,a=e.length;o<a;o++)e[o]===13&&(i=e.slice(s,o),s=o+1,this.push(i));s&&s<e.length?(i=e.slice(s),this.push(i)):s||this.push(e),n()}};Kg.exports=bp});var kl=he((Z7,Bg)=>{"use strict";var Sp=ee("crypto"),XS=ee("fs"),Fg=fp(),{PassThrough:pa}=ee("stream"),QS=Kt(),Sr=da(),ZS=Ap(),eN=yp(),tN=Pg(),rN=ca(),Vg=lr(),nN=Lg(),iN=xp(),sN=Hg(),oN=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],Np=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=r.baseBoundary||Sp.randomBytes(8).toString("hex"),this.boundaryPrefix=r.boundaryPrefix||"--_NmP",this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Sr.detectMimeType(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(s=>{this.setHeader(s.key,s.value)}):Object.keys(e).forEach(s=>{this.setHeader(s,e[s])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let s=0,o=this._headers.length;s<o;s++)this._headers[s].key===e&&(n?(this._headers.splice(s,1),s--,o--):(this._headers[s]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?(this._contentErrorHandler=r=>{this.content.removeListener("error",this._contentErrorHandler),this.content=r},this.content.once("error",this._contentErrorHandler)):typeof this.content=="string"&&(this._isPlainText=Sr.isPlainText(this.content),this._isPlainText&&Sr.hasLongerLines(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((a,c)=>{e=QS.callbackPromise(a,c)}));let n=this.createReadStream(),i=[],s=0,o=!1;return n.on("readable",()=>{let a;for(;(a=n.read())!==null;)i.push(a),s+=a.length}),n.once("error",a=>{if(!o)return o=!0,e(a)}),n.once("end",a=>{if(!o)return o=!0,a&&a.length&&(i.push(a),s+=a.length),e(null,Buffer.concat(i,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,s=n.value,o,a,c={};if(!(s&&typeof s=="object"&&!oN.includes(i)&&(Object.keys(s).forEach(d=>{d!=="value"&&(c[d]=s[d])}),s=(s.value||"").toString(),!s.trim()))){if(c.prepared){c.foldLines?r.push(Sr.foldLines(i+": "+s)):r.push(i+": "+s);return}switch(n.key){case"Content-Disposition":o=Sr.parseHeaderValue(s),this.filename&&(o.params.filename=this.filename),s=Sr.buildHeaderValue(o);break;case"Content-Type":o=Sr.parseHeaderValue(s),this._handleContentType(o),o.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(o.params.charset="utf-8"),s=Sr.buildHeaderValue(o),this.filename&&(a=this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a='"'+a+'"'),s+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(s=this._encodeHeaderValue(i,s),!!(s||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let d=this.normalizeHeaderKey(i,s);d&&typeof d=="string"&&d.length&&(i=d)}r.push(Sr.foldLines(i+": "+s,76))}}}),r.join(`\r
-`)}createReadStream(e){e=e||{};let r=new pa(e),n=r,i;this.stream(r,e,s=>{if(s){n.emit("error",s);return}r.end()});for(let s=0,o=this._transforms.length;s<o;s++)i=typeof this._transforms[s]=="function"?this._transforms[s]():this._transforms[s],n.once("error",a=>{i.emit("error",a)}),n=n.pipe(i);i=new nN,n.once("error",s=>{i.emit("error",s)}),n=n.pipe(i);for(let s=0,o=this._processFuncs.length;s<o;s++)i=this._processFuncs[s],n=i(n);if(this.newline){let o=["win","windows","dos",`\r
-`].includes(this.newline.toString().toLowerCase())?new iN:new sN,a=n.pipe(o);return n.on("error",c=>a.emit("error",c)),a}return n}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),s,o,a=!1,c=p=>{a||(a=!0,n(p))},l=()=>{let p=0,m=()=>{if(p>=this.childNodes.length)return e.write(`\r
+`)),e())}};import{Transform as oR}from"node:stream";var kr=class extends oR{constructor(e){super(e),this.lastByte=!1}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===10&&(s&&e[s-1]!==13||!s&&this.lastByte!==13)&&(s>o&&(i=e.slice(o,s),this.push(i)),this.push(Buffer.from(`\r
+`)),o=s+1);o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),this.lastByte=e[e.length-1],n()}};import{Transform as sR}from"node:stream";var Sn=class extends sR{constructor(e){super(e)}_transform(e,r,n){let i,o=0;for(let s=0,a=e.length;s<a;s++)e[s]===13&&(i=e.slice(o,s),o=s+1,this.push(i));o&&o<e.length?(i=e.slice(o),this.push(i)):o||this.push(e),n()}};var cR=["From","Sender","To","Cc","Bcc","Reply-To","Date","References"],NA="[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]",lR=new RegExp("^"+NA+"+(?:\\."+NA+"+)*$"),uR=/^"(?:[^"\\]|\\[\s\S])*"$/,dR=/^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/,pR=/[/\\?#%\x00-\x20\x7F]/,RA=()=>!1;function OA(){let t=new Error("Message stream was closed before the message was generated");return t.code=Fu,t}function fR(t,e){if(typeof rd.domainToASCII=="function"&&typeof rd.domainToUnicode=="function"&&!pR.test(t)){let r=rd.domainToASCII(t),n=r&&e?rd.domainToUnicode(r):r;if(n)return n}return e?$v(t):hs(t)}function ec(t){return t.replace(/[\x00-\x1f\x7f]+/g,"")}var pm=class t{constructor(e,r){this.nodeCounter=0,r=r||{},this.baseBoundary=ec(r.baseBoundary||um.randomBytes(8).toString("hex")),this.boundaryPrefix=ec(r.boundaryPrefix||"--_NmP"),this.disableFileAccess=!!r.disableFileAccess,this.disableUrlAccess=!!r.disableUrlAccess,this.normalizeHeaderKey=r.normalizeHeaderKey,this.date=r.parentNode?null:new Date,this.rootNode=r.rootNode||this,this.keepBcc=!!r.keepBcc,r.filename&&(this.filename=r.filename,e||(e=Wi(this.filename.split(".").pop()))),this.textEncoding=(r.textEncoding||"").toString().trim().charAt(0).toUpperCase(),this.parentNode=r.parentNode,this.hostname=r.hostname,this.newline=r.newline,this.childNodes=[],this._nodeId=++this.rootNode.nodeCounter,this._headers=[],this._isPlainText=!1,this._hasLongLines=!1,this._envelope=!1,this._raw=!1,this._transforms=[],this._processFuncs=[],e&&this.setHeader("Content-Type",e)}createChild(e,r){!r&&typeof e=="object"&&(r=e,e=void 0);let n=new t(e,r);return this.appendChild(n),n}appendChild(e){return e.parentNode&&e.parentNode!==this&&e.remove(),e.rootNode!==this.rootNode&&(e.rootNode=this.rootNode,e._nodeId=++this.rootNode.nodeCounter),e.parentNode=this,this.childNodes.push(e),e}replace(e){return e===this?this:(this.parentNode.childNodes.forEach((r,n)=>{r===this&&(e.rootNode=this.rootNode,e.parentNode=this.parentNode,e._nodeId=this._nodeId,this.rootNode=this,this.parentNode=void 0,e.parentNode.childNodes[n]=e)}),e)}remove(){if(!this.parentNode)return this;for(let e=this.parentNode.childNodes.length-1;e>=0;e--)if(this.parentNode.childNodes[e]===this)return this.parentNode.childNodes.splice(e,1),this.parentNode=void 0,this.rootNode=this,this}setHeader(e,r){let n=!1;if(!r&&e&&typeof e=="object")return e.key&&"value"in e?this.setHeader(e.key,e.value):Array.isArray(e)?e.forEach(o=>{this.setHeader(o.key,o.value)}):Object.keys(e).forEach(o=>{this.setHeader(o,e[o])}),this;e=this._normalizeHeaderKey(e);let i={key:e,value:r};for(let o=0,s=this._headers.length;o<s;o++)this._headers[o].key===e&&(n?(this._headers.splice(o,1),o--,s--):(this._headers[o]=i,n=!0));return n||this._headers.push(i),this}addHeader(e,r){return!r&&e&&typeof e=="object"?(e.key&&e.value?this.addHeader(e.key,e.value):Array.isArray(e)?e.forEach(n=>{this.addHeader(n.key,n.value)}):Object.keys(e).forEach(n=>{this.addHeader(n,e[n])}),this):Array.isArray(r)?(r.forEach(n=>{this.addHeader(e,n)}),this):(this._headers.push({key:this._normalizeHeaderKey(e),value:r}),this)}getHeader(e){e=this._normalizeHeaderKey(e);for(let r=0,n=this._headers.length;r<n;r++)if(this._headers[r].key===e)return this._headers[r].value}setContent(e){return this.content=e,typeof this.content.pipe=="function"?rm(this.content):typeof this.content=="string"&&(this._isPlainText=vs(this.content),this._isPlainText&&vA(this.content,76)&&(this._hasLongLines=!0)),this}build(e){let r;e||(r=new Promise((c,l)=>{e=Mt(c,l)}));let n=e,i=this.createReadStream(),o=[],s=0,a=!1;return i.on("readable",()=>{let c;for(;(c=i.read())!==null;)o.push(c),s+=c.length}),i.once("error",c=>{if(!a)return a=!0,n(c)}),i.once("end",c=>{if(!a)return a=!0,c&&c.length&&(o.push(c),s+=c.length),n(null,Buffer.concat(o,s))}),r}getTransferEncoding(){let e=!1,r=(this.getHeader("Content-Type")||"").toString().toLowerCase().trim();return this.content&&(e=(this.getHeader("Content-Transfer-Encoding")||"").toString().toLowerCase().trim(),(!e||!["base64","quoted-printable"].includes(e))&&(/^text\//i.test(r)?this._isPlainText&&!this._hasLongLines?e="7bit":typeof this.content=="string"||this.content instanceof Buffer?e=this._getTextEncoding(this.content)==="Q"?"quoted-printable":"base64":e=this.textEncoding==="B"?"base64":"quoted-printable":/^(multipart|message)\//i.test(r)||(e=e||"base64"))),e}buildHeaders(){let e=this.getTransferEncoding(),r=[];if(e&&this.setHeader("Content-Transfer-Encoding",e),this.filename&&!this.getHeader("Content-Disposition")&&this.setHeader("Content-Disposition","attachment"),this.rootNode===this){this.getHeader("Date")||this.setHeader("Date",this.date.toUTCString().replace(/GMT/,"+0000")),this.messageId(),this.getHeader("MIME-Version")||this.setHeader("MIME-Version","1.0");for(let n=this._headers.length-2;n>=0;n--){let i=this._headers[n];i.key==="Content-Type"&&(this._headers.splice(n,1),this._headers.push(i))}}return this._headers.forEach(n=>{let i=n.key,o=n.value,s,a,c={};if(!(o&&typeof o=="object"&&!cR.includes(i)&&(et(c,o,u=>u==="value"),o=(o.value||"").toString(),!o.trim()))){if(c.prepared){c.foldLines?r.push(Xa(i+": "+o)):r.push(i+": "+o);return}switch(n.key){case"Content-Disposition":s=am(o),this.filename&&(s.params.filename=this.filename),o=sm(s);break;case"Content-Type":s=am(o),s.value=(s.value||"").toString().replace(/[\x00-\x1f\x7f]/g,""),this._handleContentType(s),s.value.match(/^text\/plain\b/)&&typeof this.content=="string"&&/[\u0080-\uFFFF]/.test(this.content)&&(s.params.charset="utf-8"),o=sm(s),this.filename&&(a=/[\x00-\x1f\x7f]/.test(this.filename)?bn(this.filename,this._getTextEncoding(this.filename),52):this._encodeWords(this.filename),(a!==this.filename||/[\s'"\\;:/=(),<>@[\]?]|^-/.test(a))&&(a=JSON.stringify(a)),o+="; name="+a);break;case"Bcc":if(!this.keepBcc)return;break}if(o=this._encodeHeaderValue(i,o),!!(o||"").toString().trim()){if(typeof this.normalizeHeaderKey=="function"){let u=this.normalizeHeaderKey(i,o),p=typeof u=="string"?u.replace(/[\x00-\x1f\x7f]/g,""):"";p&&(i=p)}r.push(Xa(i+": "+o,76))}}}),r.join(`\r
+`)}createReadStream(e){e=e||{};let r=new Za(e);this.stream(r,e,o=>{if(o){r.destroy(o);return}r.end()}),r.once("close",()=>{r.writableFinished||this._destroyContentStreams()});let n=[r];for(let o of this._transforms)n.push(typeof o=="function"?o():o);n.push(new Qa);let i=dm(n,RA);for(let o of this._processFuncs){let s=i;i=o(s),i!==s&&td(i,a=>{a&&s.destroy()})}if(this.newline){let o=["win","windows","dos",`\r
+`].includes(this.newline.toString().toLowerCase());i=dm(i,o?new kr:new Sn,RA)}return i}transform(e){this._transforms.push(e)}processFunc(e){this._processFuncs.push(e)}stream(e,r,n){let i=this.getTransferEncoding(),o=[],s=!1,a=m=>{s||(s=!0,e.removeListener("close",c),n(m))};function c(){for(let m of o)m.destroy();return a(OA())}let l=(...m)=>{o.length||e.once("close",c),o=m},u=()=>e.destroyed?(a(OA()),!0):!1,p=()=>{let m=0,E=()=>{if(u())return;if(m>=this.childNodes.length)return e.write(`\r
 --`+this.boundary+`--\r
-`),c();let E=this.childNodes[p++];e.write((p>1?`\r
+`),a();let v=this.childNodes[m++];e.write((m>1?`\r
 `:"")+"--"+this.boundary+`\r
-`),E.stream(e,r,v=>{if(v)return c(v);setImmediate(m)})};if(this.multipart)setImmediate(m);else return c()},d=()=>{if(this.content){if(Object.prototype.toString.call(this.content)==="[object Error]")return c(this.content);typeof this.content.pipe=="function"&&(this.content.removeListener("error",this._contentErrorHandler),this._contentErrorHandler=m=>c(m),this.content.once("error",this._contentErrorHandler));let p=()=>{["quoted-printable","base64"].includes(i)?(s=new(i==="base64"?eN:ZS).Encoder(r),s.pipe(e,{end:!1}),s.once("end",l),s.once("error",m=>c(m)),o=this._getStream(this.content),o.pipe(s)):(o=this._getStream(this.content),o.pipe(e,{end:!1}),o.once("end",l)),o.once("error",m=>c(m))};if(this.content._resolve){let m=[],E=0,v=!1,b=this._getStream(this.content);b.on("error",k=>{v||(v=!0,c(k))}),b.on("readable",()=>{let k;for(;(k=b.read())!==null;)m.push(k),E+=k.length}),b.on("end",()=>{v||(v=!0,this.content._resolve=!1,this.content._resolvedValue=Buffer.concat(m,E),setImmediate(p))})}else setImmediate(p);return}return setImmediate(l)};this._raw?setImmediate(()=>{if(Object.prototype.toString.call(this._raw)==="[object Error]")return c(this._raw);typeof this._raw.pipe=="function"&&this._raw.removeListener("error",this._contentErrorHandler);let p=this._getStream(this._raw);p.pipe(e,{end:!1}),p.on("error",m=>e.emit("error",m)),p.on("end",l)}):(e.write(this.buildHeaders()+`\r
+`),v.stream(e,r,N=>{if(N)return a(N);setImmediate(E)})};if(this.multipart)setImmediate(E);else return a()},f=()=>{if(u())return;if(!this.content)return setImmediate(p);let m=()=>{if(u())return;let E=this._takeStreamContent(this.content);if(E)return a(E);let v=this._getStream(this.content);if(["quoted-printable","base64"].includes(i)){let N=i==="base64"?new Yu(r):new Xu(Object.assign({},r,{binary:!/^text\//i.test(this.contentType||"")}));l(v,N),N.pipe(e,{end:!1}),dm(v,N,S=>S&&a(S)),td(N,{writable:!1},S=>S?a(S):p())}else l(v),v.pipe(e,{end:!1}),td(v,{writable:!1},N=>N?a(N):p())};if(this.content._resolve){let E=this._getStream(this.content);l(E),za(E,(v,N)=>{if(v)return a(v);s||(this.content._resolve=!1,this.content._resolvedValue=N,setImmediate(m))})}else setImmediate(m)};this._raw?setImmediate(()=>{if(u())return;let m=this._takeStreamContent(this._raw);if(m)return a(m);let E=this._getStream(this._raw);l(E),E.pipe(e,{end:!1}),td(E,{writable:!1},v=>v?a(v):p())}):(e.write(this.buildHeaders()+`\r
 \r
-`),setImmediate(d))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseAddresses(e.from),r),r=r.filter(i=>i&&i.address),r.length&&r[0]&&(this._envelope.from=r[0].address)),["to","cc","bcc"].forEach(i=>{e[i]&&this._convertAddresses(this._parseAddresses(e[i]),this._envelope.to)}),this._envelope.to=this._envelope.to.map(i=>i.address).filter(i=>i);let n=["to","cc","bcc","from"];return Object.keys(e).forEach(i=>{n.includes(i)||(this._envelope[i]=e[i])}),this}getAddresses(){let e={};return this._headers.forEach(r=>{let n=r.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(n)&&(Array.isArray(e[n])||(e[n]=[]),this._convertAddresses(this._parseAddresses(r.value),e[n]))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]};return this._headers.forEach(r=>{let n=[];r.key==="From"||!e.from&&["Reply-To","Sender"].includes(r.key)?(this._convertAddresses(this._parseAddresses(r.value),n),n.length&&n[0]&&(e.from=n[0].address)):["To","Cc","Bcc"].includes(r.key)&&this._convertAddresses(this._parseAddresses(r.value),e.to)}),e.to=e.to.map(r=>r.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&(this._contentErrorHandler=r=>{this._raw.removeListener("error",this._contentErrorHandler),this._raw=r},this._raw.once("error",this._contentErrorHandler)),this}_getStream(e){let r;return e._resolvedValue?(r=new pa,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this.disableFileAccess?(r=new pa,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Vg.EFILEACCESS,r.emit("error",n)}),r):XS.createReadStream(e.path):e&&typeof e.href=="string"?this.disableUrlAccess?(r=new pa,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=Vg.EURLACCESS,r.emit("error",n)}),r):rN(e.href,{headers:e.httpHeaders}):(r=new pa,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){return[].concat.apply([],[].concat(e).map(r=>r&&r.address?(r.address=this._normalizeAddress(r.address),r.name=r.name||"",[r]):tN(r)))}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart?this.boundary=e.params.boundary=e.params.boundary||this.boundary||this._generateBoundary():this.boundary=!1}_generateBoundary(){return this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," "),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeWords(r)}}_convertAddresses(e,r){let n=[];return r=r||[],[].concat(e||[]).forEach(i=>{if(i.address)i.address=this._normalizeAddress(i.address),i.name?n.push(`${this._encodeAddressName(i.name)} <${i.address}>`):n.push(i.address.indexOf(" ")>=0?`<${i.address}>`:`${i.address}`),r.some(s=>s.address===i.address)||r.push(i);else if(i.group){let s=(i.group.length?this._convertAddresses(i.group,r):"").trim();n.push(`${this._encodeAddressName(i.name)}:${s};`)}}),n.join(", ")}_normalizeAddress(e){e=(e||"").toString().replace(/[\x00-\x1F<>]+/g," ").trim();let r=e.lastIndexOf("@");if(r<0)return e;let n=e.substr(0,r),i=e.substr(r+1),s=i;try{/[\x80-\uFFFF]/.test(n)?s=Fg.toUnicode(i.toLowerCase()):s=Fg.toASCII(i.toLowerCase())}catch{}return n.indexOf(" ")>=0&&(n.charAt(0)!=='"'&&(n='"'+n),n.substr(-1)!=='"'&&(n=n+'"')),`${n}@${s}`}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?'"'+e.replace(/([\\"])/g,"\\$1")+'"':Sr.encodeWord(e,this._getTextEncoding(e),52)}_encodeWords(e){return Sr.encodeWords(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,s=e.length;i<s;i++){let o=e.charCodeAt(i);o>=0&&o<=8||o===11||o===12||o>=14&&o<=31||o>=128?r++:(o>=65&&o<=90||o>=97&&o<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+Sp.randomBytes(r).toString("hex"),Sp.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}};Bg.exports=Np});var jg=he((eX,qg)=>{"use strict";var fa=kl(),wp=da(),{parseDataURI:aN}=Kt(),Rp=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new fa("message/rfc822",{newline:this.mail.newline}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n,i=[].concat(this.mail.attachments||[]).map((s,o)=>{/^data:/i.test(s.path||s.href)&&(s=this._processDataUrl(s));let a=s.contentType||wp.detectMimeType(s.filename||s.path||s.href||"bin"),c=/^image\//i.test(a),l=/^message\//i.test(a),d=s.contentDisposition||(l||c&&s.cid?"inline":"attachment"),p;"contentTransferEncoding"in s?p=s.contentTransferEncoding:l?p="8bit":p="base64";let m={contentType:a,contentDisposition:d,contentTransferEncoding:p};return s.filename?m.filename=s.filename:!l&&s.filename!==!1&&(m.filename=(s.path||s.href||"").split("/").pop().split("?").shift()||"attachment-"+(o+1),m.filename.indexOf(".")<0&&(m.filename+="."+wp.detectExtension(m.contentType))),/^https?:\/\//i.test(s.path)&&(s.href=s.path,s.path=void 0),s.cid&&(m.cid=s.cid),s.raw?m.raw=s.raw:s.path?m.content={path:s.path}:s.href?m.content={href:s.href,httpHeaders:s.httpHeaders}:m.content=s.content||"",s.encoding&&(m.encoding=s.encoding),s.headers&&(m.headers=s.headers),m});return this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?r=this.mail.icalEvent:r={content:this.mail.icalEvent},n=Object.assign({},r),n.contentType="application/ics",n.headers||(n.headers={}),n.filename=n.filename||"invite.ics",n.headers["Content-Disposition"]="attachment",n.headers["Content-Transfer-Encoding"]="base64"),e?{attached:i.filter(s=>!s.cid).concat(n||[]),related:i.filter(s=>!!s.cid)}:{attached:i.concat(n||[]),related:[]}}getAlternatives(){let e=[],r,n,i,s,o,a;return this.mail.text&&(typeof this.mail.text=="object"&&(this.mail.text.content||this.mail.text.path||this.mail.text.href||this.mail.text.raw)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(typeof this.mail.watchHtml=="object"&&(this.mail.watchHtml.content||this.mail.watchHtml.path||this.mail.watchHtml.href||this.mail.watchHtml.raw)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(typeof this.mail.amp=="object"&&(this.mail.amp.content||this.mail.amp.path||this.mail.amp.href||this.mail.amp.raw)?s=this.mail.amp:s={content:this.mail.amp},s.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(typeof this.mail.icalEvent=="object"&&(this.mail.icalEvent.content||this.mail.icalEvent.path||this.mail.icalEvent.href||this.mail.icalEvent.raw)?o=this.mail.icalEvent:o={content:this.mail.icalEvent},a=Object.assign({},o),a.content&&typeof a.content=="object"&&(a.content._resolve=!0),a.filename=!1,a.contentType="text/calendar; charset=utf-8; method="+(a.method||"PUBLISH").toString().trim().toUpperCase(),a.headers||(a.headers={})),this.mail.html&&(typeof this.mail.html=="object"&&(this.mail.html.content||this.mail.html.path||this.mail.html.href||this.mail.html.raw)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(s||[]).concat(n||[]).concat(a||[]).concat(this.mail.alternatives||[]).forEach(c=>{/^data:/i.test(c.path||c.href)&&(c=this._processDataUrl(c));let l={contentType:c.contentType||wp.detectMimeType(c.filename||c.path||c.href||"txt"),contentTransferEncoding:c.contentTransferEncoding};c.filename&&(l.filename=c.filename),/^https?:\/\//i.test(c.path)&&(c.href=c.path,c.path=void 0),c.raw?l.raw=c.raw:c.path?l.content={path:c.path}:c.href?l.content={href:c.href}:l.content=c.content||"",c.encoding&&(l.encoding=c.encoding),c.headers&&(l.headers=c.headers),e.push(l)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new fa(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",s=r.indexOf(",");if(s>0&&s<200){let a=r.substring(5,s).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign({},e,{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=aN(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}};qg.exports=Rp});var $g=he((tX,Gg)=>{"use strict";var{Transform:cN}=ee("stream"),Op=class extends cN{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,s=r-n;i<s;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,s=this.lastBytes.length+e.length;i<s;i++){let o;if(i<r?o=this.lastBytes[i]:o=e[i-r],o===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length-1>n){let i=e.slice(n);this.bodySize+=i.length,setImmediate(()=>this.push(i))}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(s){return n(s)}i&&(this.bodySize+=e.length,this.push(e)),setImmediate(n)}_flush(e){if(this.headerChunks){let r=Buffer.concat(this.headerChunks,this.headerBytes);this.bodySize+=r.length,this.push(r),this.headerChunks=null}e()}parseHeaders(){let e=(this.rawHeaders||"").toString().split(/\r?\n/);for(let r=e.length-1;r>0;r--)/^\s/.test(e[r])&&(e[r-1]+=`
-`+e[r],e.splice(r,1));return e.filter(r=>r.trim()).map(r=>({key:r.substr(0,r.indexOf(":")).trim().toLowerCase(),line:r}))}};Gg.exports=Op});var zg=he((rX,Wg)=>{"use strict";var{Transform:lN}=ee("stream"),uN=ee("crypto"),kp=class extends lN{constructor(e){super(),e=e||{},this.chunkBuffer=[],this.chunkBufferLen=0,this.bodyHash=uN.createHash(e.hashAlgo||"sha1"),this.remainder="",this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1}updateHash(e){let r,n="",i="file";for(let o=e.length-1;o>=0;o--){let a=e[o];if(!(i==="file"&&(a===10||a===13))){if(i==="file"&&(a===9||a===32))i="line";else if(!(i==="line"&&(a===9||a===32))){if((i==="file"||i==="line")&&(i="body",o===e.length-1))break}}if(o===0){if(i==="file"&&(!this.remainder||/[\r\n]$/.test(this.remainder))||i==="line"&&(!this.remainder||/[ \t]$/.test(this.remainder))){this.remainder+=e.toString("binary");return}else if(i==="line"||i==="file"){n=e.toString("binary"),e=!1;break}}if(i==="body"){n=e.slice(o+1).toString("binary"),e=e.slice(0,o+1);break}}let s=!!this.remainder;if(e&&!s){for(let o=0,a=e.length;o<a;o++)if(o&&e[o]===10&&e[o-1]!==13){s=!0;break}else if(o&&e[o]===13&&e[o-1]===32){s=!0;break}else if(o&&e[o]===32&&e[o-1]===32){s=!0;break}else if(e[o]===9){s=!0;break}}s?(r=this.remainder+(e?e.toString("binary"):""),this.remainder=n,r=r.replace(/\r?\n/g,`
-`).replace(/[ \t]*$/gm,"").replace(/[ \t]+/gm," ").replace(/\n/g,`\r
-`),e=Buffer.from(r,"binary")):n&&(this.remainder=n),this.debug&&this._debugBody.push(e),this.bodyHash.update(e)}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){/[\r\n]$/.test(this.remainder)&&this.byteLength>2&&this.bodyHash.update(Buffer.from(`\r
-`)),this.byteLength||this.push(Buffer.from(`\r
-`)),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}};Wg.exports=kp});var Xg=he((nX,Cp)=>{"use strict";var dN=fp(),pN=da(),fN=ee("crypto");Cp.exports=(t,e,r,n)=>{n=n||{};let s=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",o=Jg(t,s,n.skipFields),a=mN(n.domainName,n.keySelector,o.fieldNames,e,r);o.headers+="dkim-signature:"+Yg(a);let c=fN.createSign(("rsa-"+e).toUpperCase());c.update(o.headers);let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
- `).trim()};Cp.exports.relaxedHeaders=Jg;function mN(t,e,r,n,i){let s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+dN.toASCII(t),"q=dns/txt","s="+e,"bh="+i,"h="+r].join("; ");return pN.foldLines("DKIM-Signature: "+s,76)+`;\r
- b=`}function Jg(t,e,r){let n=new Set,i=new Set,s=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!s.has(l.key)&&s.set(l.key,Yg(l.line))}let o=[],a=[];return n.forEach(c=>{s.has(c)&&(a.push(c),o.push(c+":"+s.get(c)))}),{headers:o.join(`\r
+`),setImmediate(f))}setEnvelope(e){let r;this._envelope={from:!1,to:[]},e.from&&(r=[],this._convertAddresses(this._parseEnvelopeAddresses(e.from),r),r=r.filter(s=>s&&s.address),r.length&&r[0]&&(this._envelope.from=r[0].address));let n=new Set,i=[];["to","cc","bcc"].forEach(s=>{e[s]&&this._convertAddresses(this._parseEnvelopeAddresses(e[s]),i,n)}),this._envelope.to=i.map(s=>s.address).filter(s=>s);let o=["to","cc","bcc","from"];return et(this._envelope,e,s=>o.includes(s)),this}getAddresses(){let e={},r=new Map;return this._headers.forEach(n=>{let i=n.key.toLowerCase();["from","sender","reply-to","to","cc","bcc"].includes(i)&&(Array.isArray(e[i])||(e[i]=[],r.set(i,new Set)),this._convertAddresses(this._parseAddresses(n.value),e[i],r.get(i)))}),e}getEnvelope(){if(this._envelope)return this._envelope;let e={from:!1,to:[]},r=new Set,n=[];return this._headers.forEach(i=>{let o=[];i.key==="From"||!e.from&&["Reply-To","Sender"].includes(i.key)?(this._convertAddresses(this._parseAddresses(i.value),o),o.length&&o[0]&&(e.from=o[0].address)):["To","Cc","Bcc"].includes(i.key)&&this._convertAddresses(this._parseAddresses(i.value),n,r)}),e.to=n.map(i=>i.address),e}messageId(){let e=this.getHeader("Message-ID");return e||(e=this._generateMessageId(),this.setHeader("Message-ID",e)),e}setRaw(e){return this._raw=e,this._raw&&typeof this._raw.pipe=="function"&&rm(this._raw),this}_accessDisabled(e){let r=this;for(;r;){if(r[e])return!0;r=r.parentNode}return!1}_destroyContentStreams(){$i(this.content),$i(this._raw);for(let e of this.childNodes)e._destroyContentStreams()}_takeStreamContent(e){return Object.prototype.toString.call(e)==="[object Error]"?e:!e||typeof e.pipe!="function"||e._resolvedValue?null:nm(e)}_getStream(e){let r;return e._resolvedValue?(r=new Za,setImmediate(()=>{try{r.end(e._resolvedValue)}catch(n){r.emit("error",n)}}),r):typeof e.pipe=="function"?e:e&&typeof e.path=="string"&&!e.href?this._accessDisabled("disableFileAccess")?(r=new Za,setImmediate(()=>{let n=new Error("File access rejected for "+e.path);n.code=Gu,r.emit("error",n)}),r):aR.createReadStream(e.path):e&&typeof e.href=="string"?this._accessDisabled("disableUrlAccess")?(r=new Za,setImmediate(()=>{let n=new Error("Url access rejected for "+e.href);n.code=$u,r.emit("error",n)}),r):ui(e.href,{headers:e.httpHeaders,tls:e.tls}):(r=new Za,setImmediate(()=>{try{r.end(e||"")}catch(n){r.emit("error",n)}}),r)}_parseAddresses(e){let r=[],n=new WeakSet,i=[],o=s=>{n.has(s)||(n.add(s),i.push({list:s,pos:0}))};for(o(Array.isArray(e)?e:[e]);i.length;){let s=i[i.length-1];if(s.pos>=s.list.length){i.pop();continue}let a=s.list[s.pos++];if(Array.isArray(a)){o(a);continue}if(a&&a.address){let l=this._normalizeAddress(a.address);if(l===a.address&&typeof a.name=="string"){r.push(a);continue}let u=et({},a);u.address=l,u.name=a.name||"",r.push(u);continue}let c=this._normalizeParsedAddresses(wA(a));for(let l=0;l<c.length;l++)r.push(c[l])}return r}_normalizeParsedAddresses(e){return e.forEach(r=>{r.address?r.address=this._normalizeAddress(r.address):r.group&&this._normalizeParsedAddresses(r.group)}),e}_parseEnvelopeAddresses(e){return this._parseAddresses(e).map(r=>r.address||r.group||!r.name||/[\s@]/.test(r.name)?r:{address:this._normalizeAddress(r.name),name:""})}_normalizeHeaderKey(e){return e=(e||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x1f\x7f]/g,"").trim().toLowerCase().replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi,r=>r.toUpperCase()).replace(/^Content-Features$/i,"Content-features"),e}_handleContentType(e){if(this.contentType=e.value.trim().toLowerCase(),this.multipart=/^multipart\//i.test(this.contentType)?this.contentType.substr(this.contentType.indexOf("/")+1):!1,this.multipart){let r=ec(e.params.boundary||this.boundary||"");this.boundary=e.params.boundary=r||ec(this._generateBoundary())}else this.boundary=!1}_generateBoundary(){return ec(this.rootNode.boundaryPrefix+"-"+this.rootNode.baseBoundary)+"-Part_"+this._nodeId}_encodeHeaderValue(e,r){switch(e=this._normalizeHeaderKey(e),e){case"From":case"Sender":case"To":case"Cc":case"Bcc":case"Reply-To":return this._convertAddresses(this._parseAddresses(r));case"Message-ID":case"In-Reply-To":case"Content-Id":return r=(r||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,""),r.charAt(0)!=="<"&&(r="<"+r),r.charAt(r.length-1)!==">"&&(r=r+">"),r;case"References":return r=[].concat.apply([],[].concat(r||"").map(n=>(n=(n||"").toString().replace(/\r?\n|\r/g," ").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").trim(),n.replace(/<[^>]*>/g,i=>i.replace(/\s/g,"")).split(/\s+/)))).map(n=>(n.charAt(0)!=="<"&&(n="<"+n),n.charAt(n.length-1)!==">"&&(n=n+">"),n)),r.join(" ").trim();case"Date":return Object.prototype.toString.call(r)==="[object Date]"?r.toUTCString().replace(/GMT/,"+0000"):(r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r));case"Content-Type":case"Content-Disposition":return(r||"").toString().replace(/\r?\n|\r/g," ");default:return r=(r||"").toString().replace(/\r?\n|\r/g," "),this._encodeHeaderText(r)}}_convertAddresses(e,r,n){let i=[];if(r=r||[],!n){n=new Set;for(let o=0;o<r.length;o++)n.add(r[o].address)}return[].concat(e||[]).forEach(o=>{if(o.address)o.address=this._normalizeAddress(o.address),o.name?i.push(`${this._encodeAddressName(o.name)} <${o.address}>`):i.push(dR.test(o.address)?o.address:`<${o.address}>`),n.has(o.address)||(n.add(o.address),r.push(o));else if(o.group){let s=(o.group.length?this._convertAddresses(o.group,r,n):"").trim();i.push(`${this._encodeAddressName(o.name)}:${s};`)}}),i.join(", ")}_normalizeAddress(e){if(e=(e||"").toString().replace(/[\x00-\x1F\x7F<>]+/g," ").trim(),!e)return e;let r=e.lastIndexOf("@");if(r<0)return this._normalizeLocalPart(e);let n=e.substr(0,r),i=e.substr(r+1),o=i,s=/[\x80-\uFFFF]/.test(n);try{o=fR(i.toLowerCase(),s)}catch{}return`${this._normalizeLocalPart(n)}@${o}`}_normalizeLocalPart(e){return lR.test(e)||uR.test(e)?e:Ya(e)}_encodeAddressName(e){return/^[\w ]*$/.test(e)?e:/^[\x20-\x7e]*$/.test(e)?Ya(e):bn(e,this._getTextEncoding(e),52)}_encodeHeaderText(e){return/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(e)?bn(e,this._getTextEncoding(e),52):this._encodeWords(e)}_encodeWords(e){return AA(e,this._getTextEncoding(e),52,!0)}_getTextEncoding(e){if(e=(e||"").toString(),this.textEncoding)return this.textEncoding;let r=0,n=0;for(let i=0,o=e.length;i<o;i++){let s=e.charCodeAt(i);s>=0&&s<=8||s===11||s===12||s>=14&&s<=31||s>=128?r++:(s>=65&&s<=90||s>=97&&s<=122)&&n++}return r<n?"Q":"B"}_generateMessageId(){return"<"+[2,2,2,6].reduce((e,r)=>e+"-"+um.randomBytes(r).toString("hex"),um.randomBytes(4).toString("hex"))+"@"+(this.getEnvelope().from||this.hostname||"localhost").split("@").pop()+">"}},Qr=pm;function tc(t){let e=t;return typeof t=="object"&&!!(e.content||e.path||e.href||e.raw)}var fm=class{constructor(e){this.mail=e||{},this.message=!1}compile(){return this._alternatives=this.getAlternatives(),this._htmlNode=this._alternatives.filter(e=>/^text\/html\b/i.test(e.contentType)).pop(),this._attachments=this.getAttachments(!!this._htmlNode),this._useRelated=!!(this._htmlNode&&this._attachments.related.length),this._useAlternative=this._alternatives.length>1,this._useMixed=this._attachments.attached.length>1||this._alternatives.length&&this._attachments.attached.length===1,this.mail.raw?this.message=new Qr("message/rfc822",{newline:this.mail.newline,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess}).setRaw(this.mail.raw):this._useMixed?this.message=this._createMixed():this._useAlternative?this.message=this._createAlternative():this._useRelated?this.message=this._createRelated():this.message=this._createContentNode(!1,[].concat(this._alternatives||[]).concat(this._attachments.attached||[]).shift()||{contentType:"text/plain",content:""}),this.mail.headers&&this.message.addHeader(this.mail.headers),["from","sender","to","cc","bcc","reply-to","in-reply-to","references","subject","message-id","date"].forEach(e=>{let r=e.replace(/-(\w)/g,(n,i)=>i.toUpperCase());this.mail[r]&&this.message.setHeader(e,this.mail[r])}),this.mail.envelope&&this.message.setEnvelope(this.mail.envelope),this.message.messageId(),this.message}getAttachments(e){let r,n=[].concat(this.mail.attachments||[]).map((i,o)=>{/^data:/i.test(i.path||i.href)&&(i=this._processDataUrl(i));let s=i.contentType||Wi(i.filename||i.path||i.href||"bin"),a=/^image\//i.test(s),c=/^message\//i.test(s),l=i.contentDisposition||(c||a&&i.cid?"inline":"attachment"),u;"contentTransferEncoding"in i?u=i.contentTransferEncoding:c?u="8bit":u="base64";let p={contentType:s,contentDisposition:l,contentTransferEncoding:u};return i.filename?p.filename=i.filename:!c&&i.filename!==!1&&(p.filename=(i.path||i.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(o+1),p.filename.indexOf(".")<0&&(p.filename+="."+Zu(p.contentType))),/^https?:\/\//i.test(i.path)&&(i.href=i.path,i.path=void 0),i.cid&&(p.cid=i.cid),i.raw?p.raw=i.raw:i.path?p.content={path:i.path}:i.href?p.content={href:i.href,httpHeaders:i.httpHeaders,tls:i.tls}:p.content=i.content||"",i.encoding&&(p.encoding=i.encoding),i.headers&&(p.headers=i.headers),p});return this.mail.icalEvent&&(r=Object.assign({},this._getIcalEvent()),r.contentType="application/ics",r.headers||(r.headers={}),r.filename=r.filename||"invite.ics",r.headers["Content-Disposition"]="attachment",r.headers["Content-Transfer-Encoding"]="base64"),e?{attached:n.filter(i=>!i.cid).concat(r||[]),related:n.filter(i=>!!i.cid)}:{attached:n.concat(r||[]),related:[]}}_getIcalEvent(){if(!this._icalEvent){let e;tc(this.mail.icalEvent)?e=et({},this.mail.icalEvent):e={content:this.mail.icalEvent},/^data:/i.test(e.path||e.href)&&(e=this._processDataUrl(e)),/^https?:\/\//i.test(e.path)&&(e.href=e.path,e.path=void 0),e.raw||(e.path?(e.content={path:e.path},e.path=void 0):e.href&&(e.content={href:e.href,httpHeaders:e.httpHeaders,tls:e.tls},e.href=void 0)),e.content&&typeof e.content=="object"&&(e.content._resolve=!0),this._icalEvent=e}return this._icalEvent}getAlternatives(){let e=[],r,n,i,o,s;return this.mail.text&&(tc(this.mail.text)?r=this.mail.text:r={content:this.mail.text},r.contentType="text/plain; charset=utf-8"),this.mail.watchHtml&&(tc(this.mail.watchHtml)?i=this.mail.watchHtml:i={content:this.mail.watchHtml},i.contentType="text/watch-html; charset=utf-8"),this.mail.amp&&(tc(this.mail.amp)?o=this.mail.amp:o={content:this.mail.amp},o.contentType="text/x-amp-html; charset=utf-8"),this.mail.icalEvent&&(s=Object.assign({},this._getIcalEvent()),s.filename=!1,s.contentType="text/calendar; charset=utf-8; method="+(s.method||"PUBLISH").toString().trim().toUpperCase(),s.headers||(s.headers={})),this.mail.html&&(tc(this.mail.html)?n=this.mail.html:n={content:this.mail.html},n.contentType="text/html; charset=utf-8"),[].concat(r||[]).concat(i||[]).concat(o||[]).concat(n||[]).concat(s||[]).concat(this.mail.alternatives||[]).forEach(a=>{/^data:/i.test(a.path||a.href)&&(a=this._processDataUrl(a));let c={contentType:a.contentType||Wi(a.filename||a.path||a.href||"txt"),contentTransferEncoding:a.contentTransferEncoding};a.filename&&(c.filename=a.filename),/^https?:\/\//i.test(a.path)&&(a.href=a.path,a.path=void 0),a.raw?c.raw=a.raw:a.path?c.content={path:a.path}:a.href?c.content={href:a.href,httpHeaders:a.httpHeaders,tls:a.tls}:c.content=a.content||"",a.encoding&&(c.encoding=a.encoding),a.headers&&(c.headers=a.headers),e.push(c)}),e}_createMixed(e){let r=e?e.createChild("multipart/mixed",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/mixed",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._useAlternative?this._createAlternative(r):this._useRelated&&this._createRelated(r),[].concat(!this._useAlternative&&this._alternatives||[]).concat(this._attachments.attached||[]).forEach(n=>{(!this._useRelated||n!==this._htmlNode)&&this._createContentNode(r,n)}),r}_createAlternative(e){let r=e?e.createChild("multipart/alternative",{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr("multipart/alternative",{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._alternatives.forEach(n=>{this._useRelated&&this._htmlNode===n?this._createRelated(r):this._createContentNode(r,n)}),r}_createRelated(e){let r=e?e.createChild('multipart/related; type="text/html"',{disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr('multipart/related; type="text/html"',{baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return this._createContentNode(r,this._htmlNode),this._attachments.related.forEach(n=>this._createContentNode(r,n)),r}_createContentNode(e,r){r=r||{},r.content=r.content||"";let n=(r.encoding||"utf8").toString().toLowerCase().replace(/[-_\s]/g,""),i=e?e.createChild(r.contentType,{filename:r.filename,textEncoding:this.mail.textEncoding,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline}):new Qr(r.contentType,{filename:r.filename,baseBoundary:this.mail.baseBoundary,textEncoding:this.mail.textEncoding,boundaryPrefix:this.mail.boundaryPrefix,disableUrlAccess:this.mail.disableUrlAccess,disableFileAccess:this.mail.disableFileAccess,normalizeHeaderKey:this.mail.normalizeHeaderKey,newline:this.mail.newline});return r.headers&&i.addHeader(r.headers),r.cid&&i.setHeader("Content-Id","<"+r.cid.replace(/[<>]/g,"")+">"),r.contentTransferEncoding?i.setHeader("Content-Transfer-Encoding",r.contentTransferEncoding):this.mail.encoding&&/^text\//i.test(r.contentType)&&i.setHeader("Content-Transfer-Encoding",this.mail.encoding),(!/^text\//i.test(r.contentType)||r.contentDisposition)&&i.setHeader("Content-Disposition",r.contentDisposition||(r.cid&&/^image\//i.test(r.contentType)?"inline":"attachment")),typeof r.content=="string"&&!["utf8","usascii","ascii"].includes(n)&&(r.content=Buffer.from(r.content,n)),r.raw?i.setRaw(r.raw):i.setContent(r.content),i}_processDataUrl(e){let r=e.path||e.href;if(!r||typeof r!="string"||!r.startsWith("data:"))return e;if(r.length>52428800){let i="application/octet-stream",o=r.indexOf(",");if(o>0&&o<200){let a=r.substring(5,o).split(";");a[0]&&a[0].includes("/")&&(i=a[0].trim())}return Object.assign(et({},e),{path:!1,href:!1,content:Buffer.alloc(0),contentType:e.contentType||i})}let n;try{n=em(r)}catch{return e}return n&&(e.content=n.data,e.contentType=e.contentType||n.contentType,"path"in e&&(e.path=!1),"href"in e&&(e.href=!1)),e}},kA=fm;import{Transform as mR}from"node:stream";function hR(t){let e=0,r=t.length;for(;e<r&&(t.charCodeAt(e)===32||t.charCodeAt(e)===9);)e++;for(;r>e&&(t.charCodeAt(r-1)===32||t.charCodeAt(r-1)===9);)r--;return t.slice(e,r)}var mm=class extends mR{constructor(e){super(e),this.lastBytes=Buffer.alloc(4),this.headersParsed=!1,this.headerBytes=0,this.headerChunks=[],this.rawHeaders=!1,this.bodySize=0}updateLastBytes(e){let r=this.lastBytes.length,n=Math.min(e.length,r);for(let i=0,o=r-n;i<o;i++)this.lastBytes[i]=this.lastBytes[i+n];for(let i=1;i<=n;i++)this.lastBytes[r-i]=e[e.length-i]}checkHeaders(e){if(this.headersParsed)return!0;let r=this.lastBytes.length,n=0;for(let i=0,o=this.lastBytes.length+e.length;i<o;i++){let s;if(i<r?s=this.lastBytes[i]:s=e[i-r],s===10&&i){let a=i-1<r?this.lastBytes[i-1]:e[i-1-r],c=i>1?i-2<r?this.lastBytes[i-2]:e[i-2-r]:!1;if(a===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}else if(a===13&&c===10){this.headersParsed=!0,n=i-r+1,this.headerBytes+=n;break}}}if(this.headersParsed){if(this.headerChunks.push(e.slice(0,n)),this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders()),e.length>n){let i=e.slice(n);this.bodySize+=i.length,this.push(i)}return!1}return this.headerBytes+=e.length,this.headerChunks.push(e),this.updateLastBytes(e),!1}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r));let i;try{i=this.checkHeaders(e)}catch(o){return n(o)}i&&(this.bodySize+=e.length,this.push(e)),n()}_flush(e){this.headerChunks&&(this.rawHeaders=Buffer.concat(this.headerChunks,this.headerBytes),this.headerChunks=null,this.emit("headers",this.parseHeaders())),e()}parseHeaders(){let e=(this.rawHeaders||Buffer.alloc(0)).toString("binary").split(/\r?\n/),r=[];for(let n of e)r.length&&/^[ \t]/.test(n)?r[r.length-1]+=`
+`+n:r.push(n);return r.filter(n=>/[^ \t\r]/.test(n)).map(n=>({key:hR(n.substr(0,n.indexOf(":"))).toLowerCase(),line:n}))}},CA=mm;import{Transform as ER}from"node:stream";import yR from"node:crypto";var nd=13,PA=10,DA=32,gR=9,LA=Buffer.from(`\r
+`),UA=Buffer.alloc(4096,LA),hm=class extends ER{constructor(e){super(),e=e||{},this.bodyHash=yR.createHash(e.hashAlgo||"sha256"),this.byteLength=0,this.debug=e.debug,this._debugBody=e.debug?[]:!1,this._lineHasContent=!1,this._pendingWsp=!1,this._pendingCr=!1,this._pendingEmptyLines=0}_hashCanonical(e){e.length&&(this.bodyHash.update(e),this._debugBody&&this._debugBody.push(Buffer.from(e)))}_hashEmptyLines(){for(;this._pendingEmptyLines>0;){let e=Math.min(this._pendingEmptyLines,UA.length/2);this._hashCanonical(UA.subarray(0,e*2)),this._pendingEmptyLines-=e}}_emitContent(e,r,n){return this._lineHasContent||(this._pendingEmptyLines&&(this._hashCanonical(e.subarray(0,r)),r=0,this._hashEmptyLines()),this._lineHasContent=!0),this._pendingWsp&&(e[r++]=DA,this._pendingWsp=!1),e[r++]=n,r}updateHash(e,r){let n=Buffer.allocUnsafe(e.length*2+2),i=0;for(let o=0;o<e.length;o++){let s=e[o];if(s===PA){this._lineHasContent?(n[i++]=nd,n[i++]=PA,this._lineHasContent=!1):this._pendingEmptyLines++,this._pendingWsp=!1,this._pendingCr=!1;continue}this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),s===nd?this._pendingCr=!0:s===DA||s===gR?this._pendingWsp=!0:i=this._emitContent(n,i,s)}r&&this._pendingCr&&(i=this._emitContent(n,i,nd),this._pendingCr=!1),this._hashCanonical(n.subarray(0,i))}_transform(e,r,n){if(!e||!e.length)return n();typeof e=="string"&&(e=Buffer.from(e,r)),this.updateHash(e),this.byteLength+=e.length,this.push(e),n()}_flush(e){this.updateHash(Buffer.alloc(0),!0),this._lineHasContent&&this._hashCanonical(LA),this.emit("hash",this.bodyHash.digest("base64"),this.debug?Buffer.concat(this._debugBody):!1),e()}},MA=hm;import vR from"node:crypto";function KA(t){let e=new Error('Unsupported DKIM hash algorithm "'+t+'"');return e.code=Es,e}function Em(t,e,r,n){n=n||{};let o=n.headerFieldNames||"From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive",s=HA(t,o,n.skipFields),a=AR(n.domainName,n.keySelector,s.fieldNames,e,r);s.headers+="dkim-signature:"+FA(a);let c;try{c=vR.createSign(("rsa-"+e).toUpperCase())}catch{throw KA(e)}c.update(s.headers,"latin1");let l;try{l=c.sign(n.privateKey,"base64")}catch{return!1}return a+l.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g,`$&\r
+ `).trim()}Em.relaxedHeaders=HA;Em.unsupportedHashAlgoError=KA;var ym=Em;function AR(t,e,r,n,i){let o=a=>(a||"").toString().replace(/[\x00-\x1f\x7f;=]/g,""),s=["v=1","a=rsa-"+n,"c=relaxed/relaxed","d="+hs(o(t)),"q=dns/txt","s="+o(e),"bh="+i,"h="+o(r)].join("; ");return Xa("DKIM-Signature: "+s,76)+`;\r
+ b=`}function HA(t,e,r){let n=new Set,i=new Set,o=new Map;(r||"").toLowerCase().split(":").forEach(c=>{i.add(c.trim())}),(e||"").toLowerCase().split(":").filter(c=>!i.has(c.trim())).forEach(c=>{n.add(c.trim())});for(let c=t.length-1;c>=0;c--){let l=t[c];n.has(l.key)&&!o.has(l.key)&&o.set(l.key,FA(l.line))}let s=[],a=[];return n.forEach(c=>{o.has(c)&&(a.push(c),s.push(c+":"+o.get(c)))}),{headers:s.join(`\r
 `)+`\r
-`,fieldNames:a.join(":")}}function Yg(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/\s+/g," ").trim()}});var Zg=he((iX,Qg)=>{"use strict";var hN=$g(),EN=zg(),yN=Xg(),{PassThrough:Dp}=ee("stream"),Pp=ee("fs"),gN=ee("path"),vN=ee("crypto"),AN="sha256",TN=2*1024*1024,Up=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||TN,this.hashAlgo=this.options.hashAlgo||AN,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?gN.join(this.cacheDir,"message."+Date.now()+"-"+vN.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",s=>{this.hasErrored=!0,this.cleanup(),i.emit("error",s)})}cleanup(){!this.cache||!this.cachePath||Pp.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=Pp.createReadStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.output.emit("error",e)}),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){if(this.hasErrored)return;if(this.readPos>=this.chunks.length)return this.cache?this.createReadCache():this.output.end();let e=this.chunks[this.readPos++];if(this.output.write(e)===!1)return this.output.once("drain",()=>{this.sendNextChunk()});setImmediate(()=>this.sendNextChunk())}sendSignedOutput(){let e=0,r=()=>{if(e>=this.keys.length)return this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());let n=this.keys[e++],i=yN(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields});return i&&this.output.write(Buffer.from(i+`\r
-`)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=Pp.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.cleanup(),this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.hasErrored=!0,this.output.emit("error",e)}),this.cache.once("close",()=>{this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new hN,this.relaxedBody=new EN({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Lp=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new Dp,i=e,s=!1;Buffer.isBuffer(e)?(s=e,i=new Dp):typeof e=="string"&&(s=Buffer.from(e),i=new Dp);let o=this.options;r&&Object.keys(r).length&&(o=Object.assign({},r,this.options));let a=new Up(o,this.keys,i,n);return setImmediate(()=>{a.signStream(),s&&setImmediate(()=>{i.end(s)})}),n}};Qg.exports=Lp});var iv=he((sX,nv)=>{"use strict";var ev=ee("net"),tv=ee("tls"),_N=ee("url"),IN=lr();function rv(t,e,r,n){let i=_N.parse(t),s={host:i.hostname,port:Number(i.port)?Number(i.port):i.protocol==="https:"?443:80},o;i.protocol==="https:"?(s.rejectUnauthorized=!1,o=tv.connect.bind(tv)):o=ev.connect.bind(ev);let a,c=!1,l=p=>{if(!c){c=!0;try{a.destroy()}catch{}n(p)}},d=()=>{let p=new Error("Proxy socket timed out");p.code="ETIMEDOUT",l(p)};a=o(s,()=>{if(c)return;let p={Host:r+":"+e,Connection:"close"};i.auth&&(p["Proxy-Authorization"]="Basic "+Buffer.from(i.auth).toString("base64")),a.write("CONNECT "+r+":"+e+` HTTP/1.1\r
-`+Object.keys(p).map(v=>v+": "+p[v]).join(`\r
+`,fieldNames:a.join(":")}}function FA(t){return t.substr(t.indexOf(":")+1).replace(/\r?\n/g,"").replace(/[ \t]+/g," ").replace(/^ | $/g,"")}import{PassThrough as gm}from"node:stream";import vm from"node:fs";import TR from"node:path";import _R from"node:crypto";var IR="sha256",xR=10*1024*1024,Am=class{constructor(e,r,n,i){this.options=e||{},this.keys=r,this.cacheTreshold=Number(this.options.cacheTreshold)||xR,this.hashAlgo=this.options.hashAlgo||IR,this.cacheDir=this.options.cacheDir||!1,this.chunks=[],this.chunklen=0,this.readPos=0,this.cachePath=this.cacheDir?TR.join(this.cacheDir,"message."+Date.now()+"-"+_R.randomBytes(14).toString("hex")):!1,this.cache=!1,this.headers=!1,this.bodyHash=!1,this.parser=!1,this.relaxedBody=!1,this.input=n,this.output=i,this.output.usingCache=!1,this.hasErrored=!1,this.input.on("error",o=>this.fail(o)),this.output.once("close",()=>{this.output.writableFinished||(this.hasErrored=!0,this.input.unpipe(),this.input.destroy(),this.cleanup())})}fail(e){this.hasErrored=!0,this.cleanup(),this.output.destroy(e)}cleanup(){if(!this.cache||!this.cachePath)return;let e=this.cache;this.cache=!1,e.destroy(),vm.unlink(this.cachePath,()=>!1)}createReadCache(){this.cache=vm.createReadStream(this.cachePath),this.cache.once("error",e=>this.fail(e)),this.cache.once("close",()=>{this.cleanup()}),this.cache.pipe(this.output)}sendNextChunk(){for(;!this.hasErrored;){if(this.readPos>=this.chunks.length){if(!this.cache){this.output.end();return}return this.createReadCache()}let e=this.chunks[this.readPos++];if(this.output.write(e)===!1){this.output.once("drain",()=>{this.sendNextChunk()});return}}}sendSignedOutput(){if(this.hasErrored)return;let e=0,r=()=>{if(e>=this.keys.length){this.output.write(this.parser.rawHeaders),setImmediate(()=>this.sendNextChunk());return}let n=this.keys[e++],i;try{i=ym(this.headers,this.hashAlgo,this.bodyHash,{domainName:n.domainName,keySelector:n.keySelector,privateKey:n.privateKey,headerFieldNames:this.options.headerFieldNames,skipFields:this.options.skipFields})}catch(o){this.fail(o);return}i&&this.output.write(Buffer.from(i+`\r
+`)),setImmediate(r)};if(this.bodyHash&&this.headers)return r();this.output.write(this.parser.rawHeaders),this.sendNextChunk()}createWriteCache(){this.output.usingCache=!0,this.cache=vm.createWriteStream(this.cachePath),this.cache.once("error",e=>{this.relaxedBody.unpipe(this.cache),this.relaxedBody.on("readable",()=>{for(;this.relaxedBody.read()!==null;);}),this.fail(e)}),this.cache.once("close",()=>{this.hasErrored||this.sendSignedOutput()}),this.relaxedBody.removeAllListeners("readable"),this.relaxedBody.pipe(this.cache)}signStream(){this.parser=new CA,this.relaxedBody=new MA({hashAlgo:this.hashAlgo}),this.parser.on("headers",e=>{this.headers=e}),this.relaxedBody.on("hash",e=>{this.bodyHash=e}),this.relaxedBody.on("readable",()=>{let e;if(!this.cache){for(;(e=this.relaxedBody.read())!==null;)if(this.chunks.push(e),this.chunklen+=e.length,this.chunklen>=this.cacheTreshold&&this.cachePath)return this.createWriteCache()}}),this.relaxedBody.on("end",()=>{this.cache||this.sendSignedOutput()}),this.parser.pipe(this.relaxedBody),setImmediate(()=>this.input.pipe(this.parser))}},Tm=class{constructor(e){this.options=e||{},this.keys=[].concat(this.options.keys||{domainName:e.domainName,keySelector:e.keySelector,privateKey:e.privateKey})}sign(e,r){let n=new gm,i=e,o=!1;Buffer.isBuffer(e)?(o=e,i=new gm):typeof e=="string"&&(o=Buffer.from(e),i=new gm);let s=this.options;r&&Object.keys(r).length&&(s=et({},r),et(s,this.options));let a=new Am(s,this.keys,i,n);return setImmediate(()=>{try{a.signStream()}catch{a.fail(ym.unsupportedHashAlgoError(a.hashAlgo));return}o&&setImmediate(()=>{i.end(o)})}),n}},_m=Tm;import Im from"node:net";import VA from"node:tls";var bR=64*1024,BA=t=>typeof t=="string"&&t.startsWith("[")&&t.endsWith("]")?t.slice(1,-1):t;function jA(t,e,r,n,i){typeof n=="function"&&(i=n,n={}),n=n||{};let o=i;if(e=Number(e)||0,!e||/[\r\n]/.test(r)){let B=new Error("Invalid proxy destination");B.code=li,setImmediate(()=>o(B));return}let s=Nr(t),a=(Im.isIPv6(BA(r))?"["+BA(r)+"]":r)+":"+e,c={host:s.hostname,port:Number(s.port)?Number(s.port):s.protocol==="https:"?443:80},l;s.protocol==="https:"?(c.rejectUnauthorized=n.rejectUnauthorized!==!1,l=VA.connect.bind(VA)):l=Im.connect.bind(Im);let u=Number(n.timeout)||jA.timeout||30*1e3,p,f=!1,m,E=()=>{clearTimeout(m),p.removeListener("data",K),p.removeListener("error",v),p.removeListener("close",N)};function v(B){if(!f){f=!0,E();try{p.destroy()}catch{}o(B)}}function N(){let B=new Error("Proxy closed the connection before the tunnel was established");B.code=li,v(B)}let S=[],R=0,M="";function K(B){if(f)return;let V=M+B.toString("binary"),$=V.indexOf(`\r
+\r
+`);if(S.push(B),R+=B.length,M=V.slice(-3),$<0){if(R>bR){let I=new Error("Proxy response headers too large");I.code=li,v(I)}return}p.removeListener("data",K),p.pause();let A=R-V.length+$,x=Buffer.concat(S,R);x.length>A+4&&p.unshift(x.subarray(A+4));let b=x.toString("binary",0,A).match(/^HTTP\/\d+\.\d+ (\d+)/i);if(!b||(b[1]||"").charAt(0)!=="2"){let I=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return I.code=li,v(I)}f=!0,E();let g=I=>{I==="data"&&(p.removeListener("newListener",g),p.resume())};return p.on("newListener",g),o(null,p)}p=l(c,()=>{if(f)return;let B={Host:a,Connection:"close"};s.auth&&(B["Proxy-Authorization"]="Basic "+Buffer.from(s.auth).toString("base64")),p.write("CONNECT "+a+` HTTP/1.1\r
+`+Object.keys(B).map(V=>V+": "+B[V]).join(`\r
 `)+`\r
 \r
-`);let m="",E=v=>{let b,k;if(!c&&(m+=v.toString("binary"),b=m.match(/\r\n\r\n/))){if(a.removeListener("data",E),k=m.substr(b.index+b[0].length),m=m.substr(0,b.index),k&&a.unshift(Buffer.from(k,"binary")),c=!0,b=m.match(/^HTTP\/\d+\.\d+ (\d+)/i),!b||(b[1]||"").charAt(0)!=="2"){try{a.destroy()}catch{}let C=new Error("Invalid response from proxy"+(b&&": "+b[1]||""));return C.code=IN.EPROXY,n(C)}return a.removeListener("error",l),a.removeListener("timeout",d),a.setTimeout(0),n(null,a)}};a.on("data",E)}),a.setTimeout(rv.timeout||30*1e3),a.on("timeout",d),a.once("error",l)}nv.exports=rv});var av=he((oX,ov)=>{"use strict";var sv=Kt(),xN=kl(),Vs=da(),Mp=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};Object.assign(this.data,r),this.data.headers=this.data.headers||{},Object.keys(i).forEach(s=>{s in this.data?s==="headers"&&Object.keys(i.headers).forEach(o=>{o in this.data.headers||(this.data.headers[o]=i.headers[o])}):this.data[s]=i[s]}),["disableFileAccess","disableUrlAccess","normalizeHeaderKey"].forEach(s=>{s in n&&(this.data[s]=n[s])})}resolveContent(...e){return sv.resolveContent(...e)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split("/").pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Vs.detectExtension(c.contentType))),c.contentType||(c.contentType=Vs.detectMimeType(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new xN;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let o=0,a=()=>{if(o>=r.length)return e(null,this.data);let c=r[o++];if(!c[0]||!c[0][c[1]])return a();sv.resolveContent(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,d)=>{if(l)return e(l);let p={content:d};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&Object.keys(c[0][c[1]]).forEach(m=>{!(m in p)&&!["content","path","href","raw"].includes(m)&&(p[m]=c[0][c[1]][m])}),c[0][c[1]]=p,a()})};setImmediate(()=>a())}normalize(e){let r=this.data.envelope||this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,s)=>i?e(i):(s.envelope=r,s.messageId=n,["html","text","watchHtml","amp"].forEach(o=>{s[o]&&s[o].content&&(typeof s[o].content=="string"?s[o]=s[o].content:Buffer.isBuffer(s[o].content)&&(s[o]=s[o].content.toString()))}),s.icalEvent&&Buffer.isBuffer(s.icalEvent.content)&&(s.icalEvent.content=s.icalEvent.content.toString("base64"),s.icalEvent.encoding="base64"),s.alternatives&&s.alternatives.length&&s.alternatives.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.attachments&&s.attachments.length&&s.attachments.forEach(o=>{o&&o.content&&Buffer.isBuffer(o.content)&&(o.content=o.content.toString("base64"),o.encoding="base64")}),s.normalizedHeaders={},Object.keys(s.headers||{}).forEach(o=>{let a=[].concat(s.headers[o]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(o)&&(a=this.message._encodeHeaderValue(o,a)),s.normalizedHeaders[o]=a)}),s.list&&typeof s.list=="object"&&this._getListHeaders(s.list).forEach(a=>{s.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),s.references&&(s.normalizedHeaders.references=this.message._encodeHeaderValue("references",s.references)),s.inReplyTo&&(s.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",s.inReplyTo)),e(null,s)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){if(r.toLowerCase().trim()==="id"){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(o)?o='"'+o+'"':o=Vs.encodeWord(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+\/{,2}/,"")}let s=(i.comment||"").toString().replace(/\r?\n|\r/g," ");return Vs.isPlainText(s)||(s=Vs.encodeWord(s)),this._formatListUrl(i.url)+(i.comment?" ("+s+")":"")}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};ov.exports=Mp});var pv=he((aX,dv)=>{"use strict";var bN=ee("events"),cv=Kt(),SN=up(),NN=jg(),lv=Zg(),wN=iv(),uv=lr(),RN=ee("util"),ON=ee("url"),Kp=br(),kN=av(),CN=ee("net"),DN=ee("dns"),PN=ee("crypto"),Hp=class extends bN{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new lv(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=cv.getLogger(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...s)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...s)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((s,o)=>{r=cv.callbackPromise(s,o)})),typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let i=new kN(this,e);return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",i,s=>{if(s)return this.logger.error({err:s,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",s.message),r(s);i.message=new NN(i.data).compile(),i.setMailerHeader(),i.setPriorityHeaders(),i.setListHeaders(),this._processPlugins("stream",i,o=>{if(o)return this.logger.error({err:o,tnx:"plugin",action:"stream"},"PluginStream Error: %s",o.message),r(o);(i.data.dkim||this.dkim)&&i.message.processFunc(a=>{let c=i.data.dkim?new lv(i.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:i.message.messageId(),dkimDomains:c.keys.map(l=>l.keySelector+"."+l.domainName).join(", ")},"Signing outgoing message with %s keys",c.keys.length),c.sign(a,i.data._dkim)}),this.transporter.send(i,(...a)=>{a[0]&&this.logger.error({err:a[0],tnx:"transport",action:"send"},"Send Error: %s",a[0].message),r(...a)})})}),n}getVersionString(){return RN.format("%s (%s; +%s; %s/%s)",Kp.name,Kp.version,Kp.homepage,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],s=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+s.length===0)return n();let o=0,a="default",c=()=>{let l=a==="default"?s:i;if(o>=l.length)if(a==="default"&&i.length)a="user",o=0,l=i;else return n();let d=l[o++];d(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=ON.parse(e);this.getSocket=(n,i)=>{let s=r.protocol.replace(/:$/,"").toLowerCase();if(this.meta.has("proxy_handler_"+s))return this.meta.get("proxy_handler_"+s)(r,n,i);switch(s){case"http":case"https":wN(r.href,n.port,n.host,(a,c)=>a?i(a):i(null,{connection:c}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let c=new Error("Socks module not loaded");return c.code=uv.EPROXY,i(c)}let a=c=>{let l=!!this.meta.get("proxy_socks_module").SocksClient,d=l?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),p=Number(r.protocol.replace(/\D/g,""))||5,m={proxy:{ipaddress:c,port:Number(r.port),type:p},[l?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(r.auth){let E=decodeURIComponent(r.auth.split(":").shift()),v=decodeURIComponent(r.auth.split(":").pop());l?(m.proxy.userId=E,m.proxy.password=v):p===4?m.userid=E:m.authentication={username:E,password:v}}d.createConnection(m,(E,v)=>E?i(E):i(null,{connection:v.socket||v}))};return CN.isIP(r.hostname)?a(r.hostname):DN.resolve(r.hostname,(c,l)=>{if(c)return i(c);a(Array.isArray(l)?l[0]:l)})}}let o=new Error("Unknown proxy configuration");o.code=uv.EPROXY,i(o)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let s=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(o,a,c,l)=>{let d=PN.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:d,filename:"image-"+ ++s+"."+SN.detectExtension(l)}),a+"cid:"+d}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}};dv.exports=Hp});var mv=he((cX,fv)=>{"use strict";var{Transform:UN}=ee("stream"),Fp=class extends UN{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],s=0,o,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,o=0,a=e.length;o<a;o++)e[o]===46?(o&&e[o-1]===10||!o&&(!this.lastByte||this.lastByte===10))&&(l=e.slice(c,o+1),i.push(l),i.push(Buffer.from(".")),s+=l.length+1,c=o+1):e[o]===10&&(o&&e[o-1]!==13||!o&&this.lastByte!==13)&&(o>c?(l=e.slice(c,o),i.push(l),s+=l.length+2):s+=2,i.push(Buffer.from(`\r
-`)),c=o+1);s?(c<e.length&&(l=e.slice(c),i.push(l),s+=l.length),this.outByteCount+=s,this.push(Buffer.concat(i,s))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
+`),p.on("data",K)}),m=setTimeout(()=>{let B=new Error("Proxy socket timed out");B.code=Yf,v(B)},u),p.once("error",v),p.once("close",N)}var GA=jA;import wR from"node:util";var xm=(t,e)=>Object.prototype.hasOwnProperty.call(t,e),rc=class{constructor(e,r){this.mailer=e,this.data={},this.message=null,r=r||{};let n=e.options||{},i=e._defaults||{};et(this.data,r),this.data.headers=this.data.headers||{},et(this.data,i,o=>xm(this.data,o)),et(this.data.headers,i.headers,o=>xm(this.data.headers,o)),["disableFileAccess","disableUrlAccess","normalizeHeaderKey","maxRecipients"].forEach(o=>{o in n&&(this.data[o]=n[o])}),["disableFileAccess","disableUrlAccess"].forEach(o=>{!(o in n)&&xm(i,o)&&(this.data[o]=this.data[o]||i[o])})}resolveContent(e,r,n,i){!i&&typeof n=="function"&&(i=n,n=!1),n=n||{};let o={disableFileAccess:this.data.disableFileAccess||n.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess||n.disableUrlAccess};return tm(e,r,o,i)}resolveAll(e){let r=[[this.data,"html"],[this.data,"text"],[this.data,"watchHtml"],[this.data,"amp"],[this.data,"icalEvent"]];this.data.alternatives&&this.data.alternatives.length&&this.data.alternatives.forEach((c,l)=>{r.push([this.data.alternatives,l])}),this.data.attachments&&this.data.attachments.length&&this.data.attachments.forEach((c,l)=>{c.filename||(c.filename=(c.path||c.href||"").split(/[/\\]/).pop().split("?").shift()||"attachment-"+(l+1),c.filename.indexOf(".")<0&&(c.filename+="."+Zu(c.contentType))),c.contentType||(c.contentType=Wi(c.filename||c.path||c.href||"bin")),r.push([this.data.attachments,l])});let n=new Qr;["from","to","cc","bcc","sender","replyTo"].forEach(c=>{let l;this.message?l=[].concat(n._parseAddresses(this.message.getHeader(c==="replyTo"?"reply-to":c))||[]):this.data[c]&&(l=[].concat(n._parseAddresses(this.data[c])||[])),l&&l.length?this.data[c]=l:c in this.data&&(this.data[c]=null)}),["from","sender"].forEach(c=>{this.data[c]&&(this.data[c]=this.data[c].shift())});let s=0,a=()=>{if(s>=r.length)return e(null,this.data);let c=r[s++];if(!c[0]||!c[0][c[1]])return a();tm(...c,{disableFileAccess:this.data.disableFileAccess,disableUrlAccess:this.data.disableUrlAccess},(l,u)=>{if(l)return e(l);let p={content:u};c[0][c[1]]&&typeof c[0][c[1]]=="object"&&!Buffer.isBuffer(c[0][c[1]])&&et(p,c[0][c[1]],f=>f in p||["content","path","href","raw"].includes(f)),c[0][c[1]]=p,a()})};setImmediate(()=>a())}releaseStreams(){let e=this.data,r=[e.html,e.text,e.watchHtml,e.amp,e.raw,e.icalEvent];for(let n of["attachments","alternatives"])Array.isArray(e[n])&&r.push(...e[n]);for(let n of r)n&&typeof n=="object"&&($i(n),$i(n.content),$i(n.raw))}normalize(e){let r=this.message.getEnvelope(),n=this.message.messageId();this.resolveAll((i,o)=>i?e(i):(o.envelope=r,o.messageId=n,["html","text","watchHtml","amp"].forEach(s=>{o[s]&&o[s].content&&(typeof o[s].content=="string"?o[s]=o[s].content:Buffer.isBuffer(o[s].content)&&(o[s]=o[s].content.toString()))}),o.icalEvent&&Buffer.isBuffer(o.icalEvent.content)&&(o.icalEvent.content=o.icalEvent.content.toString("base64"),o.icalEvent.encoding="base64"),o.alternatives&&o.alternatives.length&&o.alternatives.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.attachments&&o.attachments.length&&o.attachments.forEach(s=>{s&&s.content&&Buffer.isBuffer(s.content)&&(s.content=s.content.toString("base64"),s.encoding="base64")}),o.normalizedHeaders={},Object.keys(o.headers||{}).forEach(s=>{if(Rr(s))return;let a=[].concat(o.headers[s]||[]).shift();a=a&&a.value||a,a&&(["references","in-reply-to","message-id","content-id"].includes(s)&&(a=this.message._encodeHeaderValue(s,a)),o.normalizedHeaders[s]=a)}),o.list&&typeof o.list=="object"&&this._getListHeaders(o.list).forEach(a=>{o.normalizedHeaders[a.key]=a.value.map(c=>c&&c.value||c).join(", ")}),o.references&&(o.normalizedHeaders.references=this.message._encodeHeaderValue("references",o.references)),o.inReplyTo&&(o.normalizedHeaders["in-reply-to"]=this.message._encodeHeaderValue("in-reply-to",o.inReplyTo)),e(null,o)))}setMailerHeader(){!this.message||!this.data.xMailer||this.message.setHeader("X-Mailer",this.data.xMailer)}setPriorityHeaders(){if(!(!this.message||!this.data.priority))switch((this.data.priority||"").toString().toLowerCase()){case"high":this.message.setHeader("X-Priority","1 (Highest)"),this.message.setHeader("X-MSMail-Priority","High"),this.message.setHeader("Importance","High");break;case"low":this.message.setHeader("X-Priority","5 (Lowest)"),this.message.setHeader("X-MSMail-Priority","Low"),this.message.setHeader("Importance","Low");break;default:}}setListHeaders(){!this.message||!this.data.list||typeof this.data.list!="object"||this._getListHeaders(this.data.list).forEach(e=>{e.value.forEach(r=>{this.message.addHeader(e.key,r)})})}_getListHeaders(e){return Object.keys(e).map(r=>({key:"list-"+r.toLowerCase().trim(),value:[].concat(e[r]||[]).map(n=>({prepared:!0,foldLines:!0,value:[].concat(n||[]).map(i=>{if(typeof i=="string"&&(i={url:i}),i&&i.url){let o=(i.comment||"").toString().replace(/\r?\n|\r/g," "),s=!vs(o)||/\x7f/.test(o);return r.toLowerCase().trim()==="id"?(o=s?bn(o):Ya(o),(i.comment?o+" ":"")+this._formatListUrl(i.url).replace(/^<[^:]+:\/{0,2}/,"<")):(o=s?bn(o):o.replace(/[()\\]/g,"\\$&"),this._formatListUrl(i.url)+(i.comment?" ("+o+")":""))}return""}).filter(i=>i).join(", ")}))}))}_formatListUrl(e){return e=e.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g,"").replace(/[\s<]+|[\s>]+/g,""),/^(https?|mailto|ftp):/.test(e)?"<"+e+">":/^[^@]+@[^@]+$/.test(e)?"<mailto:"+e+">":"<http://"+e+">"}};import NR from"node:net";import RR from"node:dns";import OR from"node:crypto";var kR=1e5,bm=class extends SR{constructor(e,r,n){super(),this.options=r||{},this._defaults=n||{},this._defaultPlugins={compile:[(...i)=>this._convertDataImages(...i)],stream:[]},this._userPlugins={compile:[],stream:[]},this.meta=new Map,this.dkim=this.options.dkim?new _m(this.options.dkim):!1,this.transporter=e,this.transporter.mailer=this,this.logger=ft(this.options,{component:this.options.component||"mail"}),this.logger.debug({tnx:"create"},"Creating transport: %s",this.getVersionString()),typeof this.transporter.on=="function"&&(this.transporter.on("log",i=>{this.logger.debug({tnx:"transport"},"%s: %s",i.type,i.message)}),this.transporter.on("error",i=>{this.logger.error({err:i,tnx:"transport"},"Transport Error: %s",i.message),this.emit("error",i)}),this.transporter.on("idle",(...i)=>{this.emit("idle",...i)}),this.transporter.on("clear",(...i)=>{this.emit("clear",...i)})),["close","isIdle","verify"].forEach(i=>{this[i]=(...o)=>typeof this.transporter[i]=="function"?(i==="verify"&&typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1),this.transporter[i](...o)):(this.logger.warn({tnx:"transport",methodName:i},"Non existing method %s called for transport",i),!1)}),this.options.proxy&&typeof this.options.proxy=="string"&&this.setupProxy(this.options.proxy)}use(e,r){return e=(e||"").toString(),this._userPlugins.hasOwnProperty(e)?this._userPlugins[e].push(r):this._userPlugins[e]=[r],this}sendMail(e,r=null){let n;r||(n=new Promise((a,c)=>{r=Mt(a,c)}));let i=r;typeof this.getSocket=="function"&&(this.transporter.getSocket=this.getSocket,this.getSocket=!1);let o=new rc(this,e),s=a=>{o.releaseStreams(),i(a)};return this.logger.debug({tnx:"transport",name:this.transporter.name,version:this.transporter.version,action:"send"},"Sending mail using %s/%s",this.transporter.name,this.transporter.version),this._processPlugins("compile",o,a=>{if(a)return this.logger.error({err:a,tnx:"plugin",action:"compile"},"PluginCompile Error: %s",a.message),s(a);let c;try{o.message=new kA(o.data).compile(),o.setMailerHeader(),o.setPriorityHeaders(),o.setListHeaders(),c=o.message.getEnvelope().to.length}catch(u){return this.logger.error({err:u,tnx:"transport",action:"send"},"Compile Error: %s",u.message),s(u)}let l=o.data.maxRecipients===void 0?kR:o.data.maxRecipients;if(l&&c>l){let u=new Error(`Message has ${c} recipients, which is over the ${l} allowed by maxRecipients`);return u.code=Xv,this.logger.error({err:u,tnx:"transport",action:"send"},"Send Error: %s",u.message),s(u)}this._processPlugins("stream",o,u=>{if(u)return this.logger.error({err:u,tnx:"plugin",action:"stream"},"PluginStream Error: %s",u.message),s(u);(o.data.dkim||this.dkim)&&o.message.processFunc(p=>{let f=o.data.dkim?new _m(o.data.dkim):this.dkim;return this.logger.debug({tnx:"DKIM",messageId:o.message.messageId(),dkimDomains:f.keys.map(m=>m.keySelector+"."+m.domainName).join(", ")},"Signing outgoing message with %s keys",f.keys.length),f.sign(p,o.data._dkim)}),this.transporter.send(o,(...p)=>{p[0]&&(o.releaseStreams(),this.logger.error({err:p[0],tnx:"transport",action:"send"},"Send Error: %s",p[0].message)),i(...p)})})}),n}getVersionString(){return wR.format("%s (%s; +%s; %s/%s)",Ku,Xe,zv,this.transporter.name,this.transporter.version)}_processPlugins(e,r,n){if(e=(e||"").toString(),!this._userPlugins.hasOwnProperty(e))return n();let i=this._userPlugins[e]||[],o=this._defaultPlugins[e]||[];if(i.length&&this.logger.debug({tnx:"transaction",pluginCount:i.length,step:e},"Using %s plugins for %s",i.length,e),i.length+o.length===0)return n();let s=0,a="default",c=()=>{let l=a==="default"?o:i;if(s>=l.length)if(a==="default"&&i.length)a="user",s=0,l=i;else return n();let u=l[s++];u(r,p=>{if(p)return n(p);c()})};c()}setupProxy(e){let r=Nr(e);this.getSocket=(n,i)=>{let o=r.protocol.replace(/:$/,"").toLowerCase(),s=Number(this.options.connectionTimeout)||0,a=Number(n.connectStartedAt)||Date.now(),c=s?Math.max(a+s-Date.now(),1):void 0;if(this.meta.has("proxy_handler_"+o))return this.meta.get("proxy_handler_"+o)(r,n,i);switch(o){case"http":case"https":GA(r.href,n.port,n.host,c?Object.assign({},this.options.tls,{timeout:c}):this.options.tls||{},(u,p)=>u?i(u):i(null,{connection:p}));return;case"socks":case"socks5":case"socks4":case"socks4a":{if(!this.meta.has("proxy_socks_module")){let p=new Error("Socks module not loaded");return p.code=li,i(p)}let u=p=>{let f=!!this.meta.get("proxy_socks_module").SocksClient,m=f?this.meta.get("proxy_socks_module").SocksClient:this.meta.get("proxy_socks_module"),E=Number(r.protocol.replace(/\D/g,""))||5,v={proxy:{ipaddress:p,port:Number(r.port),type:E},[f?"destination":"target"]:{host:n.host,port:n.port},command:"connect"};if(c&&(v.timeout=c),r.username||r.password){let N=r.username||"",S=r.password||"";f?(v.proxy.userId=N,v.proxy.password=S):E===4?v.userid=N:v.authentication={username:N,password:S}}m.createConnection(v,(N,S)=>N?i(N):i(null,{connection:S.socket||S}))};return NR.isIP(r.hostname)?u(r.hostname):RR.lookup(r.hostname,(p,f)=>{if(p)return i(p);u(f)})}}let l=new Error("Unknown proxy configuration");l.code=li,i(l)}}_convertDataImages(e,r){if(!this.options.attachDataUrls&&!e.data.attachDataUrls||!e.data.html)return r();e.resolveContent(e.data,"html",{disableFileAccess:e.data.disableFileAccess,disableUrlAccess:e.data.disableUrlAccess},(n,i)=>{if(n)return r(n);let o=0;i=(i||"").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,(s,a,c,l)=>{let u=OR.randomBytes(10).toString("hex")+"@localhost";return e.data.attachments||(e.data.attachments=[]),Array.isArray(e.data.attachments)||(e.data.attachments=[].concat(e.data.attachments||[])),e.data.attachments.push({path:c,cid:u,filename:"image-"+ ++o+"."+Ju(l)}),a+"cid:"+u}),e.data.html=i,r()})}set(e,r){return this.meta.set(e,r)}get(e){return this.meta.get(e)}},$A=bm;import{EventEmitter as XR}from"node:events";import{EventEmitter as MR}from"node:events";import di from"node:net";import qA from"node:tls";import KR from"node:os";import WA from"node:crypto";import{Transform as CR}from"node:stream";var PR=Buffer.from(`
+`),DR=Buffer.from(`
+.`),UR=Buffer.from("\r"),LR=Buffer.from("."),nc=class extends CR{constructor(e){super(e),this.options=e||{},this.inByteCount=0,this.outByteCount=0,this.lastByte=!1}_transform(e,r,n){let i=[],o=0,s,a,c=0,l;if(!e||!e.length)return n();for(typeof e=="string"&&(e=Buffer.from(e)),this.inByteCount+=e.length,s=0,a=e.length;s<a;s++){let u=e[s],p=s?e[s-1]:this.lastByte,f=!1;p===13&&u!==10?f=u===46?DR:PR:u===10&&p!==13?f=UR:u===46&&(p===10||p===!1)&&(f=LR),f&&(s>c&&(l=e.slice(c,s),i.push(l),o+=l.length),i.push(f),o+=f.length,c=s)}i.length?(c<e.length&&(l=e.slice(c),i.push(l),o+=l.length),this.outByteCount+=o,this.push(Buffer.concat(i,o))):(this.outByteCount+=e.length,this.push(e)),this.lastByte=e[e.length-1],n()}_flush(e){let r;this.lastByte===10?r=Buffer.from(`.\r
 `):this.lastByte===13?r=Buffer.from(`
 .\r
 `):r=Buffer.from(`\r
 .\r
-`),this.outByteCount+=r.length,this.push(r),e()}};fv.exports=Fp});var Cl=he((lX,Tv)=>{"use strict";var LN=br(),{EventEmitter:MN}=ee("events"),hv=ee("net"),Ev=ee("tls"),KN=ee("os"),yv=ee("crypto"),HN=mv(),{PassThrough:gv}=ee("stream"),Ii=Kt(),FN=120*1e3,vv=600*1e3,VN=30*1e3,BN=30*1e3,qN=()=>{};function Av(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}var Vp=class extends MN{constructor(e){super(e),this.id=yv.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:hv.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=Ii.getLogger(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=LN.version,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._greetingTimeout=!1,this._connectionTimeout=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onConnectionError(r,"ESOCKET"),this._connectionAttemptId=0}connect(e){if(typeof e=="function"){this.once("connect",()=>{this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let n=this._isDestroyedMessage("connect");if(n)return e(this._formatError(n,"ECONNECTION",!1,"CONN"))}let r={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:this.options.dnsTimeout||BN};if(this.options.localAddress&&(r.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(n=>{if(n){this._onError(new Error("Error initiating TLS - "+(n.message||n)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(r,n=>{try{this._socket.connect(this.port,this.host,()=>{this._socket.setKeepAlive(!0),this._onConnect()}),this._setupConnectionHandlers()}catch(i){return setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"))}})):(this.secureConnection&&(Object.assign(r,this.options.tls||{}),this.servername&&!r.servername&&(r.servername=this.servername)),this._resolveAndConnect(r,n=>{this._fallbackAddresses=(n._addresses||[]).filter(i=>i!==r.host),this._connectOpts=Object.assign({},r),this._connectToHost(r,this.secureConnection)}))}_resolveAndConnect(e,r){return Ii.resolveHostname(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let s of Object.keys(i))s.charAt(0)!=="_"&&i[s]&&(e[s]=i[s]);r(i)})}_connectToHost(e,r){this._connectionAttemptId++;let n=this._connectionAttemptId,i=r?Ev.connect:hv.connect;try{this._socket=i(e,()=>{this._connectionAttemptId===n&&(this._socket.setKeepAlive(!0),this._onConnect())}),this._setupConnectionHandlers()}catch(s){return setImmediate(()=>this._onError(s,"ECONNECTION",!1,"CONN"))}}_setupConnectionHandlers(){this._connectionTimeout=setTimeout(()=>{this._onConnectionError("Connection timeout","ETIMEDOUT")},this.options.connectionTimeout||FN),this._socket.on("error",this._onConnectionSocketError)}_onConnectionError(e,r){if(clearTimeout(this._connectionTimeout),!(this._fallbackAddresses&&this._fallbackAddresses.length&&this.stage==="init"&&!this._destroyed)){this._onError(e,r,!1,"CONN");return}let i=this._fallbackAddresses.shift();if(this.logger.info({tnx:"network",failedHost:this._connectOpts.host,nextHost:i,error:e.message||e},"Connection to %s failed, trying %s",this._connectOpts.host,i),this._socket){try{this._socket.removeListener("error",this._onConnectionSocketError),this._socket.destroy()}catch{}this._socket=null}this._connectOpts.host=i,this._connectToHost(this._connectOpts,this.secureConnection)}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(r&&!r.destroyed)try{r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",qN),r[e]()}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));if(this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1,!this._authMethod&&this._auth.oauth2&&!this._auth.credentials?this._authMethod="XOAUTH2":(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2)&&(this._authMethod=(this._supportedAuth[0]||"PLAIN").toUpperCase().trim()),this._authMethod!=="XOAUTH2"&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let i=this.customAuth.get(this._authMethod),s,o=!1,a=()=>{o||(o=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},c=d=>{o||(o=!0,r(this._formatError(d,"EAUTH",s,"AUTH "+this._authMethod)))},l=i({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:(d,p)=>{let m;return p||(m=new Promise((E,v)=>{p=Ii.callbackPromise(E,v)})),this._responseActions.push(E=>{s=E;let v=E.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),b={command:d,response:E};v?(b.status=Number(v[1])||0,v[2]&&(b.code=v[2]),b.text=E.substr(v[0].length)):(b.text=E,b.status=0),p(null,b)}),setImmediate(()=>this._sendCommand(d)),m},resolve:a,reject:c});l&&typeof l.catch=="function"&&l.then(a).catch(c);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(i=>{this._actionAUTH_LOGIN_USER(i,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(i=>{this._actionAUTHComplete(i,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(i=>{this._actionAUTH_CRAM_MD5(i,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){if(!r)return n(this._formatError("Empty message","EMESSAGE",!1,"API"));let i=this._isDestroyedMessage("send message");if(i)return n(this._formatError(i,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize)return setImmediate(()=>{n(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});let s=!1,o=function(){s||(s=!0,n(...arguments))};typeof r.on=="function"&&r.on("error",c=>o(this._formatError(c,"ESTREAM",!1,"API")));let a=Date.now();this._setEnvelope(e,(c,l)=>{if(c){let m=new gv;return typeof r.pipe=="function"?r.pipe(m):(m.write(r),m.end()),o(c)}let d=Date.now(),p=this._createSendStream((m,E)=>m?o(m):(l.envelopeTime=d-a,l.messageTime=Date.now()-d,l.messageSize=p.outByteCount,l.response=E,o(null,l)));typeof r.pipe=="function"?r.pipe(p):(p.write(r),p.end())})}reset(e){this._sendCommand("RSET"),this._responseActions.push(r=>r.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+r,"EPROTOCOL",r,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){if(clearTimeout(this._connectionTimeout),this.logger.info({tnx:"network",localAddress:this._socket.localAddress,localPort:this._socket.localPort,remoteAddress:this._socket.remoteAddress,remotePort:this._socket.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",this._socket.remoteAddress,this._socket.remotePort),this._destroyed){this.close();return}this.stage="connected",this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout),this._socket.removeListener("close",this._onSocketClose),this._socket.removeListener("end",this._onSocketEnd),this._socket.removeListener("error",this._onConnectionSocketError),this._socket.on("error",this._onSocketError),this._socket.on("data",this._onSocketData),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),this._greetingTimeout=setTimeout(()=>{this._socket&&!this._destroyed&&this._responseActions[0]===this._actionGreeting&&this._onError("Greeting never received","ETIMEDOUT",!1,"CONN")},this.options.greetingTimeout||VN),this._responseActions.push(this._actionGreeting),this._socket.resume()}_onData(e){if(this._destroyed||!e||!e.length)return;let r=(e||"").toString("binary"),n=(this._remainder+r).split(/\r?\n/),i;this._remainder=n.pop();for(let s=0,o=n.length;s<o;s++){if(this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))){this._responseQueue[this._responseQueue.length-1]+=`
-`+n[s];continue}this._responseQueue.push(n[s])}this._responseQueue.length&&(i=this._responseQueue[this._responseQueue.length-1],/^\d+-/.test(i.split(`
-`).pop()))||this._processResponse()}_onError(e,r,n,i){if(clearTimeout(this._connectionTimeout),clearTimeout(this._greetingTimeout),this._destroyed)return;e=this._formatError(e,r,n,i),["ETIMEDOUT","ESOCKET","ECONNECTION"].includes(e.code)?this.logger.warn(n,e.message):this.logger.error(n,e.message),this.emit("error",e),this.close()}_formatError(e,r,n,i){let s;/Error\]$/i.test(Object.prototype.toString.call(e))?s=e:s=new Error(e),r&&r!=="Error"&&(s.code=r),n&&(s.response=n,s.message+=": "+n);let o=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return o&&(s.responseCode=o),i&&(s.command=i),s}_onClose(){let e=!1;if(this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=Av(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed"),this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",e,"CONN");if(![this._actionGreeting,this.close].includes(this._responseActions[0])&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");if(/^[45]\d{2}\b/.test(e))return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",e,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(new Error("Timeout"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.emit("end"))}_upgradeConnection(e){this._socket.removeListener("data",this._onSocketData),this._socket.removeListener("timeout",this._onSocketTimeout);let r=this._socket,n=Object.assign({socket:this._socket,host:this.host},this.options.tls||{});this.servername&&!n.servername&&(n.servername=this.servername);let i=()=>{r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError)};this.upgrading=!0;try{this._socket=Ev.connect(n,()=>(this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),i(),e(null,!0)))}catch(s){return i(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||vv),this._socket.on("timeout",this._onSocketTimeout),r.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=this.lastServerResponse=Av((this._responseQueue.shift()||"").toString());if(/^\d+-/.test(e.split(`
-`).pop()))return;(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e.replace(/\r?\n$/,"")),e.trim()||setImmediate(()=>this._processResponse());let r=this._responseActions.shift();if(typeof r=="function")r.call(this,e),setImmediate(()=>this._processResponse());else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",e,"CONN")}_sendCommand(e,r){if(!this._destroyed){if(this._socket.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),this._socket.write(Buffer.from(e+`\r
-`,"utf-8"))}}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(s=>(s&&s.address||s||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let s=0,o=this._envelope.to.length;s<o;s++){if(!this._envelope.to[s]||/[\r\n<>]/.test(this._envelope.to[s]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[s]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[s])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(s){return r(this._formatError("Invalid DSN "+s.message,"EENVELOPE",!1,"API"))}if(this._responseActions.push(s=>{this._actionMAIL(s,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let s=Number(this._envelope.size)||0;s>0&&n.push("SIZE="+s)}if(this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Ii.encodeXText(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Ii.encodeXText(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));n.push("REQUIRETLS")}this._sendCommand("MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):""))}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let o=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!o.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let s=(e.recipient||e.orcpt||"").toString()||null;return s&&s.indexOf(";")<0&&(s="rfc822;"+s),{ret:r,envid:n,notify:i,orcpt:s}}_getDsnRcptToArgs(){let e=[];return this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.notify&&e.push("NOTIFY="+Ii.encodeXText(this._envelope.dsn.notify)),this._envelope.dsn.orcpt&&e.push("ORCPT="+Ii.encodeXText(this._envelope.dsn.orcpt))),e.length?" "+e.join(" "):""}_createSendStream(e){let r=new HN;if(this.options.lmtp?this._envelope.accepted.forEach((n,i)=>{let s=i===this._envelope.accepted.length-1;this._responseActions.push(o=>{this._actionLMTPStream(n,s,o,e)})}):this._responseActions.push(n=>{this._actionSMTPStream(n,e)}),this._currentDataStream=r,r.pipe(this._socket,{end:!1}),this.options.debug){let n=new gv;n.on("readable",()=>{let i;for(;i=n.read();)this.logger.debug({tnx:"message"},i.toString("binary").replace(/\r?\n$/,""))}),r.pipe(n)}return r.once("end",()=>{this._currentDataStream===r&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:r.inByteCount,outByteCount:r.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",r.outByteCount,r.inByteCount)}),r}_actionGreeting(e){if(clearTimeout(this._greetingTimeout),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){let r;if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(this._ehloLines=e.split(/\r?\n/).map(n=>n.replace(/^\d+[ -]/,"").trim()).filter(n=>n).slice(1),!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)PLAIN/i.test(e)&&this._supportedAuth.push("PLAIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)LOGIN/i.test(e)&&this._supportedAuth.push("LOGIN"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)CRAM-MD5/i.test(e)&&this._supportedAuth.push("CRAM-MD5"),/[ -]AUTH(?:(\s+|=)[^\n]*\s+|\s+|=)XOAUTH2/i.test(e)&&this._supportedAuth.push("XOAUTH2"),(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0),this.emit("connect")}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS)return this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this.emit("connect");this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),s=yv.createHmac("md5",this._auth.credentials.pass);s.update(i);let o=this._auth.credentials.user+" "+s.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(o).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(this._envelope.from)?"Internationalized mailbox name not allowed":"Mail command failed";return r(this._formatError(i,"EENVELOPE",e,"MAIL FROM"))}if(!this._envelope.rcptQueue.length)return r(this._formatError("Can't send mail - no recipients defined","EENVELOPE",!1,"API"));this._recipientQueue=[];let n=this._supportedExtensions.includes("PIPELINING");do{let i=this._envelope.rcptQueue.shift();this._recipientQueue.push(i),this._responseActions.push(s=>{this._actionRCPT(s,r)}),this._sendCommand("RCPT TO:<"+i+">"+this._getDsnRcptToArgs())}while(n&&this._envelope.rcptQueue.length)}_actionRCPT(e,r){let n,i=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(i)?"Internationalized mailbox name not allowed":"Recipient command failed";this._envelope.rejected.push(i),n=this._formatError(s,"EENVELOPE",e,"RCPT TO"),n.recipient=i,this._envelope.rejectedErrors.push(n)}else this._envelope.accepted.push(i);if(!this._envelope.rcptQueue.length&&!this._recipientQueue.length)if(this._envelope.rejected.length<this._envelope.to.length)this._responseActions.push(s=>{this._actionDATA(s,r)}),this._sendCommand("DATA");else return n=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",e,"RCPT TO"),n.rejected=this._envelope.rejected,n.rejectedErrors=this._envelope.rejectedErrors,r(n);else if(this._envelope.rcptQueue.length){let s=this._envelope.rcptQueue.shift();this._recipientQueue.push(s),this._responseActions.push(o=>{this._actionRCPT(o,r)}),this._sendCommand("RCPT TO:<"+s+">"+this._getDsnRcptToArgs())}}_actionDATA(e,r){if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let n={accepted:this._envelope.accepted,rejected:this._envelope.rejected};this._ehloLines&&this._ehloLines.length&&(n.ehlo=this._ehloLines),this._envelope.rejectedErrors.length&&(n.rejectedErrors=this._envelope.rejectedErrors),r(null,n)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,this._envelope.rejected.push(e),this._envelope.rejectedErrors.push(s);for(let o=0,a=this._envelope.accepted.length;o<a;o++)this._envelope.accepted[o]===e&&this._envelope.accepted.splice(o,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(s=>{this._actionAUTHComplete(s,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KN.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}};Tv.exports=Vp});var qp=he((uX,_v)=>{"use strict";var{Stream:jN}=ee("stream"),GN=ca(),$N=ee("crypto"),WN=Kt(),xi=lr(),Bp=class extends jN{constructor(e,r){if(super(),this.options=e||{},e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=xi.EOAUTH2,setImmediate(()=>this.emit("error",i));return}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=WN.getLogger({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,r(i)}if(this.renewing)return this.renewalQueue.push({renew:e,callback:r});this.renewing=!0;let n=(i,s)=>{this.renewalQueue.forEach(o=>o.callback(i,s)),this.renewalQueue=[],this.renewing=!1,i?this.logger.error({err:i,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),r(i,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(i,s,o)=>{!i&&s&&(this.accessToken=s,this.expires=o||0),n(i,s)}):this.generateToken(n)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r,n;if(this.options.serviceClient){let i=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:i,exp:i+this.options.serviceRequestTimeout},o;try{o=this.jwtSignRS256(s)}catch{let c=new Error("Can't generate token. Check your auth options");return c.code=xi.EOAUTH2,e(c)}r={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:o},n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let i=new Error("Can't create new access token for user");return i.code=xi.EOAUTH2,e(i)}r={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},n={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(r,this.options.customParams),Object.assign(n,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(n)),this.postRequest(this.options.accessUrl,r,this.options,(i,s)=>{let o;if(i)return e(i);try{o=JSON.parse(s.toString())}catch(l){return e(l)}if(!o||typeof o!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let l=new Error("Invalid authentication response");return l.code=xi.EOAUTH2,e(l)}let a=Object.assign({},o);if(a.access_token&&(a.access_token=(a.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(a)),o.error){let l=o.error;o.error_description&&(l+=": "+o.error_description),o.error_uri&&(l+=" ("+o.error_uri+")");let d=new Error(l);return d.code=xi.EOAUTH2,e(d)}if(o.access_token)return this.updateToken(o.access_token,o.expires_in),e(null,this.accessToken);let c=new Error("No access token");return c.code=xi.EOAUTH2,e(c)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join("
"),"utf-8").toString("base64")}postRequest(e,r,n,i){let s=!1,o=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=GN(e,c);l.on("readable",()=>{let d;for(;(d=l.read())!==null;)o.push(d),a+=d.length}),l.once("error",d=>{if(!s)return s=!0,i(d)}),l.once("end",()=>{if(!s)return s=!0,i(null,Buffer.concat(o,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){e=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(n=>this.toBase64URL(n)).join(".");let r=$N.createSign("RSA-SHA256").update(e).sign(this.options.privateKey);return e+"."+this.toBase64URL(r)}};_v.exports=Bp});var bv=he((dX,xv)=>{"use strict";var zN=Cl(),JN=Kt().assign,YN=qp(),Iv=lr(),XN=ee("events"),jp=class extends XN{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new YN(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this.emit("error",n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0}connect(e){this.pool.getSocket(this.options,(r,n)=>{if(r)return e(r);let i=!1,s=this.options;n&&n.connection&&(this.logger.info({tnx:"proxy",remoteAddress:n.connection.remoteAddress,remotePort:n.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",n.connection.remoteAddress,n.connection.remotePort,s.host||"",s.port||""),s=Object.assign(JN(!1,s),n)),this.connection=new zN(s),this.connection.once("error",o=>{if(this.emit("error",o),!i)return i=!0,e(o)}),this.connection.once("end",()=>{if(this.close(),i)return;i=!0;let o=setTimeout(()=>{if(i)return;let a=new Error("Unexpected socket close");this.connection&&this.connection._socket&&this.connection._socket.upgrading&&(a.code=Iv.ETLS),e(a)},1e3);try{o.unref()}catch{}}),this.connection.connect(()=>{if(!i)if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,o=>{if(!i){if(i=!0,o)return this.connection.close(),this.emit("error",o),e(o);this._connected=!0,e(null,!0)}});else return i=!0,this._connected=!0,e(null,!0)})})}send(e,r){if(!this._connected)return this.connect(o=>o?r(o):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,s.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.connection.send(n,e.message.createReadStream(),(o,a)=>{if(this.messages++,o)return this.connection.close(),this.emit("error",o),r(o);a.envelope={from:n.from,to:n.to},a.messageId=i,setImmediate(()=>{if(this.messages>=this.options.maxMessages){let c=new Error("Resource exhausted");c.code=Iv.EMAXLIMIT,this.connection.close(),this.emit("error",c)}else this.pool._checkRateLimit(()=>{this.available=!0,this.emit("available")})}),r(null,a)})}close(){this._connected=!1,this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};xv.exports=jp});var Sv=he((pX,QN)=>{QN.exports={"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},"126":{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},"163":{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}}});var Gp=he((fX,wv)=>{"use strict";var Nv=Sv(),Dl={};Object.keys(Nv).forEach(t=>{let e=Nv[t],r=ZN(e);Dl[Pl(t)]=r,[].concat(e.aliases||[]).forEach(n=>{Dl[Pl(n)]=r}),[].concat(e.domains||[]).forEach(n=>{Dl[Pl(n)]=r})});function Pl(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function ZN(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}wv.exports=function(t){return t=Pl(t.split("@").pop()),Dl[t]||!1}});var Dv=he((mX,Cv)=>{"use strict";var ew=ee("events"),Rv=bv(),tw=Cl(),rw=Gp(),ma=Kt(),Ov=lr(),kv=br(),$p=class extends ew{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=ma.parseConnectionUrl(e.url),n=n||r.service),this.options=ma.assign(!1,e,r,n&&rw(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.logger=ma.getLogger(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=kv.version+"[client:"+kv.version+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){return setImmediate(()=>r(null,!1))}send(e,r){return this._closed?!1:(this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0)}close(){let e,r=this._connections.length;if(this._closed=!0,clearTimeout(this._rateLimit.timeout),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(s){this.logger.error({err:s,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,s.message)}e.queueEntry=!1}})}_createConnection(){let e=new Rv(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Ov.EMAXLIMIT?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues===void 0||this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{e.queueEntry.callback(new Error("Reached maximum number of retries after connection was closed"))}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((i,s)=>{e=ma.callbackPromise(i,s)}));let n=new Rv(this).auth;return this.getSocket(this.options,(i,s)=>{if(i)return e(i);let o=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,o.host||"",o.port||""),o=Object.assign(ma.assign(!1,o),s));let a=new tw(o),c=!1;a.once("error",d=>{if(!c)return c=!0,a.close(),e(d)}),a.once("end",()=>{if(!c)return c=!0,e(new Error("Connection closed"))});let l=()=>{if(!c)return c=!0,a.quit(),e(null,!0)};a.connect(()=>{if(!c)if(n&&(a.allowsAuth||o.forceAuth))a.login(n,d=>{if(!c){if(d)return c=!0,a.close(),e(d);l()}});else if(!n&&a.allowsAuth&&o.forceAuth){let d=new Error("Authentication info was not provided");return d.code=Ov.ENOAUTH,c=!0,a.close(),e(d)}else l()})}),r}};Cv.exports=$p});var Kv=he((hX,Mv)=>{"use strict";var nw=ee("events"),Pv=Cl(),iw=Gp(),Bs=Kt(),sw=qp(),Uv=lr(),Lv=br(),Wp=class extends nw{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=Bs.parseConnectionUrl(e.url),n=n||r.service),this.options=Bs.assign(!1,e,r,n&&iw(n)),this.logger=Bs.getLogger(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Lv.version+"[client:"+Lv.version+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){return setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},e&&typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new sw(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){this.getSocket(this.options,(n,i)=>{if(n)return r(n);let s=!1,o=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:o.host||"",destPort:o.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,o.host||"",o.port||""),o=Object.assign(Bs.assign(!1,o),i));let a=new Pv(o),c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};a.once("error",p=>{if(!s)return s=!0,l(),a.close(),r(p)}),a.once("end",()=>{if(s)return;let p=setTimeout(()=>{if(s)return;s=!0,l();let m=new Error("Unexpected socket close");a&&a._socket&&a._socket.upgrading&&(m.code=Uv.ETLS),r(m)},1e3);try{p.unref()}catch{}});let d=()=>{let p=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(p.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(p.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(p.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),a.send(p,e.message.createReadStream(),(v,b)=>{if(s=!0,l(),a.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);b.envelope={from:p.from,to:p.to},b.messageId=m;try{return r(null,b)}catch(k){this.logger.error({err:k,tnx:"callback"},"Callback error for %s: %s",m,k.message)}})};a.connect(()=>{s||(c=this.getAuth(e.data.auth),c&&(a.allowsAuth||o.forceAuth)?a.login(c,p=>{if(l(),!s){if(p)return s=!0,a.close(),r(p);d()}}):d())})})}verify(e){let r;return e||(r=new Promise((n,i)=>{e=Bs.callbackPromise(n,i)})),this.getSocket(this.options,(n,i)=>{if(n)return e(n);let s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Bs.assign(!1,s),i));let o=new Pv(s),a=!1,c,l=()=>{c&&c!==this.auth&&c.oauth2&&c.oauth2.removeAllListeners(),c=null};o.once("error",p=>{if(!a)return a=!0,l(),o.close(),e(p)}),o.once("end",()=>{if(!a)return a=!0,l(),e(new Error("Connection closed"))});let d=()=>{if(!a)return a=!0,l(),o.quit(),e(null,!0)};o.connect(()=>{if(!a)if(c=this.getAuth({}),c&&(o.allowsAuth||s.forceAuth))o.login(c,p=>{if(l(),!a){if(p)return a=!0,o.close(),e(p);d()}});else if(!c&&o.allowsAuth&&s.forceAuth){let p=new Error("Authentication info was not provided");return p.code=Uv.ENOAUTH,a=!0,l(),o.close(),e(p)}else d()})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}};Mv.exports=Wp});var Fv=he((EX,Hv)=>{"use strict";var{spawn:ow}=ee("child_process"),aw=br(),cw=Kt(),zp=lr(),Jp=class{constructor(e){e=e||{},this._spawn=ow,this.options=e,this.name="Sendmail",this.version=aw.version,this.path="sendmail",this.args=!1,this.logger=cw.getLogger(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args))}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s;if([].concat(n.from||[]).concat(n.to||[]).some(d=>/^-/.test(d))){let d=new Error("Can not send mail. Invalid envelope addresses.");return d.code=zp.ESENDMAIL,r(d)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=d=>{if(!s&&(s=!0,typeof r=="function"))return d?r(d):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(d){return this.logger.error({err:d,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",d.message),c(d)}if(l){l.on("error",m=>{this.logger.error({err:m,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,m.message),c(m)}),l.once("exit",m=>{if(!m)return c();let E=new Error(m===127?"Sendmail command not found, process exited with code "+m:"Sendmail exited with code "+m);E.code=zp.ESENDMAIL,this.logger.error({err:E,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,E.message),c(E)}),l.once("close",c),l.stdin.on("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,m.message),c(m)});let d=[].concat(n.to||[]);d.length>3&&d.push("...and "+d.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,d.join(", "));let p=e.message.createReadStream();p.once("error",m=>{this.logger.error({err:m,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,m.message),l.kill("SIGINT"),c(m)}),p.pipe(l.stdin)}else{let d=new Error("sendmail was not found");return d.code=zp.ESENDMAIL,c(d)}}};Hv.exports=Jp});var Bv=he((yX,Vv)=>{"use strict";var lw=br(),uw=Kt(),Yp=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=lw.version,this.logger=uw.getLogger(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
-`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,s.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let o;try{o=e.message.createReadStream()}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return o.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:o});let a=[],c=0;o.on("readable",()=>{let l;for(;(l=o.read())!==null;)a.push(l),c+=l.length}),o.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),o.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}};Vv.exports=Yp});var jv=he((gX,qv)=>{"use strict";var dw=br(),pw=Kt(),Xp=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=dw.version,this.logger=pw.getLogger(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.data.envelope||e.message.getEnvelope(),i=e.message.messageId(),s=[].concat(n.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,s.join(", ")),setImmediate(()=>{e.normalize((o,a)=>o?(this.logger.error({err:o,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,o.message),r(o)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}};qv.exports=Xp});var Wv=he((vX,$v)=>{"use strict";var fw=ee("events"),mw=br(),Gv=Kt(),hw=xp(),Ew=kl(),Qp=class extends fw{constructor(e){super(),e=e||{},this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=mw.version,this.logger=Gv.getLogger(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){return this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"?this.ses.sesClient.config.region().then(r=>e(null,r)).catch(r=>e(r)):e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Ew("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.data.envelope||e.message.getEnvelope(),s=e.message.messageId(),o=[].concat(i.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:s},"Sending message %s to <%s>",s,o.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),d=l.pipe(new hw),p=[],m=0;d.on("readable",()=>{let E;for(;(E=d.read())!==null;)p.push(E),m+=E.length}),l.once("error",E=>d.emit("error",E)),d.once("error",E=>c(E)),d.once("end",()=>c(null,Buffer.concat(p,m)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:s},"Failed creating message for %s. %s",s,c.message),r(c);let d=Object.assign({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses||{});this.getRegion((p,m)=>{(p||!m)&&(m="us-east-1");let E=new this.ses.SendEmailCommand(d);this.ses.sesClient.send(E).then(b=>{m==="us-east-1"&&(m="email"),r(null,{envelope:{from:i.from,to:i.to},messageId:"<"+b.MessageId+(/@/.test(b.MessageId)?"":"@"+m+".amazonses.com")+">",response:b.MessageId,raw:l})}).catch(b=>{this.logger.error({err:b,tnx:"send"},"Send error for %s: %s",s,b.message),r(b)})})}))}verify(e){let r;e||(r=new Promise((s,o)=>{e=Gv.callbackPromise(s,o)}));let n=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?e(s):e(null,!0),i={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
+`),this.outByteCount+=r.length,this.push(r),e()}};import{PassThrough as HR}from"node:stream";var FR=120*1e3,zA=600*1e3,VR=30*1e3,BR=30*1e3,jR=5*1e3,GR=30*1e3,JA=()=>{};function YA(t){let e=t.slice();for(let r=e.length-1;r>0;r--){let n=Math.floor(Math.random()*(r+1));[e[r],e[n]]=[e[n],e[r]]}return e}function id(t,e){let r=new Error(t);return r.timeoutType=e,r}var $R=1024*1024;function XA(t){if(!t)return t;let e=Buffer.from(t,"binary").toString("utf8");return e.includes("\uFFFD")?t:e}function qR(t){return QA(t.slice(t.lastIndexOf(`
+`)+1))}function QA(t){return/^\d+-/.test(t)}var Sm=class extends MR{constructor(e){super(e),this.id=WA.randomBytes(8).toString("base64").replace(/\W/g,""),this.stage="init",this.options=e||{},this.options.requireTLS&&(this.options.ignoreTLS||this.options.opportunisticTLS)&&(this.options=Object.assign({},this.options,{ignoreTLS:!1,opportunisticTLS:!1})),this.secureConnection=!!this.options.secure,this.alreadySecured=!!this.options.secured,this.port=Number(this.options.port)||(this.secureConnection?465:587),this.host=this.options.host||"localhost",this.servername=this.options.servername?this.options.servername:di.isIP(this.host)?!1:this.host,this.allowInternalNetworkInterfaces=this.options.allowInternalNetworkInterfaces||!1,typeof this.options.secure>"u"&&this.port===465&&(this.secureConnection=!0),this.name=(this.options.name||this._getHostname()).toString().replace(/[\r\n]+/g,""),this.logger=ft(this.options,{component:this.options.component||"smtp-connection",sid:this.id}),this.customAuth=new Map;for(let r of Object.keys(this.options.customAuth||{})){let n=(r||"").toString().trim().toUpperCase();n&&this.customAuth.set(n,this.options.customAuth[r])}this.version=Xe,this.authenticated=!1,this.destroyed=!1,this.secure=!!this.secureConnection,this._remainder="",this._responseQueue=[],this._responsePartial=!1,this.lastServerResponse=!1,this._socket=!1,this._supportedAuth=[],this.allowsAuth=!1,this._envelope=!1,this._supportedExtensions=[],this._maxAllowedSize=0,this._responseActions=[],this._recipientQueue=[],this._phaseTimer=!1,this._plaintextEhlo=!1,this._destroyed=!1,this._closing=!1,this._currentDataStream=!1,this._pendingSend=!1,this._connectCallback=!1,this._onSocketData=r=>this._onData(r),this._onSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN"),this._onSocketClose=()=>this._onClose(),this._onSocketEnd=()=>this._onEnd(),this._onSocketTimeout=()=>this._onTimeout(),this._onConnectionSocketError=r=>this._onError(r,"ESOCKET",!1,"CONN")}connect(e){if(this._connectCalled&&!this._destroyed){let i=this._formatError("Cannot connect - connect() was already called for this connection","ECONNECTION",!1,"API");if(typeof e=="function"){setImmediate(()=>e(i));return}this.logger.warn({tnx:"smtp"},"%s",i.message);return}if(this._connectCalled=!0,typeof e=="function"){this._connectCallback=e,this.once("connect",()=>{this._connectCallback=!1,this.logger.debug({tnx:"smtp"},"SMTP handshake finished"),e()});let i=this._isDestroyedMessage("connect");if(i)return e(this._formatError(i,"ECONNECTION",!1,"CONN"))}let r=this.options.connectionTimeout||FR;this._connectionDeadline=(this._connectStartedAt||Date.now())+r;let n={port:this.port,host:this.host,allowInternalNetworkInterfaces:this.allowInternalNetworkInterfaces,timeout:Math.min(this.options.dnsTimeout||BR,r)};if(this.options.localAddress&&(n.localAddress=this.options.localAddress),this.options.connection){this._socket=this.options.connection,this._setupConnectionHandlers(),this.secureConnection&&!this.alreadySecured?setImmediate(()=>this._upgradeConnection(i=>{if(i){this._onError(new Error("Error initiating TLS - "+(i.message||i)),"ETLS",!1,"CONN");return}this._onConnect()})):setImmediate(()=>this._onConnect());return}else return this.options.socket?(this._socket=this.options.socket,this._resolveAndConnect(n,i=>{try{this._socket.connect(this.port,this.host,()=>{if(this.secureConnection&&!this.alreadySecured)return this._upgradeConnection(o=>{if(o){this._onError(new Error("Error initiating TLS - "+(o.message||o)),"ETLS",!1,"CONN");return}this._onConnect()});this._onConnect()}),this._setupConnectionHandlers()}catch(o){setImmediate(()=>this._onError(o,"ECONNECTION",!1,"CONN"));return}})):(this.secureConnection&&(Object.assign(n,this.options.tls||{}),this.servername&&!n.servername&&(n.servername=this.servername)),this._resolveAndConnect(n,i=>{let o=i._addresses||[];if(n.localAddress){let s=di.isIPv6(n.localAddress)?6:4,a=o.filter(c=>di.isIP(c)===s);o=a.length?a:o}if(o.length>1){let s=o.filter(l=>di.isIPv6(l)),a=o.filter(l=>!di.isIPv6(l)),c=YA(s).concat(YA(a));if(n.host=this.host,n.autoSelectFamily=!0,!s.length||!a.length){let l=this._connectionDeadline-Date.now();n.autoSelectFamilyAttemptTimeout=Math.max(Math.floor(l/c.length),10)}n.lookup=((l,u,p)=>{if(u&&u.all){let f=c.map(m=>({address:m,family:di.isIPv6(m)?6:4}));return setImmediate(()=>p(null,f))}setImmediate(()=>p(null,c[0],di.isIPv6(c[0])?6:4))})}else o.length&&(n.host=o[0]);this._connectToHost(n,this.secureConnection)}))}_resolveAndConnect(e,r){return sA(e,(n,i)=>{if(n)return setImmediate(()=>this._onError(n,"EDNS",!1,"CONN"));this.logger.debug({tnx:"dns",source:e.host,resolved:i.host,cached:!!i.cached},"Resolved %s as %s [cache %s]",e.host,i.host,i.cached?"hit":"miss");for(let o of Object.keys(i))o.charAt(0)!=="_"&&i[o]&&(e[o]=i[o]);r(i)})}_connectToHost(e,r){if(this._destroyed||this._closing)return;let n=r?qA.connect:di.connect;try{this._socket=n(e,()=>this._onConnect()),this._setupConnectionHandlers()}catch(i){setImmediate(()=>this._onError(i,"ECONNECTION",!1,"CONN"));return}}_setupConnectionHandlers(){this._startPhase(Math.max((this._connectionDeadline||Date.now())-Date.now(),0),id("Connection timeout","CONNECT_TIMEOUT")),this._socket.on("error",this._onConnectionSocketError)}_startPhase(e,r){this._clearPhase(),this._phaseTimer=setTimeout(()=>{this._phaseTimer=!1,this._onError(r,"ETIMEDOUT",!1,"CONN")},e)}_remainingSetupTime(){return Math.min(this.options.greetingTimeout||VR,Math.max((this._connectionDeadline||1/0)-Date.now(),1))}_clearPhase(){clearTimeout(this._phaseTimer),this._phaseTimer=!1}quit(){this._sendCommand("QUIT"),this._responseActions.push(this.close)}close(){if(this._clearPhase(),this._responseActions=[],this._closing)return;this._closing=!0;let e=this.stage==="init"?"destroy":"end";this.logger.debug({tnx:"smtp"},'Closing connection to the server using "%s"',e);let r=this._socket&&this._socket.socket||this._socket;if(this._currentDataStream){try{this._currentDataStream.unpipe(this._socket)}catch{}this._currentDataStream=!1}if(this._pendingSend){let{stream:n,onStreamError:i}=this._pendingSend;n&&(n.removeListener("error",i),n.on("error",JA),n.destroy()),this._pendingSend=!1}if(r&&!r.destroyed)try{if(r.setTimeout(0),r.removeListener("data",this._onSocketData),r.removeListener("timeout",this._onSocketTimeout),r.removeListener("close",this._onSocketClose),r.removeListener("end",this._onSocketEnd),r.removeListener("error",this._onSocketError),r.removeListener("error",this._onConnectionSocketError),r.on("error",JA),r[e](),e==="end"){let n=setTimeout(()=>r.destroy(),jR);typeof n.unref=="function"&&n.unref(),r.once("close",()=>clearTimeout(n))}}catch{}this._destroy()}login(e,r){let n=this._isDestroyedMessage("login");if(n)return r(this._formatError(n,"ECONNECTION",!1,"API"));this._auth=e||{},this._authMethod=(this._auth.method||"").toString().trim().toUpperCase()||!1;let i=!!this._auth.oauth2||this.customAuth.has("XOAUTH2");if(!this._authMethod&&this._auth.oauth2&&!this._auth.credentials)this._authMethod="XOAUTH2";else if(!this._authMethod||this._authMethod==="XOAUTH2"&&!this._auth.oauth2){let o=this._supportedAuth.find(s=>s!=="XOAUTH2"||i);this._authMethod=(o||"PLAIN").toUpperCase().trim()}if((this._authMethod!=="XOAUTH2"||this.customAuth.has("XOAUTH2"))&&(!this._auth.credentials||!this._auth.credentials.user||!this._auth.credentials.pass))if(this._auth.user&&this._auth.pass||this.customAuth.has(this._authMethod))this._auth.credentials={user:this._auth.user,pass:this._auth.pass,options:this._auth.options};else return r(this._formatError('Missing credentials for "'+this._authMethod+'"',"EAUTH",!1,"API"));if(this.customAuth.has(this._authMethod)){let o=this.customAuth.get(this._authMethod),s,a=!1,c=()=>{a||(a=!0,this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0))},l=f=>{a||(a=!0,r(this._formatError(f,"EAUTH",s,"AUTH "+this._authMethod)))},u=(f,m)=>{let E;return m||(E=new Promise((v,N)=>{m=Mt(v,N)})),this._responseActions.push(v=>{s=v;let N=v.match(/^(\d+)(?:\s(\d+\.\d+\.\d+))?\s/),S={command:f,response:v};N?(S.status=Number(N[1])||0,N[2]&&(S.code=N[2]),S.text=v.substr(N[0].length)):(S.text=v,S.status=0),m(null,S)}),setImmediate(()=>this._sendCommand(f)),E},p=o({auth:this._auth,method:this._authMethod,extensions:[].concat(this._supportedExtensions),authMethods:[].concat(this._supportedAuth),maxAllowedSize:this._maxAllowedSize||!1,sendCommand:u,resolve:c,reject:l});p&&typeof p.catch=="function"&&p.then(c).catch(l);return}switch(this._authMethod){case"XOAUTH2":this._handleXOauth2Token(!1,r);return;case"LOGIN":this._responseActions.push(o=>{this._actionAUTH_LOGIN_USER(o,r)}),this._sendCommand("AUTH LOGIN");return;case"PLAIN":this._responseActions.push(o=>{this._actionAUTHComplete(o,r)}),this._sendCommand("AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0"+this._auth.credentials.pass,"utf-8").toString("base64"),"AUTH PLAIN "+Buffer.from("\0"+this._auth.credentials.user+"\0/* secret */","utf-8").toString("base64"));return;case"CRAM-MD5":this._responseActions.push(o=>{this._actionAUTH_CRAM_MD5(o,r)}),this._sendCommand("AUTH CRAM-MD5");return}return r(this._formatError('Unknown authentication method "'+this._authMethod+'"',"EAUTH",!1,"API"))}send(e,r,n){let i=!1,o=(l,u)=>{i||(i=!0,this._pendingSend&&this._pendingSend.callback===o&&(this._pendingSend=!1),n(l,u))};if(!r)return o(this._formatError("Empty message","EMESSAGE",!1,"API"));let s=this._isDestroyedMessage("send message");if(s)return o(this._formatError(s,"ECONNECTION",!1,"API"));if(this._maxAllowedSize&&e.size>this._maxAllowedSize){setImmediate(()=>{o(this._formatError("Message size larger than allowed "+this._maxAllowedSize,"EMESSAGE",!1,"MAIL FROM"))});return}let a={callback:o,stream:!1,onStreamError:l=>o(this._formatError(l,"ESTREAM",!1,"API"))};typeof r.on=="function"&&(a.stream=r,a.stream.on("error",a.onStreamError)),this._pendingSend=a;let c=Date.now();this._setEnvelope(e,(l,u)=>{if(l)return typeof r.destroy=="function"&&r.destroy(),o(l);let p=Date.now(),f=this._createSendStream((m,E)=>{if(m)return o(m);let v=u;return v.envelopeTime=p-c,v.messageTime=Date.now()-p,v.messageSize=f.outByteCount,v.response=E,o(null,v)});typeof r.pipe=="function"?r.pipe(f):(f.write(r),f.end())})}reset(e){let r=this._isDestroyedMessage("reset");if(r)return e(this._formatError(r,"ECONNECTION",!1,"API"));this._sendCommand("RSET"),this._responseActions.push(n=>n.charAt(0)!=="2"?e(this._formatError("Could not reset session state. response="+n,"EPROTOCOL",n,"RSET")):(this._envelope=!1,e(null,!0)))}_onConnect(){let e=this._socket;if(this._clearPhase(),this.logger.info({tnx:"network",localAddress:e.localAddress,localPort:e.localPort,remoteAddress:e.remoteAddress,remotePort:e.remotePort},"%s established to %s:%s",this.secure?"Secure connection":"Connection",e.remoteAddress,e.remotePort),this._destroyed){this.close();return}this.stage="connected",e.removeListener("data",this._onSocketData),e.removeListener("timeout",this._onSocketTimeout),e.removeListener("close",this._onSocketClose),e.removeListener("end",this._onSocketEnd),e.removeListener("error",this._onConnectionSocketError),e.removeListener("error",this._onSocketError),e.on("error",this._onSocketError),e.on("data",this._onSocketData),e.once("close",this._onSocketClose),e.once("end",this._onSocketEnd),e.setTimeout(this.options.socketTimeout||zA),e.on("timeout",this._onSocketTimeout),typeof e.setKeepAlive=="function"&&e.setKeepAlive(!0,GR),typeof e.setNoDelay=="function"&&e.setNoDelay(!0),this._startPhase(this._remainingSetupTime(),id("Greeting never received","GREETING_TIMEOUT")),this._responseActions.push(this._actionGreeting),e.resume()}_onServerClosing(e){if(this._destroyed)return;let r=this._pendingSend,n=this._envelope;this._responseActions=[],this.close(),r&&r.callback(n&&n.mailError||this._formatError("Server closed the connection","ECONNECTION",e,"CONN"))}_onData(e){if(this._destroyed||!e||!e.length)return;let r=this.options.maxResponseSize||$R,n=e.toString("binary");if(!n.includes(`
+`))return this._remainder+=n,this._remainder.length>r?this._onResponseTooLarge():void 0;let i=(this._remainder+n).split(/\r?\n/);this._remainder=i.pop();for(let o=0,s=i.length;o<s;o++)if(this._responsePartial?this._responseQueue[this._responseQueue.length-1]+=`
+`+i[o]:this._responseQueue.push(i[o]),this._responsePartial=QA(i[o]),this._responsePartial&&this._responseQueue[this._responseQueue.length-1].length>r)return this._onResponseTooLarge();if(this._remainder.length>r)return this._onResponseTooLarge();this._responsePartial||this._processResponse()}_onResponseTooLarge(){this._remainder="",this._responseQueue=[],this._responsePartial=!1,this._onError(new Error("Server response exceeds maximum allowed size"),"EPROTOCOL",!1,"CONN")}_onError(e,r,n,i){if(this._clearPhase(),this._destroyed)return;e=this._formatError(e,r,n,i),Wa(e)?this.logger.warn({tnx:"smtp",err:e},"%s",e.message):this.logger.error({tnx:"smtp",err:e},"%s",e.message);let o=this._pendingSend;this.emit("error",e),this.close(),o&&o.callback(e)}_formatError(e,r,n,i){let o;/Error\]$/i.test(Object.prototype.toString.call(e))?o=e:o=new Error(e),r&&r!=="Error"&&o.code!==Wu&&(o.code&&o.code!==r&&!o.originalCode&&(o.originalCode=o.code),o.code=r),n&&(o.response=n,o.message+=": "+n);let s=typeof n=="string"&&Number((n.match(/^\d+/)||[])[0])||!1;return s&&(o.responseCode=s),i&&(o.command=i),o}_onClose(){let e=!1;this._remainder&&this._remainder.trim()&&(this.lastServerResponse=e=XA(this._remainder.trim()),(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},e)),this.logger.info({tnx:"network"},"Connection closed");let r=typeof e=="string"&&/^[45]\d{2}[ -]/.test(e)?e:!1;if(this.upgrading&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ETLS",r,"CONN");if(!r&&this._responseActions[0]===this._actionGreeting&&this._connectCallback&&!this._destroyed){let n=this._connectCallback;this._connectCallback=!1;let i=this._formatError(new Error("Connection closed unexpectedly"),"ECONNECTION",!1,"CONN");this.logger.warn({tnx:"network"},i.message),n(i),this.close();return}if(!r&&this.stage==="connected"&&!this._responseActions.length&&!this._pendingSend&&!this._destroyed&&!this._closing)return this.logger.info({tnx:"network"},"Server closed the idle connection"),this._destroy();if(r||this._responseActions[0]!==this.close&&!this._destroyed)return this._onError(new Error("Connection closed unexpectedly"),"ECONNECTION",r,"CONN");this._destroy()}_onEnd(){this._socket&&!this._socket.destroyed&&this._socket.end()}_onTimeout(){return this._onError(id("Timeout","SOCKET_TIMEOUT"),"ETIMEDOUT",!1,"CONN")}_destroy(){this._destroyed||(this._destroyed=!0,this.destroyed=!0,this._clearPhase(),this.emit("end"))}_upgradeConnection(e){let r=this._remainder.length+this._responseQueue.reduce((s,a)=>s+a.length,0);r&&this.logger.warn({tnx:"smtp",discarded:r},"Discarded %s bytes received in plaintext after the STARTTLS response",r),this._plaintextEhlo=!1,this._remainder="",this._responseQueue=[],this._responsePartial=!1;let n=this._socket;n.removeListener("data",this._onSocketData),n.removeListener("timeout",this._onSocketTimeout),n.setTimeout(0);let i=Object.assign({socket:n,host:this.host},this.options.tls||{});this.servername&&!i.servername&&(i.servername=this.servername);let o=()=>{n.removeListener("close",this._onSocketClose),n.removeListener("end",this._onSocketEnd),n.removeListener("error",this._onSocketError),n.removeListener("error",this._onConnectionSocketError)};this.upgrading=!0,this._startPhase(this._remainingSetupTime(),id("TLS handshake timed out","UPGRADE_TIMEOUT"));try{this._socket=qA.connect(i,()=>(this._clearPhase(),this.secure=!0,this.upgrading=!1,this._socket.on("data",this._onSocketData),o(),e(null,!0)))}catch(s){return this._clearPhase(),o(),e(s)}this._socket.on("error",this._onSocketError),this._socket.once("close",this._onSocketClose),this._socket.once("end",this._onSocketEnd),this._socket.setTimeout(this.options.socketTimeout||zA),this._socket.on("timeout",this._onSocketTimeout),n.resume()}_processResponse(){if(!this._responseQueue.length)return!1;let e=(this._responseQueue.shift()||"").toString();if(!e.trim()){setImmediate(()=>this._processResponse());return}if(qR(e)){this._responseQueue.unshift(e);return}let r=this.lastServerResponse=XA(e);(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"server"},r.replace(/\r?\n$/,""));let n=this._responseActions.shift(),i=/^421[ -]/.test(r);if(typeof n=="function"){if(n.call(this,r),i)return this._onServerClosing(r);setImmediate(()=>this._processResponse())}else if(i&&!this._pendingSend&&this.stage==="connected")this.logger.info({tnx:"smtp"},"Server closed the idle connection: %s",r),this.close();else return this._onError(new Error("Unexpected Response"),"EPROTOCOL",r,"CONN")}_sendCommand(e,r){if(this._destroyed)return;let n=this._socket;if(n.destroyed)return this.close();(this.options.debug||this.options.transactionLog)&&this.logger.debug({tnx:"client"},(r||e||"").toString().replace(/\r?\n$/,"")),n.write(Buffer.from(e+`\r
+`,"utf-8"))}_setEnvelope(e,r){let n=[],i=!1;if(this._envelope=e||{},this._envelope.from=(this._envelope.from&&this._envelope.from.address||this._envelope.from||"").toString().trim(),this._envelope.to=[].concat(this._envelope.to||[]).map(a=>(a&&a.address||a||"").toString().trim()),!this._envelope.to.length)return r(this._formatError("No recipients defined","EENVELOPE",!1,"API"));if(this._envelope.from&&/[\r\n<>]/.test(this._envelope.from))return r(this._formatError("Invalid sender "+JSON.stringify(this._envelope.from),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.from)&&(i=!0);for(let a=0,c=this._envelope.to.length;a<c;a++){if(!this._envelope.to[a]||/[\r\n<>]/.test(this._envelope.to[a]))return r(this._formatError("Invalid recipient "+JSON.stringify(this._envelope.to[a]),"EENVELOPE",!1,"API"));/[\x80-\uFFFF]/.test(this._envelope.to[a])&&(i=!0)}if(this._envelope.rcptQueue=[].concat(this._envelope.to||[]),this._envelope.rejected=[],this._envelope.rejectedErrors=[],this._envelope.accepted=[],this._envelope.dsn)try{this._envelope.dsn=this._setDsnEnvelope(this._envelope.dsn)}catch(a){return r(this._formatError("Invalid DSN "+a.message,"EENVELOPE",!1,"API"))}if(this._envelope.requireTLSExtensionEnabled){if(!this.secure)return r(this._formatError("REQUIRETLS can only be used over TLS connections (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"));if(!this._supportedExtensions.includes("REQUIRETLS"))return r(this._formatError("Server does not support REQUIRETLS extension (RFC 8689)","EREQUIRETLS",!1,"MAIL FROM"))}if(this._envelope.pipelined=this._supportedExtensions.includes("PIPELINING"),this._responseActions.push(a=>{this._actionMAIL(a,r)}),i&&this._supportedExtensions.includes("SMTPUTF8")&&(n.push("SMTPUTF8"),this._usingSmtpUtf8=!0),this._envelope.use8BitMime&&this._supportedExtensions.includes("8BITMIME")&&(n.push("BODY=8BITMIME"),this._using8BitMime=!0),this._envelope.size&&this._supportedExtensions.includes("SIZE")){let a=Number(this._envelope.size)||0;a>0&&n.push("SIZE="+a)}this._envelope.dsn&&this._supportedExtensions.includes("DSN")&&(this._envelope.dsn.ret&&n.push("RET="+Ja(this._envelope.dsn.ret)),this._envelope.dsn.envid&&n.push("ENVID="+Ja(this._envelope.dsn.envid))),this._envelope.requireTLSExtensionEnabled&&n.push("REQUIRETLS");let o="MAIL FROM:<"+this._envelope.from+">"+(n.length?" "+n.join(" "):"");if(this._recipientQueue=[],!this._envelope.pipelined){this._sendCommand(o);return}let s=this._socket;for(s.cork(),this._sendCommand(o);this._envelope.rcptQueue.length;)this._sendRcpt(this._envelope.rcptQueue.shift(),r);this._responseActions.push(a=>{this._actionDATA(a,r)}),this._sendCommand("DATA"),s.uncork()}_sendRcpt(e,r){this._recipientQueue.push(e),this._responseActions.push(n=>{this._actionRCPT(n,r)}),this._sendCommand("RCPT TO:<"+e+">"+this._getDsnRcptToArgs())}_setDsnEnvelope(e){let r=(e.ret||e.return||"").toString().toUpperCase()||null;if(r)switch(r){case"HDRS":case"HEADERS":r="HDRS";break;case"FULL":case"BODY":r="FULL";break}if(r&&!["FULL","HDRS"].includes(r))throw new Error("ret: "+JSON.stringify(r));let n=(e.envid||e.id||"").toString()||null,i=e.notify||null;if(i){typeof i=="string"&&(i=i.split(",")),i=i.map(c=>c.trim().toUpperCase());let s=["NEVER","SUCCESS","FAILURE","DELAY"];if(i.filter(c=>!s.includes(c)).length||i.length>1&&i.includes("NEVER"))throw new Error("notify: "+JSON.stringify(i.join(",")));i=i.join(",")}let o=(e.recipient||e.orcpt||"").toString()||null;return o&&o.indexOf(";")<0&&(o="rfc822;"+o),{ret:r,envid:n,notify:i,orcpt:o}}_getDsnRcptToArgs(){let e=this._envelope,r=[];return e.dsn&&this._supportedExtensions.includes("DSN")&&(e.dsn.notify&&r.push("NOTIFY="+Ja(e.dsn.notify)),e.dsn.orcpt&&r.push("ORCPT="+Ja(e.dsn.orcpt))),r.length?" "+r.join(" "):""}_createSendStream(e){let r=this._envelope,n=new nc;if(this.options.lmtp?r.accepted.forEach((i,o)=>{let s=o===r.accepted.length-1;this._responseActions.push(a=>{this._actionLMTPStream(i,s,a,e)})}):this._responseActions.push(i=>{this._actionSMTPStream(i,e)}),this._currentDataStream=n,n.pipe(this._socket,{end:!1}),this.options.debug){let i=new HR;i.on("readable",()=>{let o;for(;o=i.read();)this.logger.debug({tnx:"message"},o.toString("binary").replace(/\r?\n$/,""))}),n.pipe(i)}return n.once("end",()=>{this._currentDataStream===n&&(this._currentDataStream=!1),this.logger.info({tnx:"message",inByteCount:n.inByteCount,outByteCount:n.outByteCount},"<%s bytes encoded mime message (source size %s bytes)>",n.outByteCount,n.inByteCount)}),n}_actionGreeting(e){if(this._clearPhase(),e.substr(0,3)!=="220"){this._onError(new Error("Invalid greeting. response="+e),"EPROTOCOL",e,"CONN");return}this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name))}_actionLHLO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid LHLO. response="+e),"EPROTOCOL",e,"LHLO");return}this._actionEHLO(e)}_actionEHLO(e){if(e.substr(0,3)==="421"){this._onError(new Error("Server terminates connection. response="+e),"ECONNECTION",e,"EHLO");return}if(e.charAt(0)!=="2"){if(this.options.requireTLS){this._onError(new Error("EHLO failed but HELO does not support required STARTTLS. response="+e),"ECONNECTION",e,"EHLO");return}this._responseActions.push(this._actionHELO),this._sendCommand("HELO "+this.name);return}if(!this.secure&&!this.options.ignoreTLS&&(/[ -]STARTTLS\b/im.test(e)||this.options.requireTLS)){this._plaintextEhlo=e,this._sendCommand("STARTTLS"),this._responseActions.push(this._actionSTARTTLS);return}this._parseEhloExtensions(e),this.emit("connect")}_parseEhloExtensions(e){let r;this._ehloLines=e.split(/\r?\n/).map(i=>i.replace(/^\d+[ -]/,"").trim()).filter(i=>i).slice(1),/[ -]SMTPUTF8\b/im.test(e)&&this._supportedExtensions.push("SMTPUTF8"),/[ -]DSN\b/im.test(e)&&this._supportedExtensions.push("DSN"),/[ -]8BITMIME\b/im.test(e)&&this._supportedExtensions.push("8BITMIME"),/[ -]REQUIRETLS\b/im.test(e)&&this._supportedExtensions.push("REQUIRETLS"),/[ -]PIPELINING\b/im.test(e)&&this._supportedExtensions.push("PIPELINING"),/[ -]AUTH\b/i.test(e)&&(this.allowsAuth=!0);let n=new Set;for(let i of this._ehloLines){let o=/^AUTH[\s=](.*)/i.exec(i);if(o)for(let s of o[1].split(/[\s=]+/))n.add(s.toUpperCase())}for(let i of["PLAIN","LOGIN","CRAM-MD5","XOAUTH2"])n.has(i)&&this._supportedAuth.push(i);(r=e.match(/[ -]SIZE(?:[ \t]+(\d+))?/im))&&(this._supportedExtensions.push("SIZE"),this._maxAllowedSize=Number(r[1])||0)}_actionHELO(e){if(e.charAt(0)!=="2"){this._onError(new Error("Invalid HELO. response="+e),"EPROTOCOL",e,"HELO");return}this.allowsAuth=!0,this.emit("connect")}_actionSTARTTLS(e){if(e.charAt(0)!=="2"){if(this.options.opportunisticTLS){this.logger.info({tnx:"smtp"},"Failed STARTTLS upgrade, continuing unencrypted"),this._plaintextEhlo&&(this._parseEhloExtensions(this._plaintextEhlo),this._plaintextEhlo=!1,this.allowsAuth=!1,this._supportedAuth=[]),this.emit("connect");return}this._onError(new Error("Error upgrading connection with STARTTLS"),"ETLS",e,"STARTTLS");return}this._upgradeConnection((r,n)=>{if(r){this._onError(new Error("Error initiating TLS - "+(r.message||r)),"ETLS",!1,"STARTTLS");return}this.logger.info({tnx:"smtp"},"Connection upgraded with STARTTLS"),n?this.options.lmtp?(this._responseActions.push(this._actionLHLO),this._sendCommand("LHLO "+this.name)):(this._responseActions.push(this._actionEHLO),this._sendCommand("EHLO "+this.name)):this.emit("connect")})}_actionAUTH_LOGIN_USER(e,r){if(!/^334[ -]/.test(e)){r(this._formatError('Invalid login sequence while waiting for "334 VXNlcm5hbWU6"',"EAUTH",e,"AUTH LOGIN"));return}this._responseActions.push(n=>{this._actionAUTH_LOGIN_PASS(n,r)}),this._sendCommand(Buffer.from(this._auth.credentials.user+"","utf-8").toString("base64"))}_actionAUTH_CRAM_MD5(e,r){let n=e.match(/^334\s+(.+)$/);if(!n)return r(this._formatError("Invalid login sequence while waiting for server challenge string","EAUTH",e,"AUTH CRAM-MD5"));let i=Buffer.from(n[1],"base64").toString("ascii"),o=WA.createHmac("md5",this._auth.credentials.pass);o.update(i);let s=this._auth.credentials.user+" "+o.digest("hex");this._responseActions.push(a=>{this._actionAUTH_CRAM_MD5_PASS(a,r)}),this._sendCommand(Buffer.from(s).toString("base64"),Buffer.from(this._auth.credentials.user+" /* secret */").toString("base64"))}_actionAUTH_CRAM_MD5_PASS(e,r){if(!e.match(/^235\s+/))return r(this._formatError('Invalid login sequence while waiting for "235"',"EAUTH",e,"AUTH CRAM-MD5"));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,r(null,!0)}_actionAUTH_LOGIN_PASS(e,r){if(!/^334[ -]/.test(e))return r(this._formatError('Invalid login sequence while waiting for "334 UGFzc3dvcmQ6"',"EAUTH",e,"AUTH LOGIN"));this._responseActions.push(n=>{this._actionAUTHComplete(n,r)}),this._sendCommand(Buffer.from((this._auth.credentials.pass||"").toString(),"utf-8").toString("base64"),Buffer.from("/* secret */","utf-8").toString("base64"))}_actionAUTHComplete(e,r,n){if(!n&&typeof r=="function"&&(n=r,r=!1),e.substr(0,3)==="334"){this._responseActions.push(i=>{r||this._authMethod!=="XOAUTH2"?this._actionAUTHComplete(i,!0,n):setImmediate(()=>this._handleXOauth2Token(!0,n))}),this._sendCommand("");return}if(e.charAt(0)!=="2")return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),n(this._formatError("Invalid login","EAUTH",e,"AUTH "+this._authMethod));this.logger.info({tnx:"smtp",username:this._auth.user,action:"authenticated",method:this._authMethod},"User %s authenticated",JSON.stringify(this._auth.user)),this.authenticated=!0,n(null,!0)}_actionMAIL(e,r){let n=this._envelope;if(Number(e.charAt(0))!==2){let i=this._usingSmtpUtf8&&/^550 /.test(e)&&/[\x80-\uFFFF]/.test(n.from)?"Internationalized mailbox name not allowed":"Mail command failed";n.mailError=this._formatError(i,"EENVELOPE",e,"MAIL FROM")}this._advanceEnvelope(e,r)}_actionRCPT(e,r){let n=this._envelope,i,o=this._recipientQueue.shift();if(Number(e.charAt(0))!==2){let s=this._usingSmtpUtf8&&/^553 /.test(e)&&/[\x80-\uFFFF]/.test(o)?"Internationalized mailbox name not allowed":"Recipient command failed";n.rejected.push(o),i=this._formatError(s,"EENVELOPE",e,"RCPT TO"),i.recipient=o,n.rejectedErrors.push(i)}else n.accepted.push(o);this._advanceEnvelope(e,r)}_advanceEnvelope(e,r){let n=this._envelope;if(n.pipelined)return;if(n.mailError)return r(n.mailError);if(n.rcptQueue.length)return this._sendRcpt(n.rcptQueue.shift(),r);if(this._recipientQueue.length)return;let i=this._envelopeError(e);if(i)return r(i);this._responseActions.push(o=>{this._actionDATA(o,r)}),this._sendCommand("DATA")}_envelopeError(e){let r=this._envelope;if(r.mailError)return r.mailError;if(r.accepted.length)return null;let n=r.rejectedErrors.find(a=>a.responseCode&&a.responseCode<500),i=r.rejectedErrors[r.rejectedErrors.length-1],o=n?.response??(r.pipelined&&i?i.response:e),s=this._formatError("Can't send mail - all recipients were rejected","EENVELOPE",o,"RCPT TO");return s.rejected=r.rejected,s.rejectedErrors=r.rejectedErrors,s}_actionDATA(e,r){let n=this._envelope;if(n.pipelined){let o=this._envelopeError(e);if(o){if(/^3/.test(e)){if(n.mailError)return this.close(),r(o);this._responseActions.push(()=>r(o)),this._sendCommand(".");return}return r(o)}}if(!/^[23]/.test(e))return r(this._formatError("Data command failed","EENVELOPE",e,"DATA"));let i={accepted:n.accepted,rejected:n.rejected};this._ehloLines&&this._ehloLines.length&&(i.ehlo=this._ehloLines),n.rejectedErrors.length&&(i.rejectedErrors=n.rejectedErrors),r(null,i)}_actionSMTPStream(e,r){return Number(e.charAt(0))!==2?r(this._formatError("Message failed","EMESSAGE",e,"DATA")):r(null,e)}_actionLMTPStream(e,r,n,i){let o=this._envelope,s;if(Number(n.charAt(0))!==2){s=this._formatError("Message failed for recipient "+e,"EMESSAGE",n,"DATA"),s.recipient=e,o.rejected.push(e),o.rejectedErrors.push(s);for(let a=0,c=o.accepted.length;a<c;a++)o.accepted[a]===e&&o.accepted.splice(a,1)}if(r)return i(null,n)}_handleXOauth2Token(e,r){this._auth.oauth2.getToken(e,(n,i)=>{if(n)return this.logger.info({tnx:"smtp",username:this._auth.user,action:"authfail",method:this._authMethod},"User %s failed to authenticate",JSON.stringify(this._auth.user)),r(this._formatError(n,"EAUTH",!1,"AUTH XOAUTH2"));this._responseActions.push(o=>{this._actionAUTHComplete(o,e,r)}),this._sendCommand("AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token(i),"AUTH XOAUTH2 "+this._auth.oauth2.buildXOAuth2Token("/* secret */"))})}_isDestroyedMessage(e){if(this._destroyed)return"Cannot "+e+" - smtp connection is already destroyed.";if(this._socket){if(this._socket.destroyed)return"Cannot "+e+" - smtp connection socket is already destroyed.";if(!this._socket.writable)return"Cannot "+e+" - smtp connection socket is already half-closed."}}_getHostname(){let e;try{e=KR.hostname()||""}catch{e="localhost"}return(!e||e.indexOf(".")<0)&&(e="[127.0.0.1]"),e.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)&&(e="["+e+"]"),e}},zi=Sm;import{Stream as WR}from"node:stream";import zR from"node:crypto";var wm=class extends WR{constructor(e,r){if(super(),this.options=e||{},this.configError=!1,e&&e.serviceClient){if(!e.privateKey||!e.user){let i=new Error('Options "privateKey" and "user" are required for service account!');i.code=ci,this.configError=i}let n=Math.min(Math.max(Number(this.options.serviceRequestTimeout)||0,0),3600);this.options.serviceRequestTimeout=n||300}if(this.logger=ft({logger:r},{component:this.options.component||"OAuth2"}),this.provisionCallback=typeof this.options.provisionCallback=="function"?this.options.provisionCallback:!1,this.options.accessUrl=this.options.accessUrl||"https://accounts.google.com/o/oauth2/token",this.options.customHeaders=this.options.customHeaders||{},this.options.customParams=this.options.customParams||{},this.accessToken=this.options.accessToken||!1,this.options.expires&&Number(this.options.expires))this.expires=this.options.expires;else{let n=Math.max(Number(this.options.timeout)||0,0);this.expires=n&&Date.now()+n*1e3||0}this.renewing=!1,this.renewalQueue=[]}getToken(e,r){let n=r;if(this.configError)return n(this.configError);if(!e&&this.accessToken&&(!this.expires||this.expires>Date.now()))return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token for %s",this.options.user),r(null,this.accessToken);if(!this.provisionCallback&&!this.options.refreshToken&&!this.options.serviceClient){if(this.accessToken)return this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"reuse"},"Reusing existing access token (no refresh capability) for %s",this.options.user),r(null,this.accessToken);this.logger.error({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Cannot renew access token for %s: No refresh mechanism available",this.options.user);let o=new Error("Can't create new access token for user");return o.code=ci,n(o)}if(this.renewing){this.renewalQueue.push({renew:e,callback:n});return}this.renewing=!0;let i=(o,s)=>{this.renewalQueue.forEach(a=>a.callback(o,s)),this.renewalQueue=[],this.renewing=!1,o?this.logger.error({err:o,tnx:"OAUTH2",user:this.options.user,action:"renew"},"Failed generating new Access Token for %s",this.options.user):this.logger.info({tnx:"OAUTH2",user:this.options.user,action:"renew"},"Generated new Access Token for %s",this.options.user),n(o,s)};this.provisionCallback?this.provisionCallback(this.options.user,!!e,(o,s,a)=>{!o&&s&&(this.accessToken=s,this.expires=a||0),i(o,s)}):this.generateToken(i)}updateToken(e,r){this.accessToken=e,r=Math.max(Number(r)||0,0),this.expires=r&&Date.now()+r*1e3||0,this.emit("token",{user:this.options.user,accessToken:e||"",expires:this.expires})}generateToken(e){let r=e,n,i;if(this.options.serviceClient){let o=Math.floor(Date.now()/1e3),s={iss:this.options.serviceClient,scope:this.options.scope||"https://mail.google.com/",sub:this.options.user,aud:this.options.accessUrl,iat:o,exp:o+this.options.serviceRequestTimeout},a;try{a=this.jwtSignRS256(s)}catch{let l=new Error("Can't generate token. Check your auth options");return l.code=ci,r(l)}n={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:a},i={grant_type:"urn:ietf:params:oauth:grant-type:jwt-bearer",assertion:s}}else{if(!this.options.refreshToken){let o=new Error("Can't create new access token for user");return o.code=ci,r(o)}n={client_id:this.options.clientId||"",client_secret:this.options.clientSecret||"",refresh_token:this.options.refreshToken,grant_type:"refresh_token"},i={client_id:this.options.clientId||"",client_secret:(this.options.clientSecret||"").substr(0,6)+"...",refresh_token:(this.options.refreshToken||"").substr(0,6)+"...",grant_type:"refresh_token"}}Object.assign(n,this.options.customParams),Object.assign(i,this.options.customParams),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"generate"},"Requesting token using: %s",JSON.stringify(i)),this.postRequest(this.options.accessUrl,n,this.options,(o,s)=>{let a;if(o)return r(o);try{a=JSON.parse(s.toString())}catch(u){return r(u)}if(!a||typeof a!="object"){this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",(s||"").toString());let u=new Error("Invalid authentication response");return u.code=ci,r(u)}let c=Object.assign({},a);if(c.access_token&&(c.access_token=(c.access_token||"").toString().substr(0,6)+"..."),this.logger.debug({tnx:"OAUTH2",user:this.options.user,action:"post"},"Response: %s",JSON.stringify(c)),a.error){let u=a.error;a.error_description&&(u+=": "+a.error_description),a.error_uri&&(u+=" ("+a.error_uri+")");let p=new Error(u);return p.code=ci,r(p)}if(a.access_token)return this.updateToken(a.access_token,a.expires_in),e(null,this.accessToken);let l=new Error("No access token");return l.code=ci,r(l)})}buildXOAuth2Token(e){let r=["user="+(this.options.user||""),"auth=Bearer "+(e||this.accessToken),"",""];return Buffer.from(r.join("
"),"utf-8").toString("base64")}postRequest(e,r,n,i){let o=!1,s=[],a=0,c={method:"post",headers:n.customHeaders,body:r,allowErrorResponse:!0,timeout:n.requestTimeout};/^https:/i.test(e)&&(c.tls=Object.assign({rejectUnauthorized:!0},n.tls||{}));let l=ui(e,c);l.on("readable",()=>{let u;for(;(u=l.read())!==null;)s.push(u),a+=u.length}),l.once("error",u=>{if(!o)return o=!0,i(u)}),l.once("end",()=>{if(!o)return o=!0,i(null,Buffer.concat(s,a))})}toBase64URL(e){return typeof e=="string"&&(e=Buffer.from(e)),e.toString("base64").replace(/[=]+/g,"").replace(/\+/g,"-").replace(/\//g,"_")}jwtSignRS256(e){let r=['{"alg":"RS256","typ":"JWT"}',JSON.stringify(e)].map(i=>this.toBase64URL(i)).join("."),n=zR.createSign("RSA-SHA256").update(r).sign(this.options.privateKey);return r+"."+this.toBase64URL(n)}},od=wm;import{EventEmitter as JR}from"node:events";var As=class extends JR{constructor(e){if(super(),this.pool=e,this.options=e.options,this.logger=this.pool.logger,this.options.auth)switch((this.options.auth.type||"").toString().toUpperCase()){case"OAUTH2":{let r=new od(this.options.auth,this.logger);r.provisionCallback=this.pool.mailer&&this.pool.mailer.get("oauth2_provision_cb")||r.provisionCallback,this.auth={type:"OAUTH2",user:this.options.auth.user,oauth2:r,method:"XOAUTH2"},r.on("token",n=>this.pool.mailer.emit("token",n)),r.on("error",n=>this._fail(n));break}default:if(!this.options.auth.user&&!this.options.auth.pass)break;this.auth={type:(this.options.auth.type||"").toString().toUpperCase()||"LOGIN",user:this.options.auth.user,credentials:{user:this.options.auth.user||"",pass:this.options.auth.pass,options:this.options.auth.options},method:(this.options.auth.method||"").trim().toUpperCase()||this.options.authMethod||!1}}this._connection=!1,this._connected=!1,this.messages=0,this.available=!0,this._failed=!1,this._sending=!1,this._idleTimer=!1}_fail(e){this._failed||(this._failed=!0,this.emit("error",e))}connect(e){let r=Date.now();this.pool.getSocket(Object.assign({},this.options,{connectStartedAt:r}),(n,i)=>{if(n)return this._fail(n),e(n);let o=!1,s=this.options;i&&i.connection&&(this.logger.info({tnx:"proxy",remoteAddress:i.connection.remoteAddress,remotePort:i.connection.remotePort,destHost:s.host||"",destPort:s.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",i.connection.remoteAddress,i.connection.remotePort,s.host||"",s.port||""),s=Object.assign(Or(!1,s),i)),this.connection=new zi(s),this.connection._connectStartedAt=r,this.connection.on("error",a=>{if(!this._sending){if(this._connected&&Wa(a)){this.logger.info({tnx:"pool",cid:this.id},"Connection #%s was closed by the server: %s",this.id,a.message);return}if(this._fail(a),!o)return o=!0,e(a)}}),this.connection.once("end",()=>{this.close(),o=!0}),this.connection.connect(a=>{if(!o){if(a){o=!0;return}if(this.auth&&(this.connection.allowsAuth||s.forceAuth))this.connection.login(this.auth,c=>{if(!o){if(o=!0,c)return this.connection.close(),this._fail(c),e(c);this._connected=!0,e(null,!0)}});else return o=!0,this._connected=!0,e(null,!0)}})})}send(e,r){if(!this._connected)return this.connect(c=>c?r(c):this.send(e,r));let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i,cid:this.id},"Sending message %s using #%s to <%s>",i,this.id,o.join(", ")),e.data.dsn&&(n.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(n.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this._sending=!0;let s=this.messages>0,a=e.message.createReadStream();this.connection.send(n,a,(c,l)=>{if(this._sending=!1,this.messages++,c){if(s&&a.readableDidRead===!1&&Wa(c)){this.logger.info({tnx:"pool",cid:this.id,messageId:i},"Connection #%s was closed by the server before message %s was sent: %s",this.id,i,c.message),this.connection.close();return}return(c.code===Jv||c.code===Yv)&&c.responseCode!==421&&!this.connection._destroyed?(this.connection.reset(u=>{if(u){this.connection.close();return}this._release()}),r(c)):(this.connection.close(),this._fail(c),r(c))}l.envelope={from:n.from,to:n.to},l.messageId=i,setImmediate(()=>this._release()),r(null,l)})}_release(){if(this.messages>=this.options.maxMessages){let e=new Error("Resource exhausted");e.code=Bu,this.connection.close(),this._fail(e);return}this.pool._checkRateLimit(()=>{this.available=!0,this._startIdleTimer(),this.emit("available")})}_startIdleTimer(){if(!(!this.options.idleTimeout||this.options.idleTimeout<0)){if(this._idleTimer&&typeof this._idleTimer.refresh=="function"){this._idleTimer.refresh();return}clearTimeout(this._idleTimer),this._idleTimer=setTimeout(()=>{this.available&&(this.logger.debug({tnx:"pool",cid:this.id},"Closing connection #%s after it was idle for %sms",this.id,this.options.idleTimeout),this.available=!1,this.connection.quit())},this.options.idleTimeout),typeof this._idleTimer.unref=="function"&&this._idleTimer.unref()}}_stopIdleTimer(){clearTimeout(this._idleTimer),this._idleTimer=!1}close(){this._connected=!1,this._stopIdleTimer(),this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.connection&&this.connection.close(),this.emit("close")}};var Nm={126:{description:"126 Mail (NetEase)",host:"smtp.126.com",port:465,secure:!0},163:{description:"163 Mail (NetEase)",host:"smtp.163.com",port:465,secure:!0},"1und1":{description:"1&1 Mail (German hosting provider)",host:"smtp.1und1.de",port:465,secure:!0,authMethod:"LOGIN"},Aliyun:{description:"Alibaba Cloud Mail",domains:["aliyun.com"],host:"smtp.aliyun.com",port:465,secure:!0},AliyunQiye:{description:"Alibaba Cloud Enterprise Mail",host:"smtp.qiye.aliyun.com",port:465,secure:!0},AOL:{description:"AOL Mail",domains:["aol.com"],host:"smtp.aol.com",port:587},Aruba:{description:"Aruba PEC (Italian email provider)",domains:["aruba.it","pec.aruba.it"],aliases:["Aruba PEC"],host:"smtps.aruba.it",port:465,secure:!0,authMethod:"LOGIN"},Bluewin:{description:"Bluewin (Swiss email provider)",host:"smtpauths.bluewin.ch",domains:["bluewin.ch"],port:465},BOL:{description:"BOL Mail (Brazilian provider)",domains:["bol.com.br"],host:"smtp.bol.com.br",port:587,requireTLS:!0},DebugMail:{description:"DebugMail (email testing service)",host:"debugmail.io",port:25},Disroot:{description:"Disroot (privacy-focused provider)",domains:["disroot.org"],host:"disroot.org",port:587,secure:!1,authMethod:"LOGIN"},DynectEmail:{description:"Dyn Email Delivery",aliases:["Dynect"],host:"smtp.dynect.net",port:25},ElasticEmail:{description:"Elastic Email",aliases:["Elastic Email"],host:"smtp.elasticemail.com",port:465,secure:!0},Ethereal:{description:"Ethereal Email (email testing service)",aliases:["ethereal.email"],host:"smtp.ethereal.email",port:587},FastMail:{description:"FastMail",domains:["fastmail.com","fastmail.fm"],host:"smtp.fastmail.com",port:465,secure:!0},"Feishu Mail":{description:"Feishu Mail (Lark)",aliases:["Feishu","FeishuMail"],domains:["www.feishu.cn"],host:"smtp.feishu.cn",port:465,secure:!0},"Forward Email":{description:"Forward Email (email forwarding service)",aliases:["FE","ForwardEmail"],domains:["forwardemail.net"],host:"smtp.forwardemail.net",port:465,secure:!0},GandiMail:{description:"Gandi Mail",aliases:["Gandi","Gandi Mail"],host:"mail.gandi.net",port:587},Gmail:{description:"Gmail",aliases:["Google Mail"],domains:["gmail.com","googlemail.com"],host:"smtp.gmail.com",port:465,secure:!0},GmailWorkspace:{description:"Gmail Workspace",aliases:["Google Workspace Mail"],host:"smtp-relay.gmail.com",port:465,secure:!0},GMX:{description:"GMX Mail",domains:["gmx.com","gmx.net","gmx.de"],host:"mail.gmx.com",port:587},Godaddy:{description:"GoDaddy Email (US)",host:"smtpout.secureserver.net",port:25},GodaddyAsia:{description:"GoDaddy Email (Asia)",host:"smtp.asia.secureserver.net",port:25},GodaddyEurope:{description:"GoDaddy Email (Europe)",host:"smtp.europe.secureserver.net",port:25},"hot.ee":{description:"Hot.ee (Estonian email provider)",host:"mail.hot.ee"},Hotmail:{description:"Outlook.com / Hotmail",aliases:["Outlook","Outlook.com","Hotmail.com"],domains:["hotmail.com","outlook.com"],host:"smtp-mail.outlook.com",port:587},iCloud:{description:"iCloud Mail",aliases:["Me","Mac"],domains:["icloud.com","me.com","mac.com"],host:"smtp.mail.me.com",port:587},Infomaniak:{description:"Infomaniak Mail (Swiss hosting provider)",host:"mail.infomaniak.com",domains:["ik.me","ikmail.com","etik.com"],port:587},KolabNow:{description:"KolabNow (secure email service)",domains:["kolabnow.com"],aliases:["Kolab"],host:"smtp.kolabnow.com",port:465,secure:!0,authMethod:"LOGIN"},Loopia:{description:"Loopia (Swedish hosting provider)",host:"mailcluster.loopia.se",port:465},Loops:{description:"Loops",host:"smtp.loops.so",port:587},"mail.ee":{description:"Mail.ee (Estonian email provider)",host:"smtp.mail.ee"},"Mail.ru":{description:"Mail.ru",host:"smtp.mail.ru",port:465,secure:!0},"Mailcatch.app":{description:"Mailcatch (email testing service)",host:"sandbox-smtp.mailcatch.app",port:2525},Maildev:{description:"MailDev (local email testing)",port:1025,ignoreTLS:!0},MailerSend:{description:"MailerSend",host:"smtp.mailersend.net",port:587},Mailgun:{description:"Mailgun",host:"smtp.mailgun.org",port:465,secure:!0},Mailjet:{description:"Mailjet",host:"in.mailjet.com",port:587},Mailosaur:{description:"Mailosaur (email testing service)",host:"mailosaur.io",port:25},MailSenpai:{description:"MailSenpai (SMTP Senpai, EU)",host:"relay.mailsenpai.com",port:2525,secure:!1},Mailtrap:{description:"Mailtrap",host:"live.smtp.mailtrap.io",port:587},Mandrill:{description:"Mandrill (by Mailchimp)",host:"smtp.mandrillapp.com",port:587},Naver:{description:"Naver Mail (Korean email provider)",host:"smtp.naver.com",port:587},OhMySMTP:{description:"OhMySMTP (email delivery service)",host:"smtp.ohmysmtp.com",port:587,secure:!1},One:{description:"One.com Email",host:"send.one.com",port:465,secure:!0},OpenMailBox:{description:"OpenMailBox",aliases:["OMB","openmailbox.org"],host:"smtp.openmailbox.org",port:465,secure:!0},Outlook365:{description:"Microsoft 365 / Office 365",host:"smtp.office365.com",port:587,secure:!1},Postmark:{description:"Postmark",aliases:["PostmarkApp"],host:"smtp.postmarkapp.com",port:2525},Proton:{description:"Proton Mail",aliases:["ProtonMail","Proton.me","Protonmail.com","Protonmail.ch"],domains:["proton.me","protonmail.com","pm.me","protonmail.ch"],host:"smtp.protonmail.ch",port:587,requireTLS:!0},"qiye.aliyun":{description:"Alibaba Mail Enterprise Edition",host:"smtp.mxhichina.com",port:"465",secure:!0},QQ:{description:"QQ Mail",domains:["qq.com"],host:"smtp.qq.com",port:465,secure:!0},QQex:{description:"QQ Enterprise Mail",aliases:["QQ Enterprise"],domains:["exmail.qq.com"],host:"smtp.exmail.qq.com",port:465,secure:!0},Resend:{description:"Resend",host:"smtp.resend.com",port:465,secure:!0},Runbox:{description:"Runbox (Norwegian email provider)",domains:["runbox.com"],host:"smtp.runbox.com",port:465,secure:!0},SendCloud:{description:"SendCloud (Chinese email delivery)",host:"smtp.sendcloud.net",port:2525},SendGrid:{description:"SendGrid",host:"smtp.sendgrid.net",port:587},SendinBlue:{description:"Brevo (formerly Sendinblue)",aliases:["Brevo"],host:"smtp-relay.brevo.com",port:587},SendPulse:{description:"SendPulse",host:"smtp-pulse.com",port:465,secure:!0},SES:{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-1":{description:"AWS SES Asia Pacific (Tokyo)",host:"email-smtp.ap-northeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-2":{description:"AWS SES Asia Pacific (Seoul)",host:"email-smtp.ap-northeast-2.amazonaws.com",port:465,secure:!0},"SES-AP-NORTHEAST-3":{description:"AWS SES Asia Pacific (Osaka)",host:"email-smtp.ap-northeast-3.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTH-1":{description:"AWS SES Asia Pacific (Mumbai)",host:"email-smtp.ap-south-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-1":{description:"AWS SES Asia Pacific (Singapore)",host:"email-smtp.ap-southeast-1.amazonaws.com",port:465,secure:!0},"SES-AP-SOUTHEAST-2":{description:"AWS SES Asia Pacific (Sydney)",host:"email-smtp.ap-southeast-2.amazonaws.com",port:465,secure:!0},"SES-CA-CENTRAL-1":{description:"AWS SES Canada (Central)",host:"email-smtp.ca-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-CENTRAL-1":{description:"AWS SES Europe (Frankfurt)",host:"email-smtp.eu-central-1.amazonaws.com",port:465,secure:!0},"SES-EU-NORTH-1":{description:"AWS SES Europe (Stockholm)",host:"email-smtp.eu-north-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-1":{description:"AWS SES Europe (Ireland)",host:"email-smtp.eu-west-1.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-2":{description:"AWS SES Europe (London)",host:"email-smtp.eu-west-2.amazonaws.com",port:465,secure:!0},"SES-EU-WEST-3":{description:"AWS SES Europe (Paris)",host:"email-smtp.eu-west-3.amazonaws.com",port:465,secure:!0},"SES-SA-EAST-1":{description:"AWS SES South America (S\xE3o Paulo)",host:"email-smtp.sa-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-1":{description:"AWS SES US East (N. Virginia)",host:"email-smtp.us-east-1.amazonaws.com",port:465,secure:!0},"SES-US-EAST-2":{description:"AWS SES US East (Ohio)",host:"email-smtp.us-east-2.amazonaws.com",port:465,secure:!0},"SES-US-GOV-EAST-1":{description:"AWS SES GovCloud (US-East)",host:"email-smtp.us-gov-east-1.amazonaws.com",port:465,secure:!0},"SES-US-GOV-WEST-1":{description:"AWS SES GovCloud (US-West)",host:"email-smtp.us-gov-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-1":{description:"AWS SES US West (N. California)",host:"email-smtp.us-west-1.amazonaws.com",port:465,secure:!0},"SES-US-WEST-2":{description:"AWS SES US West (Oregon)",host:"email-smtp.us-west-2.amazonaws.com",port:465,secure:!0},Seznam:{description:"Seznam Email (Czech email provider)",aliases:["Seznam Email"],domains:["seznam.cz","email.cz","post.cz","spoluzaci.cz"],host:"smtp.seznam.cz",port:465,secure:!0},SMTP2GO:{description:"SMTP2GO",host:"mail.smtp2go.com",port:2525},Sparkpost:{description:"SparkPost",aliases:["SparkPost","SparkPost Mail"],domains:["sparkpost.com"],host:"smtp.sparkpostmail.com",port:587,secure:!1},Tipimail:{description:"Tipimail (email delivery service)",host:"smtp.tipimail.com",port:587},TurboSMTP:{description:"TurboSMTP",host:"pro.turbo-smtp.com",port:465,secure:!0},"TurboSMTP-EU":{description:"TurboSMTP (EU region)",host:"pro.eu.turbo-smtp.com",port:465,secure:!0},Tutanota:{description:"Tutanota (Tuta Mail)",domains:["tutanota.com","tuta.com","tutanota.de","tuta.io"],host:"smtp.tutanota.com",port:465,secure:!0},Yahoo:{description:"Yahoo Mail",domains:["yahoo.com"],host:"smtp.mail.yahoo.com",port:465,secure:!0},Yandex:{description:"Yandex Mail",domains:["yandex.ru"],host:"smtp.yandex.ru",port:465,secure:!0},Zimbra:{description:"Zimbra Mail Server",aliases:["Zimbra Collaboration"],host:"smtp.zimbra.com",port:587,requireTLS:!0},Zoho:{description:"Zoho Mail",host:"smtp.zoho.com",port:465,secure:!0,authMethod:"LOGIN"}};var sd={};Object.keys(Nm).forEach(t=>{let e=Nm[t],r=YR(e);sd[ad(t)]=r,[].concat(e.aliases||[]).forEach(n=>{sd[ad(n)]=r}),[].concat(e.domains||[]).forEach(n=>{sd[ad(n)]=r})});function ad(t){return t.replace(/[^a-zA-Z0-9.-]/g,"").toLowerCase()}function YR(t){let e={};return Object.keys(t).forEach(r=>{["domains","aliases"].includes(r)||(e[r]=t[r])}),e}function ic(t){return t=ad(t.split("@").pop()),sd[t]||!1}var QR=50,ZR=2e3,Rm=class extends XR{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.options.maxConnections=this.options.maxConnections||5,this.options.maxMessages=this.options.maxMessages||100,this.options.maxRequeues=typeof this.options.maxRequeues=="number"?this.options.maxRequeues:5,this.options.idleTimeout=typeof this.options.idleTimeout=="number"?this.options.idleTimeout:240*1e3,this.logger=ft(this.options,{component:this.options.component||"smtp-pool"}),this.name="SMTP (pool)",this.version=Xe+"[client:"+Xe+"]",this._rateLimit={counter:0,timeout:null,waiting:[],checkpoint:!1,delta:Number(this.options.rateDelta)||1e3,limit:Number(this.options.rateLimit)||0},this._closed=!1,this._queue=[],this._connections=[],this._connectionCounter=0,this.idling=!0,setImmediate(()=>{this.idling&&this.emit("idle")})}getSocket(e,r){setImmediate(()=>r(null,!1))}send(e,r){if(this._closed){let n=new Error("Connection pool was closed");return n.code=Hu,setImmediate(()=>r(n)),!1}return this._queue.push({mail:e,requeueAttempts:0,callback:r}),this.idling&&this._queue.length>=this.options.maxConnections&&(this.idling=!1),setImmediate(()=>this._processMessages()),!0}close(){let e,r=this._connections.length;if(this._closed=!0,this._clearRateLimit(),!r&&!this._queue.length)return;for(let i=r-1;i>=0;i--)this._connections[i]&&this._connections[i].available&&(e=this._connections[i],e.close(),this.logger.info({tnx:"connection",cid:e.id,action:"removed"},"Connection #%s removed",e.id));if(r&&!this._connections.length&&this.logger.debug({tnx:"connection"},"All connections removed"),!this._queue.length)return;let n=()=>{if(!this._queue.length){this.logger.debug({tnx:"connection"},"Pending queue entries cleared");return}let i=this._queue.shift();if(i&&typeof i.callback=="function")try{i.callback(new Error("Connection pool was closed"))}catch(o){this.logger.error({err:o,tnx:"callback"},"Callback error: %s",o.message)}setImmediate(n)};setImmediate(n)}_processMessages(){if(this._closed)return;if(!this._queue.length){this.idling||(this.idling=!0,this.emit("idle"));return}let e=this._connections.find(n=>n.available);if(!e&&this._connections.length<this.options.maxConnections&&(e=this._createConnection()),!e){this.idling=!1;return}!this.idling&&this._queue.length<this.options.maxConnections&&(this.idling=!0,this.emit("idle"));let r=e.queueEntry=this._queue.shift();r.messageId=(e.queueEntry.mail.message.getHeader("message-id")||"").replace(/[<>\s]/g,""),e.available=!1,this.logger.debug({tnx:"pool",cid:e.id,messageId:r.messageId,action:"assign"},"Assigned message <%s> to #%s (%s)",r.messageId,e.id,e.messages+1),this._rateLimit.limit&&(this._rateLimit.counter++,this._rateLimit.checkpoint||(this._rateLimit.checkpoint=Date.now())),e.send(r.mail,(n,i)=>{if(r===e.queueEntry){try{r.callback(n,i)}catch(o){this.logger.error({err:o,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,o.message)}e.queueEntry=!1}})}_createConnection(){let e=new As(this);return e.id=++this._connectionCounter,this.logger.info({tnx:"pool",cid:e.id,action:"conection"},"Created new pool resource #%s",e.id),e.on("available",()=>{this.logger.debug({tnx:"connection",cid:e.id,action:"available"},"Connection #%s became available",e.id),this._closed?this.close():this._processMessages()}),e.once("error",r=>{if(r.code!==Bu?this.logger.warn({err:r,tnx:"pool",cid:e.id},"Pool Error for #%s: %s",e.id,r.message):this.logger.debug({tnx:"pool",cid:e.id,action:"maxlimit"},"Max messages limit exchausted for #%s",e.id),e.queueEntry){try{e.queueEntry.callback(r)}catch(n){this.logger.error({err:n,tnx:"callback",cid:e.id},"Callback error for #%s: %s",e.id,n.message)}e.queueEntry=!1}this._removeConnection(e),this._continueProcessing()}),e.once("close",()=>{this.logger.info({tnx:"connection",cid:e.id,action:"closed"},"Connection #%s was closed",e.id),this._removeConnection(e),e.queueEntry?setTimeout(()=>{let r=0;e.queueEntry&&(this._shouldRequeuOnConnectionClose(e.queueEntry)?r=this._requeueEntryOnConnectionClose(e):this._failDeliveryOnConnectionClose(e)),r?setTimeout(()=>this._continueProcessing(),r):this._continueProcessing()},50):(!this._closed&&this.idling&&!this._connections.length&&this.emit("clear"),this._continueProcessing())}),this._connections.push(e),e}_shouldRequeuOnConnectionClose(e){return this.options.maxRequeues<0?!0:e.requeueAttempts<this.options.maxRequeues}_failDeliveryOnConnectionClose(e){if(e.queueEntry&&e.queueEntry.callback){try{let r=new Error("Reached maximum number of retries after connection was closed");r.code=Hu,e.queueEntry.callback(r)}catch(r){this.logger.error({err:r,tnx:"callback",messageId:e.queueEntry.messageId,cid:e.id},"Callback error for #%s: %s",e.id,r.message)}e.queueEntry=!1}}_requeueEntryOnConnectionClose(e){let r=Math.min(QR*2**e.queueEntry.requeueAttempts,ZR);return e.queueEntry.requeueAttempts+=1,this.logger.debug({tnx:"pool",cid:e.id,messageId:e.queueEntry.messageId,action:"requeue"},"Re-queued message <%s> for #%s. Attempt: #%s",e.queueEntry.messageId,e.id,e.queueEntry.requeueAttempts),this._queue.unshift(e.queueEntry),e.queueEntry=!1,r}_continueProcessing(){this._closed?this.close():setTimeout(()=>this._processMessages(),100)}_removeConnection(e){let r=this._connections.indexOf(e);r!==-1&&this._connections.splice(r,1)}_checkRateLimit(e){if(!this._rateLimit.limit)return e();let r=Date.now();if(this._rateLimit.counter<this._rateLimit.limit)return e();if(this._rateLimit.waiting.push(e),this._rateLimit.checkpoint<=r-this._rateLimit.delta)return this._clearRateLimit();this._rateLimit.timeout||(this._rateLimit.timeout=setTimeout(()=>this._clearRateLimit(),this._rateLimit.delta-(r-this._rateLimit.checkpoint)),this._rateLimit.checkpoint=r)}_clearRateLimit(){for(clearTimeout(this._rateLimit.timeout),this._rateLimit.timeout=null,this._rateLimit.counter=0,this._rateLimit.checkpoint=!1;this._rateLimit.waiting.length;){let e=this._rateLimit.waiting.shift();setImmediate(e)}}isIdle(){return this.idling}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=new As(this).auth,o=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:o}),(s,a)=>{if(s)return n(s);let c=this.options;a&&a.connection&&(this.logger.info({tnx:"proxy",remoteAddress:a.connection.remoteAddress,remotePort:a.connection.remotePort,destHost:c.host||"",destPort:c.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",a.connection.remoteAddress,a.connection.remotePort,c.host||"",c.port||""),c=Object.assign(Or(!1,c),a));let l=new zi(c);l._connectStartedAt=o;let u=!1;l.once("error",f=>{if(!u)return u=!0,l.close(),n(f)}),l.once("end",()=>{if(!u)return u=!0,n(new Error("Connection closed"))});let p=()=>{if(!u)return u=!0,l.quit(),n(null,!0)};l.connect(f=>{if(!u){if(f)return u=!0,l.close(),n(f);if(i&&(l.allowsAuth||c.forceAuth))l.login(i,m=>{if(!u){if(m)return u=!0,l.close(),n(m);p()}});else if(!i&&l.allowsAuth&&c.forceAuth){let m=new Error("Authentication info was not provided");return m.code=Vu,u=!0,l.close(),n(m)}else p()}})}),r}},ZA=Rm;import{EventEmitter as e0}from"node:events";var Om=class extends e0{constructor(e){super(),e=e||{},typeof e=="string"&&(e={url:e});let r,n=e.service;typeof e.getSocket=="function"&&(this.getSocket=e.getSocket),e.url&&(r=gs(e.url),n=n||r.service),this.options=Or(!1,e,r,n&&ic(n)),this.logger=ft(this.options,{component:this.options.component||"smtp-transport"}),this.name="SMTP",this.version=Xe+"[client:"+Xe+"]",this.options.auth&&(this.auth=this.getAuth({}))}getSocket(e,r){setImmediate(()=>r(null,!1))}getAuth(e){if(!e)return this.auth&&this.auth.oauth2&&this.mailer&&(this.auth.oauth2.provisionCallback=this.mailer.get("oauth2_provision_cb")||this.auth.oauth2.provisionCallback),this.auth;let r=Object.assign({},this.options.auth&&typeof this.options.auth=="object"?this.options.auth:{},typeof e=="object"?e:{});if(Object.keys(r).length===0)return!1;switch((r.type||"").toString().toUpperCase()){case"OAUTH2":{if(!r.service&&!r.user)return!1;let n=new od(r,this.logger);return n.provisionCallback=this.mailer&&this.mailer.get("oauth2_provision_cb")||n.provisionCallback,n.on("token",i=>this.mailer.emit("token",i)),n.on("error",i=>this.emit("error",i)),{type:"OAUTH2",user:r.user,oauth2:n,method:"XOAUTH2"}}default:return{type:(r.type||"").toString().toUpperCase()||"LOGIN",user:r.user,credentials:{user:r.user||"",pass:r.pass,options:r.options},method:(r.method||"").trim().toUpperCase()||this.options.authMethod||!1}}}send(e,r){let n=Date.now();this.getSocket(Object.assign({},this.options,{connectStartedAt:n}),(i,o)=>{if(i)return r(i);let s=!1,a=this.options;o&&o.connection&&(this.logger.info({tnx:"proxy",remoteAddress:o.connection.remoteAddress,remotePort:o.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",o.connection.remoteAddress,o.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),o));let c=new zi(a);c._connectStartedAt=n;let l,u=()=>{l&&l!==this.auth&&l.oauth2&&l.oauth2.removeAllListeners(),l=null};c.once("error",f=>{if(!s)return s=!0,u(),c.close(),r(f)});let p=()=>{let f=e.message.getEnvelope(),m=e.message.messageId(),E=[].concat(f.to||[]);E.length>3&&E.push("...and "+E.splice(2).length+" more"),e.data.dsn&&(f.dsn=e.data.dsn),e.data.requireTLSExtensionEnabled&&(f.requireTLSExtensionEnabled=e.data.requireTLSExtensionEnabled),this.logger.info({tnx:"send",messageId:m},"Sending message %s to <%s>",m,E.join(", ")),c.send(f,e.message.createReadStream(),(v,N)=>{if(!s){if(s=!0,u(),c.close(),v)return this.logger.error({err:v,tnx:"send"},"Send error for %s: %s",m,v.message),r(v);N.envelope={from:f.from,to:f.to},N.messageId=m;try{return r(null,N)}catch(S){this.logger.error({err:S,tnx:"callback"},"Callback error for %s: %s",m,S.message)}}})};c.connect(f=>{if(!s){if(f)return s=!0,c.close(),r(f);l=this.getAuth(e.data.auth),l&&(c.allowsAuth||a.forceAuth)?c.login(l,m=>{if(u(),!s){if(m)return s=!0,c.close(),r(m);p()}}):p()}})})}verify(e){let r;e||(r=new Promise((o,s)=>{e=Mt(o,s)}));let n=e,i=Date.now();return this.getSocket(Object.assign({},this.options,{connectStartedAt:i}),(o,s)=>{if(o)return n(o);let a=this.options;s&&s.connection&&(this.logger.info({tnx:"proxy",remoteAddress:s.connection.remoteAddress,remotePort:s.connection.remotePort,destHost:a.host||"",destPort:a.port||"",action:"connected"},"Using proxied socket from %s:%s to %s:%s",s.connection.remoteAddress,s.connection.remotePort,a.host||"",a.port||""),a=Object.assign(Or(!1,a),s));let c=new zi(a);c._connectStartedAt=i;let l=!1,u,p=()=>{u&&u!==this.auth&&u.oauth2&&u.oauth2.removeAllListeners(),u=null};c.once("error",m=>{if(!l)return l=!0,p(),c.close(),n(m)}),c.once("end",()=>{if(!l)return l=!0,p(),n(new Error("Connection closed"))});let f=()=>{if(!l)return l=!0,p(),c.quit(),n(null,!0)};c.connect(m=>{if(!l){if(m)return l=!0,c.close(),n(m);if(u=this.getAuth({}),u&&(c.allowsAuth||a.forceAuth))c.login(u,E=>{if(p(),!l){if(E)return l=!0,c.close(),n(E);f()}});else if(!u&&c.allowsAuth&&a.forceAuth){let E=new Error("Authentication info was not provided");return E.code=Vu,l=!0,p(),c.close(),n(E)}else f()}})}),r}close(){this.auth&&this.auth.oauth2&&this.auth.oauth2.removeAllListeners(),this.emit("close")}},eT=Om;import{spawn as t0}from"node:child_process";import{pipeline as r0}from"node:stream";var n0=1e3,km=class{constructor(e){e=e||{},this._spawn=t0,this.options=e,this.name="Sendmail",this.version=Xe,this.path="sendmail",this.args=!1,this.logger=ft(this.options,{component:this.options.component||"sendmail"}),typeof e=="string"?this.path=e:typeof e=="object"&&(e.path&&(this.path=e.path),Array.isArray(e.args)&&(this.args=e.args)),this.winbreak=["win","windows","dos",`\r
+`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o;if([].concat(n.from||[]).concat(n.to||[]).some(u=>/^"?-/.test(u))){let u=new Error("Can not send mail. Invalid envelope addresses.");return u.code=ju,r(u)}let a=this.args?["-i"].concat(this.args).concat(n.to):["-i"].concat(n.from?["-f",n.from]:[]).concat(n.to),c=u=>{if(!o&&(o=!0,typeof r=="function"))return u?r(u):r(null,{envelope:n,messageId:i,response:"Messages queued for delivery"})},l;try{l=this._spawn(this.path,a)}catch(u){return this.logger.error({err:u,tnx:"spawn",messageId:i},"Error occurred while spawning sendmail. %s",u.message),c(u)}if(l){let u,p=()=>!!u&&u.readableEnded,f=null,m=()=>{u&&!p()&&u.destroy()},E=R=>{m(),c(R)};l.on("error",R=>{this.logger.error({err:R,tnx:"spawn",messageId:i},"Error occurred when sending message %s. %s",i,R.message),E(R)});let v=(R,M)=>{let K=null;if(R?K=new Error(R===127?"Sendmail command not found, process exited with code "+R:"Sendmail exited with code "+R):M?K=new Error("Sendmail was terminated by "+M):p()?f&&(K=f):K=new Error("Sendmail exited before the message was written"),!K)return c();K.code=K.code||ju,this.logger.error({err:K,tnx:"stdin",messageId:i},"Error sending message %s to sendmail. %s",i,K.message),E(K)};l.once("exit",v),l.once("close",v),l.stdin.on("error",R=>{if(this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when piping message %s to sendmail. %s",i,R.message),f)return;f=R,m();let M=setTimeout(()=>E(R),n0);l.once("exit",()=>clearTimeout(M))});let N=[].concat(n.to||[]);N.length>3&&N.push("...and "+N.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s>",i,N.join(", "));let S=e.message.createReadStream();u=S,this.options.newline&&(u=r0(S,this.winbreak?new kr:new Sn,()=>!1)),u.once("error",R=>{this.logger.error({err:R,tnx:"stdin",messageId:i},"Error occurred when generating message %s. %s",i,R.message),l.kill("SIGINT"),c(R)}),u.pipe(l.stdin)}else{let u=new Error("sendmail was not found");return u.code=ju,c(u)}}},tT=km;var Cm=class{constructor(e){e=e||{},this.options=e,this.name="StreamTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"stream-transport"}),this.winbreak=["win","windows","dos",`\r
+`].includes((e.newline||"").toString().toLowerCase())}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Sending message %s to <%s> using %s line breaks",i,o.join(", "),this.winbreak?"<CR><LF>":"<LF>"),setImmediate(()=>{let s;try{if(s=e.message.createReadStream(),this.options.newline){let l=s;s=l.pipe(this.winbreak?new kr:new Sn),l.once("error",u=>s.emit("error",u))}}catch(l){return this.logger.error({err:l,tnx:"send",messageId:i},"Creating send stream failed for %s. %s",i,l.message),r(l)}if(!this.options.buffer)return s.once("error",l=>{this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message)}),r(null,{envelope:n,messageId:i,message:s});let a=[],c=0;s.on("readable",()=>{let l;for(;(l=s.read())!==null;)a.push(l),c+=l.length}),s.once("error",l=>(this.logger.error({err:l,tnx:"send",messageId:i},"Failed creating message for %s. %s",i,l.message),r(l))),s.on("end",()=>r(null,{envelope:n,messageId:i,message:Buffer.concat(a,c)}))})}},rT=Cm;var Pm=class{constructor(e){e=e||{},this.options=e,this.name="JSONTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"json-transport"})}send(e,r){e.message.keepBcc=!0;let n=e.message.getEnvelope(),i=e.message.messageId(),o=[].concat(n.to||[]);o.length>3&&o.push("...and "+o.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:i},"Composing JSON structure of %s to <%s>",i,o.join(", ")),setImmediate(()=>{e.normalize((s,a)=>s?(this.logger.error({err:s,tnx:"send",messageId:i},"Failed building JSON structure for %s. %s",i,s.message),r(s)):(delete a.envelope,delete a.normalizedHeaders,r(null,{envelope:n,messageId:i,message:this.options.skipEncoding?a:JSON.stringify(a)})))})}},nT=Pm;import i0 from"node:events";function Dm(t){return t&&typeof t=="object"&&!t.code&&(t.code=Qv),t}var Um=class extends i0{constructor(e){if(super(),!e||!e.SES||!e.SES.sesClient){let r=new Error("Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw r.code=Es,r}this.options=e,this.ses=this.options.SES,this.name="SESTransport",this.version=Xe,this.logger=ft(this.options,{component:this.options.component||"ses-transport"})}getRegion(e){if(this.ses.sesClient.config&&typeof this.ses.sesClient.config.region=="function"){this.ses.sesClient.config.region().then(r=>e(null,r),r=>e(r));return}return e(null,!1)}send(e,r){let n=e.message._headers.find(c=>/^from$/i.test(c.key));if(n){let c=new Qr("text/plain");n=c._convertAddresses(c._parseAddresses(n.value))}let i=e.message.getEnvelope(),o=e.message.messageId(),s=[].concat(i.to||[]);s.length>3&&s.push("...and "+s.splice(2).length+" more"),this.logger.info({tnx:"send",messageId:o},"Sending message %s to <%s>",o,s.join(", "));let a=c=>{e.data._dkim||(e.data._dkim={}),e.data._dkim.skipFields&&typeof e.data._dkim.skipFields=="string"?e.data._dkim.skipFields+=":date:message-id":e.data._dkim.skipFields="date:message-id";let l=e.message.createReadStream(),u=l.pipe(new kr),p=[],f=0;u.on("readable",()=>{let m;for(;(m=u.read())!==null;)p.push(m),f+=m.length}),l.once("error",m=>u.emit("error",m)),u.once("error",m=>c(m)),u.once("end",()=>c(null,Buffer.concat(p,f)))};setImmediate(()=>a((c,l)=>{if(c)return this.logger.error({err:c,tnx:"send",messageId:o},"Failed creating message for %s. %s",o,c.message),r(c);let u=et({Content:{Raw:{Data:l}},FromEmailAddress:n||i.from,Destination:{ToAddresses:i.to}},e.data.ses);this.getRegion((p,f)=>{(p||!f)&&(f="us-east-1");let m;try{let E=new this.ses.SendEmailCommand(u);m=this.ses.sesClient.send(E)}catch(E){Dm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E));return}m.then(E=>{f==="us-east-1"&&(f="email");let v={envelope:{from:i.from,to:i.to},messageId:"<"+E.MessageId+(/@/.test(E.MessageId)?"":"@"+f+".amazonses.com")+">",response:E.MessageId,raw:l};setImmediate(()=>r(null,v))}).catch(E=>{Dm(E),this.logger.error({err:E,tnx:"send"},"Send error for %s: %s",o,E.message),setImmediate(()=>r(E))})})}))}verify(e){let r;e||(r=new Promise((s,a)=>{e=Mt(s,a)}));let n=e,i=s=>s&&!["InvalidParameterValue","MessageRejected"].includes(s.code||s.Code||s.name)?n(Dm(s)):n(null,!0),o={Content:{Raw:{Data:Buffer.from(`From: <invalid@invalid>\r
 To: <invalid@invalid>\r
  Subject: Invalid\r
 \r
-Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion((s,o)=>{(s||!o)&&(o="us-east-1");let a=new this.ses.SendEmailCommand(i);this.ses.sesClient.send(a).then(l=>n(null,l)).catch(l=>n(l))}),r}};$v.exports=Qp});var Xv=he((AX,Ul)=>{"use strict";var yw=pv(),Yv=Kt(),gw=Dv(),vw=Kv(),Aw=Fv(),Tw=Bv(),_w=jv(),Iw=Wv(),xw=lr(),bw=ca(),zv=br(),Sw=(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),Nw=(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),Jv=(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,ww=["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),ha=!1;Ul.exports.createTransport=function(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n?r=Yv.parseConnectionUrl(n):r=t,r.pool)t=new gw(r);else if(r.sendmail)t=new Aw(r);else if(r.streamTransport)t=new Tw(r);else if(r.jsonTransport)t=new _w(r);else if(r.SES){if(r.SES.ses&&r.SES.aws){let i=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw i.code=xw.ECONFIG,i}t=new Iw(r)}else t=new vw(r)}return new yw(t,r,e)};Ul.exports.createTestAccount=function(t,e){let r;if(!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((l,d)=>{e=Yv.callbackPromise(l,d)})),ww&&ha)return setImmediate(()=>e(null,ha)),r;t=t||Sw;let n=[],i=0,s={},o={requestor:zv.name,version:zv.version};Jv&&(s.Authorization="Bearer "+Jv);let a={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(o))};/^https:/i.test(t)&&(a.tls={rejectUnauthorized:!0});let c=bw(t+"/user",a);return c.on("readable",()=>{let l;for(;(l=c.read())!==null;)n.push(l),i+=l.length}),c.once("error",l=>e(l)),c.once("end",()=>{let l=Buffer.concat(n,i),d;try{d=JSON.parse(l.toString())}catch(p){return e(p)}if(d.status!=="success"||d.error)return e(new Error(d.error||"Request failed"));delete d.status,ha=d,e(null,ha)}),r};Ul.exports.getTestMessageUrl=function(t){if(!t||!t.response)return!1;let e=new Map;return t.response.replace(/\[([^\]]+)\]$/,(r,n)=>{n.replace(/\b([A-Z0-9]+)=([^\s]+)/g,(i,s,o)=>{e.set(s,o)})}),e.has("STATUS")&&e.has("MSGID")?(ha.web||Nw)+"/message/"+e.get("MSGID"):!1}});var YA={};Ba(YA,{RequestError:()=>jn,createAdaptorServer:()=>JA,getRequestListener:()=>zA,serve:()=>P0});import{createServer as y0}from"http";import{Http2ServerRequest as g0}from"http2";import{Http2ServerRequest as bf}from"http2";import{Readable as FA}from"stream";import O0 from"crypto";async function N0(t){return Promise.race([t,Promise.resolve().then(()=>Promise.resolve(void 0))])}function jA(t,e,r){let n=a=>{t.cancel(a).catch(()=>{})};return e.on("close",n),e.on("error",n),(r??t.read()).then(o,i),t.closed.finally(()=>{e.off("close",n),e.off("error",n)});function i(a){a&&e.destroy(a)}function s(){t.read().then(o,i)}function o({done:a,value:c}){try{if(a)e.end();else if(!e.write(c))e.once("drain",s);else return t.read().then(o,i)}catch(l){i(l)}}}function w0(t,e){if(t.locked)throw new TypeError("ReadableStream is locked.");return e.destroyed?void 0:jA(t.getReader(),e)}var jn,v0,A0,Ha,T0,BA,_0,zs,I0,Jl,Yl,x0,Ws,b0,Xl,S0,VA,$s,Ni,wf,Fa,Sf,R0,Rf,k0,GA,Nf,$A,WA,C0,D0,zA,JA,P0,XA=Q(()=>{jn=class extends Error{constructor(t,e){super(t,e),this.name="RequestError"}},v0=t=>t instanceof jn?t:new jn(t.message,{cause:t}),A0=global.Request,Ha=class extends A0{constructor(t,e){typeof t=="object"&&zs in t&&(t=t[zs]()),typeof e?.body?.getReader<"u"&&(e.duplex??="half"),super(t,e)}},T0=t=>{let e=[],r=t.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:i,[n+1]:s}=r;i.charCodeAt(0)!==58&&e.push([i,s])}return new Headers(e)},BA=Symbol("wrapBodyStream"),_0=(t,e,r,n,i)=>{let s={method:t,headers:r,signal:i.signal};if(t==="TRACE"){s.method="GET";let o=new Ha(e,s);return Object.defineProperty(o,"method",{get(){return"TRACE"}}),o}if(!(t==="GET"||t==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(o){o.enqueue(n.rawBody),o.close()}});else if(n[BA]){let o;s.body=new ReadableStream({async pull(a){try{o||=FA.toWeb(n).getReader();let{done:c,value:l}=await o.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=FA.toWeb(n);return new Ha(e,s)},zs=Symbol("getRequestCache"),I0=Symbol("requestCache"),Jl=Symbol("incomingKey"),Yl=Symbol("urlKey"),x0=Symbol("headersKey"),Ws=Symbol("abortControllerKey"),b0=Symbol("getAbortController"),Xl={get method(){return this[Jl].method||"GET"},get url(){return this[Yl]},get headers(){return this[x0]||=T0(this[Jl])},[b0](){return this[zs](),this[Ws]},[zs](){return this[Ws]||=new AbortController,this[I0]||=_0(this.method,this[Yl],this.headers,this[Jl],this[Ws])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(t=>{Object.defineProperty(Xl,t,{get(){return this[zs]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Xl,t,{value:function(){return this[zs]()[t]()}})});Object.setPrototypeOf(Xl,Ha.prototype);S0=(t,e)=>{let r=Object.create(Xl);r[Jl]=t;let n=t.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(t instanceof bf)throw new jn("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[Yl]=a.href}catch(a){throw new jn("Invalid absolute URL",{cause:a})}return r}let i=(t instanceof bf?t.authority:t.headers.host)||e;if(!i)throw new jn("Missing host header");let s;if(t instanceof bf){if(s=t.scheme,!(s==="http"||s==="https"))throw new jn("Unsupported scheme")}else s=t.socket&&t.socket.encrypted?"https":"http";let o=new URL(`${s}://${i}${n}`);if(o.hostname.length!==i.length&&o.hostname!==i.replace(/:\d+$/,""))throw new jn("Invalid host header");return r[Yl]=o.href,r},VA=Symbol("responseCache"),$s=Symbol("getResponseCache"),Ni=Symbol("cache"),wf=global.Response,Fa=class qA{#e;#t;[$s](){return delete this[Ni],this[VA]||=new wf(this.#e,this.#t)}constructor(e,r){let n;if(this.#e=e,r instanceof qA){let i=r[VA];if(i){this.#t=i,this[$s]();return}else this.#t=r.#t,n=new Headers(r.#t.headers)}else this.#t=r;(typeof e=="string"||typeof e?.getReader<"u"||e instanceof Blob||e instanceof Uint8Array)&&(this[Ni]=[r?.status||200,e,n||r?.headers])}get headers(){let e=this[Ni];return e?(e[2]instanceof Headers||(e[2]=new Headers(e[2]||{"content-type":"text/plain; charset=UTF-8"})),e[2]):this[$s]().headers}get status(){return this[Ni]?.[0]??this[$s]().status}get ok(){let e=this.status;return e>=200&&e<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{get(){return this[$s]()[t]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(t=>{Object.defineProperty(Fa.prototype,t,{value:function(){return this[$s]()[t]()}})});Object.setPrototypeOf(Fa,wf);Object.setPrototypeOf(Fa.prototype,wf.prototype);Sf=t=>{let e={};t instanceof Headers||(t=new Headers(t??void 0));let r=[];for(let[n,i]of t)n==="set-cookie"?r.push(i):e[n]=i;return r.length>0&&(e["set-cookie"]=r),e["content-type"]??="text/plain; charset=UTF-8",e},R0="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=O0);Rf=Symbol("outgoingEnded"),k0=()=>new Response(null,{status:400}),GA=t=>new Response(null,{status:t instanceof Error&&(t.name==="TimeoutError"||t.constructor.name==="TimeoutError")?504:500}),Nf=(t,e)=>{let r=t instanceof Error?t:new Error("unknown error",{cause:t});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(t),e.headersSent||e.writeHead(500,{"Content-Type":"text/plain"}),e.end(`Error: ${r.message}`),e.destroy(r))},$A=t=>{"flushHeaders"in t&&t.writable&&t.flushHeaders()},WA=async(t,e)=>{let[r,n,i]=t[Ni],s=!1;if(!i)i={"content-type":"text/plain; charset=UTF-8"};else if(i instanceof Headers)s=i.has("content-length"),i=Sf(i);else if(Array.isArray(i)){let o=new Headers(i);s=o.has("content-length"),i=Sf(o)}else for(let o in i)if(o.length===14&&o.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?i["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?i["Content-Length"]=n.byteLength:n instanceof Blob&&(i["Content-Length"]=n.size)),e.writeHead(r,i),typeof n=="string"||n instanceof Uint8Array?e.end(n):n instanceof Blob?e.end(new Uint8Array(await n.arrayBuffer())):($A(e),await w0(n,e)?.catch(o=>Nf(o,e))),e[Rf]?.()},C0=t=>typeof t.then=="function",D0=async(t,e,r={})=>{if(C0(t))if(r.errorHandler)try{t=await t}catch(i){let s=await r.errorHandler(i);if(!s)return;t=s}else t=await t.catch(GA);if(Ni in t)return WA(t,e);let n=Sf(t.headers);if(t.body){let i=t.body.getReader(),s=[],o=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=i.read();let d=await N0(a).catch(p=>{console.error(p),o=!0});if(!d){if(l===1){await new Promise(p=>setTimeout(p)),c=3;continue}break}if(a=void 0,d.value&&s.push(d.value),d.done){o=!0;break}}o&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,d)=>l+d.length,0))}e.writeHead(t.status,n),s.forEach(c=>{e.write(c)}),o?e.end():(s.length===0&&$A(e),await jA(i,e,a))}else n[R0]||(e.writeHead(t.status,n),e.end());e[Rf]?.()},zA=(t,e={})=>{let r=e.autoCleanupIncoming??!0;return e.overrideGlobalObjects!==!1&&global.Request!==Ha&&(Object.defineProperty(global,"Request",{value:Ha}),Object.defineProperty(global,"Response",{value:Fa})),async(n,i)=>{let s,o;try{o=S0(n,e.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[BA]=!0,n.on("end",()=>{a=!0}),n instanceof g0&&(i[Rf]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{n.destroy(),i.destroy()})})})),i.on("close",()=>{o[Ws]&&(n.errored?o[Ws].abort(n.errored.toString()):i.writableFinished||o[Ws].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{n.destroy()})})}),s=t(o,{incoming:n,outgoing:i}),Ni in s)return WA(s,i)}catch(a){if(s)return Nf(a,i);if(e.errorHandler){if(s=await e.errorHandler(o?a:v0(a)),!s)return}else o?s=GA(a):s=k0()}try{return await D0(s,i,e)}catch(a){return Nf(a,i)}}},JA=t=>{let e=t.fetch,r=zA(e,{hostname:t.hostname,overrideGlobalObjects:t.overrideGlobalObjects,autoCleanupIncoming:t.autoCleanupIncoming});return(t.createServer||y0)(t.serverOptions||{},r)},P0=(t,e)=>{let r=JA(t);return r.listen(t?.port??3e3,t.hostname,()=>{let n=r.address();e&&e(n)}),r}});var Ci=Object.freeze({READ:1,WRITE:2,DELETE:4,APPROVE:8,EXECUTE:16}),cT=Ci.READ|Ci.WRITE|Ci.DELETE|Ci.APPROVE|Ci.EXECUTE,tt={GLOBAL:"global",TENANT:"tenant",OWNER:"owner",SELF:"self"},tr={JWT:"jwt",API_KEY:"apiKey",GATEWAY_JWT:"gatewayJwt"};var lT=typeof process<"u"&&process?.env?.NODE_ENV!=="production";function Di(t){return lT?Object.freeze(t):t}function g(t,e){if(arguments.length===0)return Di({ok:!0,data:void 0});let r={ok:!0,data:t};return e!==void 0&&(r.meta=e),Di(r)}function u(t,e){let n={ok:!1,errors:Di(Array.isArray(t)?[...t]:[t])};return e!==void 0&&(n.meta=e),Di(n)}function mr(t,e,r){let{limit:n,hasNext:i,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c}=e,l={type:"cursor",limit:n,count:t.length,hasNext:i,hasPrev:o!=null,cursor:s,prevCursor:o,totalItems:a,estimatedTotal:c};return g(t,{...r,pagination:l})}function T(t,e){return r=>{let n={code:t,message:r?.message??e};return r?.field&&(n.field=r.field),n}}function X(t,e){return r=>{let n=r?.message??e;if(!r?.message&&r)for(let s in r){if(s==="message"||s==="field")continue;let o=r[s];(typeof o=="string"||typeof o=="number")&&(n=n.replace(new RegExp(`\\{${s}\\}`,"g"),String(o)))}let i={code:t,message:n};return r?.field&&(i.field=r.field),i}}function Pi(t){return t.ok?t.data===void 0?t.meta?{ok:!0,meta:t.meta}:{ok:!0}:t.meta?{ok:!0,data:t.data,meta:t.meta}:{ok:!0,data:t.data}:t.meta?{ok:!1,errors:t.errors,meta:t.meta}:{ok:!1,errors:t.errors}}var $t=T("AUTH_NOT_AUTHENTICATED","Not authenticated"),rr=T("AUTH_MISSING_CREDENTIALS","Missing credentials"),Wt=T("AUTH_INVALID_CREDENTIALS","Invalid credentials"),Dr=T("AUTH_TOKEN_EXPIRED","Token expired"),Qr=T("AUTH_TOKEN_MALFORMED","Token malformed"),zt=T("PERM_DENIED","Permission denied"),eu=X("BOUNDARY_VIOLATION","Access denied: {boundary} boundary violation"),$n=T("VALIDATION_ERROR","Validation failed"),Ui=X("INVALID_INPUT","Invalid input: {reason}"),Js=T("FORBIDDEN","Access forbidden"),tu=T("NOT_FOUND","Resource not found"),ru=X("RESOURCE_NOT_FOUND","{resource} with id {id} not found"),Ys=X("ALREADY_EXISTS","{resource} already exists"),Xs=T("CONFLICT","Resource conflict"),Wn=T("RATE_LIMIT_EXCEEDED","Rate limit exceeded. Please try again later."),Li=T("INTERNAL_ERROR","Internal server error"),oe={NotAuthenticated:$t,MissingCredentials:rr,InvalidCredentials:Wt,TokenExpired:Dr,TokenMalformed:Qr,PermissionDenied:zt,BoundaryViolation:eu,Forbidden:Js,ValidationError:$n,InvalidInput:Ui,NotFound:tu,ResourceNotFound:ru,AlreadyExists:Ys,Conflict:Xs,RateLimitExceeded:Wn,InternalError:Li};var Ct={AUTH_NOT_AUTHENTICATED:401,AUTH_MISSING_CREDENTIALS:401,AUTH_INVALID_CREDENTIALS:401,AUTH_TOKEN_EXPIRED:401,AUTH_TOKEN_MALFORMED:401,PERM_DENIED:403,BOUNDARY_VIOLATION:403,FORBIDDEN:403,VALIDATION_ERROR:400,INVALID_INPUT:400,NOT_FOUND:404,RESOURCE_NOT_FOUND:404,ALREADY_EXISTS:409,CONFLICT:409,RATE_LIMIT_EXCEEDED:429,INTERNAL_ERROR:500};var qa=class{getMask(e,r){return Uf(e.perms,r)}check(e,r,n){if(r.roles?.length&&!(r.requireAllRoles?r.roles.every(a=>e.roles?.includes(a)):r.roles.some(a=>e.roles?.includes(a))))return u(zt({message:"Role requirement not met"}));if(r.allowOwner&&n?.ownerId!==void 0&&n.ownerId===e.id)return g();let i=this.getMask(e,r.resource),s=this.checkCapability(i,r.action);return s.ok?this.checkBoundary(e,r.boundary,n):s}checkCapability(e,r){return(e&r)!==r?u(zt()):g()}checkBoundary(e,r,n){if(r===tt.GLOBAL)return g();if(!n)return u(zt({message:"Resource context required for boundary check"}));let i=n;switch(r){case tt.TENANT:if(!e.tenantId||i.tenantId!==e.tenantId)return u(zt({message:"Tenant boundary violation"}));break;case tt.OWNER:case tt.SELF:if(i.ownerId!==e.id)return u(zt({message:"Owner boundary violation"}));break;default:return u(zt({message:`Unknown boundary type: ${r}`}))}return g()}can(e,r,n){return(this.getMask(e,r)&n)===n}compile(e){return(r,n)=>this.check(r,e,n).ok}checkCapabilityOnly(e,r,n){let i=this.getMask(e,r);return this.checkCapability(i,n)}hasAnyPermission(e,r,n){let i=this.getMask(e,r);return n.some(s=>(i&s)!==0)}hasAllPermissions(e,r,n){let i=this.getMask(e,r);return n.every(s=>(i&s)!==0)}explain(e,r,n){let i=["[Permission Check]"];if(i.push(`Resource: ${r.resource}`),r.roles?.length){let E=r.requireAllRoles?"ALL":"ANY",v=e.roles??[],b=r.requireAllRoles?r.roles.every(k=>v.includes(k)):r.roles.some(k=>v.includes(k));if(i.push(`Roles (${E}): ${r.roles.join(", ")} \u2014 user has: [${v.join(", ")}]`),!b)return i.push("Result: \u2717 DENIED (role requirement not met)"),i.join(`
-`);i.push("Roles: \u2713 OK")}if(r.allowOwner){let E=n?.ownerId!==void 0&&n.ownerId===e.id;if(i.push(`Owner bypass: resource.ownerId=${n?.ownerId??"undefined"}, user.id=${e.id}`),E)return i.push("Result: \u2713 ALLOWED (owner bypass)"),i.join(`
-`);i.push("Owner bypass: not owner, continuing to perm check")}let s=this.describeBits(r.action);i.push(`Required: ${s} (${r.action})`);let o=e.perms,a=o?.[r.resource],c=o?.["*"],l=a??c??0,d=a!==void 0?r.resource:c!==void 0?"*":"none",p=this.describeBits(l);if(i.push(`User Perms: ${p||"none"} (from: ${d})`),i.push(`User Mask: ${l}`),!((l&r.action)===r.action))return i.push(`Result: \u2717 DENIED (capability mismatch: ${l} & ${r.action} = ${l&r.action})`),i.join(`
-`);if(r.boundary!=="global"){if(!n)return i.push(`Boundary: ${r.boundary} - MISSING RESOURCE CONTEXT`),i.push("Result: \u2717 DENIED (no resource context for boundary check)"),i.join(`
-`);if(!this.checkBoundary(e,r.boundary,n).ok)return i.push(`Boundary: ${r.boundary} - VIOLATED`),r.boundary==="tenant"?(i.push(`  User tenantId: ${e.tenantId||"undefined"}`),i.push(`  Resource tenantId: ${n.tenantId||"undefined"}`)):(r.boundary==="owner"||r.boundary==="self")&&(i.push(`  User id: ${e.id}`),i.push(`  Resource ownerId: ${n.ownerId||"undefined"}`)),i.push("Result: \u2717 DENIED (boundary violation)"),i.join(`
-`);i.push(`Boundary: ${r.boundary} - OK`)}return i.push("Result: \u2713 ALLOWED"),i.join(`
-`)}describeBits(e){if(e===0)return"none";let r=[];e&1&&r.push("READ"),e&2&&r.push("WRITE"),e&4&&r.push("DELETE"),e&8&&r.push("APPROVE"),e&16&&r.push("EXECUTE");let n=31;return(e&~n)!==0&&r.push(`BIT${(e&~n).toString(2)}`),r.join("|")}};function zn(){return new qa}function Uf(t,e){return t?.[e]??t?.["*"]??0}var uT="AUTH_INVALID_CREDENTIALS",ja=class{constructor(e,r={}){this.methods=new Map(e.map(n=>[n.name,n])),this.defaultMethods=r.defaultMethods??[tr.JWT,tr.API_KEY]}async resolve(e,r){let n=this.normalizeRequirement(e);if(n.length===0)return u($t({message:"No auth methods configured"}));for(let i of n){let s=this.methods.get(i);if(!s)continue;let o=await s.authenticate(r);if(o.ok)return g({user:o.data,method:i});if(!o.errors||o.errors.length===0)continue;let a=o.errors[0];if(a?.code===uT)return u(a)}return u($t())}normalizeRequirement(e){return e===!0?this.defaultMethods:e===!1?[]:typeof e=="string"?[e]:e}hasMethod(e){return this.methods.has(e)}getRegisteredMethods(){return Array.from(this.methods.keys())}registerMethod(e){this.methods.set(e.name,e)}};function Jn(t,e={}){return new ja(t,e)}var Qs={TOKEN_EXPIRED:"TOKEN_EXPIRED",TOKEN_MALFORMED:"TOKEN_MALFORMED"};function vn(t,e){return{name:tr.JWT,async authenticate(r){let n=r.headers.authorization??r.headers.Authorization;if(!n)return u(rr({message:"Authorization header required"}));if(!n.startsWith("Bearer "))return u(Qr({message:"Authorization header must start with Bearer"}));let i=n.slice(7);if(!i)return u(rr({message:"Bearer token is empty"}));let s=await e(i,t);if(!s.ok){let a=s.errors[0];return a?.code===Qs.TOKEN_EXPIRED?u(Dr()):a?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let o=s.data;return o.exp&&o.exp<Date.now()/1e3?u(Dr()):g({id:o.sub,perms:o.perms,tenantId:o.tid,tenantType:o.tty,roles:o.roles??[]})}}}function Ga(t){let e=t.authorization??t.Authorization;return e?.startsWith("Bearer ")&&e.slice(7)||null}function An(t){return{name:tr.API_KEY,async authenticate(e){let r=e.headers["x-api-key"]??e.headers["X-API-Key"];if(!r)return u(rr({message:"X-API-Key header required"}));let n=await t.lookup(r);return n?g({id:n.ownerId,perms:n.perms,tenantId:n.tenantId}):u(Wt({message:"Invalid API key"}))}}}ho();function vc(t){let e=new Uint8Array(t.length/2);for(let n=0;n<e.length;n++)e[n]=parseInt(t.slice(n*2,n*2+2),16);let r="";for(let n of e)r+=String.fromCharCode(n);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var zT="x-gateway-auth";function es(t){let{publicKeyHex:e}=t.gateway,r=t.gateway.header??zT;if(e!==void 0&&!/^[0-9a-f]{64}$/i.test(e))throw new Error("GatewayJwt: gateway.publicKeyHex must be 64 hex chars (Ed25519 public key = 32 bytes)");let n=null;function i(){if(!n){let s=vc(e);n=it({kty:"OKP",crv:"Ed25519",x:s},"EdDSA").catch(a=>{throw n=null,a})}return n}return{name:tr.GATEWAY_JWT,async authenticate(s){if(e!==void 0){let l=s.headers[r];if(!l)return u(rr({message:`${r} header required`}));if(!l.startsWith("Bearer "))return u(Wt({message:`${r} must use Bearer scheme`}));let d=l.slice(7);if(!d)return u(rr({message:"Gateway JWT is empty"}));let p;try{let m=await i(),{payload:E}=await bn(d,m,{issuer:t.gateway.expectedIssuer,audience:t.gateway.expectedAudience,algorithms:["EdDSA"],clockTolerance:t.gateway.clockSkewSeconds??5});p=E}catch(m){return m.code==="ERR_JWT_EXPIRED"?u(Dr({message:"Gateway JWT expired"})):u(Wt({message:"Invalid Gateway JWT"}))}if(t.gateway.validateJti){let m=typeof p.jti=="string"?p.jti:void 0;if(!m)return u(Wt({message:"Gateway JWT missing jti (replay protection required)"}));if(!await t.gateway.validateJti(m))return u(Wt({message:"Gateway JWT jti already used (replay)"}))}}let o=Ga(s.headers);if(o===null)return s.headers.authorization??s.headers.Authorization?u(Qr({message:"Authorization header must use Bearer scheme"})):u(rr({message:"Authorization header required"}));let a=await t.accessJwt.verifyFn(o,t.accessJwt.config);if(!a.ok){let l=a.errors[0];return l?.code===Qs.TOKEN_EXPIRED?u(Dr()):l?.code===Qs.TOKEN_MALFORMED?u(Qr()):u(Wt())}let c=a.data;return c.exp&&c.exp<Date.now()/1e3?u(Dr()):g({id:c.sub,perms:c.perms,tenantId:c.tid,tenantType:c.tty,roles:c.roles??[]})}}}var qU=globalThis.performance;ho();var d_="TOKEN_EXPIRED",dh="TOKEN_MALFORMED";function p_(t){return"secret"in t}function f_(t){return t.length>0&&t.length%2===0&&/^[0-9a-fA-F]+$/.test(t)}async function m_(t){if(t.length/2!==32)throw new Error(`Ed25519 public key must be 32 bytes, got ${t.length/2}`);let e=vc(t);return it({kty:"OKP",crv:"Ed25519",x:e},"EdDSA")}function ph(t){try{let e=JSON.parse(t);if(e&&typeof e=="object"&&"kty"in e)return e}catch{}return null}function h_(t){try{let e=atob(t);return ph(e)}catch{return null}}async function E_(t){if(p_(t))return new TextEncoder().encode(t.secret);let e=t.publicKey.trim(),r=t.algorithm??"RS256",n=ph(e);if(n)return it(n,r);let i=h_(e);return i?it(i,r):r==="EdDSA"&&f_(e)?m_(e):sc(e,r)}function y_(t){let e={};return t.issuer&&(e.issuer=t.issuer),t.audience&&(e.audience=t.audience),t.algorithm&&(e.algorithms=[t.algorithm]),e}function gr(t){let e=null;return async(r,n)=>{try{e||(e=E_(t));let i=await e,{payload:s}=await bn(r,i,y_(t));return g(s)}catch(i){return(!(i instanceof Error)||!i.message.includes("expired"))&&(e=null),i instanceof Error?i.message.includes("expired")||i.code==="ERR_JWT_EXPIRED"?u({code:d_,message:"Token has expired"}):u({code:dh,message:i.message}):u({code:dh,message:"JWT verification failed"})}}}function Fu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}import{randomUUID as g_}from"crypto";async function Vu(t,e){let r=t.req.header("x-correlation-id")??t.req.header("x-request-id")??g_();t.set("requestId",r),t.set("correlationId",r),t.header("X-Request-Id",r),t.header("X-Correlation-Id",r),await e()}function tn(t,e){return t.ok?t.data===void 0?{status:204,body:null}:{status:e?.success??200,body:Pi(t)}:{status:e?.error??400,body:Pi(t)}}var ts=class extends Error{constructor(e,r,n){let i=n?`[${n}] `:"";super(`${i}Unmapped error code: "${e??"<missing>"}"`),this.name="UnmappedErrorCodeError",this.code=e,this.result=r,this.adapterName=n}};function rs(t,e){let r=e?.name;return function(i){if(i.ok)return tn(i);let s=i.errors[0]?.code;if(!s||!(s in t))throw new ts(s,i,r);let o=t[s];return tn(i,{error:o})}}function ns(t,e){return r=>{try{return t(r)}catch(n){if(n instanceof ts)return tn(n.result,{error:e});throw n}}}var v_={...Ct},aM=ns(rs(v_),400);var NM=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");var Bu=(t,e,r)=>(n,i)=>{let s=-1;return o(0);async function o(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,d;if(t[a]?(d=t[a][0][0],n.req.routeIndex=a):d=a===t.length&&i||void 0,d)try{c=await d(n,()=>o(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Eh=Symbol();var yh=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,s=(t instanceof Ic?t.raw.headers:t.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?S_(t,{all:r,dot:n}):{}};async function S_(t,e){let r=await t.formData();return r?N_(r,e):{}}function N_(t,e){let r=Object.create(null);return t.forEach((n,i)=>{e.all||i.endsWith("[]")?w_(r,i,n):r[i]=n}),e.dot&&Object.entries(r).forEach(([n,i])=>{n.includes(".")&&(R_(r,n,i),delete r[n])}),r}var w_=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},R_=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,i=e.split(".");i.forEach((s,o)=>{o===i.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var ju=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},gh=t=>{let{groups:e,path:r}=O_(t),n=ju(r);return k_(n,e)},O_=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let i=`@${n}`;return e.push([i,r]),i}),{groups:e,path:t}},k_=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let i=t.length-1;i>=0;i--)if(t[i].includes(n)){t[i]=t[i].replace(n,e[r][1]);break}}return t},xc={},vh=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return xc[n]||(r[2]?xc[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:xc[n]=[t,r[1],!0]),xc[n]}return null},ss=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},C_=t=>ss(t,decodeURI),Gu=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let i=e.charCodeAt(n);if(i===37){let s=e.indexOf("?",n),o=e.indexOf("#",n),a=s===-1?o===-1?void 0:o:o===-1?s:Math.min(s,o),c=e.slice(r,a);return C_(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(i===63||i===35)break}return e.slice(r,n)};var Ah=t=>{let e=Gu(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Nn=(t,e,...r)=>(r.length&&(e=Nn(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),bc=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(i=>{if(i!==""&&!/\:/.test(i))n+="/"+i;else if(/\:/.test(i))if(/\?/.test(i)){r.length===0&&n===""?r.push("/"):r.push(n);let s=i.replace("?","");n+="/"+s,r.push(n)}else n+="/"+i}),r.filter((i,s,o)=>o.indexOf(i)===s)},qu=t=>/[%+]/.test(t)?(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),t.indexOf("%")!==-1?ss(t,yo):t):t,Th=(t,e,r)=>{let n;if(!r&&e&&!/[%+]/.test(e)){let o=t.indexOf("?",8);if(o===-1)return;for(t.startsWith(e,o+1)||(o=t.indexOf(`&${e}`,o+1));o!==-1;){let a=t.charCodeAt(o+e.length+1);if(a===61){let c=o+e.length+2,l=t.indexOf("&",c);return qu(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";o=t.indexOf(`&${e}`,o+1)}if(n=/[%+]/.test(t),!n)return}let i={};n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let o=t.indexOf("&",s+1),a=t.indexOf("=",s);a>o&&o!==-1&&(a=-1);let c=t.slice(s+1,a===-1?o===-1?void 0:o:a);if(n&&(c=qu(c)),s=o,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,o===-1?void 0:o),n&&(l=qu(l))),r?(i[c]&&Array.isArray(i[c])||(i[c]=[]),i[c].push(l)):i[c]??=l}return e?i[e]:i},_h=Th,Ih=(t,e)=>Th(t,e,!0),yo=decodeURIComponent;var xh=t=>ss(t,yo),Ic=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#t=r,this.#e={}}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#t[0][this.routeIndex][1][t],r=this.#n(e);return r&&/\%/.test(r)?xh(r):r}#s(){let t={},e=Object.keys(this.#t[0][this.routeIndex][1]);for(let r of e){let n=this.#n(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=/\%/.test(n)?xh(n):n)}return t}#n(t){return this.#t[1]?this.#t[1][t]:t}query(t){return _h(this.url,t)}queries(t){return Ih(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e={};return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return yh(this,t)}#i=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;let i=Object.keys(e)[0];return i?e[i].then(s=>(i==="json"&&(s=JSON.stringify(s)),new Response(s)[t]())):e[t]=r[t]()};json(){return this.#i("text").then(t=>JSON.parse(t))}text(){return this.#i("text")}arrayBuffer(){return this.#i("arrayBuffer")}bytes(){return this.#i("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#i("blob")}formData(){return this.#i("formData")}addValidatedData(t,e){this.#e[t]=e}valid(t){return this.#e[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[Eh](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,t]])=>t)}get routePath(){return this.#t[0].map(([[,t]])=>t)[this.routeIndex].path}};var bh={Stringify:1,BeforeStream:2,Stream:3},D_=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var $u=async(t,e,r,n,i)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);i?i[0]+=t:i=[t];let o=Promise.all(s.map(a=>a({phase:e,buffer:i,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>$u(c,e,!1,n,i))).then(()=>i[0]));return r?D_(await o,s):o};var P_="text/plain; charset=UTF-8",Wu=(t,e)=>({"Content-Type":t,...e}),go=(t,e)=>new Response(t,e),zu=class{#e;#t;env={};#r;finalized=!1;error;#s;#n;#i;#a;#o;#l;#c;#d;#p;constructor(t,e){this.#e=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#t??=new Ic(this.#e,this.#p,this.#d),this.#t}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#i||=go(null,{headers:this.#c??=new Headers})}set res(t){if(this.#i&&t){t=go(t.body,t);for(let[e,r]of this.#i.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#i.headers.getSetCookie();t.headers.delete("set-cookie");for(let i of n)t.headers.append("set-cookie",i)}else t.headers.set(e,r)}this.#i=t,this.finalized=!0}render=(...t)=>(this.#o??=e=>this.html(e),this.#o(...t));setLayout=t=>this.#a=t;getLayout=()=>this.#a;setRenderer=t=>{this.#o=t};header=(t,e,r)=>{this.finalized&&(this.#i=go(this.#i.body,this.#i));let n=this.#i?this.#i.headers:this.#c??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#u(t,e,r){let n=this.#i?new Headers(this.#i.headers):this.#c??new Headers;if(typeof e=="object"&&"headers"in e){let s=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[o,a]of s)o.toLowerCase()==="set-cookie"?n.append(o,a):n.set(o,a)}if(r)for(let[s,o]of Object.entries(r))if(typeof o=="string")n.set(s,o);else{n.delete(s);for(let a of o)n.append(s,a)}let i=typeof e=="number"?e:e?.status??this.#s;return go(t,{status:i,headers:n})}newResponse=(...t)=>this.#u(...t);body=(t,e,r)=>this.#u(t,e,r);text=(t,e,r)=>!this.#c&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#u(t,e,Wu(P_,r));json=(t,e,r)=>this.#u(JSON.stringify(t),e,Wu("application/json",r));html=(t,e,r)=>{let n=i=>this.#u(i,e,Wu("text/html; charset=UTF-8",r));return typeof t=="object"?$u(t,bh.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>go(),this.#l(this))};var Be="ALL",Sh="all",Nh=["get","post","put","delete","options","patch"],Sc="Can not add a route since the matcher is already built.",Nc=class extends Error{};var wh="__COMPOSED_HANDLER";var U_=t=>t.text("404 Not Found",404),Rh=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},Oh=class kh{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(e={}){[...Nh,Sh].forEach(s=>{this[s]=(o,...a)=>(typeof o=="string"?this.#e=o:this.#s(s,this.#e,o),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,o,...a)=>{for(let c of[o].flat()){this.#e=c;for(let l of[s].flat())a.map(d=>{this.#s(l.toUpperCase(),this.#e,d)})}return this},this.use=(s,...o)=>(typeof s=="string"?this.#e=s:(this.#e="*",o.unshift(s)),o.forEach(a=>{this.#s(Be,this.#e,a)}),this);let{strict:n,...i}=e;Object.assign(this,i),this.getPath=n??!0?e.getPath??Gu:Ah}#t(){let e=new kh({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=U_;errorHandler=Rh;route(e,r){let n=this.basePath(e);return r.routes.map(i=>{let s;r.errorHandler===Rh?s=i.handler:(s=async(o,a)=>(await Bu([],r.errorHandler)(o,()=>i.handler(o,a))).res,s[wh]=i.handler),n.#s(i.method,i.path,s,i.basePath)}),this}basePath(e){let r=this.#t();return r._basePath=Nn(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let i,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?i=c=>c:i=n.replaceRequest));let o=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};i||=(()=>{let c=Nn(this._basePath,e),l=c==="/"?0:c.length;return d=>{let p=new URL(d.url);return p.pathname=this.getPath(d).slice(l)||"/",new Request(p,d)}})();let a=async(c,l)=>{let d=await r(i(c.req.raw),...o(c));if(d)return d;await l()};return this.#s(Be,Nn(e,"*"),a),this}#s(e,r,n,i){e=e.toUpperCase(),r=Nn(this._basePath,r);let s={basePath:i!==void 0?Nn(this._basePath,i):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#i(e,r,n,i){if(i==="HEAD")return(async()=>new Response(null,await this.#i(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),o=this.router.match(i,s),a=new zu(e,{path:s,matchResult:o,env:n,executionCtx:r,notFoundHandler:this.#r});if(o[0].length===1){let l;try{l=o[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(d){return this.#n(d,a)}return l instanceof Promise?l.then(d=>d||(a.finalized?a.res:this.#r(a))).catch(d=>this.#n(d,a)):l??this.#r(a)}let c=Bu(o[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,a)}})()}fetch=(e,...r)=>this.#i(e,r[1],r[0],e.method);request=(e,r,n,i)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,i):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Nn("/",e)}`,r),n,i));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#i(e.request,e,void 0,e.request.method))})}};var wc=[];function Ju(t,e){let r=this.buildAllMatchers(),n=((i,s)=>{let o=r[i]||r[Be],a=o[2][s];if(a)return a;let c=s.match(o[0]);if(!c)return[[],wc];let l=c.indexOf("",1);return[o[1][l],c]});return this.match=n,n(t,e)}var Rc="[^/]+",vo=".*",Ao="(?:|/.*)",oi=Symbol(),L_=new Set(".\\+*[^]$()");function M_(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1||t===vo||t===Ao?1:e===vo||e===Ao?-1:t===Rc?1:e===Rc?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var Ch=class Yu{#e;#t;#r=Object.create(null);insert(e,r,n,i,s){if(e.length===0){if(this.#e!==void 0)throw oi;if(s)return;this.#e=r;return}let[o,...a]=e,c=o==="*"?a.length===0?["","",vo]:["","",Rc]:o==="/*"?["","",Ao]:o.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let d=c[1],p=c[2]||Rc;if(d&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw oi;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(m=>m!==vo&&m!==Ao))throw oi;if(s)return;l=this.#r[p]=new Yu,d!==""&&(l.#t=i.varIndex++)}!s&&d!==""&&n.push([d,l.#t])}else if(l=this.#r[o],!l){if(Object.keys(this.#r).some(d=>d.length>1&&d!==vo&&d!==Ao))throw oi;if(s)return;l=this.#r[o]=new Yu}l.insert(a,r,n,i,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(M_).map(n=>{let i=this.#r[n];return(typeof i.#t=="number"?`(${n})@${i.#t}`:L_.has(n)?`\\${n}`:n)+i.buildRegExpStr()});return typeof this.#e=="number"&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Dh=class{#e={varIndex:0};#t=new Ch;insert(t,e,r){let n=[],i=[];for(let o=0;;){let a=!1;if(t=t.replace(/\{[^}]+\}/g,c=>{let l=`@\\${o}`;return i[o]=[l,c],o++,a=!0,l}),!a)break}let s=t.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let o=i.length-1;o>=0;o--){let[a]=i[o];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,i[o][1]);break}}return this.#t.insert(s,e,n,this.#e,r),n}buildRegExp(){let t=this.#t.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(i,s,o)=>s!==void 0?(r[++e]=Number(s),"$()"):(o!==void 0&&(n[Number(o)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var K_=[/^$/,[],Object.create(null)],Ph=Object.create(null);function Uh(t){return Ph[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function H_(){Ph=Object.create(null)}function F_(t){let e=new Dh,r=[];if(t.length===0)return K_;let n=t.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,d],[p,m])=>l?1:p?-1:d.length-m.length),i=Object.create(null);for(let l=0,d=-1,p=n.length;l<p;l++){let[m,E,v]=n[l];m?i[E]=[v.map(([k])=>[k,Object.create(null)]),wc]:d++;let b;try{b=e.insert(E,d,m)}catch(k){throw k===oi?new Nc(E):k}m||(r[d]=v.map(([k,C])=>{let L=Object.create(null);for(C-=1;C>=0;C--){let[B,G]=b[C];L[B]=G}return[k,L]}))}let[s,o,a]=e.buildRegExp();for(let l=0,d=r.length;l<d;l++)for(let p=0,m=r[l].length;p<m;p++){let E=r[l][p]?.[1];if(!E)continue;let v=Object.keys(E);for(let b=0,k=v.length;b<k;b++)E[v[b]]=a[E[v[b]]]}let c=[];for(let l in o)c[l]=r[o[l]];return[s,c,i]}function os(t,e){if(t){for(let r of Object.keys(t).sort((n,i)=>i.length-n.length))if(Uh(r).test(e))return[...t[r]]}}var Oc=class{name="RegExpRouter";#e;#t;constructor(){this.#e={[Be]:Object.create(null)},this.#t={[Be]:Object.create(null)}}add(t,e,r){let n=this.#e,i=this.#t;if(!n||!i)throw new Error(Sc);n[t]||[n,i].forEach(a=>{a[t]=Object.create(null),Object.keys(a[Be]).forEach(c=>{a[t][c]=[...a[Be][c]]})}),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=Uh(e);t===Be?Object.keys(n).forEach(c=>{n[c][e]||=os(n[c],e)||os(n[Be],e)||[]}):n[t][e]||=os(n[t],e)||os(n[Be],e)||[],Object.keys(n).forEach(c=>{(t===Be||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(i).forEach(c=>{(t===Be||t===c)&&Object.keys(i[c]).forEach(l=>a.test(l)&&i[c][l].push([r,s]))});return}let o=bc(e)||[e];for(let a=0,c=o.length;a<c;a++){let l=o[a];Object.keys(i).forEach(d=>{(t===Be||t===d)&&(i[d][l]||=[...os(n[d],l)||os(n[Be],l)||[]],i[d][l].push([r,s-c+a+1]))})}}match=Ju;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#t).concat(Object.keys(this.#e)).forEach(e=>{t[e]||=this.#r(e)}),this.#e=this.#t=void 0,H_(),t}#r(t){let e=[],r=t===Be;return[this.#e,this.#t].forEach(n=>{let i=n[t]?Object.keys(n[t]).map(s=>[s,n[t][s]]):[];i.length!==0?(r||=!0,e.push(...i)):t!==Be&&e.push(...Object.keys(n[Be]).map(s=>[s,n[Be][s]]))}),r?F_(e):null}};var Xu=class{name="SmartRouter";#e=[];#t=[];constructor(t){this.#e=t.routers}add(t,e,r){if(!this.#t)throw new Error(Sc);this.#t.push([t,e,r])}match(t,e){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,i=r.length,s=0,o;for(;s<i;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);o=a.match(t,e)}catch(c){if(c instanceof Nc)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===i)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,o}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var To=Object.create(null),V_=t=>{for(let e in t)return!0;return!1},Lh=class Mh{#e;#t;#r;#s=0;#n=To;constructor(e,r,n){if(this.#t=n||Object.create(null),this.#e=[],e&&r){let i=Object.create(null);i[e]={handler:r,possibleKeys:[],score:0},this.#e=[i]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let i=this,s=gh(r),o=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],d=s[a+1],p=vh(l,d),m=Array.isArray(p)?p[0]:l;if(m in i.#t){i=i.#t[m],p&&o.push(p[1]);continue}i.#t[m]=new Mh,p&&(i.#r.push(p),o.push(p[1])),i=i.#t[m]}return i.#e.push({[e]:{handler:n,possibleKeys:o.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),i}#i(e,r,n,i,s){for(let o=0,a=r.#e.length;o<a;o++){let c=r.#e[o],l=c[n]||c[Be],d={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),i!==To||s&&s!==To))for(let p=0,m=l.possibleKeys.length;p<m;p++){let E=l.possibleKeys[p],v=d[l.score];l.params[E]=s?.[E]&&!v?s[E]:i[E]??s?.[E],d[l.score]=!0}}}search(e,r){let n=[];this.#n=To;let s=[this],o=ju(r),a=[],c=o.length,l=null;for(let d=0;d<c;d++){let p=o[d],m=d===c-1,E=[];for(let b=0,k=s.length;b<k;b++){let C=s[b],L=C.#t[p];L&&(L.#n=C.#n,m?(L.#t["*"]&&this.#i(n,L.#t["*"],e,C.#n),this.#i(n,L,e,C.#n)):E.push(L));for(let B=0,G=C.#r.length;B<G;B++){let j=C.#r[B],$=C.#n===To?{}:{...C.#n};if(j==="*"){let y=C.#t["*"];y&&(this.#i(n,y,e,C.#n),y.#n=$,E.push(y));continue}let[te,A,x]=j;if(!p&&!(x instanceof RegExp))continue;let S=C.#t[te];if(x instanceof RegExp){if(l===null){l=new Array(c);let w=r[0]==="/"?1:0;for(let R=0;R<c;R++)l[R]=w,w+=o[R].length+1}let y=r.substring(l[d]),_=x.exec(y);if(_){if($[A]=_[0],this.#i(n,S,e,C.#n,$),V_(S.#t)){S.#n=$;let w=_[0].match(/\//)?.length??0;(a[w]||=[]).push(S)}continue}}(x===!0||x.test(p))&&($[A]=p,m?(this.#i(n,S,e,$,C.#n),S.#t["*"]&&this.#i(n,S.#t["*"],e,$,C.#n)):(S.#n=$,E.push(S)))}}let v=a.shift();s=v?E.concat(v):E}return n.length>1&&n.sort((d,p)=>d.score-p.score),[n.map(({handler:d,params:p})=>[d,p])]}};var Qu=class{name="TrieRouter";#e;constructor(){this.#e=new Lh}add(t,e,r){let n=bc(e);if(n){for(let i=0,s=n.length;i<s;i++)this.#e.insert(t,n[i],r);return}this.#e.insert(t,e,r)}match(t,e){return this.#e.search(t,e)}};var Vr=class extends Oh{constructor(t={}){super(t),this.router=t.router??new Xu({routers:[new Oc,new Qu]})}};function Zu(t){let e=[];if(t.auth.jwt){let s=t.auth.jwt,o=s.verify??gr(s);e.push(vn(s,o))}t.auth.apiKey&&e.push(An(t.auth.apiKey)),t.auth.customMethods&&e.push(...t.auth.customMethods);let r=Jn(e,{defaultMethods:t.auth.defaultMethods??["jwt","apiKey"]}),n=zn(),i=t.errorHttpMap?{...Ct,...t.errorHttpMap}:{...Ct};return{auth:r,permission:n,errorHttpMap:i}}function sr(t){return t.get("requestId")??t.get("correlationId")??"unknown"}var ed={...Ct},Kh=ns(rs(ed),400);function td(t){ed={...Ct,...t},Kh=ns(rs(ed),400)}function Hh(){return Kh}function qe(t,e,r){let{traceId:n,successStatus:i,adapter:s=Hh()}=r??{},o=new Date().toISOString(),a={...e.meta,traceId:n??e.meta?.traceId,params:{...e.meta?.params,timestamp:o}},l=s(e).status;if(e.ok&&i!==void 0&&(l=i),e.ok&&e.data===void 0)return new Response(null,{status:204});if(l===204)return new Response(null,{status:204});let d=e.ok?g(e.data,a):{...e,meta:a},p=Pi(d);return t.json(p,l)}async function B_(t){let e={};t.req.raw.headers.forEach((o,a)=>{e[a]=o});let r={},n=t.req.query();for(let[o,a]of Object.entries(n))r[o]=a;let i=await t.req.raw.clone().text();return{headers:e,query:r,body:i||void 0,method:t.req.method,path:t.req.path}}function _o(t){let{engine:e,optional:r=!1}=t,n=t.methods??!0;return async(i,s)=>{let o=sr(i);try{let a=await B_(i),c=await e.resolve(n,a);if(!c.ok){if(r){await s();return}return qe(i,u($t()),{traceId:o})}let l={user:c.data.user,method:c.data.method};i.set("authResult",l),await s()}catch{if(r){await s();return}return qe(i,u($t()),{traceId:o})}}}function rd(t){return async(e,r)=>{let n=sr(e),i=e.get("authResult");if(!i)return qe(e,u($t()),{traceId:n});let{user:s}=i,o;if(t.loadResource){let l=e.req.param(),d=await t.loadResource(l,s);if(d===null)return qe(e,u(zt({message:"Resource not found for boundary check"})),{traceId:n});o=d}let a={resource:t.resource,action:t.action,boundary:t.boundary,roles:t.roles,requireAllRoles:t.requireAllRoles,allowOwner:t.allowOwner},c=t.engine.check(s,a,o);if(!c.ok)return qe(e,c,{traceId:n});await r()}}function Io(t,e){let r=t["~standard"].validate(e);if(r instanceof Promise)throw new Error("[api-policy] Async schema validation is not supported. Use a sync schema.");return r.issues?u(r.issues.map(n=>{let i=n.path?.map(s=>typeof s=="object"?s.key:s).join(".")??"";return $n({message:i?`${i}: ${n.message}`:n.message})})):g(r.value)}function xo(t){return async(e,r)=>{let n=sr(e);try{let i={};if(t.body){let s;try{s=await e.req.json()}catch{return qe(e,u(Ui({reason:"Request body is not valid JSON"})),{traceId:n})}let o=Io(t.body,s);if(!o.ok)return qe(e,o,{traceId:n});i.body=o.data}if(t.params){let s=Io(t.params,e.req.param());if(!s.ok)return qe(e,s,{traceId:n});i.params=s.data}if(t.query){let s=Io(t.query,e.req.query());if(!s.ok)return qe(e,s,{traceId:n});i.query=s.data}if(t.headers){let s={};e.req.raw.headers.forEach((a,c)=>{s[c]=a});let o=Io(t.headers,s);if(!o.ok)return qe(e,o,{traceId:n});i.headers=o.data}e.set("validatedData",i),await r()}catch(i){let s={traceId:n,params:{detail:i instanceof Error?i.message:String(i)}};return qe(e,u($n(),s),{traceId:n})}}}function bo(t){return t.get("validatedData")?.body}function So(t){return t.get("validatedData")?.params}function No(t){return t.get("validatedData")?.query}var uH=T("TENANT_NOT_FOUND","Tenant could not be resolved from this request");function q_(t,e){let r=[...t,e];return async(n,i)=>{let s,o=async a=>{if(s||a>=r.length){!s&&i&&await i();return}let c=r[a],l=await c(n,async()=>{await o(a+1)});l instanceof Response&&(s=l)};return await o(0),s}}function Y(t,e){let r=[];if(e.auth!==!1){let s=Array.isArray(e.auth)?e.auth:void 0;r.push(_o({engine:t.auth,methods:s}))}e.permission&&r.push(rd({engine:t.permission,resource:e.permission.resource,action:e.permission.action,boundary:e.permission.boundary,roles:e.permission.roles,requireAllRoles:e.permission.requireAllRoles,allowOwner:e.permission.allowOwner,loadResource:e.loadResource?async(s,o)=>{let a={body:void 0,query:void 0,params:s,user:o};return await e.loadResource(a)??null}:void 0})),(e.input?.body||e.input?.query||e.input?.params)&&r.push(xo({body:e.input.body,query:e.input.query,params:e.input.params}));let i=q_(r,async s=>{let o=sr(s);try{let a=s.get("authResult"),c={body:bo(s),query:No(s),params:So(s),user:a?.user,tenantContext:s.get("tenantContext"),traceId:o},l={user:c.user??{id:"anonymous"},body:c.body,query:c.query,params:c.params},d=await e.handler(l),p=e.successStatus??200;return qe(s,d,{traceId:o,successStatus:p})}catch(a){let c=a instanceof Error?a.message:String(a);return console.error(JSON.stringify({level:"error",context:"defineRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:o,route:`${e.method} ${e.path}`,error:{message:c}})),qe(s,u(Li()),{traceId:o})}});return i.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},i}function nd(t,e){let r=new Vr;for(let n of e){let{method:i,path:s}=n.routeMeta,o=s==="/"?t:`${t}${s}`;switch(i){case"GET":r.get(o,n);break;case"POST":r.post(o,n);break;case"PUT":r.put(o,n);break;case"PATCH":r.patch(o,n);break;case"DELETE":r.delete(o,n);break}}return r}var Fh={INVALID_IDENTITY_FORMAT:400,INVALID_CREDENTIAL:400,PREVIOUS_CHALLENGE_REQUIRED:400,INVALID_CREDENTIALS:401,IDENTITY_NOT_FOUND:401,INVALID_CURRENT_PASSWORD:401,NOT_AUTHENTICATED:401,SESSION_NOT_FOUND:401,TOKEN_EXPIRED:401,INVALID_TOKEN:401,INVALID_REFRESH_TOKEN:401,CHALLENGE_NOT_FOUND:401,CHALLENGE_EXPIRED:401,CHALLENGE_ALREADY_USED:401,INVALID_CODE:401,LOGIN_DISABLED:403,IDENTITY_NOT_VERIFIED:403,ACCOUNT_SUSPENDED:403,NO_ACCESS_TO_TENANT:403,SUSPENDED_IN_TENANT:403,USER_NOT_FOUND:404,TENANT_NOT_FOUND:404,PROVIDER_NOT_FOUND:404,IDENTITY_ALREADY_EXISTS:409,EMAIL_ALREADY_EXISTS:409,ALREADY_MEMBER:409,MFA_CHALLENGE_REQUIRED:422,TENANT_SELECTION_REQUIRED:422,VERIFICATION_REQUIRED:422,MFA_NOT_AVAILABLE:422,METHOD_NOT_VERIFIED:422,PROVIDER_NOT_LINKED:422,GUARD_LOCKED:423,TOO_MANY_ATTEMPTS:429,RESEND_COOLDOWN_ACTIVE:429,VERIFICATION_COOLDOWN_ACTIVE:429,MFA_PLUGIN_NOT_FOUND:500,EMAIL_SYSTEM_NOT_AVAILABLE:500,VERIFICATION_EMAIL_SEND_FAILED:502};var kc,j_={lang:void 0,message:void 0,abortEarly:void 0,abortPipeEarly:void 0};function G_(t){return!t&&!kc?j_:{lang:t?.lang??kc?.lang,message:t?.message,abortEarly:t?.abortEarly??kc?.abortEarly,abortPipeEarly:t?.abortPipeEarly??kc?.abortPipeEarly}}var $_;function W_(t){return $_?.get(t)}var z_;function J_(t){return z_?.get(t)}var Y_;function X_(t,e){return Y_?.get(t)?.get(e)}function ai(t){let e=typeof t;return e==="string"?`"${t}"`:e==="number"||e==="bigint"||e==="boolean"?`${t}`:e==="object"||e==="function"?(t&&Object.getPrototypeOf(t)?.constructor?.name)??"null":e}function mt(t,e,r,n,i){let s=i&&"input"in i?i.input:r.value,o=i?.expected??t.expects??null,a=i?.received??ai(s),c={kind:t.kind,type:t.type,input:s,expected:o,received:a,message:`Invalid ${e}: ${o?`Expected ${o} but r`:"R"}eceived ${a}`,requirement:t.requirement,path:i?.path,issues:i?.issues,lang:n.lang,abortEarly:n.abortEarly,abortPipeEarly:n.abortPipeEarly},l=t.kind==="schema",d=i?.message??t.message??X_(t.reference,c.lang)??(l?J_(c.lang):null)??n.message??W_(c.lang);d!==void 0&&(c.message=typeof d=="function"?d(c):d),l&&(r.typed=!1),r.issues?r.issues.push(c):r.issues=[c]}var Vh=new WeakMap;function Yt(t){let e=Vh.get(t);return e||(e={version:1,vendor:"valibot",validate(r){return t["~run"]({value:r},G_())}},Vh.set(t,e)),e}function Q_(t,e){return Object.prototype.hasOwnProperty.call(t,e)&&e!=="__proto__"&&e!=="prototype"&&e!=="constructor"}function qh(t,e){let r=[...new Set(t)];return r.length>1?`(${r.join(` ${e} `)})`:r[0]??"never"}var Z_=/^[\w+-]+(?:\.[\w+-]+)*@[\da-z]+(?:[.-][\da-z]+)*\.[a-z]{2,}$/iu;function Cc(t,e){return{kind:"validation",type:"check",reference:Cc,async:!1,expects:null,requirement:t,message:e,"~run"(r,n){return r.typed&&!this.requirement(r.value)&&mt(this,"input",r,n),r}}}function rn(t){return{kind:"validation",type:"email",reference:rn,expects:null,async:!1,requirement:Z_,message:t,"~run"(e,r){return e.typed&&!this.requirement.test(e.value)&&mt(this,"email",e,r),e}}}function wn(t){return{kind:"validation",type:"integer",reference:wn,async:!1,expects:null,requirement:Number.isInteger,message:t,"~run"(e,r){return e.typed&&!this.requirement(e.value)&&mt(this,"integer",e,r),e}}}function ht(t,e){return{kind:"validation",type:"max_length",reference:ht,async:!1,expects:`<=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length>this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function as(t,e){return{kind:"validation",type:"max_value",reference:as,async:!1,expects:`<=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value<=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function id(t,e){return{kind:"validation",type:"min_length",reference:id,async:!1,expects:`>=${t}`,requirement:t,message:e,"~run"(r,n){return r.typed&&r.value.length<this.requirement&&mt(this,"length",r,n,{received:`${r.value.length}`}),r}}}function cs(t,e){return{kind:"validation",type:"min_value",reference:cs,async:!1,expects:`>=${t instanceof Date?t.toJSON():ai(t)}`,requirement:t,message:e,"~run"(r,n){return r.typed&&!(r.value>=this.requirement)&&mt(this,"value",r,n,{received:r.value instanceof Date?r.value.toJSON():ai(r.value)}),r}}}function ls(t){return{kind:"transformation",type:"transform",reference:ls,async:!1,operation:t,"~run"(e){return e.value=this.operation(e.value),e}}}function eI(t,e,r){return typeof t.fallback=="function"?t.fallback(e,r):t.fallback}function sd(t,e,r){return typeof t.default=="function"?t.default(e,r):t.default}function Z(t,e){return{kind:"schema",type:"array",reference:Z,expects:"Array",async:!1,item:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(Array.isArray(i)){r.typed=!0,r.value=[];for(let s=0;s<i.length;s++){let o=i[s],a=this.item["~run"]({value:o},n);if(a.issues){let c={type:"array",origin:"value",input:i,key:s,value:o};for(let l of a.issues)l.path?l.path.unshift(c):l.path=[c],r.issues?.push(l);if(r.issues||(r.issues=a.issues),n.abortEarly){r.typed=!1;break}}a.typed||(r.typed=!1),r.value.push(a.value)}}else mt(this,"type",r,n);return r}}}function _t(t){return{kind:"schema",type:"boolean",reference:_t,expects:"boolean",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="boolean"?e.typed=!0:mt(this,"type",e,r),e}}}function us(t,e){return{kind:"schema",type:"literal",reference:us,expects:ai(t),async:!1,literal:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===this.literal?r.typed=!0:mt(this,"type",r,n),r}}}function ci(t,e){return{kind:"schema",type:"nullable",reference:ci,expects:`(${t.expects} | null)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===null&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===null)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function $e(t){return{kind:"schema",type:"number",reference:$e,expects:"number",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="number"&&!isNaN(e.value)?e.typed=!0:mt(this,"type",e,r),e}}}function H(t,e){return{kind:"schema",type:"object",reference:H,expects:"Object",async:!1,entries:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i=r.value;if(i&&typeof i=="object"){r.typed=!0,r.value={};for(let s in this.entries){let o=this.entries[s];if(s in i||(o.type==="exact_optional"||o.type==="optional"||o.type==="nullish")&&o.default!==void 0){let a=s in i?i[s]:sd(o),c=o["~run"]({value:a},n);if(c.issues){let l={type:"object",origin:"value",input:i,key:s,value:a};for(let d of c.issues)d.path?d.path.unshift(l):d.path=[l],r.issues?.push(d);if(r.issues||(r.issues=c.issues),n.abortEarly){r.typed=!1;break}}c.typed||(r.typed=!1),r.value[s]=c.value}else if(o.fallback!==void 0)r.value[s]=eI(o);else if(o.type!=="exact_optional"&&o.type!=="optional"&&o.type!=="nullish"&&(mt(this,"key",r,n,{input:void 0,expected:`"${s}"`,path:[{type:"object",origin:"key",input:i,key:s,value:i[s]}]}),n.abortEarly))break}}else mt(this,"type",r,n);return r}}}function I(t,e){return{kind:"schema",type:"optional",reference:I,expects:`(${t.expects} | undefined)`,async:!1,wrapped:t,default:e,get"~standard"(){return Yt(this)},"~run"(r,n){return r.value===void 0&&(this.default!==void 0&&(r.value=sd(this,r,n)),r.value===void 0)?(r.typed=!0,r):this.wrapped["~run"](r,n)}}}function Xt(t,e){return{kind:"schema",type:"picklist",reference:Xt,expects:qh(t.map(ai),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){return this.options.includes(r.value)?r.typed=!0:mt(this,"type",r,n),r}}}function me(t,e,r){return{kind:"schema",type:"record",reference:me,expects:"Object",async:!1,key:t,value:e,message:r,get"~standard"(){return Yt(this)},"~run"(n,i){let s=n.value;if(s&&typeof s=="object"){n.typed=!0,n.value={};for(let o in s)if(Q_(s,o)){let a=s[o],c=this.key["~run"]({value:o},i);if(c.issues){let d={type:"object",origin:"key",input:s,key:o,value:a};for(let p of c.issues)p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=c.issues),i.abortEarly){n.typed=!1;break}}let l=this.value["~run"]({value:a},i);if(l.issues){let d={type:"object",origin:"value",input:s,key:o,value:a};for(let p of l.issues)p.path?p.path.unshift(d):p.path=[d],n.issues?.push(p);if(n.issues||(n.issues=l.issues),i.abortEarly){n.typed=!1;break}}(!c.typed||!l.typed)&&(n.typed=!1),c.typed&&(n.value[c.value]=l.value)}}else mt(this,"type",n,i);return n}}}function h(t){return{kind:"schema",type:"string",reference:h,expects:"string",async:!1,message:t,get"~standard"(){return Yt(this)},"~run"(e,r){return typeof e.value=="string"?e.typed=!0:mt(this,"type",e,r),e}}}function Bh(t){let e;if(t)for(let r of t)if(e)for(let n of r.issues)e.push(n);else e=r.issues;return e}function wo(t,e){return{kind:"schema",type:"union",reference:wo,expects:qh(t.map(r=>r.expects),"|"),async:!1,options:t,message:e,get"~standard"(){return Yt(this)},"~run"(r,n){let i,s,o;for(let a of this.options){let c=a["~run"]({value:r.value},n);if(c.typed)if(c.issues)s?s.push(c):s=[c];else{i=c;break}else o?o.push(c):o=[c]}if(i)return i;if(s){if(s.length===1)return s[0];mt(this,"type",r,n,{issues:Bh(s)}),r.typed=!0}else{if(o?.length===1)return o[0];mt(this,"type",r,n,{issues:Bh(o)})}return r}}}function ge(){return{kind:"schema",type:"unknown",reference:ge,expects:"unknown",async:!1,get"~standard"(){return Yt(this)},"~run"(t){return t.typed=!0,t}}}function we(...t){return{...t[0],pipe:t,get"~standard"(){return Yt(this)},"~run"(e,r){for(let n of t)if(n.kind!=="metadata"){if(e.issues&&(n.kind==="schema"||n.kind==="transformation")){e.typed=!1;break}(!e.issues||!r.abortEarly&&!r.abortPipeEarly)&&(e=n["~run"](e,r))}return e}}}var Vt=(t=100)=>we(h(),ht(t)),Dc=we(h(),ht(320)),Rn=we(h(),ht(4096)),Ro=(t=256)=>we(h(),ht(t)),od=(t=8192)=>we(h(),ht(t)),Oo=we(ge(),ls(Number),$e(),wn(),cs(1),as(100));var Ut=H({message:I(h())}),jh=H({accessToken:h(),refreshToken:I(h()),expiresAt:$e()}),Gh=H({requiresChallenge:us(!0),challenge:H({type:I(h()),phase:I(h()),expiresAt:I(wo([h(),$e()])),data:me(h(),ge())})}),$h=H({requiresMfa:us(!0),mfa:H({phase:I(h()),challengeId:h(),methods:Z(h()),method:I(h()),expiresAt:wo([h(),$e()]),userId:h()})}),Wh=H({requiresVerification:us(!0),verification:H({channel:us("email"),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h(),userId:h()})}),li=wo([Gh,$h,Wh,jh]),ko=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),username:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),metadata:I(me(h(),ge())),createdAt:h(),updatedAt:h()}),Co=H({challengeId:h(),expiresAt:h()});var ad=H({maskedRecipient:I(h()),expiresAt:h()}),cd=H({userId:h(),verification:I(H({channel:h(),challengeId:h(),expiresAt:h(),identityType:h(),identityValue:h()}))});var ld=H({userId:h(),identityType:h(),identityValue:h(),verifiedAt:h()});var zh=H({id:h(),tokenId:h(),tenantId:I(h()),deviceLabel:I(h()),country:I(h()),city:I(h()),createdAt:h(),expiresAt:h(),lastUsedAt:h(),revokedAt:I(ci(h())),metadata:I(me(h(),ge())),isCurrent:I(_t())}),ud=Z(zh);var dd=H({method:h(),data:me(h(),ge())}),pd=H({method:h(),verified:_t(),data:me(h(),ge())}),Jh=H({method:h(),verifiedAt:ci(h()),createdAt:h(),id:I(h()),label:I(h()),lastUsedAt:I(h())}),fd=H({authenticators:Z(Jh),total:$e()});var md=H({state:h()}),Yh=H({provider:h(),providerId:I(h()),email:I(h()),linkedAt:I(h())}),hd=Z(Yh);var Xh=H({id:h(),tenantId:h(),inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),status:h(),roles:I(Z(h())),authPerms:Z(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h()),invitedBy:I(ge()),createdAt:h(),updatedAt:h(),expiresAt:h()}),Ed=Z(Xh),yd=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),Qh=H({userId:h(),tenantId:h(),status:h(),roles:I(Z(h())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),updatedAt:h()}),gd=H({members:Z(Qh)}),Pc=H({userId:h(),tenantId:h(),status:h(),roles:I(Z(h())),authPerms:Z(h()),isOwner:_t(),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),jobTitle:I(h()),contactEmail:I(h()),contactPhone:I(h()),bio:I(h()),locale:I(h()),metadata:I(me(h(),ge())),createdAt:I(h()),memberUpdatedAt:I(h()),profileUpdatedAt:I(h())}),vd=H({tenantId:h(),roles:I(Z(h())),authPerms:Z(h())});var rI={method:"POST",path:"/auth/authenticate",kind:"login",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:I(Rn),metadata:I(me(Vt(),ge())),country:I(Vt()),city:I(Vt())}),response:li},nI={method:"POST",path:"/auth/register",kind:"data",public:!0,body:H({identityType:Vt(),identityValue:Dc,credentialType:Vt(),credentialValue:Rn,displayName:I(Ro()),givenName:I(Ro()),familyName:I(Ro()),avatarUrl:I(od(2048)),locale:I(Vt()),metadata:I(me(Vt(),ge()))}),response:cd},iI={method:"POST",path:"/auth/complete-challenge",kind:"login",public:!0,body:H({challengeId:h(),code:h()}),response:li},sI={method:"POST",path:"/auth/complete-mfa-challenge",kind:"login",public:!0,body:H({challengeId:h(),method:h(),code:h()}),response:li},oI={method:"POST",path:"/auth/issue-mfa-challenge",kind:"data",public:!0,body:H({challengeId:h(),method:h(),userId:h()}),response:ad},aI={method:"POST",path:"/auth/refresh",kind:"exchange",public:!0},cI={method:"POST",path:"/auth/logout",kind:"logout",public:!0},lI={method:"GET",path:"/auth/me",kind:"data",response:ko},uI={method:"POST",path:"/auth/select-tenant",kind:"exchange",body:H({tenantId:h()})},Lt={authenticate:rI,register:nI,completeChallenge:iI,completeMfaChallenge:sI,issueMfaChallenge:oI,refresh:aI,logout:cI,me:lI,selectTenant:uI};var dI={method:"PATCH",path:"/password/change",kind:"data",body:H({currentPassword:Rn,newPassword:Rn}),response:Ut},pI={method:"POST",path:"/password/forgot",kind:"data",public:!0,body:H({email:we(h(),ht(320),rn())}),response:Co},fI={method:"POST",path:"/password/reset",kind:"data",public:!0,body:H({challengeId:Vt(),code:Vt(),newPassword:Rn}),response:Ut},sn={changePassword:dI,forgotPassword:pI,resetPassword:fI};var mI={method:"POST",path:"/verification/verify",kind:"data",public:!0,body:H({challengeId:h(),code:h()}),response:ld},hI={method:"POST",path:"/verification/resend",kind:"data",public:!0,body:H({channel:Xt(["sms","email"]),identityValue:h(),previousChallengeId:I(h())}),response:Co},ui={verifyCode:mI,resendVerification:hI};var EI={method:"GET",path:"/sessions",kind:"data",query:H({includeRevoked:I(Xt(["true","false"])),limit:I(Oo),cursor:I(h())}),response:ud},yI={method:"DELETE",path:"/sessions",kind:"data",body:H({sessionId:h()}),response:Ut},gI={method:"POST",path:"/sessions/revoke",kind:"data",body:H({refreshToken:h()}),response:Ut},on={listSessions:EI,deleteSession:yI,revokeToken:gI};var vI={method:"POST",path:"/mfa/authenticators/setup",kind:"data",body:H({method:h(),data:I(me(h(),ge()))}),response:dd},AI={method:"POST",path:"/mfa/authenticators/verify",kind:"data",body:H({method:h(),data:I(me(h(),ge())),authenticatorId:I(h())}),response:pd},TI={method:"GET",path:"/mfa/authenticators",kind:"data",query:H({method:I(h()),verifiedOnly:I(_t())}),response:fd},_I={method:"DELETE",path:"/mfa/authenticators",kind:"data",body:H({method:h(),authenticatorId:I(h()),password:I(h())}),response:H({message:I(h())})},II={method:"PATCH",path:"/mfa/settings",kind:"data",body:H({mfaRequired:I(_t()),mfaMethods:I(Z(h())),password:I(h())}),response:H({mfaRequired:I(_t()),mfaMethods:I(Z(h()))})},vr={setupAuthenticator:vI,verifyAuthenticator:AI,listAuthenticators:TI,removeAuthenticator:_I,updateMfaSettings:II};var xI={method:"POST",path:"/oauth/state",kind:"data",public:!0,response:md},bI={method:"POST",path:"/oauth/callback",kind:"login",public:!0,body:H({provider:we(h(),ht(100)),code:I(we(h(),ht(8192))),credential:I(we(h(),ht(8192))),state:I(we(h(),ht(1024))),tenantId:I(we(h(),ht(100)))}),response:li},SI={method:"POST",path:"/oauth/link",kind:"data",body:H({provider:h(),code:I(h())}),response:Ut},NI={method:"POST",path:"/oauth/unlink",kind:"data",body:H({provider:h()}),response:Ut},wI={method:"GET",path:"/oauth/providers",kind:"data",response:hd},an={oauthState:xI,oauthCallback:bI,linkProvider:SI,unlinkProvider:NI,getProviders:wI};var RI={method:"PATCH",path:"/users/profile",kind:"data",body:H({email:I(we(h(),rn())),phone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),metadata:I(me(h(),ge()))}),response:ko},Do={updateProfile:RI};var OI={method:"GET",path:"/tenants/:tenantId/profile",kind:"data",response:Pc},kI={method:"PATCH",path:"/tenants/:tenantId/profile",kind:"data",body:H({contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))}),response:Pc},CI={method:"POST",path:"/tenants/:tenantId/invites",kind:"data",body:H({inviteeEmail:I(we(h(),rn())),inviteeUserId:I(h()),inviteePhone:I(h()),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),response:yd},DI={method:"GET",path:"/tenants/:tenantId/invites",kind:"data",query:H({status:I(h()),limit:I(Oo),cursor:I(h())}),response:Ed},PI={method:"POST",path:"/tenants/:tenantId/invites/accept",kind:"data",body:H({inviteId:I(h()),inviteToken:I(h())}),response:vd},UI={method:"POST",path:"/tenants/:tenantId/invites/decline",kind:"data",body:H({inviteId:I(h()),inviteToken:I(h())}),response:Ut},LI={method:"POST",path:"/tenants/:tenantId/invites/revoke",kind:"data",body:H({inviteId:h()}),response:Ut},MI={method:"GET",path:"/tenants/:tenantId/members",kind:"data",query:H({limit:I(Oo),cursor:I(h())}),response:gd},KI={method:"PATCH",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h(),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h()))}),response:Ut},HI={method:"DELETE",path:"/tenants/:tenantId/members",kind:"data",body:H({userId:h()}),response:Ut},Ad={getTenantProfile:OI,updateTenantProfile:kI,createInvite:CI,listInvites:DI,acceptInvite:PI,declineInvite:UI,revokeInvite:LI,listMembers:MI,updateMember:KI,removeMember:HI};var iF={...Lt,...sn,...ui,...on,...vr,...an,...Do,...Ad};var V={VALIDATION_ERROR:T("VALIDATION_ERROR","D\u1EEF li\u1EC7u kh\xF4ng h\u1EE3p l\u1EC7"),DATABASE_ERROR:T("DATABASE_ERROR","L\u1ED7i c\u01A1 s\u1EDF d\u1EEF li\u1EC7u"),UNAUTHORIZED:T("UNAUTHORIZED","Kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp"),FORBIDDEN:T("FORBIDDEN","B\u1ECB c\u1EA5m truy c\u1EADp"),NOT_FOUND:T("NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y t\xE0i nguy\xEAn"),ALREADY_EXISTS:T("ALREADY_EXISTS","T\xE0i nguy\xEAn \u0111\xE3 t\u1ED3n t\u1EA1i"),RATE_LIMIT_EXCEEDED:T("RATE_LIMIT_EXCEEDED","Qu\xE1 nhi\u1EC1u y\xEAu c\u1EA7u, vui l\xF2ng th\u1EED l\u1EA1i sau"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB x\xF3a"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n \u0111\xE3 b\u1ECB kh\xF3a"),INTERNAL_ERROR:T("INTERNAL_ERROR","L\u1ED7i h\u1EC7 th\u1ED1ng, vui l\xF2ng th\u1EED l\u1EA1i sau"),SERVICE_UNAVAILABLE:T("SERVICE_UNAVAILABLE","D\u1ECBch v\u1EE5 t\u1EA1m th\u1EDDi kh\xF4ng kh\u1EA3 d\u1EE5ng"),TIMEOUT:T("TIMEOUT","Y\xEAu c\u1EA7u h\u1EBFt th\u1EDDi gian ch\u1EDD"),NETWORK_ERROR:T("NETWORK_ERROR","L\u1ED7i k\u1EBFt n\u1ED1i m\u1EA1ng"),CONFIGURATION_ERROR:T("CONFIGURATION_ERROR","L\u1ED7i c\u1EA5u h\xECnh h\u1EC7 th\u1ED1ng"),PLUGIN_ERROR:T("PLUGIN_ERROR","L\u1ED7i plugin"),PLUGIN_NOT_FOUND:T("PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin"),PLUGIN_INITIALIZATION_ERROR:T("PLUGIN_INITIALIZATION_ERROR","L\u1ED7i kh\u1EDFi t\u1EA1o plugin")};function ds(t,e){let r=e.tokenAudiences;if(r)return t?t===e.systemTenantId?r.system:r.tenant:r.customer}async function On(t,e){let{userId:r,tenantId:n,tenantType:i,permissions:s,device:o}=t,a=e.plugins.database.sessions.generateSessionId(),c=e.plugins.database.sessions.generateTokenId(),l=o?.deviceLabel,d={id:a,userId:r,tokenId:c,expiresAt:new Date(Date.now()+e.security.refreshTokenLifetimeMinutes*60*1e3),...n&&{tenantId:n},...i&&{tenantType:i},...l&&{deviceLabel:l},...o?.country&&{country:o.country},...o?.city&&{city:o.city},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}},p=await e.plugins.database.sessions.create(d);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u(V.DATABASE_ERROR());let m=p.data,E=ds(n,e.security),v=await e.plugins.token.signAccessToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i},...s?.roles&&{roles:s.roles},...s?.perms!==void 0&&{perms:s.perms}}),b=await e.plugins.token.signRefreshToken({sub:r,sid:m.id,jti:m.tokenId,...E&&{aud:E},...n&&{tid:n},...i&&{tty:i}});return g({accessToken:v.token,refreshToken:b.token,expiresAt:v.expiresAt,...n&&{tenantId:n}})}var Po={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};function Zh(t){let e={id:t.id,createdAt:t.createdAt,updatedAt:t.updatedAt};return t.contactEmail!==void 0&&(e.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(e.contactPhone=t.contactPhone),t.username!==void 0&&(e.username=t.username),t.displayName!==void 0&&(e.displayName=t.displayName),t.givenName!==void 0&&(e.givenName=t.givenName),t.familyName!==void 0&&(e.familyName=t.familyName),t.avatarUrl!==void 0&&(e.avatarUrl=t.avatarUrl),t.locale!==void 0&&(e.locale=t.locale),t.metadata!==void 0&&(e.metadata=t.metadata),e}async function Uo(t,e){let r=await e.plugins.database.users.getById(t.userId);return!r.ok||!r.data?u(Po.USER_NOT_FOUND()):g(Zh(r.data))}var Td={SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),DATABASE_ERROR:V.DATABASE_ERROR};async function Uc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return g();let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(Td.DATABASE_ERROR());let i=n.data;return i?i.revokedAt?g():(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(Td.DATABASE_ERROR()):g():g()}var kn={INVALID_TOKEN:T("INVALID_TOKEN","Token kh\xF4ng h\u1EE3p l\u1EC7"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Token scope does not match route scope"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","T\xE0i kho\u1EA3n t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a"),TOKEN_ROTATED:T("TOKEN_ROTATED","Token \u0111\xE3 \u0111\u01B0\u1EE3c xoay v\xF2ng, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_SUSPENDED:V.ACCOUNT_SUSPENDED,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var cn;(function(t){t[t.Access=1]="Access",t[t.Refresh=2]="Refresh",t[t.Service=3]="Service"})(cn||(cn={}));async function Lc(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);if(!r)return u(kn.INVALID_TOKEN());if(r.typ!==cn.Refresh)return u(kn.INVALID_TOKEN());let n=await e.plugins.database.sessions.get(r.sid);if(n.ok===!1)return u(V.DATABASE_ERROR());let i=n.data;if(!i||i.revokedAt)return u(kn.INVALID_TOKEN());let s=Date.now(),o=r.jti===i.tokenId,a=i.rotatedAt!==void 0&&i.previousTokenId!==void 0&&r.jti===i.previousTokenId&&s-i.rotatedAt<e.security.refreshTokenGraceWindowMs;if(!o&&!a)return(await e.plugins.database.sessions.revoke(i.id)).ok===!1?u(V.DATABASE_ERROR()):u(kn.INVALID_TOKEN());if(a&&!o){let v=ds(i.tenantId,e.security),b=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),k=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:i.tokenId,...v&&{aud:v},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}});return await e.plugins.database.sessions.update(i.id,{lastUsedAt:new Date}),g({accessToken:b.token,refreshToken:k.token,expiresAt:b.expiresAt})}let c=e.plugins.database.sessions.generateTokenId(),l=await e.plugins.database.sessions.rotateToken(i.id,i.tokenId,{tokenId:c,previousTokenId:i.tokenId,rotatedAt:s,expiresAt:new Date(s+e.security.refreshTokenLifetimeMinutes*60*1e3),lastUsedAt:new Date});if(l.ok===!1)return u(V.DATABASE_ERROR());let d=ds(i.tenantId,e.security);if(l.data===!1){let v=await e.plugins.database.sessions.get(i.id);if(v.ok===!1)return u(V.DATABASE_ERROR());let b=v.data;if(!b||b.revokedAt)return u(kn.INVALID_TOKEN());let k=await e.plugins.token.signAccessToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType},...b.perms!==void 0&&{perms:b.perms},...b.roles&&{roles:b.roles}}),C=await e.plugins.token.signRefreshToken({sub:b.userId,sid:b.id,jti:b.tokenId,...d&&{aud:d},...b.tenantId&&{tid:b.tenantId},...b.tenantType&&{tty:b.tenantType}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt})}let p=await e.plugins.token.signAccessToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType},...i.perms!==void 0&&{perms:i.perms},...i.roles&&{roles:i.roles}}),m=await e.plugins.token.signRefreshToken({sub:i.userId,sid:i.id,jti:c,...d&&{aud:d},...i.tenantId&&{tid:i.tenantId},...i.tenantType&&{tty:i.tenantType}}),E={accessToken:p.token,refreshToken:m.token,expiresAt:p.expiresAt};return g(E)}var Rt={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i \u0111\u1ECBnh danh {identityType}"),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin x\xE1c th\u1EF1c cho lo\u1EA1i th\xF4ng tin x\xE1c th\u1EF1c {credentialType}"),LOGIN_DISABLED:T("LOGIN_DISABLED","\u0110\u0103ng nh\u1EADp \u0111\xE3 b\u1ECB v\xF4 hi\u1EC7u h\xF3a cho \u0111\u1ECBnh danh n\xE0y"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Vui l\xF2ng x\xE1c minh \u0111\u1ECBnh danh tr\u01B0\u1EDBc khi \u0111\u0103ng nh\u1EADp"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Vui l\xF2ng ch\u1EDD tr\u01B0\u1EDBc khi y\xEAu c\u1EA7u g\u1EEDi l\u1EA1i email x\xE1c minh"),GUARD_LOCKED:X("GUARD_LOCKED","Ph\u01B0\u01A1ng th\u1EE9c \u0111\u0103ng nh\u1EADp t\u1EA1m th\u1EDDi b\u1ECB kh\xF3a do qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED sai. Vui l\xF2ng th\u1EED l\u1EA1i sau {minutes} ph\xFAt"),INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Th\xF4ng tin \u0111\u0103ng nh\u1EADp kh\xF4ng h\u1EE3p l\u1EC7"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","\u0110\u1ECBnh d\u1EA1ng \u0111\u1ECBnh danh kh\xF4ng h\u1EE3p l\u1EC7"),NO_ACCESS_TO_TENANT:X("NO_ACCESS_TO_TENANT","Ng\u01B0\u1EDDi d\xF9ng kh\xF4ng ph\u1EA3i l\xE0 th\xE0nh vi\xEAn c\u1EE7a tenant {tenantId}"),SUSPENDED_IN_TENANT:X("SUSPENDED_IN_TENANT","Ng\u01B0\u1EDDi d\xF9ng b\u1ECB {status} trong tenant {tenantId}"),CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o challenge x\xE1c th\u1EF1c"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o phi\xEAn \u0111\u0103ng nh\u1EADp"),TOKEN_GENERATION_FAILED:T("TOKEN_GENERATION_FAILED","Kh\xF4ng th\u1EC3 t\u1EA1o token x\xE1c th\u1EF1c"),USER_CONTEXT_NOT_FOUND:X("USER_CONTEXT_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y ng\u1EEF c\u1EA3nh ng\u01B0\u1EDDi d\xF9ng cho tenant {tenantId}"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR,ACCOUNT_DELETED:V.ACCOUNT_DELETED};var Fe={PENDING:"pending",VERIFIED:"verified",EXPIRED:"expired",CANCELLED:"cancelled"},Ar={VERIFY_CREDENTIAL:"verify_credential",SELECT_MFA:"select_mfa",VERIFY_MFA:"verify_mfa"},Ie={LOGIN:"login",REGISTRATION:"registration",PASSWORD_RESET:"password-reset",EMAIL_VERIFICATION:"email-verification",PHONE_VERIFICATION:"phone-verification"};var or={EMAIL:"email",PHONE:"phone",USERNAME:"username",WALLET:"wallet"};function _d(t,e){let r=t.guards[e],n=r?.lockedUntil?new Date(r.lockedUntil):null;return!n||n<=new Date?{locked:!1}:{locked:!0,minutesLeft:Math.ceil((n.getTime()-Date.now())/6e4)}}async function Mc(t,e){let r=e.security.maxConcurrentSessions;if(!r||r<=0)return;let n=await e.plugins.database.sessions.getActiveSessionsForLimit(t);if(n.ok===!1){console.error("Failed to get active sessions for limit:",n.errors);return}let i=n.data??[];if(i.length<=r)return;let o=i.slice(0,i.length-r).map(a=>a.id);await e.plugins.database.sessions.revokeBatch(o)}async function eE(t,e){let r=e.plugins.database.challenges.generateChallengeId(),n=t.nextStepData.expiresAt instanceof Date?t.nextStepData.expiresAt:new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),i=t.nextStepData.codeHash,{code:s,codeHash:o,challengeId:a,expiresAt:c,...l}=t.nextStepData,d={id:r,userId:t.userId,purpose:Ie.LOGIN,status:Fe.PENDING,phase:Ar.VERIFY_CREDENTIAL,method:t.credentialType,identityType:t.identityType,identityValue:t.identityValue,attempts:0,maxAttempts:e.security.maxChallengeAttempts,metadata:l,expiresAt:n};return t.tenantId!==void 0&&(d.tenantId=t.tenantId),t.deviceLabel!==void 0&&(d.deviceLabel=t.deviceLabel),t.country!==void 0&&(d.country=t.country),t.city!==void 0&&(d.city=t.city),i!==void 0&&(d.codeHash=i),(await e.plugins.database.challenges.create(d)).ok===!1?u([V.DATABASE_ERROR()]):g({challengeId:r,expiresAt:n,displayData:l,challengeType:t.nextStepType,phase:d.phase})}async function Kc(t,e){let r=new Date(Date.now()+e.security.mfaChallengeExpiryMinutes*60*1e3),n=e.plugins.database.challenges.generateChallengeId(),i=t.deliveryMethods.length===1&&t.userHasMethods.length===0,s=t.userHasMethods.length===1&&t.deliveryMethods.length===0,o=i?t.deliveryMethods[0]:s?t.userHasMethods[0]:void 0,a={id:n,userId:t.userId,purpose:Ie.LOGIN,status:Fe.PENDING,phase:o?Ar.VERIFY_MFA:Ar.SELECT_MFA,allowedMethods:t.availableMethods,maxAttempts:e.security.maxChallengeAttempts,expiresAt:r};t.tenantId!==void 0&&(a.tenantId=t.tenantId),o!==void 0&&(a.method=o),t.device?.deviceLabel!==void 0&&(a.deviceLabel=t.device.deviceLabel),t.device?.country!==void 0&&(a.country=t.device.country),t.device?.city!==void 0&&(a.city=t.device.city);let c=await e.plugins.database.challenges.create(a);if(c.ok===!1)return u(c.errors,c.meta);let l={challengeId:n,expiresAt:r,phase:a.phase,availableMethods:t.availableMethods,...o!==void 0&&{selectedMethod:o}};return g(l)}var lt={INVITED:"invited",ACTIVE:"active",SUSPENDED:"suspended",REMOVED:"removed"};var ye={ACTIVE:"active",SUSPENDED:"suspended",DELETED:"deleted"};var Id={ACCOUNT_DELETED:"ACCOUNT_DELETED",ACCOUNT_SUSPENDED:"ACCOUNT_SUSPENDED",NO_ACCESS_TO_TENANT:"NO_ACCESS_TO_TENANT",SUSPENDED_IN_TENANT:"SUSPENDED_IN_TENANT"},Hc={ACCOUNT_DELETED:V.ACCOUNT_DELETED,ACCOUNT_SUSPENDED:T(Id.ACCOUNT_SUSPENDED,"T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),NO_ACCESS_TO_TENANT:T(Id.NO_ACCESS_TO_TENANT,"B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T(Id.SUSPENDED_IN_TENANT,"T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y")};async function Br(t,e){let{userStatus:r,userId:n,tenantId:i}=t;if(r===ye.DELETED)return u(Hc.ACCOUNT_DELETED());if(r===ye.SUSPENDED)return u(Hc.ACCOUNT_SUSPENDED());let s,o,a;if(i&&e.plugins.database.tenantMembers){let l=await e.plugins.database.tenantMembers.get(i,n);if(l.ok===!1||!l.data)return u(Hc.NO_ACCESS_TO_TENANT());let d=l.data;if(d.status!==lt.ACTIVE)return u(Hc.SUSPENDED_IN_TENANT());if(o=d.roles,s=d.isOwner?{"*":-1}:d.perms,e.plugins.database.tenants){let p=await e.plugins.database.tenants.get(i);p.ok&&p.data&&(a=p.data.type)}}let c={};return s!==void 0&&(c.perms=s),o!==void 0&&(c.roles=o),a!==void 0&&(c.tenantType=a),g(c)}var Ze={SMS:"sms",EMAIL:"email"},di={PHONE:"phone",EMAIL:"email"},pi={SMS_CODE:"verification-code",EMAIL_CODE:"email-verification"};var Cn={type:Ze.EMAIL,purpose:Ie.EMAIL_VERIFICATION,identityType:di.EMAIL,template:pi.EMAIL_CODE};var Dn={type:Ze.SMS,purpose:Ie.PHONE_VERIFICATION,identityType:di.PHONE,template:pi.SMS_CODE};var Re={CHANNEL_NOT_CONFIGURED:T("CHANNEL_NOT_CONFIGURED","Verification channel is not configured"),SEND_ERROR:T("SEND_ERROR","Failed to send verification code"),IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),IDENTITY_ALREADY_VERIFIED:T("IDENTITY_ALREADY_VERIFIED","Identity is already verified"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Verification challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Verification challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Verification challenge has already been used"),PREVIOUS_CHALLENGE_REQUIRED:T("PREVIOUS_CHALLENGE_REQUIRED","Previous verification challenge is required to resend a code"),RESEND_COOLDOWN_ACTIVE:T("RESEND_COOLDOWN_ACTIVE","Please wait before requesting another verification code"),VERIFICATION_COOLDOWN_ACTIVE:T("VERIFICATION_COOLDOWN_ACTIVE","Please wait before requesting a new verification code"),INVALID_CODE:T("INVALID_CODE","Invalid verification code"),CODE_EXPIRED:T("CODE_EXPIRED","Verification code has expired"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new code"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")};async function _e(t,e){let r=t.plugins.audit;if(r)try{let n={event:e.event,system:e.system,data:e.data??{},timestamp:e.timestamp??new Date};e.userId!==void 0&&(n.userId=e.userId),e.sessionId!==void 0&&(n.sessionId=e.sessionId),e.tenantId!==void 0&&(n.tenantId=e.tenantId),e.ip!==void 0&&(n.ip=e.ip),e.userAgent!==void 0&&(n.userAgent=e.userAgent),e.correlationId!==void 0&&(n.correlationId=e.correlationId),e.risk_score!==void 0&&(n.risk_score=e.risk_score),await r.log(n)}catch(n){console.error("[auth-core] Failed to log audit event",{event:e.event,originalError:n instanceof Error?n.message:n})}}function ln(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}async function qr(t){let r=new TextEncoder().encode(t),n=await crypto.subtle.digest("SHA-256",r);return FI(n)}async function ps(t,e){let r=await qr(t);return r.length!==e.length?!1:VI(r,e)}function FI(t){let e=new Uint8Array(t),r="";for(let n=0;n<e.length;n++)r+=e[n].toString(16).padStart(2,"0");return r}function VI(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function BI(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function fs(t,e){let r=BI(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=e.plugins.identity?.[r.identityType],i=n?n.normalize(t.identityValue):t.identityValue,s=await e.plugins.database.identities.get(r.identityType,i);if(!s.ok||!s.data)return u(Re.IDENTITY_NOT_FOUND());let o=s.data;if(o.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let a=o.pendingVerification,c=a&&a.purpose===r.purpose&&a.channel===r.type?a.challengeId:null,l=t.previousChallengeId??c,d=t.previousChallengeId===void 0&&l===c;if(!l)return u(Re.PREVIOUS_CHALLENGE_REQUIRED());let p=await e.plugins.database.challenges.get(l);if(p.ok===!1)return u(p.errors,p.meta);let m=p.data;if(m&&(m.status!==Fe.PENDING||m.userId!==o.userId||m.purpose!==r.purpose||m.method!==r.type||m.identityType!==r.identityType||m.identityValue!==i))return u(Re.CHALLENGE_NOT_FOUND());if(!m&&!d)return u(Re.CHALLENGE_NOT_FOUND());let E=e.security.verificationResendCooldownSeconds*1e3,v=a?.challengeId===l&&a.resendAvailableAt?a.resendAvailableAt.getTime():(m?.createdAt.getTime()??0)+E;if(E>0&&Date.now()<v)return u(Re.RESEND_COOLDOWN_ACTIVE());let b=ln(6),k=await qr(b),C=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),L=e.plugins.database.challenges.generateChallengeId(),B=await e.plugins.database.challenges.create({id:L,userId:o.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:i,codeHash:k,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:C});if(B.ok===!1)return u(B.errors,B.meta);let G=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,j=await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:{challengeId:L,purpose:r.purpose,channel:r.type,expiresAt:C,resendAvailableAt:G}});return j.ok===!1?(await e.plugins.database.challenges.remove(L),u(j.errors,j.meta)):(await qI(t.channel,i,b,r.template,L,C,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(L),await e.plugins.database.identities.update(r.identityType,i,{pendingVerification:a??null}),u(Re.SEND_ERROR())):(await Promise.all([e.plugins.database.challenges.remove(l),_e(e,{event:`verification_code_resent_${t.channel}`,userId:o.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:i,challengeId:L,previousChallengeId:l}})]),g({challengeId:L,expiresAt:C}))}async function qI(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}function jI(t){switch(t){case Ze.SMS:return Dn;case Ze.EMAIL:return Cn}}async function ms(t,e){let r=jI(t.channel);if(t.channel===Ze.SMS&&!e.plugins.smsSystem)return u(Re.CHANNEL_NOT_CONFIGURED());if(t.channel===Ze.EMAIL&&!e.plugins.emailSystem)return u(Re.CHANNEL_NOT_CONFIGURED());let n=await e.plugins.database.identities.get(r.identityType,t.identityValue);if(!n.ok||!n.data)return u(Re.IDENTITY_NOT_FOUND());let i=n.data;if(i.verifiedAt)return u(Re.IDENTITY_ALREADY_VERIFIED());let s=i.guards.email_verification;if(s?.lockedUntil&&new Date(s.lockedUntil)>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let o=i.pendingVerification,a=o&&o.purpose===r.purpose&&o.channel===r.type&&o.expiresAt>new Date?o.challengeId:null;if(o?.resendAvailableAt&&o.purpose===r.purpose&&o.channel===r.type&&o.resendAvailableAt>new Date)return u(Re.VERIFICATION_COOLDOWN_ACTIVE());let c=ln(6),l=await qr(c),d=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),p=e.plugins.database.challenges.generateChallengeId(),m=await e.plugins.database.challenges.create({id:p,userId:i.userId,purpose:r.purpose,status:Fe.PENDING,method:r.type,identityType:r.identityType,identityValue:t.identityValue,codeHash:l,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:d});if(m.ok===!1)return u(m.errors,m.meta);let E=Math.max(0,e.security.verificationResendCooldownSeconds),v=E>0?new Date(Date.now()+E*1e3):null,b=await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:{challengeId:p,purpose:r.purpose,channel:r.type,expiresAt:d,resendAvailableAt:v}});return b.ok===!1?(await e.plugins.database.challenges.remove(p),u(b.errors,b.meta)):(await GI(t.channel,t.identityValue,c,r.template,p,d,r.purpose,e,t.authContext)).ok===!1?(await e.plugins.database.challenges.remove(p),await e.plugins.database.identities.update(r.identityType,t.identityValue,{pendingVerification:o??null}),u(Re.SEND_ERROR())):(await Promise.all([a?e.plugins.database.challenges.remove(a):Promise.resolve(),_e(e,{event:`verification_code_sent_${t.channel}`,userId:i.userId,system:e.system.system.systemId,data:{channel:t.channel,identityValue:t.identityValue,challengeId:p}})]),g({challengeId:p,expiresAt:d}))}async function GI(t,e,r,n,i,s,o,a,c){let l={code:r,challengeId:i,expiresAt:s.toISOString(),purpose:o,appName:a.system.email?.appName||"Auth Craft",appUrl:a.system.email?.appUrl||"",supportEmail:a.system.email?.supportEmail||"",...c?{authContext:c}:{}};return t===Ze.SMS&&a.plugins.smsSystem?a.plugins.smsSystem.send({to:e,template:n,variables:l}):t===Ze.EMAIL&&a.plugins.emailSystem?a.plugins.emailSystem.send({to:e,template:n,variables:l}):u(Re.CHANNEL_NOT_CONFIGURED())}var $I=[Ie.PHONE_VERIFICATION,Ie.EMAIL_VERIFICATION];async function hs(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(Re.CHALLENGE_NOT_FOUND());let n=r.data;if(!$I.includes(n.purpose))return u(Re.CHALLENGE_NOT_FOUND());if(n.status!==Fe.PENDING)return u(Re.CHALLENGE_ALREADY_USED());if(n.expiresAt<new Date)return u(Re.CHALLENGE_EXPIRED());let i=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(i.ok===!1)return i.errors.some(l=>l.code==="ATTEMPTS_EXCEEDED")?u(Re.TOO_MANY_ATTEMPTS()):u(i.errors,i.meta);if(!n.codeHash)return u(Re.INVALID_CODE());if(!await ps(t.code,n.codeHash))return u(Re.INVALID_CODE());let o=new Date,a=n.identityType||"",c=n.identityValue||"";if(a&&c){let l=await e.plugins.database.identities.get(a,c);l.ok&&l.data&&await e.plugins.database.identities.update(a,c,{verifiedAt:o,pendingVerification:null})}return await e.plugins.database.challenges.remove(t.challengeId),await _e(e,{event:`${a}_verified`,userId:n.userId,system:e.system.system.systemId,data:{identityType:a,identityValue:c,challengeId:t.challengeId}}),g({userId:n.userId,identityType:a,identityValue:c,verifiedAt:o})}function Lo(t,e){return e[t]??null}function tE(t,e){return e[t]??null}async function rE(t,e){for(let r of t)try{switch(r.kind){case"credential.patch":{let n=r.payload;await e.plugins.database.credentials.update(n.id,n.patch);break}case"credential.create":{let n=r.payload;await e.plugins.database.credentials.create(n.data);break}case"notification.sendCode":{let n=r.payload;n.method==="email"&&(e.plugins.email?await e.plugins.email.sendVerificationCode(n.to,n.code):e.plugins.emailSystem&&await e.plugins.emailSystem.send({to:n.to,template:"login-otp",variables:{code:n.code,purpose:"login"}}));break}case"cache.store":{let n=r.payload;e.cache&&await e.cache.set(n.key,n.value,n.ttl);break}case"cache.delete":{let n=r.payload;e.cache&&await e.cache.delete(n.key);break}default:console.warn(`[executeIntents] Unknown intent kind: ${r.kind}`)}}catch(n){console.error(`[executeIntents] Failed to execute intent ${r.kind}:`,n)}}async function nE(t,e,r){let i=(t.guards[e]||{failedAttempts:0,lastFailedAt:null,lockedUntil:null}).failedAttempts+1,s=r.security.maxFailedAttempts||5,o=i>=s,a=null;if(o){let l=r.security.lockoutDurationMinutes||15;if(r.security.progressiveLockoutEnabled&&i>s){let d=r.security.progressiveLockoutMultiplier||2,p=r.security.maxLockoutDurationMinutes||1440;l=Math.min(l*d**(i-s),p)}a=new Date(Date.now()+l*60*1e3)}let c={failedAttempts:i,lastFailedAt:new Date,lockedUntil:a};await r.plugins.database.identities.updateGuard(t.type,t.value,e,c)}async function iE(t,e,r){let n=t.guards[e];if(!n||n.failedAttempts===0&&!n.lastFailedAt&&!n.lockedUntil)return;let i={failedAttempts:0,lastFailedAt:null,lockedUntil:null};await r.plugins.database.identities.updateGuard(t.type,t.value,e,i)}async function Mo(t,e){let r=t.tid,n=Lo(t.identityType,e.plugins.identity);if(!n)return u(Rt.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let i=n.validate(t.identityValue);if(i&&!i.ok)return u(Rt.INVALID_IDENTITY_FORMAT());let s=n.normalize(t.identityValue),o=await e.plugins.database.identities.get(t.identityType,s);if(o.ok===!1||!o.data)return u(Rt.INVALID_CREDENTIALS());let a=o.data;if(!a.loginEnabled)return u(Rt.LOGIN_DISABLED());let c=_d(a,t.credentialType);if(c.locked)return u(Rt.GUARD_LOCKED({minutes:c.minutesLeft.toString()}));let l=tE(t.credentialType,e.plugins.credential);if(!l)return u(Rt.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let d=await e.plugins.database.credentials.getByUserIdAndType(a.userId,t.credentialType),p=d.ok?d.data:null,m=await l.verify({userId:a.userId,identityValue:s,credential:p?{value:p.value,data:p.data}:null,...t.credentialValue!==void 0&&{credentialValue:t.credentialValue},...t.metadata!==void 0&&{metadata:t.metadata}});if(m.ok===!1)return await nE(a,t.credentialType,e),u(Rt.INVALID_CREDENTIALS());let{userId:E,nextStep:v,intents:b}=m.data;b&&b.length>0&&await rE(b,e);let k;if(t.userAgent&&e.plugins.deviceParser){let w=e.plugins.deviceParser.parseDeviceInfo(t.userAgent),R=w.browser||"Unknown Browser",N=w.os||"Unknown OS";k=`${R} - ${N}`}if(v){let w={userId:E,credentialType:t.credentialType,identityType:t.identityType,identityValue:s,nextStepData:v.data,nextStepType:v.type};t.tid!==void 0&&(w.tenantId=t.tid),k!==void 0&&(w.deviceLabel=k),t.country!==void 0&&(w.country=t.country),t.city!==void 0&&(w.city=t.city);let R=await eE(w,e);if(R.ok===!1)return u(R.errors,R.meta);if(!R.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:N,expiresAt:O,displayData:P,challengeType:U,phase:K}=R.data;return g({requiresChallenge:!0,challenge:{type:U,phase:K,expiresAt:O,data:{challengeId:N,expiresAt:O,...P}}})}if(e.security.requireVerifiedIdentity&&!a.verifiedAt){if(t.identityType!=="email")return u(Rt.IDENTITY_NOT_VERIFIED());let w=a.pendingVerification;if(!!w&&w.purpose===Ie.EMAIL_VERIFICATION&&w.channel==="email"&&w.expiresAt>new Date&&w)return g({requiresVerification:!0,verification:{channel:"email",challengeId:w.challengeId,expiresAt:w.expiresAt,identityType:t.identityType,identityValue:s,userId:E}});let N=await ms({channel:"email",identityValue:s,...t.authContext?{authContext:t.authContext}:{}},{plugins:{database:e.plugins.database,identity:e.plugins.identity,...e.plugins.emailSystem?{emailSystem:e.plugins.emailSystem}:{}},security:e.security,system:{system:{systemId:e.system.systemId}}});if(!N.ok){let O=await e.plugins.database.identities.get(t.identityType,s),P=O.ok&&O.data?O.data.pendingVerification:null;return P&&P.purpose===Ie.EMAIL_VERIFICATION&&P.channel==="email"&&P.expiresAt>new Date?g({requiresVerification:!0,verification:{channel:"email",challengeId:P.challengeId,expiresAt:P.expiresAt,identityType:t.identityType,identityValue:s,userId:E}}):u(Rt.IDENTITY_NOT_VERIFIED())}return g({requiresVerification:!0,verification:{channel:"email",challengeId:N.data.challengeId,expiresAt:N.data.expiresAt,identityType:t.identityType,identityValue:s,userId:E}})}let C=await e.plugins.database.userAuths.get(E);if(C.ok===!1||!C.data)return u(Rt.USER_AUTH_NOT_FOUND());let L=C.data,B={userStatus:L.userStatus,userId:E,...r&&{tenantId:r}},G=await Br(B,e);if(G.ok===!1)return u(G.errors,G.meta);if(!G.ok)return u(V.DATABASE_ERROR());let{perms:j,roles:$,tenantType:te}=G.data;if(L.mfaRequired){let w=L.mfaMethods;if(!(!w||w.length===0)){let R=w.filter(N=>e.plugins.mfa?.[N]);if(R.length!==0){let N=R.filter(fe=>e.plugins.mfa?.[fe]?.requiresServerDelivery),O=R.filter(fe=>!e.plugins.mfa?.[fe]?.requiresServerDelivery),P={};k!==void 0&&(P.deviceLabel=k),t.country!==void 0&&(P.country=t.country),t.city!==void 0&&(P.city=t.city);let U={userId:E,availableMethods:R,deliveryMethods:N,userHasMethods:O,device:P};t.tid!==void 0&&(U.tenantId=t.tid);let K=await Kc(U,e);if(K.ok===!1)return u(K.errors,K.meta);if(!K.ok)return u(Rt.INTERNAL_ERROR());let{challengeId:W,expiresAt:J,phase:de,selectedMethod:ke,availableMethods:He}=K.data;return g({requiresMfa:!0,mfa:{phase:de,challengeId:W,methods:He,...ke&&{method:ke},expiresAt:J,userId:E}})}}}let A={userId:E,...r&&{tenantId:r},...te&&{tenantType:te},...j!==void 0||$?{permissions:{...$&&{roles:$},...j!==void 0&&{perms:j}}}:{},...k||t.country||t.city?{device:{...k&&{deviceLabel:k},...t.country&&{country:t.country},...t.city&&{city:t.city}}}:{}},x=await On(A,e);if(x.ok===!1)return u(x.errors,x.meta);if(!x.ok)return u(V.DATABASE_ERROR());let{accessToken:S,refreshToken:y,expiresAt:_}=x.data;return await Mc(E,e),await iE(a,t.credentialType,e),g({accessToken:S,refreshToken:y,expiresAt:_})}var It={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Th\u1EED th\xE1ch \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","M\xE3 x\xE1c minh kh\xF4ng h\u1EE3p l\u1EC7"),MAX_ATTEMPTS_EXCEEDED:T("MAX_ATTEMPTS_EXCEEDED","\u0110\xE3 v\u01B0\u1EE3t qu\xE1 s\u1ED1 l\u1EA7n th\u1EED t\u1ED1i \u0111a. Th\u1EED th\xE1ch \u0111\xE3 b\u1ECB kh\xF3a"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};var WI={CHALLENGE_CREATE_FAILED:T("CHALLENGE_CREATE_FAILED","Failed to create MFA challenge")};async function cE(t,e){let{mfaRequired:r,mfaMethods:n,userId:i,tenantId:s,device:o}=t;if(!r)return g({requiresMfa:!1});if(!n||n.length===0)return g({requiresMfa:!1});let a=n.filter(C=>e.plugins.mfa?.[C]);if(a.length===0)return g({requiresMfa:!1});let c=a.filter(C=>e.plugins.mfa?.[C]?.requiresServerDelivery),l=a.filter(C=>!e.plugins.mfa?.[C]?.requiresServerDelivery),d={userId:i,availableMethods:a,deliveryMethods:c,userHasMethods:l};s!==void 0&&(d.tenantId=s),o!==void 0&&(d.device=o);let p=await Kc(d,e);if(p.ok===!1)return u(p.errors,p.meta);if(!p.ok)return u([WI.CHALLENGE_CREATE_FAILED()]);let{challengeId:m,expiresAt:E,phase:v,selectedMethod:b,availableMethods:k}=p.data;return g({requiresMfa:!0,mfa:{phase:v,challengeId:m,methods:k,...b&&{method:b},expiresAt:E,userId:i}})}async function Ko(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(r.ok===!1||!r.data)return u(It.CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId;if(n.status!==Fe.PENDING)return u(It.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_CREDENTIAL)return u(It.INVALID_CHALLENGE_STATE());if(n.purpose!==Ie.LOGIN)return u(It.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(It.CHALLENGE_EXPIRED());let s=n.method;if(!s)return u(It.INTERNAL_ERROR());let o=e.plugins.credential[s];if(!o)return u(It.INTERNAL_ERROR());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(_=>_.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.update(t.challengeId,{status:Fe.EXPIRED}),u(It.MAX_ATTEMPTS_EXCEEDED())):u(a.errors,a.meta);if((await o.verify({userId:n.userId,identityValue:n.identityValue||"",credential:null,credentialValue:t.code,metadata:{...n.metadata,codeHash:n.codeHash,challengeId:t.challengeId}})).ok===!1)return u(It.INVALID_CHALLENGE_CODE());await e.plugins.database.challenges.remove(t.challengeId);let l=await e.plugins.database.userAuths.get(n.userId);if(l.ok===!1||!l.data)return u(It.USER_AUTH_NOT_FOUND());let d=l.data,p={userStatus:d.userStatus,userId:n.userId};i!==void 0&&(p.tenantId=i);let m=await Br(p,e);if(m.ok===!1)return u(m.errors,m.meta);if(!m.ok)return u(It.INTERNAL_ERROR());let{perms:E,roles:v,tenantType:b}=m.data,k=n.deviceLabel,C=n.country,L=n.city,B={};k!==void 0&&(B.deviceLabel=k),C!==void 0&&(B.country=C),L!==void 0&&(B.city=L);let G={mfaRequired:d.mfaRequired,...d.mfaMethods&&{mfaMethods:d.mfaMethods},userId:n.userId,device:B},j=await cE(G,e);if(j.ok===!1)return u(j.errors,j.meta);if(!j.ok)return u(It.INTERNAL_ERROR());if(j.data.requiresMfa){let _={requiresMfa:!0,mfa:j.data.mfa};return g(_)}let $={};E!==void 0&&($.perms=E),v!==void 0&&($.roles=v);let te={userId:n.userId,permissions:$,device:B};i!==void 0&&(te.tenantId=i),b!==void 0&&(te.tenantType=b);let A=await On(te,e);if(A.ok===!1)return u(A.errors,A.meta);if(!A.ok)return u(It.INTERNAL_ERROR());let{accessToken:x,refreshToken:S,expiresAt:y}=A.data;return g({accessToken:x,refreshToken:S,expiresAt:y})}var ot={MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y th\u1EED th\xE1ch MFA ho\u1EB7c \u0111\xE3 ho\xE0n th\xE0nh"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","Th\u1EED th\xE1ch MFA \u0111\xE3 h\u1EBFt h\u1EA1n. Vui l\xF2ng y\xEAu c\u1EA7u m\u1ED9t th\u1EED th\xE1ch m\u1EDBi"),INVALID_CHALLENGE_STATE:T("INVALID_CHALLENGE_STATE","Th\u1EED th\xE1ch MFA kh\xF4ng \u1EDF tr\u1EA1ng th\xE1i h\u1EE3p l\u1EC7 \u0111\u1EC3 ho\xE0n th\xE0nh"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","M\xE3 MFA kh\xF4ng h\u1EE3p l\u1EC7"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Qu\xE1 nhi\u1EC1u l\u1EA7n th\u1EED m\xE3 MFA, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","Ph\u01B0\u01A1ng th\u1EE9c MFA kh\xF4ng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 cho ng\u01B0\u1EDDi d\xF9ng n\xE0y"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y b\u1EA3n ghi x\xE1c th\u1EF1c ng\u01B0\u1EDDi d\xF9ng"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","T\xE0i kho\u1EA3n n\xE0y \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng"),MFA_PLUGIN_NOT_FOUND:T("MFA_PLUGIN_NOT_FOUND","Ch\u01B0a c\u1EA5u h\xECnh plugin x\xE1c th\u1EF1c \u0111a y\u1EBFu t\u1ED1 (MFA)"),SCOPE_MISMATCH:T("SCOPE_MISMATCH","Challenge scope does not match route scope"),NO_ACCESS_TO_TENANT:T("NO_ACCESS_TO_TENANT","B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n truy c\u1EADp v\xE0o tenant n\xE0y"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","T\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n \u0111\xE3 b\u1ECB t\u1EA1m ng\u01B0ng trong tenant n\xE0y"),VALIDATION_ERROR:V.VALIDATION_ERROR,DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function Ho(t,e){if(!e.plugins.mfa)return u(ot.MFA_PLUGIN_NOT_FOUND());let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(ot.MFA_CHALLENGE_NOT_FOUND());let n=r.data,i=n.tenantId,s=n.deviceLabel,o=n.country,a=n.city;if(n.status!==Fe.PENDING)return u(ot.INVALID_CHALLENGE_STATE());if(n.phase!==Ar.VERIFY_MFA)return u(ot.INVALID_CHALLENGE_STATE());if(n.purpose!==Ie.LOGIN)return u(ot.INVALID_CHALLENGE_STATE());if(n.expiresAt<new Date)return await e.plugins.database.challenges.remove(t.challengeId),u(ot.MFA_CHALLENGE_EXPIRED());let c=n.metadata?.methods;if(c&&!c.includes(t.method))return u(ot.MFA_METHOD_NOT_SUPPORTED());let l=e.plugins.mfa[t.method];if(!l)return u(ot.MFA_METHOD_NOT_SUPPORTED());let d=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(d.ok===!1)return d.errors.some(te=>te.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(ot.TOO_MANY_ATTEMPTS())):u(d.errors,d.meta);if(l.requiresServerDelivery){if(!n.codeHash)return u(ot.INVALID_CHALLENGE_STATE());if(!await ps(t.code,n.codeHash))return u(ot.INVALID_MFA_CODE())}else{if(!l.verifyWithCredentials)return u(ot.MFA_METHOD_NOT_SUPPORTED());let te=await e.plugins.database.userMfaAuthenticators.get(n.userId,t.method);if(te.ok===!1||!te.data)return u(ot.INVALID_MFA_CODE());let A=te.data;if(!A.verifiedAt)return u(ot.INVALID_MFA_CODE());let x=await l.verifyWithCredentials({credentialData:A.data,data:{code:t.code}});if(x.ok===!1||!x.data.verified)return u(ot.INVALID_MFA_CODE());let S=x.data.data?.usedBackupCodeHash;if(S){let _=(A.data.backupCodeHashes??[]).filter(w=>w!==S);await e.plugins.database.userMfaAuthenticators.update(n.userId,t.method,void 0,{data:{...A.data,backupCodeHashes:_}})}}await e.plugins.database.challenges.remove(t.challengeId);let p=await e.plugins.database.userAuths.get(n.userId);if(!p.ok||!p.data)return u(ot.USER_AUTH_NOT_FOUND());let E={userStatus:p.data.userStatus,userId:n.userId,...i&&{tenantId:i}},v=await Br(E,e);if(v.ok===!1)return u(v.errors,v.meta);if(!v.ok)return u(V.DATABASE_ERROR());let{perms:b,roles:k,tenantType:C}=v.data,L={userId:n.userId,...i&&{tenantId:i},...C&&{tenantType:C},...b!==void 0||k?{permissions:{...k&&{roles:k},...b!==void 0&&{perms:b}}}:{},...s||o||a?{device:{...s&&{deviceLabel:s},...o&&{country:o},...a&&{city:a}}}:{}},B=await On(L,e);if(B.ok===!1)return u(B.errors,B.meta);if(!B.ok)return u(V.DATABASE_ERROR());let{accessToken:G,refreshToken:j,expiresAt:$}=B.data;return g({accessToken:G,refreshToken:j,expiresAt:$})}var xt={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge kh\xF4ng t\u1ED3n t\u1EA1i"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge \u0111\xE3 h\u1EBFt h\u1EA1n"),CHALLENGE_INVALID_STATUS:X("CHALLENGE_INVALID_STATUS","Challenge c\xF3 tr\u1EA1ng th\xE1i kh\xF4ng h\u1EE3p l\u1EC7: {status}"),METHOD_NOT_ALLOWED:X("METHOD_NOT_ALLOWED","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng \u0111\u01B0\u1EE3c ph\xE9p cho challenge n\xE0y"),METHOD_NO_SERVER_DELIVERY:X("METHOD_NO_SERVER_DELIVERY","Ph\u01B0\u01A1ng th\u1EE9c {method} kh\xF4ng c\u1EA7n server g\u1EEDi m\xE3"),MFA_PLUGIN_NOT_FOUND:X("MFA_PLUGIN_NOT_FOUND","Kh\xF4ng t\xECm th\u1EA5y plugin MFA cho ph\u01B0\u01A1ng th\u1EE9c {method}"),CHALLENGE_ISSUE_FAILED:T("CHALLENGE_ISSUE_FAILED","Kh\xF4ng th\u1EC3 ph\xE1t h\xE0nh challenge"),CHALLENGE_UPDATE_FAILED:T("CHALLENGE_UPDATE_FAILED","Kh\xF4ng th\u1EC3 c\u1EADp nh\u1EADt challenge"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope"),TOO_MANY_ISSUES:T("TOO_MANY_ISSUES","Qu\xE1 nhi\u1EC1u l\u1EA7n g\u1EEDi m\xE3, vui l\xF2ng \u0111\u0103ng nh\u1EADp l\u1EA1i")};async function Fo(t,e){let r=await e.plugins.database.challenges.get(t.challengeId);if(!r.ok||!r.data)return u(xt.CHALLENGE_NOT_FOUND());let n=r.data;if(n.status!==Fe.PENDING)return u(xt.CHALLENGE_INVALID_STATUS({status:n.status}));if(n.expiresAt<new Date)return u(xt.CHALLENGE_EXPIRED());if(n.userId!==t.userId)return u(xt.CHALLENGE_NOT_FOUND());if(!n.allowedMethods?.includes(t.method))return u(xt.METHOD_NOT_ALLOWED({method:t.method}));let i=e.plugins.mfa?.[t.method];if(!i)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));if(!i.requiresServerDelivery)return u(xt.METHOD_NO_SERVER_DELIVERY({method:t.method}));let s=await e.plugins.database.userAuths.get(t.userId);if(!s.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let o=s.data;if(!o)return u(xt.CHALLENGE_ISSUE_FAILED());let a=await e.plugins.database.challenges.incrementAttempts(t.challengeId,n.maxAttempts);if(a.ok===!1)return a.errors.some(m=>m.code==="ATTEMPTS_EXCEEDED")?(await e.plugins.database.challenges.remove(t.challengeId),u(xt.TOO_MANY_ISSUES())):u(a.errors,a.meta);if(!i.sendCode)return u(xt.MFA_PLUGIN_NOT_FOUND({method:t.method}));let c=await i.sendCode({userId:t.userId,method:t.method,userAuth:o},e);if(!c.ok)return u(xt.CHALLENGE_ISSUE_FAILED());let l=c.data.codeHash,d=c.data.maskedRecipient;return(await e.plugins.database.challenges.update(t.challengeId,{method:t.method,phase:Ar.VERIFY_MFA,codeHash:l})).ok===!1?u(xt.CHALLENGE_UPDATE_FAILED()):g({maskedRecipient:d,expiresAt:n.expiresAt})}var je={IDENTITY_PLUGIN_NOT_FOUND:X("IDENTITY_PLUGIN_NOT_FOUND",'Identity plugin "{identityType}" not found'),CREDENTIAL_PLUGIN_NOT_FOUND:X("CREDENTIAL_PLUGIN_NOT_FOUND",'Credential plugin "{credentialType}" not found'),INVALID_IDENTITY_FORMAT:X("INVALID_IDENTITY_FORMAT","Invalid {identityType} format"),IDENTITY_ALREADY_EXISTS:X("IDENTITY_ALREADY_EXISTS","{identityType} already exists in the system"),INVALID_CREDENTIAL:T("INVALID_CREDENTIAL","Invalid credential format or strength"),USER_CREATION_FAILED:T("USER_CREATION_FAILED","Failed to create user account"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not available"),VERIFICATION_EMAIL_SEND_FAILED:T("VERIFICATION_EMAIL_SEND_FAILED","Failed to send verification email"),DATABASE_ERROR:T("DATABASE_ERROR","Database error occurred during registration"),INTERNAL_ERROR:T("INTERNAL_ERROR","Internal error occurred during registration")};function zI(t,e){return e[t]}function JI(t,e){return e[t]}async function Vo(t,e){let r=zI(t.identityType,e.plugins.identity);if(!r)return u(je.IDENTITY_PLUGIN_NOT_FOUND({identityType:t.identityType}));let n=r.validate(t.identityValue);if(n&&!n.ok)return u(je.INVALID_IDENTITY_FORMAT({identityType:t.identityType}));let i=r.normalize(t.identityValue),s=await e.plugins.database.identities.get(t.identityType,i);if(s.ok===!1)return u(je.DATABASE_ERROR());if(s.data)return u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType}));let o=JI(t.credentialType,e.plugins.credential);if(!o)return u(je.CREDENTIAL_PLUGIN_NOT_FOUND({credentialType:t.credentialType}));let a=await o.create({value:t.credentialValue});if(a.ok===!1)return u(je.INVALID_CREDENTIAL());if(!a.ok)return u(je.INTERNAL_ERROR());let{value:c,data:l}=a.data,d=e.plugins.database.users.generateUserId(),p=t.displayName;!p&&(t.givenName||t.familyName)&&(t.givenName&&t.familyName?p=`${t.givenName} ${t.familyName}`:p=t.givenName||t.familyName);let m={id:d,status:ye.ACTIVE,...p!==void 0&&{displayName:p},...t.givenName!==void 0&&{givenName:t.givenName},...t.familyName!==void 0&&{familyName:t.familyName},...t.avatarUrl!==void 0&&{avatarUrl:t.avatarUrl},...t.locale!==void 0&&{locale:t.locale},...t.metadata!==void 0&&{metadata:t.metadata},...t.identityType===or.EMAIL&&{contactEmail:t.identityValue},...t.identityType===or.PHONE&&{contactPhone:t.identityValue},...t.identityType===or.USERNAME&&{username:t.identityValue}},E={userId:d,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null},v={type:t.identityType,value:i,userId:d,loginEnabled:!0,verifiedAt:null,guards:{}},b={userId:d,type:t.credentialType,value:c,data:l||{},revokedAt:null,lastUsedAt:null};if(t.identityType===or.EMAIL&&e.plugins.database.registration){let j=await YI({profileData:{...m,id:d},userAuthData:E,identityData:v,credentialRepoData:b,identityValue:i},e);return j.ok===!1?j.errors.some($=>$.code==="UNIQUE_CONSTRAINT_VIOLATION")?u(je.IDENTITY_ALREADY_EXISTS({identityType:t.identityType})):u(j.errors,j.meta):j.ok?g({userId:d,verification:{channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}):u(je.INTERNAL_ERROR())}let k=await e.plugins.database.users.create(m);if(k.ok===!1||!k.data)return u(je.USER_CREATION_FAILED());if((await e.plugins.database.userAuths.create(E)).ok===!1)return await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());if((await e.plugins.database.identities.create(v)).ok===!1)return await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let B=await e.plugins.database.credentials.create(b);if(B.ok===!1)return await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.USER_CREATION_FAILED());let G;if(t.identityType===or.EMAIL){let j=await ZI({userId:d,identityType:t.identityType,identityValue:i},e);if(j.ok===!1)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(j.errors,j.meta);if(!j.ok)return await e.plugins.database.credentials.remove(B.data.id),await e.plugins.database.identities.remove(t.identityType,i),await e.plugins.database.userAuths.remove(d),await e.plugins.database.users.remove(d),u(je.INTERNAL_ERROR());G={channel:"email",challengeId:j.data.challengeId,expiresAt:j.data.expiresAt,identityType:t.identityType,identityValue:i}}return g({userId:d,...G&&{verification:G}})}async function YI(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=await XI(t.userAuthData.userId,t.identityValue,e);return(await e.plugins.database.registration.createEmailVerificationRegistration({profile:t.profileData,userAuth:t.userAuthData,identity:{...t.identityData,pendingVerification:r.pendingVerification},credential:t.credentialRepoData,challenge:r.challenge})).ok===!1?u(je.USER_CREATION_FAILED()):((await QI({to:t.identityValue,code:r.code,challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt},e)).ok===!1&&console.error("[auth-core] Initial verification email delivery failed after registration transaction",{userId:t.userAuthData.userId,challengeId:r.challenge.id}),g({challengeId:r.challenge.id,expiresAt:r.challenge.expiresAt}))}async function XI(t,e,r){let n=ln(6),i=await qr(n),s=new Date(Date.now()+r.security.verificationCodeExpiryMinutes*60*1e3),o=r.plugins.database.challenges.generateChallengeId(),a=r.security.verificationResendCooldownSeconds>0?new Date(Date.now()+r.security.verificationResendCooldownSeconds*1e3):null;return{code:n,challenge:{id:o,userId:t,purpose:Ie.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:or.EMAIL,identityValue:e,codeHash:i,attempts:0,maxAttempts:r.security.maxChallengeAttempts,expiresAt:s},pendingVerification:{challengeId:o,purpose:Ie.EMAIL_VERIFICATION,channel:"email",expiresAt:s,resendAvailableAt:a}}}async function QI(t,e){return e.plugins.emailSystem?(await e.plugins.emailSystem.send({to:t.to,template:"email-verification",variables:{code:t.code,challengeId:t.challengeId,expiresAt:t.expiresAt.toISOString(),purpose:Ie.EMAIL_VERIFICATION}})).ok===!1?u(je.VERIFICATION_EMAIL_SEND_FAILED()):g(void 0):u(je.EMAIL_SYSTEM_NOT_AVAILABLE())}async function ZI(t,e){if(!e.plugins.emailSystem)return u(je.EMAIL_SYSTEM_NOT_AVAILABLE());let r=ln(6),n=await qr(r),i=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3),s=e.plugins.database.challenges.generateChallengeId(),o=await e.plugins.database.challenges.create({id:s,userId:t.userId,purpose:Ie.EMAIL_VERIFICATION,status:Fe.PENDING,method:"email",identityType:t.identityType,identityValue:t.identityValue,codeHash:n,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:i});if(o.ok===!1)return u(o.errors,o.meta);let a=e.security.verificationResendCooldownSeconds>0?new Date(Date.now()+e.security.verificationResendCooldownSeconds*1e3):null,c=await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:{challengeId:s,purpose:Ie.EMAIL_VERIFICATION,channel:"email",expiresAt:i,resendAvailableAt:a}});return c.ok===!1?(await e.plugins.database.challenges.remove(s),u(c.errors,c.meta)):(await e.plugins.emailSystem.send({to:t.identityValue,template:"email-verification",variables:{code:r,challengeId:s,expiresAt:i.toISOString(),purpose:Ie.EMAIL_VERIFICATION}})).ok===!1?(await e.plugins.database.challenges.remove(s),await e.plugins.database.identities.update(t.identityType,t.identityValue,{pendingVerification:null}),u(je.VERIFICATION_EMAIL_SEND_FAILED())):g({challengeId:s,expiresAt:i})}var Pn={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Bo(t,e){let{sessionId:r,userId:n,tenantId:i}=t,s=await e.plugins.database.sessions.get(r);if(s.ok===!1)return u(s.errors,s.meta);if(!s.data)return u(Pn.SESSION_NOT_FOUND());let o=s.data;if(o.revokedAt)return u(Pn.SESSION_REVOKED());if(o.userId!==n)return u(Pn.SESSION_NOT_FOUND());let a=await e.plugins.database.userAuths.get(n);if(a.ok===!1)return u(a.errors,a.meta);if(!a.data)return u(Pn.USER_NOT_FOUND());let c=a.data,l=await Br({userStatus:c.userStatus,userId:n,tenantId:i},e);if(l.ok===!1)return u(l.errors,l.meta);if(!l.ok)return u(V.DATABASE_ERROR());let{perms:d,roles:p,tenantType:m}=l.data,E=e.plugins.database.sessions.generateTokenId(),v=await e.plugins.database.sessions.switchTenant(r,{tenantId:i,tokenId:E,...d!==void 0&&{perms:d},...p&&{roles:p},...m&&{tenantType:m}});if(v.ok===!1)return u(v.errors,v.meta);let b=ds(i,e.security),k=await e.plugins.token.signAccessToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m},...d!==void 0&&{perms:d},...p&&{roles:p}}),C=await e.plugins.token.signRefreshToken({sub:n,sid:r,jti:E,...b&&{aud:b},tid:i,...m&&{tty:m}});return g({accessToken:k.token,refreshToken:C.token,expiresAt:k.expiresAt,tenantId:i})}var uE=/^[\w!#$%&'*.^`|~+-]+$/,ex=/^[ !#-:<-[\]-~]*$/,lE=t=>{let e=0,r=t.length;for(;e<r;){let n=t.charCodeAt(e);if(n!==32&&n!==9)break;e++}for(;r>e;){let n=t.charCodeAt(r-1);if(n!==32&&n!==9)break;r--}return e===0&&r===t.length?t:t.slice(e,r)},xd=(t,e)=>{if(e&&t.indexOf(e)===-1)return{};let r=t.split(";"),n=Object.create(null);for(let i of r){let s=i.indexOf("=");if(s===-1)continue;let o=lE(i.substring(0,s));if(e&&e!==o||!uE.test(o)||o in n)continue;let a=lE(i.substring(s+1));if(a.startsWith('"')&&a.endsWith('"')&&(a=a.slice(1,-1)),ex.test(a)&&(n[o]=a.indexOf("%")!==-1?ss(a,yo):a,e))break}return n};var tx=(t,e,r={})=>{if(!uE.test(t))throw new Error("Invalid cookie name");let n=`${t}=${e}`;if(t.startsWith("__Secure-")&&!r.secure)throw new Error("__Secure- Cookie must have Secure attributes");if(t.startsWith("__Host-")){if(!r.secure)throw new Error("__Host- Cookie must have Secure attributes");if(r.path!=="/")throw new Error('__Host- Cookie must have Path attributes with "/"');if(r.domain)throw new Error("__Host- Cookie must not have Domain attributes")}for(let i of["domain","path","sameSite","priority"])if(r[i]&&/[;\r\n]/.test(r[i]))throw new Error(`${i} must not contain ";", "\\r", or "\\n"`);if(r&&typeof r.maxAge=="number"&&r.maxAge>=0){if(r.maxAge>3456e4)throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");n+=`; Max-Age=${r.maxAge|0}`}if(r.domain&&r.prefix!=="host"&&(n+=`; Domain=${r.domain}`),r.path&&(n+=`; Path=${r.path}`),r.expires){if(r.expires.getTime()-Date.now()>3456e7)throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");n+=`; Expires=${r.expires.toUTCString()}`}if(r.httpOnly&&(n+="; HttpOnly"),r.secure&&(n+="; Secure"),r.sameSite&&(n+=`; SameSite=${r.sameSite.charAt(0).toUpperCase()+r.sameSite.slice(1)}`),r.priority&&(n+=`; Priority=${r.priority.charAt(0).toUpperCase()+r.priority.slice(1)}`),r.partitioned){if(!r.secure)throw new Error("Partitioned Cookie must have Secure attributes");n+="; Partitioned"}return n},Fc=(t,e,r)=>(e=encodeURIComponent(e),tx(t,e,r));var bd=(t,e,r)=>{let n=t.req.raw.headers.get("Cookie");if(typeof e=="string"){if(!n)return;let s=e;return r==="secure"?s="__Secure-"+e:r==="host"&&(s="__Host-"+e),xd(n,s)[s]}return n?xd(n):{}};var rx=(t,e,r)=>{let n;return r?.prefix==="secure"?n=Fc("__Secure-"+t,e,{path:"/",...r,secure:!0}):r?.prefix==="host"?n=Fc("__Host-"+t,e,{...r,path:"/",secure:!0,domain:void 0}):n=Fc(t,e,{path:"/",...r}),n},qo=(t,e,r,n)=>{let i=rx(e,r,n);t.header("Set-Cookie",i,{append:!0})};var jo=(t,e,r)=>{let n=bd(t,e,r?.prefix);return qo(t,e,"",{...r,maxAge:0}),n};function Sd(t,e){let r=t.tokenStrategy;return typeof r=="string"?r:r[e??"customer"]??"body"}function Vc(t){return t==="cookie"||t==="both"}function nx(t){let e=t.tokenStrategy;return typeof e=="string"?Vc(e):Object.values(e).some(r=>r!==void 0&&Vc(r))}function Nd(t,e){let r=t.refreshTokenCookie?.name??"refresh_token",n=t.audienceCookieNames?.cookieNames;return n?n[e??"customer"]??r:r}function ix(t,e){return e?e===t.audienceCookieNames?.systemTenantId?"system":"tenant":"customer"}function dE(t,e,r,n,i){let s=r.refreshTokenCookie??{},o=i??ix(r,n),a=Sd(r,o),c=e.refreshToken;if(typeof c!="string"||!c)return e;if(a==="cookie"||a==="both"){let l=Nd(r,o);sx(t,c,{...s,name:l})}if(a==="cookie"){let{refreshToken:l,...d}=e;return d}return e}function pE(t,e,r){if(!(r?Vc(Sd(e,r)):nx(e)))return;let i=e.refreshTokenCookie??{},s={path:i.path??"/",...i.domain?{domain:i.domain}:{}},o=e.audienceCookieNames?.cookieNames;if(o&&!r){let c=i.name??"refresh_token",l=new Set([o.customer??c,o.tenant??c,o.system??c]);for(let d of l)jo(t,d,s);return}let a=Nd(e,r);jo(t,a,s)}function Bc(t,e,r){let n=Sd(e,r);if(!Vc(n)||!t)return;let i=Nd(e,r);return ox(t,i)}function sx(t,e,r){qo(t,r.name??"refresh_token",e,{httpOnly:r.httpOnly??!0,secure:r.secure??!0,sameSite:r.sameSite??"Strict",path:r.path??"/",maxAge:r.maxAge??720*60*60,...r.domain?{domain:r.domain}:{}})}function ox(t,e){for(let r of t.split(";")){let[n,...i]=r.trim().split("=");if(n?.trim()===e)try{return decodeURIComponent(i.join("="))}catch{return i.join("=")}}}var fE=new Set(["customer","tenant","system"]);function Ue(t,e){let r=[];if(e.auth!==!1&&r.push(_o({engine:t.policy.auth})),e.input?.body||e.input?.query||e.input?.params){let a={};e.input?.body&&(a.body=e.input.body),e.input?.query&&(a.query=e.input.query),e.input?.params&&(a.params=e.input.params),r.push(xo(a))}let n=async a=>{let c=sr(a);try{let l;if(!e.input?.body&&(a.req.header("content-type")??"").includes("application/json"))try{l=await a.req.json()}catch{l=void 0}let d=a.get("authResult"),p={body:bo(a),query:No(a),params:So(a),user:d?.user??{id:"anonymous"},tenantContext:a.get("tenantContext"),traceId:c,cookieHeader:a.req.header("cookie"),authorizationHeader:a.req.header("authorization"),authContextHeader:a.req.header("x-auth-context"),userAgentHeader:a.req.header("user-agent"),originHeader:a.req.header("origin"),rawBody:l},m=await e.handler(p),E=e.successStatus;if(m.ok&&m.data!==void 0&&e.tokenMode==="auth"){let v=m.data,b=typeof v.tenantId=="string"?v.tenantId:void 0,k=p.authContextHeader,C=b!==void 0?void 0:typeof k=="string"&&fE.has(k)?k:void 0,L=dE(a,v,t,b,C),B={...m,data:L};return qe(a,B,{traceId:c,...E!==void 0?{successStatus:E}:{}})}if(m.ok&&e.tokenMode==="logout"){let v=p.authContextHeader,b=typeof v=="string"&&fE.has(v)?v:void 0;pE(a,t,b)}return qe(a,m,{traceId:c,...E!==void 0?{successStatus:E}:{}})}catch(l){let d=l instanceof Error?l.message:String(l);return console.error(JSON.stringify({level:"error",context:"defineAuthRoute",message:"Route handler error",timestamp:new Date().toISOString(),traceId:c,route:`${e.method} ${e.path}`,error:{message:d}})),qe(a,u(oe.InternalError()),{traceId:c})}},i=[...r,n],o=async(a,c)=>{let l,d=async p=>{if(l||p>=i.length){!l&&c&&await c();return}let m=i[p],E=await m(a,async()=>{await d(p+1)});E instanceof Response&&(l=E)};return await d(0),l};return o.routeMeta={method:e.method,path:e.path,authRequired:e.auth!==!1},o}function jr(t){let e={plugins:t.plugins,security:t.security,system:{systemId:t.system.system.systemId}};return t.plugins.cache&&(e.cache=t.plugins.cache),e}function mE(t){return{plugins:t.plugins,security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts}}}function hE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token}}}function EE(t){return{plugins:{database:t.plugins.database,token:t.plugins.token},security:{refreshTokenLifetimeMinutes:t.security.refreshTokenLifetimeMinutes,refreshTokenGraceWindowMs:t.security.refreshTokenGraceWindowMs??0,...t.security.systemTenantId&&{systemTenantId:t.security.systemTenantId},...t.security.tokenAudiences&&{tokenAudiences:t.security.tokenAudiences}}}}function yE(t){return{plugins:{database:t.plugins.database}}}var dj=we(h(),ht(320)),pj=we(h(),ht(4096));function gE(t){return Ue(t,{method:"POST",path:"/auth/authenticate",auth:!1,tokenMode:"auth",input:{body:Lt.authenticate.body},handler:async e=>{let r=jr(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,userAgent:e.userAgentHeader??"unknown"};return e.authContextHeader==="system"&&t.auth.security.systemTenantId&&(n.tid=t.auth.security.systemTenantId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),e.body.credentialValue!==void 0&&(n.credentialValue=e.body.credentialValue),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),e.body.country!==void 0&&(n.country=e.body.country),e.body.city!==void 0&&(n.city=e.body.city),Mo(n,r)}})}function vE(t){return Ue(t,{method:"POST",path:"/auth/complete-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeChallenge.body},handler:async e=>{let r=jr(t.auth);return Ko({challengeId:e.body.challengeId,code:e.body.code},r)}})}function AE(t){return Ue(t,{method:"POST",path:"/auth/complete-mfa-challenge",auth:!1,tokenMode:"auth",input:{body:Lt.completeMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Ho({challengeId:e.body.challengeId,method:e.body.method,code:e.body.code},r)}})}function TE(t){return Ue(t,{method:"POST",path:"/auth/issue-mfa-challenge",auth:!1,input:{body:Lt.issueMfaChallenge.body},handler:async e=>{let r=jr(t.auth);return Fo({challengeId:e.body.challengeId,method:e.body.method,userId:e.body.userId},r)}})}function qc(t,e){return!e||e.length===0||!t||e.includes("*")?!0:e.includes(t)}var ax=new Set(["customer","tenant","system"]);function _E(t){return Ue(t,{method:"POST",path:"/auth/logout",auth:!1,tokenMode:"logout",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&ax.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=hE(t.auth);return Uc({refreshToken:a},c)}})}function cx(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=r.replace(/-/g,"+").replace(/_/g,"/"),i=atob(n);return JSON.parse(i)}catch{return null}}function Un(t){if(!t?.startsWith("Bearer "))return;let e=t.slice(7),r=cx(e);return typeof r?.sid=="string"?r.sid:void 0}function IE(t){return Ue(t,{method:"GET",path:"/auth/me",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(r){let i=await t.auth.plugins.database.sessions.get(r);if(!i.ok||!i.data||i.data.revokedAt)return u(oe.NotAuthenticated())}let n=yE(t.auth);return Uo({userId:e.user.id},n)}})}var lx=new Set(["customer","tenant","system"]);function xE(t){return Ue(t,{method:"POST",path:"/auth/refresh",auth:!1,tokenMode:"auth",handler:async e=>{let r=e.authContextHeader,n=typeof r=="string"&&lx.has(r)?r:void 0,i=Bc(e.cookieHeader,t,n),s=e.rawBody?.refreshToken,o=typeof s=="string"?s:void 0;if(!o&&i&&!qc(e.originHeader,t.trustedOrigins))return u(oe.NotAuthenticated());let a=o??i;if(!a)return u(oe.ValidationError());let c=EE(t.auth);return Lc({refreshToken:a},c)}})}function bE(t){return Ue(t,{method:"POST",path:"/auth/register",auth:!1,tokenMode:"auth",successStatus:201,input:{body:Lt.register.body},handler:async e=>{let r=mE(t.auth),n={identityType:e.body.identityType,identityValue:e.body.identityValue,credentialType:e.body.credentialType,credentialValue:e.body.credentialValue};return e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),Vo(n,r)}})}function SE(t){return Ue(t,{method:"POST",path:"/auth/select-tenant",auth:!0,tokenMode:"auth",input:{body:Lt.selectTenant.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=Un(e.authorizationHeader);if(!r)return u(oe.NotAuthenticated());let n=jr(t.auth);return Bo({sessionId:r,userId:e.user.id,tenantId:e.body.tenantId},n)}})}var Go={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while listing authenticators")};async function jc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Go.USER_AUTH_NOT_FOUND());if(r.data.userStatus===ye.DELETED)return u(Go.ACCOUNT_DELETED());let i;if(t.method?i=await e.plugins.database.userMfaAuthenticators.findByUserIdAndMethod(t.userId,t.method):i=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId),i.ok===!1)return u(i.errors,i.meta);let s=i.data??[];t.verifiedOnly&&(s=s.filter(a=>a.verifiedAt!==null));let o=s.map(a=>{let c={method:a.method,verifiedAt:a.verifiedAt,createdAt:a.createdAt};return a.id!==void 0&&(c.id=a.id),a.label!==void 0&&(c.label=a.label),a.lastUsedAt!==void 0&&(c.lastUsedAt=a.lastUsedAt),c});return g({authenticators:o,total:o.length})}var un={USER_AUTH_NOT_FOUND:X("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:X("ACCOUNT_DELETED","Account has been deleted"),ACCOUNT_SUSPENDED:X("ACCOUNT_SUSPENDED","Account is suspended"),AUTHENTICATOR_NOT_FOUND:X("AUTHENTICATOR_NOT_FOUND","MFA authenticator not found"),CANNOT_REMOVE_LAST_AUTHENTICATOR:X("CANNOT_REMOVE_LAST_AUTHENTICATOR","Cannot remove the last MFA authenticator when MFA is required. Disable MFA first or add another authenticator."),PASSWORD_REQUIRED:X("PASSWORD_REQUIRED","Password confirmation is required to remove this authenticator"),INVALID_PASSWORD:X("INVALID_PASSWORD","Invalid password"),INTERNAL_ERROR:X("INTERNAL_ERROR","An internal error occurred while removing the authenticator")};var dn={PASSWORD:"password",PASSKEY:"passkey",SIGNATURE:"signature"};async function Gc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(un.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(un.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(un.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok||!i.data)return u(un.AUTHENTICATOR_NOT_FOUND());let s=await e.plugins.database.userMfaAuthenticators.findByUserId(t.userId);if(s.ok===!1)return u(s.errors,s.meta);let o=s.data??[],a=o.filter(b=>b.verifiedAt!==null),c=a[0],l=a.length===1&&c!==void 0&&c.method===t.method&&c.id===t.authenticatorId;if(l&&n.mfaRequired)return u(un.CANNOT_REMOVE_LAST_AUTHENTICATOR());if(t.password&&e.plugins.credential?.password){let b=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(b.ok===!1)return u(b.errors,b.meta);let k=b.data;if(k&&k.value!==null&&(await e.plugins.credential.password.verify({userId:t.userId,credential:{value:k.value,data:k.data??{}},credentialValue:t.password})).ok===!1)return u(un.INVALID_PASSWORD())}let d=await e.plugins.database.userMfaAuthenticators.remove(t.userId,t.method,t.authenticatorId);if(d.ok===!1)return u(d.errors,d.meta);let m=o.filter(b=>b.method===t.method&&(b.id!==t.authenticatorId||b.method!==t.method)).length,E=a.length>1||a.length===1&&!l;await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_removed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method,authenticatorId:t.authenticatorId,mfaStillEnabled:E,remainingCount:m}});let v={method:t.method,mfaStillEnabled:E,remainingCount:m};return t.authenticatorId!==void 0&&(v.authenticatorId=t.authenticatorId),g(v)}var pn={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function $c(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(pn.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(pn.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(pn.ACCOUNT_SUSPENDED());if(!e.plugins.mfa)return u(pn.MFA_NOT_AVAILABLE());let i=e.plugins.mfa[t.method];if(!i?.setup)return u(pn.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let s=await i.setup({userId:t.userId,data:t.data||{}},e);if(s.ok===!1)return u(s.errors,s.meta);if(!s.ok)return u(pn.INTERNAL_ERROR());let o=s.data;if(o.credentialData){let l=await e.plugins.database.userMfaAuthenticators.create({userId:t.userId,method:t.method,verifiedAt:null,data:o.credentialData});if(l.ok===!1)return u(l.errors,l.meta)}await _e({plugins:{audit:e.plugins.audit}},{event:"authenticator_setup_initiated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,method:t.method}});let{credentialData:a,...c}=o;return g({method:t.method,data:c})}var Et={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),MFA_ALREADY_ENABLED:T("MFA_ALREADY_ENABLED","MFA enforcement is already enabled"),MFA_NOT_ENABLED:T("MFA_NOT_ENABLED","MFA enforcement is not enabled"),PASSWORD_REQUIRED:T("PASSWORD_REQUIRED","Password is required to disable MFA enforcement"),INVALID_PASSWORD:T("INVALID_PASSWORD","Invalid password"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found"),PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),METHOD_NOT_VERIFIED:X("METHOD_NOT_VERIFIED",'MFA method "{method}" is not verified. Please setup and verify this method first.'),INVALID_METHOD:X("INVALID_METHOD",'Invalid MFA method "{method}". Allowed methods: totp, webauthn, passkey, hardware, email, sms, phone.'),NO_CHANGES:T("NO_CHANGES","No changes provided. Please specify mfaRequired or mfaMethods."),INTERNAL_ERROR:V.INTERNAL_ERROR};var NE=["totp","webauthn","passkey","hardware"],wE=["email","sms","phone"],ux=new Set([...NE,...wE]);async function Wc(t,e){if(t.mfaRequired===void 0&&t.mfaMethods===void 0)return u(Et.NO_CHANGES());if(t.mfaMethods!==void 0){for(let i of t.mfaMethods)if(!ux.has(i))return u(Et.INVALID_METHOD({method:i}))}if(t.mfaRequired===!1&&!t.password)return u(Et.PASSWORD_REQUIRED());if(t.mfaRequired===!1&&!e.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Et.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Et.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Et.ACCOUNT_SUSPENDED());if(t.mfaRequired!==void 0)if(t.mfaRequired===!0){if(n.mfaRequired)return u(Et.MFA_ALREADY_ENABLED())}else{if(!n.mfaRequired)return u(Et.MFA_NOT_ENABLED());if(!t.password)return u(Et.PASSWORD_REQUIRED());let i=await dx(t.userId,t.password,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaMethods!==void 0&&t.mfaMethods.length>0){let i=await px(t.userId,t.mfaMethods,e);if(i.ok===!1)return u(i.errors,i.meta)}if(t.mfaRequired!==void 0&&t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaSettings(t.userId,{mfaRequired:t.mfaRequired,mfaMethods:t.mfaMethods});if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaRequired!==void 0){let i=await e.plugins.database.userAuths.updateMfaRequired(t.userId,t.mfaRequired);if(i.ok===!1)return u(i.errors,i.meta)}else if(t.mfaMethods!==void 0){let i=await e.plugins.database.userAuths.updateMfaMethods(t.userId,t.mfaMethods);if(i.ok===!1)return u(i.errors,i.meta)}return await _e({plugins:{audit:e.plugins.audit}},{event:"mfa_settings_updated",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId,changes:{...t.mfaRequired!==void 0&&{mfaRequired:{from:n.mfaRequired,to:t.mfaRequired}},...t.mfaMethods!==void 0&&{mfaMethods:{from:n.mfaMethods??[],to:t.mfaMethods}}}}}),g()}async function dx(t,e,r){let n=await r.plugins.database.credentials.getByUserIdAndType(t,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(Et.PASSWORD_CREDENTIAL_NOT_FOUND());if(!r.plugins.credential?.password)return u(Et.PASSWORD_PLUGIN_NOT_CONFIGURED());let s=await r.plugins.credential.password.verify({userId:t,credential:{value:i.value,data:i.data},credentialValue:e});return s.ok===!1?u(s.errors,s.meta):g()}async function px(t,e,r){let n=e.filter(s=>NE.includes(s)),i=e.filter(s=>wE.includes(s));if(n.length>0){let s=await r.plugins.database.userMfaAuthenticators.findByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.method));for(let a of n)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}if(i.length>0){let s=await r.plugins.database.identities.getByUserId(t);if(s.ok===!1)return u(s.errors,s.meta);let o=new Set((s.data??[]).filter(a=>a.verifiedAt!==null).map(a=>a.type));for(let a of i)if(!o.has(a))return u(Et.METHOD_NOT_VERIFIED({method:a}))}return g()}var Tr={MFA_NOT_AVAILABLE:T("MFA_NOT_AVAILABLE","MFA plugin is not configured"),MFA_METHOD_NOT_SUPPORTED:X("MFA_METHOD_NOT_SUPPORTED","MFA method {method} is not supported or not configured"),USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_DELETED:T("ACCOUNT_DELETED","This account has been deleted"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","This account has been suspended"),AUTHENTICATOR_NOT_CONFIGURED:T("AUTHENTICATOR_NOT_CONFIGURED","MFA authenticator is not configured for this user"),INVALID_CODE:T("INVALID_CODE","Invalid MFA code"),DATABASE_ERROR:V.DATABASE_ERROR,INTERNAL_ERROR:V.INTERNAL_ERROR};async function zc(t,e){let r=await e.plugins.database.userAuths.get(t.userId);if(r.ok===!1)return u(r.errors,r.meta);if(!r.ok||!r.data)return u(Tr.USER_AUTH_NOT_FOUND());let n=r.data;if(n.userStatus===ye.DELETED)return u(Tr.ACCOUNT_DELETED());if(n.userStatus===ye.SUSPENDED)return u(Tr.ACCOUNT_SUSPENDED());let i=await e.plugins.database.userMfaAuthenticators.get(t.userId,t.method,t.authenticatorId);if(i.ok===!1)return u(i.errors,i.meta);if(!i.ok)return u(Tr.INTERNAL_ERROR());let s=i.data;if(!s)return u(Tr.AUTHENTICATOR_NOT_CONFIGURED());if(!e.plugins.mfa)return u(Tr.MFA_NOT_AVAILABLE());let o=e.plugins.mfa[t.method];if(!o?.verifyWithCredentials)return u(Tr.MFA_METHOD_NOT_SUPPORTED({method:t.method}));let a=await o.verifyWithCredentials({credentialData:s.data,data:t.data||{}});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Tr.INTERNAL_ERROR());let c=a.data;if(!c.verified)return g({method:t.method,verified:!1,data:c.data||{}});if(!s.verifiedAt){let l=await e.plugins.database.userMfaAuthenticators.update(t.userId,t.method,t.authenticatorId,{verifiedAt:new Date});if(l.ok===!1)return u(l.errors,l.meta);let d=n.mfaMethods||[];if(!d.includes(t.method)){let p=await e.plugins.database.userAuths.updateMfaMethods(t.userId,[...d,t.method]);if(p.ok===!1)return u(p.errors,p.meta)}}return await _e(e,{event:"authenticator_verified",userId:t.userId,system:e.system.system.systemId,data:{method:t.method}}),g({method:t.method,verified:!0,data:c.data||{}})}function $o(t){return{system:{systemId:t.system.system.systemId}}}function RE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email?.appName&&(e.system.email={appName:t.system.email.appName}),e}function OE(t){let e={plugins:{database:t.plugins.database},system:$o(t)};return t.plugins.mfa&&(e.plugins.mfa=t.plugins.mfa),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function kE(t){return{plugins:{database:t.plugins.database},system:$o(t)}}function CE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function DE(t){let e={plugins:{database:t.plugins.database},system:$o(t)},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function PE(t){return Y(t.policy,{method:"GET",path:"/mfa/authenticators",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=kE(t.auth);return jc({userId:e.user.id},r)}})}function UE(t){return Y(t.policy,{method:"DELETE",path:"/mfa/authenticators",auth:!0,input:{body:vr.removeAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=CE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),e.body.password!==void 0&&(n.password=e.body.password),Gc(n,r)}})}function LE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/setup",auth:!0,input:{body:vr.setupAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=RE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),$c(n,r)}})}function ME(t){return Y(t.policy,{method:"PATCH",path:"/mfa/settings",auth:!0,input:{body:vr.updateMfaSettings.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=DE(t.auth),n={userId:e.user.id};return e.body.mfaRequired!==void 0&&(n.mfaRequired=e.body.mfaRequired),e.body.mfaMethods!==void 0&&(n.mfaMethods=e.body.mfaMethods),e.body.password!==void 0&&(n.password=e.body.password),Wc(n,r)}})}function KE(t){return Y(t.policy,{method:"POST",path:"/mfa/authenticators/verify",auth:!0,input:{body:vr.verifyAuthenticator.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=OE(t.auth),n={userId:e.user.id,method:e.body.method};return e.body.data!==void 0&&(n.data=e.body.data),e.body.authenticatorId!==void 0&&(n.authenticatorId=e.body.authenticatorId),zc(n,r)}})}var Jc={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found")};async function Yc(t,e){if(!await e.plugins.database.users.getById(t.userId))return u(Jc.USER_NOT_FOUND());let n=await e.plugins.database.userProviders.findByUserId(t.userId);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(!i)return g([]);let s=i.map(o=>{let a={provider:o.provider,externalId:o.externalId,linkedAt:o.createdAt};return o.externalEmail&&(a.externalEmail=o.externalEmail),o.externalName&&(a.externalName=o.externalName),a});return g(s)}var bt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found. Make sure the provider plugin is registered."),INVALID_PROVIDER_NAME:T("INVALID_PROVIDER_NAME","Invalid provider name"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),EMAIL_REQUIRED:T("EMAIL_REQUIRED","Email is required from OAuth provider"),ACCOUNT_LOCKED:T("ACCOUNT_LOCKED","Account is locked"),SESSION_CREATE_FAILED:T("SESSION_CREATE_FAILED","Failed to create session"),EMAIL_NOT_VERIFIED_BY_PROVIDER:T("EMAIL_NOT_VERIFIED_BY_PROVIDER","This email is not verified by the provider; sign in and link this provider from your account settings")};async function fx(t,e,r){let n=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,t.id);if(n.ok===!1)return u(n.errors,n.meta);let i=n.data;if(i){let c=i.userId,l=await e.plugins.database.userAuths.get(c);if(!l.ok||!l.data)return u(V.DATABASE_ERROR());let d=l.data;if(d.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(d.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED());let p={};if(t.email!==void 0&&t.email!==i.externalEmail&&(p.externalEmail=t.email),t.name!==void 0&&t.name!==i.externalName&&(p.externalName=t.name),t.avatarUrl!==void 0&&t.avatarUrl!==i.externalAvatarUrl&&(p.externalAvatarUrl=t.avatarUrl),Object.keys(p).length>0){let m=await e.plugins.database.userProviders.update(t.provider,t.id,p);if(m.ok===!1)return u(m.errors,m.meta)}return g(c)}let s=null;if(t.email){let c=Lo(or.EMAIL,e.plugins.identity);if(!c)return u(V.PLUGIN_NOT_FOUND());let l=c.normalize(t.email),d=await e.plugins.database.identities.get(or.EMAIL,l);if(d.ok===!1)return u(V.DATABASE_ERROR());if(d.data){if(t.emailVerified!==!0)return u(bt.EMAIL_NOT_VERIFIED_BY_PROVIDER());s=d.data.userId;let p=await e.plugins.database.userAuths.get(s);if(!p.ok||!p.data)return u(V.DATABASE_ERROR());let m=p.data;if(m.userStatus===ye.DELETED)return u(V.ACCOUNT_DELETED());if(m.userStatus===ye.SUSPENDED)return u(V.ACCOUNT_SUSPENDED())}}if(!s){if(!t.email)return u(bt.EMAIL_REQUIRED());s=e.plugins.database.users.generateUserId();let c="",l="";if(t.name){let k=t.name.trim().split(/\s+/);c=k[0]||"",l=k.slice(1).join(" ")||""}let d={id:s,contactEmail:t.email,status:ye.ACTIVE,givenName:c,familyName:l,locale:t.locale||"",createdAt:new Date,updatedAt:new Date};if(!(await e.plugins.database.users.create(d)).ok)return u(V.DATABASE_ERROR());if((await e.plugins.database.userAuths.create({userId:s,userStatus:ye.ACTIVE,mfaRequired:!1,mfaMethods:null})).ok===!1)return await e.plugins.database.users.remove(s),u(V.DATABASE_ERROR());let E=Lo(or.EMAIL,e.plugins.identity);if(!E)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(V.PLUGIN_NOT_FOUND());let v=E.normalize(t.email),b=await e.plugins.database.identities.create({type:or.EMAIL,value:v,userId:s,loginEnabled:!0,verifiedAt:new Date,guards:{}});if(b.ok===!1)return await e.plugins.database.userAuths.remove(s),await e.plugins.database.users.remove(s),u(b.errors,b.meta)}let o={userId:s,provider:t.provider,externalId:t.id,createdAt:new Date};t.email!==void 0&&(o.externalEmail=t.email),t.name!==void 0&&(o.externalName=t.name),t.avatarUrl!==void 0&&(o.externalAvatarUrl=t.avatarUrl);let a=await e.plugins.database.userProviders.create(o);return a.ok===!1?u(a.errors,a.meta):g(s)}async function Xc(t,e){if(!t.provider)return u(bt.INVALID_PROVIDER_NAME());if(!t.code&&!t.credential)return u(bt.MISSING_CODE_OR_TOKEN());let r=e.plugins.oauthProviders?.get(t.provider);if(!r)return u(bt.PROVIDER_NOT_FOUND());try{let n,i="";if(t.credential){if(!r.verifyCredential)return u(bt.PROVIDER_NOT_FOUND());let b=await r.verifyCredential(t.credential);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}else if(t.code){let b=await r.exchangeCodeForToken(t.code);if(b.ok===!1)return u(bt.CODE_EXCHANGE_FAILED());let k=b.data;if(!k)return u(bt.CODE_EXCHANGE_FAILED());i=k.accessToken}if(!n){if(!i)return u(bt.INVALID_ACCESS_TOKEN());let b=await r.getUserProfile(i);if(b.ok===!1)return u(bt.PROFILE_FETCH_FAILED());if(n=b.data,!n)return u(bt.PROFILE_FETCH_FAILED())}let s=await fx(n,e,t);if(!s.ok)return u(s.errors,s.meta);let o=s.data,a={plugins:e.plugins,security:e.security,system:{systemId:e.system.system.systemId}},c=await e.plugins.database.userAuths.get(o);if(!c.ok||!c.data)return u(V.DATABASE_ERROR());let l=await Br({userStatus:c.data.userStatus,userId:o,...t.tenantId&&{tenantId:t.tenantId}},a);if(l.ok===!1)return u(l.errors,l.meta);let{perms:d,roles:p,tenantType:m}=l.data,E={userId:o,...t.tenantId&&{tenantId:t.tenantId},...m&&{tenantType:m},...d!==void 0||p?{permissions:{...p&&{roles:p},...d!==void 0&&{perms:d}}}:{}},v=await On(E,a);return v.ok===!1?u(v.errors,v.meta):(await _e(e,{event:"oauth_login_success",userId:o,system:e.system.system.systemId,data:{provider:t.provider,email:n.email,...t.tenantId&&{tenantId:t.tenantId}}}),await Mc(o,e),g({accessToken:v.data.accessToken,refreshToken:v.data.refreshToken,expiresAt:v.data.expiresAt}))}catch(n){return await _e(e,{event:"oauth_login_error",userId:"",sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:n instanceof Error?n.message:"Unknown error"}}),u(bt.PROFILE_FETCH_FAILED())}}var Mt={PROVIDER_NOT_FOUND:T("PROVIDER_NOT_FOUND","OAuth provider not found"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),MISSING_CODE_OR_TOKEN:T("MISSING_CODE_OR_TOKEN","Either authorization code or access token is required"),CODE_EXCHANGE_FAILED:T("CODE_EXCHANGE_FAILED","Failed to exchange authorization code for access token"),INVALID_ACCESS_TOKEN:T("INVALID_ACCESS_TOKEN","Invalid or expired access token"),PROFILE_FETCH_FAILED:T("PROFILE_FETCH_FAILED","Failed to fetch user profile from OAuth provider"),PROVIDER_ALREADY_LINKED:T("PROVIDER_ALREADY_LINKED","This provider is already linked to your account"),PROVIDER_LINKED_TO_ANOTHER_USER:T("PROVIDER_LINKED_TO_ANOTHER_USER","This provider is already linked to another user account")};async function Qc(t,e){if(!t.code)return u(Mt.MISSING_CODE_OR_TOKEN());if(!await e.plugins.database.users.getById(t.userId))return u(Mt.USER_NOT_FOUND());let n=e.plugins.oauthProviders?.get(t.provider);if(!n)return u(Mt.PROVIDER_NOT_FOUND());try{let i="";if(t.code){let m=await n.exchangeCodeForToken(t.code);if(m.ok===!1)return u(Mt.CODE_EXCHANGE_FAILED());let E=m.data;if(!E)return u(Mt.CODE_EXCHANGE_FAILED());i=E.accessToken}if(!i)return u(Mt.INVALID_ACCESS_TOKEN());let s=await n.getUserProfile(i);if(s.ok===!1)return u(Mt.PROFILE_FETCH_FAILED());let o=s.data;if(!o)return u(Mt.PROFILE_FETCH_FAILED());let a=await e.plugins.database.userProviders.findByProviderAndExternalId(t.provider,o.id);if(a.ok===!1)return u(a.errors,a.meta);let c=a.data;if(c)return c.userId===t.userId?u(Mt.PROVIDER_ALREADY_LINKED()):u(Mt.PROVIDER_LINKED_TO_ANOTHER_USER());let l={userId:t.userId,provider:t.provider,externalId:o.id,createdAt:new Date};o.email!==void 0&&(l.externalEmail=o.email),o.name!==void 0&&(l.externalName=o.name),o.avatarUrl!==void 0&&(l.externalAvatarUrl=o.avatarUrl);let d=await e.plugins.database.userProviders.create(l);if(d.ok===!1)return u(d.errors,d.meta);let p=d.data;return p?(await _e(e,{event:"oauth_provider_linked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,externalId:o.id}}),g(p)):u(Mt.PROFILE_FETCH_FAILED())}catch(i){return await _e(e,{event:"oauth_provider_link_error",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:t.provider,error:i instanceof Error?i.message:"Unknown error"}}),u(Mt.PROFILE_FETCH_FAILED())}}var Es={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),PROVIDER_NOT_LINKED:T("PROVIDER_NOT_LINKED","This provider is not linked to your account"),CANNOT_UNLINK_LAST_PROVIDER:T("CANNOT_UNLINK_LAST_PROVIDER","Cannot unlink the last authentication method. Please add another method first.")};async function Zc(t,e){let r=await e.plugins.database.userProviders.findByUserId(t.userId);if(r.ok===!1)return u(r.errors,r.meta);let n=r.data;if(!n||n.length===0)return u(Es.PROVIDER_NOT_LINKED());let i=n.find(o=>o.provider===t.provider);if(!i)return u(Es.PROVIDER_NOT_LINKED());if(n.length<=1){let o=await e.plugins.database.identities.getByUserId(t.userId);if(!(o.ok&&o.data&&o.data.length>0))return u(Es.CANNOT_UNLINK_LAST_PROVIDER())}let s=await e.plugins.database.userProviders.remove(i.provider,i.externalId);return s.ok===!1?u(s.errors,s.meta):(await _e(e,{event:"oauth_provider_unlinked",userId:t.userId,sessionId:"",system:e.system.system.systemId,data:{provider:i.provider,externalId:i.externalId}}),g())}function HE(t){return Y(t.policy,{method:"GET",path:"/oauth/providers",auth:!0,handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Yc({userId:e.user.id},r)}})}function FE(t){return Y(t.policy,{method:"POST",path:"/oauth/link",auth:!0,input:{body:an.linkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id,provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),Qc(n,r)}})}function VE(t){return Ue(t,{method:"POST",path:"/oauth/callback",auth:!1,tokenMode:"auth",input:{body:an.oauthCallback.body},handler:async e=>{let r=t.auth,n={provider:e.body.provider};return e.body.code!==void 0&&(n.code=e.body.code),e.body.credential!==void 0&&(n.credential=e.body.credential),e.body.state!==void 0&&(n.state=e.body.state),e.body.tenantId!==void 0&&(n.tenantId=e.body.tenantId),Xc(n,r)}})}function BE(t){return Y(t.policy,{method:"POST",path:"/oauth/unlink",auth:!0,input:{body:an.unlinkProvider.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth;return Zc({userId:e.user.id,provider:e.body.provider},r)}})}var Ot={PASSWORD_PLUGIN_NOT_CONFIGURED:T("PASSWORD_PLUGIN_NOT_CONFIGURED","Password credential plugin is not configured"),PASSWORD_CREDENTIAL_NOT_FOUND:T("PASSWORD_CREDENTIAL_NOT_FOUND","Password credential not found. User may not have password authentication set up."),INVALID_CURRENT_PASSWORD:T("INVALID_CURRENT_PASSWORD","Current password is incorrect"),SAME_PASSWORD:T("SAME_PASSWORD","New password cannot be the same as current password"),CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Password reset challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Password reset challenge has expired"),CHALLENGE_ALREADY_USED:T("CHALLENGE_ALREADY_USED","Password reset challenge has already been used"),INVALID_CODE:T("INVALID_CODE","Invalid reset code"),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Please request a new reset code"),EMAIL_SYSTEM_NOT_AVAILABLE:T("EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),SEND_EMAIL_ERROR:T("SEND_EMAIL_ERROR","Failed to send password reset email"),AUTH_SCOPE_MISMATCH:T("AUTH_SCOPE_MISMATCH","Route auth scope does not match challenge scope")},_r={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,PASSWORD_CREDENTIAL_NOT_FOUND:Ot.PASSWORD_CREDENTIAL_NOT_FOUND,INVALID_CURRENT_PASSWORD:Ot.INVALID_CURRENT_PASSWORD,SAME_PASSWORD:Ot.SAME_PASSWORD},fi={EMAIL_SYSTEM_NOT_AVAILABLE:Ot.EMAIL_SYSTEM_NOT_AVAILABLE,SEND_EMAIL_ERROR:Ot.SEND_EMAIL_ERROR},Bt={PASSWORD_PLUGIN_NOT_CONFIGURED:Ot.PASSWORD_PLUGIN_NOT_CONFIGURED,CHALLENGE_NOT_FOUND:Ot.CHALLENGE_NOT_FOUND,CHALLENGE_EXPIRED:Ot.CHALLENGE_EXPIRED,CHALLENGE_ALREADY_USED:Ot.CHALLENGE_ALREADY_USED,INVALID_CODE:Ot.INVALID_CODE,TOO_MANY_ATTEMPTS:Ot.TOO_MANY_ATTEMPTS,AUTH_SCOPE_MISMATCH:Ot.AUTH_SCOPE_MISMATCH};async function ys(t,e){if(!e.plugins.credential?.password)return u(_r.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.credentials.getByUserIdAndType(t.userId,dn.PASSWORD);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(_r.PASSWORD_CREDENTIAL_NOT_FOUND());let i=n.data;if(!i.value)return u(_r.PASSWORD_CREDENTIAL_NOT_FOUND());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.currentPassword})).ok===!1)return u(_r.INVALID_CURRENT_PASSWORD());if((await r.verify({userId:t.userId,credential:{value:i.value,data:i.data},credentialValue:t.newPassword})).ok===!0)return u(_r.SAME_PASSWORD());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(_r.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.update(i.id,{value:c});if(l.ok===!1)return u(l.errors,l.meta);let d=await e.plugins.database.sessions.revokeAllByUserId(t.userId,t.currentSessionId);return d.ok===!1&&console.error("Failed to revoke sessions after password change:",d.errors),await _e(e,{event:"password_changed",userId:t.userId,system:e.system.system.systemId,data:{userId:t.userId}}),g()}async function gs(t,e){if(!e.plugins.emailSystem)return u(fi.EMAIL_SYSTEM_NOT_AVAILABLE());let r=t.email.toLowerCase().trim(),n=await e.plugins.database.identities.get("email",r),i=ln(6),s=await qr(i),o=new Date(Date.now()+e.security.verificationCodeExpiryMinutes*60*1e3);if(!n.ok||!n.data)return g({challengeId:`fake_challenge_${Date.now()}`,expiresAt:o});let a=n.data,c=a.pendingVerification;if(c&&c.purpose===Ie.PASSWORD_RESET&&c.channel==="email"&&c.resendAvailableAt&&c.resendAvailableAt>new Date)return g({challengeId:c.challengeId,expiresAt:c.expiresAt});let l=e.plugins.database.challenges.generateChallengeId(),d=await e.plugins.database.challenges.create({id:l,userId:a.userId,purpose:Ie.PASSWORD_RESET,status:Fe.PENDING,method:"email",identityType:"email",identityValue:r,codeHash:s,attempts:0,maxAttempts:e.security.maxChallengeAttempts,expiresAt:o});if(d.ok===!1)return u(d.errors,d.meta);if((await e.plugins.emailSystem.send({to:r,template:"password-reset",variables:{code:i,challengeId:l,expiresAt:o.toISOString(),purpose:Ie.PASSWORD_RESET,appName:e.system.email?.appName||"Auth Craft",appUrl:e.system.email?.appUrl||"",supportEmail:e.system.email?.supportEmail||"",...t.authContext?{authContext:t.authContext}:{}}})).ok===!1)return await e.plugins.database.challenges.remove(l),u(fi.SEND_EMAIL_ERROR());let m=Math.max(0,e.security.verificationResendCooldownSeconds),E=m>0?new Date(Date.now()+m*1e3):null,v=!c||c.purpose===Ie.PASSWORD_RESET;return await Promise.all([v?e.plugins.database.identities.update("email",r,{pendingVerification:{challengeId:l,purpose:Ie.PASSWORD_RESET,channel:"email",expiresAt:o,resendAvailableAt:E}}):Promise.resolve(),_e(e,{event:"password_reset_requested",userId:a.userId,system:e.system.system.systemId,data:{email:r,challengeId:l}})]),g({challengeId:l,expiresAt:o})}async function vs(t,e){if(!e.plugins.credential?.password)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let r=e.plugins.credential.password,n=await e.plugins.database.challenges.get(t.challengeId);if(n.ok===!1)return u(n.errors,n.meta);if(!n.ok||!n.data)return u(Bt.CHALLENGE_NOT_FOUND());let i=n.data;if(i.purpose!==Ie.PASSWORD_RESET)return u(Bt.CHALLENGE_NOT_FOUND());if(i.status!==Fe.PENDING)return u(Bt.CHALLENGE_ALREADY_USED());if(i.expiresAt<new Date)return u(Bt.CHALLENGE_EXPIRED());let s=await e.plugins.database.challenges.incrementAttempts(t.challengeId,i.maxAttempts);if(s.ok===!1)return s.errors.some(p=>p.code==="ATTEMPTS_EXCEEDED")?u(Bt.TOO_MANY_ATTEMPTS()):u(s.errors,s.meta);if(!i.codeHash)return u(Bt.INVALID_CODE());if(!await ps(t.code,i.codeHash))return u(Bt.INVALID_CODE());let a=await r.create({value:t.newPassword});if(a.ok===!1)return u(a.errors,a.meta);if(!a.ok)return u(Bt.PASSWORD_PLUGIN_NOT_CONFIGURED());let c=a.data.value,l=await e.plugins.database.credentials.getByUserIdAndType(i.userId,dn.PASSWORD);if(l.ok===!1)return u(l.errors,l.meta);if(l.ok&&l.data){let p=await e.plugins.database.credentials.update(l.data.id,{value:c});if(p.ok===!1)return u(p.errors,p.meta)}else{let p=await e.plugins.database.credentials.create({userId:i.userId,type:dn.PASSWORD,value:c,data:{},revokedAt:null,lastUsedAt:null});if(p.ok===!1)return u(p.errors,p.meta)}await e.plugins.database.challenges.remove(t.challengeId);let d=await e.plugins.database.sessions.revokeAllByUserId(i.userId);return d.ok===!1&&console.error("Failed to revoke sessions after password reset:",d.errors),await _e(e,{event:"password_reset_completed",userId:i.userId,system:e.system.system.systemId,data:{challengeId:t.challengeId}}),g()}var el={NO_CHANGES_PROVIDED:T("NO_CHANGES_PROVIDED","At least one field must be provided to update the profile")};async function tl(t,e){if(!(t.email!==void 0||t.phone!==void 0||t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.metadata!==void 0))return u(el.NO_CHANGES_PROVIDED());if(!(await e.plugins.database.users.getById(t.userId)).ok)return u(V.NOT_FOUND());let i={};if(t.email!==void 0&&(i.contactEmail=t.email),t.phone!==void 0&&(i.contactPhone=t.phone),t.displayName!==void 0&&(i.displayName=t.displayName),t.givenName!==void 0&&(i.givenName=t.givenName),t.familyName!==void 0&&(i.familyName=t.familyName),t.avatarUrl!==void 0&&(i.avatarUrl=t.avatarUrl),t.locale!==void 0&&(i.locale=t.locale),t.metadata!==void 0&&(i.metadata=t.metadata),(await e.plugins.database.users.updateProfile(t.userId,i)).ok===!1)return u(V.INTERNAL_ERROR());await _e(e,{event:"user_profile_updated",userId:t.userId,system:e.system.system.systemId,data:{updatedFields:Object.keys(i)}});let o=await e.plugins.database.users.getById(t.userId);return!o.ok||o.data===null?u(V.NOT_FOUND()):g(o.data)}function As(t){let e={plugins:{database:t.plugins.database},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,maxChallengeAttempts:t.security.maxChallengeAttempts,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds},system:{system:{systemId:t.system.system.systemId}}},r=t.plugins.credential?.password;return r&&(e.plugins.credential={password:r}),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function qE(t){return Ue(t,{method:"PATCH",path:"/password/change",auth:!0,input:{body:sn.changePassword.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=As(t.auth),n=e.body,i=Un(e.authorizationHeader);return ys({userId:e.user.id,currentPassword:n.currentPassword,newPassword:n.newPassword,...i?{currentSessionId:i}:{}},r)}})}function jE(t){return Ue(t,{method:"POST",path:"/password/forgot",auth:!1,input:{body:sn.forgotPassword.body},handler:async e=>{let r=As(t.auth),n={email:e.body.email};return e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),gs(n,r)}})}function GE(t){return Y(t.policy,{method:"POST",path:"/password/reset",auth:!1,input:{body:sn.resetPassword.body},handler:async e=>{let r=As(t.auth);return vs({challengeId:e.body.challengeId,code:e.body.code,newPassword:e.body.newPassword},r)}})}var Wo={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),FORBIDDEN:T("FORBIDDEN","You are not authorized to delete this session"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to delete session")};async function zo(t,e){return(await e.plugins.database.sessions.revokeByIdAndUserId(t.sessionId,t.userId)).ok===!1?u(Wo.DATABASE_ERROR()):(await _e(e,{event:"session_revoked",userId:t.userId,system:e.system.system.systemId,data:{sessionId:t.sessionId,reason:"user_requested"}}),g())}var Jo={DATABASE_ERROR:T("DATABASE_ERROR","Failed to retrieve sessions")};async function Yo(t,e){let r={};t.limit!==void 0&&(r.limit=t.limit),t.cursor!==void 0&&(r.cursor=t.cursor);let i=t.includeRevoked??!1?await e.plugins.database.sessions.findByUserId(t.userId,Object.keys(r).length>0?r:void 0):await e.plugins.database.sessions.findActiveByUserId(t.userId,Object.keys(r).length>0?r:void 0);if(i.ok===!1)return u(Jo.DATABASE_ERROR());let a=(i.data??[]).sort((c,l)=>l.lastUsedAt.getTime()-c.lastUsedAt.getTime()).map(c=>{let l={id:c.id,tokenId:c.tokenId,createdAt:c.createdAt,expiresAt:c.expiresAt,lastUsedAt:c.lastUsedAt};return c.tenantId&&(l.tenantId=c.tenantId),c.deviceLabel&&(l.deviceLabel=c.deviceLabel),c.country&&(l.country=c.country),c.city&&(l.city=c.city),c.revokedAt!==void 0&&(l.revokedAt=c.revokedAt),c.metadata&&(l.metadata=c.metadata),l});return g(a,i.meta)}var Ts={INVALID_TOKEN:T("INVALID_TOKEN","Invalid or expired token"),SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),DATABASE_ERROR:T("DATABASE_ERROR","Failed to revoke token")};async function Xo(t,e){let r=await e.plugins.token.verifyRefreshToken(t.refreshToken);return r?(await e.plugins.database.sessions.revoke(r.sid)).ok===!1?u(Ts.DATABASE_ERROR()):(await _e(e,{event:"token_revoked",userId:r.sub,system:e.system.system.systemId,data:{sessionId:r.sid,tokenId:r.jti,reason:"manual_revoke"}}),g()):u(Ts.INVALID_TOKEN())}function $E(t){return{plugins:{database:{sessions:t.plugins.database.sessions}}}}function WE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions}},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function zE(t){let e={plugins:{database:{sessions:t.plugins.database.sessions},token:t.plugins.token},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.audit&&(e.plugins.audit=t.plugins.audit),e}function JE(t){return Y(t.policy,{method:"DELETE",path:"/sessions",auth:!0,input:{body:on.deleteSession.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=WE(t.auth);return zo({userId:e.user.id,sessionId:e.body.sessionId},r)}})}function YE(t){return Ue(t,{method:"GET",path:"/sessions",auth:!0,input:{query:on.listSessions.query},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=$E(t.auth),n={userId:e.user.id};e.query.includeRevoked!==void 0&&(n.includeRevoked=e.query.includeRevoked==="true"),e.query.limit!==void 0&&(n.limit=e.query.limit),e.query.cursor!==void 0&&(n.cursor=e.query.cursor);let i=await Yo(n,r);if(!i.ok)return i;let s=Un(e.authorizationHeader);if(s&&i.data){let o=i.data.map(a=>a.id===s?{...a,isCurrent:!0}:a);return g(o,i.meta)}return i}})}function XE(t){return Y(t.policy,{method:"POST",path:"/sessions/revoke",auth:!0,input:{body:on.revokeToken.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=zE(t.auth);return Xo({refreshToken:e.body.refreshToken},r)}})}var se={INVITE_MEMBERS:1,REMOVE_MEMBERS:2,VIEW_MEMBERS:4,CHANGE_MEMBER_PERMISSION:8,UPDATE_MEMBER_PROFILE:16,UPDATE_MEMBER_STATUS:32,VIEW_ACCOUNTS:64,UPDATE_ACCOUNT_PROFILE:128,UPDATE_ACCOUNT_STATUS:256,RESET_ACCOUNT_CREDENTIALS:512,REMOVE_ACCOUNTS:1024},Qo=se.VIEW_ACCOUNTS|se.UPDATE_ACCOUNT_PROFILE|se.UPDATE_ACCOUNT_STATUS|se.RESET_ACCOUNT_CREDENTIALS|se.REMOVE_ACCOUNTS;function Zo(t,e){return t===void 0?!1:(t&e)===e}var wd={[se.INVITE_MEMBERS]:"tenant.member.invite",[se.REMOVE_MEMBERS]:"tenant.member.remove",[se.VIEW_MEMBERS]:"tenant.member.view",[se.CHANGE_MEMBER_PERMISSION]:"tenant.member.permission",[se.UPDATE_MEMBER_PROFILE]:"tenant.member.profile.update",[se.UPDATE_MEMBER_STATUS]:"tenant.member.status.update",[se.VIEW_ACCOUNTS]:"account.view",[se.UPDATE_ACCOUNT_PROFILE]:"account.profile.update",[se.UPDATE_ACCOUNT_STATUS]:"account.status.update",[se.RESET_ACCOUNT_CREDENTIALS]:"account.credentials.reset",[se.REMOVE_ACCOUNTS]:"account.remove"},QE=Object.fromEntries(Object.entries(wd).map(([t,e])=>[e,Number(t)]));function Qt(t){return t?Object.entries(wd).filter(([e])=>(t&Number(e))!==0).map(([,e])=>e):[]}function Ln(t){let e=0;for(let r of t){let n=QE[r];if(n===void 0)throw new Error(`Unknown auth permission: ${r}`);e|=n}return e}var Zt={SYSTEM:"system",DEFAULT:"org"};var ar={PENDING:"pending",ACCEPTED:"accepted",DECLINED:"declined",REVOKED:"revoked",EXPIRED:"expired"};var Gr={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_EXPIRED:T("INVITE_EXPIRED","Invite has expired"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),INVITE_IDENTITY_MISMATCH:T("INVITE_IDENTITY_MISMATCH","This invite was issued to an email/phone you have not verified on your account"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),DATABASE_ERROR:V.DATABASE_ERROR};var mx={IDENTITY_NOT_FOUND:T("IDENTITY_NOT_FOUND","Identity not found"),LOGIN_DISABLED:T("LOGIN_DISABLED","Login is disabled for this identity"),IDENTITY_NOT_VERIFIED:T("IDENTITY_NOT_VERIFIED","Please verify your email/phone before logging in"),INVALID_IDENTITY_FORMAT:T("INVALID_IDENTITY_FORMAT","Invalid identity format"),IDENTITY_ALREADY_EXISTS:T("IDENTITY_ALREADY_EXISTS","This identity is already registered")},hx={GUARD_LOCKED:T("GUARD_LOCKED","Login method temporarily locked due to too many failed attempts. Please try again later or use an alternative method."),TOO_MANY_ATTEMPTS:T("TOO_MANY_ATTEMPTS","Too many failed attempts. Account will be locked after next failure.")},Ex={INVALID_CREDENTIALS:T("INVALID_CREDENTIALS","Invalid credentials provided"),CREDENTIAL_NOT_FOUND:T("CREDENTIAL_NOT_FOUND","Credential not found for this user"),CREDENTIAL_INACTIVE:T("CREDENTIAL_INACTIVE","This credential is no longer active"),CREDENTIAL_EXPIRED:T("CREDENTIAL_EXPIRED","Credential has expired"),CREDENTIAL_PLUGIN_ERROR:T("CREDENTIAL_PLUGIN_ERROR","Credential verification failed")},yx={CHALLENGE_NOT_FOUND:T("CHALLENGE_NOT_FOUND","Challenge not found"),CHALLENGE_EXPIRED:T("CHALLENGE_EXPIRED","Challenge has expired. Please request a new one."),INVALID_CHALLENGE_CODE:T("INVALID_CHALLENGE_CODE","Invalid verification code"),CHALLENGE_ALREADY_COMPLETED:T("CHALLENGE_ALREADY_COMPLETED","Challenge already completed"),TOO_MANY_CHALLENGE_ATTEMPTS:T("TOO_MANY_CHALLENGE_ATTEMPTS","Too many attempts. Please request a new code."),CHALLENGE_RATE_LIMIT:T("CHALLENGE_RATE_LIMIT","Too many verification code requests. Please wait before requesting again.")},gx={USER_AUTH_NOT_FOUND:T("USER_AUTH_NOT_FOUND","User authentication record not found"),ACCOUNT_SUSPENDED:T("ACCOUNT_SUSPENDED","Your account has been suspended. Please contact support."),ACCOUNT_PENDING_VERIFICATION:T("ACCOUNT_PENDING_VERIFICATION","Please verify your account before logging in."),PASSWORD_CHANGE_REQUIRED:T("PASSWORD_CHANGE_REQUIRED","Password change required before login.")},vx={MFA_NOT_CONFIGURED:T("MFA_NOT_CONFIGURED","Multi-factor authentication is required. Please set up MFA first."),MFA_REQUIRED:T("MFA_REQUIRED","Multi-factor authentication required"),INVALID_MFA_CODE:T("INVALID_MFA_CODE","Invalid MFA code"),MFA_METHOD_NOT_SUPPORTED:T("MFA_METHOD_NOT_SUPPORTED","MFA method not supported"),MFA_CHALLENGE_NOT_FOUND:T("MFA_CHALLENGE_NOT_FOUND","MFA challenge not found"),MFA_CHALLENGE_EXPIRED:T("MFA_CHALLENGE_EXPIRED","MFA challenge has expired. Please restart login."),INVALID_BACKUP_CODE:T("INVALID_BACKUP_CODE","Invalid backup code"),BACKUP_CODE_ALREADY_USED:T("BACKUP_CODE_ALREADY_USED","This backup code has already been used")},Ax={SESSION_NOT_FOUND:T("SESSION_NOT_FOUND","Session not found"),SESSION_EXPIRED:T("SESSION_EXPIRED","Session has expired. Please login again."),SESSION_REVOKED:T("SESSION_REVOKED","Session has been revoked"),INVALID_SESSION:T("INVALID_SESSION","Invalid session")},Tx={TOKEN_NOT_FOUND:T("TOKEN_NOT_FOUND","Token not found"),TOKEN_EXPIRED:T("TOKEN_EXPIRED","Token has expired"),TOKEN_REVOKED:T("TOKEN_REVOKED","Token has been revoked. Please login again."),INVALID_TOKEN:T("INVALID_TOKEN","Invalid token"),TOKEN_VERIFICATION_FAILED:T("TOKEN_VERIFICATION_FAILED","Token verification failed")},kt={NOT_MEMBER_OF_TENANT:T("NOT_MEMBER_OF_TENANT","You are not a member of this organization"),SUSPENDED_IN_TENANT:T("SUSPENDED_IN_TENANT","Your access to this organization has been suspended"),REMOVED_FROM_TENANT:T("REMOVED_FROM_TENANT","You have been removed from this organization"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Organization not found"),INVITATION_REQUIRED:T("INVITATION_REQUIRED","Please accept the invitation before accessing this organization"),INSUFFICIENT_TENANT_PERMISSIONS:T("INSUFFICIENT_TENANT_PERMISSIONS","You do not have permission to perform this action in this organization"),ACCOUNT_PERMS_SYSTEM_ONLY:T("ACCOUNT_PERMS_SYSTEM_ONLY","Account permissions can only be granted in system tenants")},Z$={...mx,...hx,...Ex,...yx,...gx,...vx,...Ax,...Tx,...kt};async function _s(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Gr.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let k=await s.tenantInvites.getById(r);if(!k.ok)return u(k.errors,k.meta);o=k.data}else if(n){let k=await s.tenantInvites.getByToken(n);if(!k.ok)return u(k.errors,k.meta);o=k.data}if(!o)return u(Gr.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Gr.INVITE_NOT_PENDING());if(o.expiresAt<new Date)return u(Gr.INVITE_EXPIRED());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Gr.INVITE_USER_MISMATCH());if(!o.inviteeUserId&&(o.inviteeEmail||o.inviteePhone)){let k=await s.identities.getByUserId(i);if(!k.ok)return u(k.errors,k.meta);let C=k.data.filter(j=>j.verifiedAt!==null),L=(j,$)=>{let te=$.trim().toLowerCase();return C.some(A=>A.type===j&&A.value.trim().toLowerCase()===te)},B=o.inviteeEmail?L("email",o.inviteeEmail):!1,G=o.inviteePhone?L("phone",o.inviteePhone):!1;if(!B&&!G)return u(Gr.INVITE_IDENTITY_MISMATCH())}let a=await s.tenantMembers.get(o.tenantId,i);if(!a.ok)return u(a.errors,a.meta);if(a.data&&a.data.status!==lt.REMOVED)return u(Gr.ALREADY_MEMBER());let c=await s.tenants.get(o.tenantId);if(!c.ok)return u(c.errors,c.meta);if(o.authPerm!==void 0&&(o.authPerm&Qo)!==0){if(!c.data)return u(kt.TENANT_NOT_FOUND());if(c.data.type!==Zt.SYSTEM)return u(kt.ACCOUNT_PERMS_SYSTEM_ONLY())}let l={tenantId:o.tenantId,userId:i,status:lt.ACTIVE,isOwner:!1,tenantType:o.tenantType};c.data?.parentTenantId!==void 0&&(l.parentTenantId=c.data.parentTenantId),o.roles!==void 0&&(l.roles=o.roles),o.perms!==void 0&&(l.perms=o.perms),o.authPerm!==void 0&&(l.authPerm=o.authPerm);let d=await s.tenantMembers.create(l);if(!d.ok)return u(d.errors,d.meta);let p={tenantId:o.tenantId,userId:i},m=await s.users.getById(i);m.ok&&m.data&&(m.data.contactEmail&&(p.contactEmail=m.data.contactEmail),m.data.contactPhone&&(p.contactPhone=m.data.contactPhone),m.data.displayName&&(p.displayName=m.data.displayName),m.data.givenName&&(p.givenName=m.data.givenName),m.data.familyName&&(p.familyName=m.data.familyName),m.data.avatarUrl&&(p.avatarUrl=m.data.avatarUrl),m.data.locale&&(p.locale=m.data.locale)),o.displayName&&(p.displayName=o.displayName),o.givenName&&(p.givenName=o.givenName),o.familyName&&(p.familyName=o.familyName),o.jobTitle&&(p.jobTitle=o.jobTitle);let E=await s.userTenantProfiles.create(p);if(!E.ok)return u(E.errors,E.meta);let v=await s.tenantInvites.updateStatus(o.id,{status:ar.ACCEPTED,acceptedAt:new Date});if(!v.ok)return u(v.errors,v.meta);let b={tenantId:o.tenantId};return o.roles!==void 0&&(b.roles=o.roles),o.perms!==void 0&&(b.perms=o.perms),o.authPerm!==void 0&&(b.authPerm=o.authPerm),g(b)}var mi={USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),TENANT_NOT_FOUND:T("TENANT_NOT_FOUND","Tenant not found"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only an owner can grant CHANGE_MEMBER_PERMISSION")};async function hi(t,e,r){if(t===void 0||(t&Qo)===0)return g(void 0);let n=await r.get(e);return n.ok?n.data?n.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g(void 0):u(kt.TENANT_NOT_FOUND()):u(n.errors,n.meta)}var rl={NOT_MEMBER:kt.NOT_MEMBER_OF_TENANT,SUSPENDED:kt.SUSPENDED_IN_TENANT,INSUFFICIENT_PERMISSIONS:kt.INSUFFICIENT_TENANT_PERMISSIONS};async function ut(t,e){let{tenantId:r,actorUserId:n,requiredPerm:i}=t,s=await e.tenantMembers.get(r,n);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(rl.NOT_MEMBER());let o=s.data;return o.status!==lt.ACTIVE?u(rl.SUSPENDED()):o.isOwner?g(o):Zo(o.authPerm,i)?g(o):u(rl.INSUFFICIENT_PERMISSIONS())}async function nl(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(t.authPerm!==void 0&&(t.authPerm&se.CHANGE_MEMBER_PERMISSION)!==0&&!o.data.isOwner)return u(mi.CANNOT_ESCALATE_PERMISSIONS());let a=await hi(t.authPerm,r,s.tenants);if(!a.ok)return u(a.errors,a.meta);let c=await s.users.getById(n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(mi.USER_NOT_FOUND());let l=c.data,d=await s.tenantMembers.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(d.data&&d.data.status!==lt.REMOVED)return u(mi.ALREADY_MEMBER());let p=await s.tenants.get(r);if(!p.ok)return u(p.errors,p.meta);if(!p.data)return u(mi.TENANT_NOT_FOUND());let m=p.data,E={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!1,tenantType:m.type};m.parentTenantId!==void 0&&(E.parentTenantId=m.parentTenantId),t.roles!==void 0&&(E.roles=t.roles),t.perms!==void 0&&(E.perms=t.perms),t.authPerm!==void 0&&(E.authPerm=t.authPerm);let v=await s.tenantMembers.create(E);if(!v.ok)return u(v.errors,v.meta);let b={tenantId:r,userId:n};l.contactEmail&&(b.contactEmail=l.contactEmail),l.contactPhone&&(b.contactPhone=l.contactPhone),l.displayName&&(b.displayName=l.displayName),l.givenName&&(b.givenName=l.givenName),l.familyName&&(b.familyName=l.familyName),l.avatarUrl&&(b.avatarUrl=l.avatarUrl),l.locale&&(b.locale=l.locale),t.contactEmail!==void 0&&(b.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(b.contactPhone=t.contactPhone),t.displayName!==void 0&&(b.displayName=t.displayName),t.givenName!==void 0&&(b.givenName=t.givenName),t.familyName!==void 0&&(b.familyName=t.familyName),t.avatarUrl!==void 0&&(b.avatarUrl=t.avatarUrl),t.locale!==void 0&&(b.locale=t.locale),t.jobTitle!==void 0&&(b.jobTitle=t.jobTitle),t.bio!==void 0&&(b.bio=t.bio),t.metadata!==void 0&&(b.metadata=t.metadata);let k=await s.userTenantProfiles.create(b);return k.ok?g({tenantId:r,userId:n}):u(k.errors,k.meta)}var Is={TENANT_ALREADY_HAS_OWNER:T("TENANT_ALREADY_HAS_OWNER","This tenant already has an owner"),USER_NOT_FOUND:T("USER_NOT_FOUND","User not found"),SYSTEM_TYPE_FORBIDDEN:T("SYSTEM_TYPE_FORBIDDEN","System tenants can only be created via admin CLI"),DATABASE_ERROR:V.DATABASE_ERROR};async function il(t,e){let{tenantId:r,userId:n,tenantType:i,parentTenantId:s,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k}=t,C=e.plugins.database,L=i??"org";if(L===Zt.SYSTEM)return u(Is.SYSTEM_TYPE_FORBIDDEN());let B=await C.users.getById(n);if(!B.ok)return u(B.errors,B.meta);if(!B.data)return u(Is.USER_NOT_FOUND());let G=await C.tenants.get(r);if(!G.ok)return u(G.errors,G.meta);if(!G.data){let S={id:r,type:L,ownerId:n};s!==void 0&&(S.parentTenantId=s);let y=await C.tenants.create(S);if(!y.ok)return u(y.errors,y.meta)}let j=await C.tenantMembers.hasOwner(r);if(!j.ok)return u(j.errors,j.meta);if(j.data)return u(Is.TENANT_ALREADY_HAS_OWNER());let $=G.data?.parentTenantId??s,te={tenantId:r,userId:n,status:lt.ACTIVE,isOwner:!0,tenantType:L};$!==void 0&&(te.parentTenantId=$);let A=await C.tenantMembers.create(te);if(!A.ok)return u(A.errors,A.meta);let x=await C.userTenantProfiles.create({tenantId:r,userId:n,contactEmail:o,contactPhone:a,displayName:c,displayNameSource:l,givenName:d,familyName:p,avatarUrl:m,locale:E,jobTitle:v,bio:b,metadata:k});return x.ok?g({tenantId:r,userId:n}):u(x.errors,x.meta)}async function sl(t,e){let{email:r,phone:n}=t,i=e.plugins.database,s=[],o=new Set;if(r){let a=await i.tenantInvites.findPendingByEmail(r);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}if(n){let a=await i.tenantInvites.findPendingByPhone(n);if(!a.ok)return u(a.errors,a.meta);for(let c of a.data)if(!o.has(c.id)){o.add(c.id);let l={inviteId:c.id,tenantId:c.tenantId,expiresAt:c.expiresAt};c.roles!==void 0&&(l.roles=c.roles),c.perms!==void 0&&(l.perms=c.perms),s.push(l)}}return g({pendingInvites:s})}var Ei={INVITE_IDENTIFIER_REQUIRED:T("INVITE_IDENTIFIER_REQUIRED","Either inviteId or inviteToken is required"),INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),INVITE_USER_MISMATCH:T("INVITE_USER_MISMATCH","This invite is for a different user"),DATABASE_ERROR:V.DATABASE_ERROR};async function xs(t,e){let{inviteId:r,inviteToken:n,userId:i}=t,s=e.plugins.database;if(!r&&!n)return u(Ei.INVITE_IDENTIFIER_REQUIRED());let o=null;if(r){let c=await s.tenantInvites.getById(r);if(!c.ok)return u(c.errors,c.meta);o=c.data}else if(n){let c=await s.tenantInvites.getByToken(n);if(!c.ok)return u(c.errors,c.meta);o=c.data}if(!o)return u(Ei.INVITE_NOT_FOUND());if(o.status!==ar.PENDING)return u(Ei.INVITE_NOT_PENDING());if(o.inviteeUserId&&o.inviteeUserId!==i)return u(Ei.INVITE_USER_MISMATCH());let a=await s.tenantInvites.updateStatus(o.id,{status:ar.DECLINED,declinedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}async function yi(t,e){let{tenantId:r,userId:n}=t,i=e.plugins.database,[s,o]=await Promise.all([i.tenantMembers.get(r,n),i.userTenantProfiles.get(r,n)]);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(kt.NOT_MEMBER_OF_TENANT());if(!o.ok)return u(o.errors,o.meta);let a=s.data,c=o.data,l={tenantId:a.tenantId,userId:a.userId,status:a.status,authPerm:a.authPerm??0,isOwner:a.isOwner,createdAt:a.createdAt,memberUpdatedAt:a.updatedAt};return a.roles!==void 0&&(l.roles=a.roles),a.perms!==void 0&&(l.perms=a.perms),c&&(c.contactEmail!==void 0&&(l.contactEmail=c.contactEmail),c.contactPhone!==void 0&&(l.contactPhone=c.contactPhone),c.displayName!==void 0&&(l.displayName=c.displayName),c.displayNameSource!==void 0&&(l.displayNameSource=c.displayNameSource),c.givenName!==void 0&&(l.givenName=c.givenName),c.familyName!==void 0&&(l.familyName=c.familyName),c.avatarUrl!==void 0&&(l.avatarUrl=c.avatarUrl),c.locale!==void 0&&(l.locale=c.locale),c.jobTitle!==void 0&&(l.jobTitle=c.jobTitle),c.bio!==void 0&&(l.bio=c.bio),c.metadata!==void 0&&(l.metadata=c.metadata),l.profileUpdatedAt=c.updatedAt),g(l)}var qt={INVITEE_REQUIRED:T("INVITEE_REQUIRED","Either inviteeUserId, inviteeEmail, or inviteePhone is required"),INVITEE_USER_NOT_FOUND:X("INVITEE_USER_NOT_FOUND","User {userId} not found"),ALREADY_MEMBER:T("ALREADY_MEMBER","User is already a member of this tenant"),INVITE_ALREADY_EXISTS:T("INVITE_ALREADY_EXISTS","A pending invite already exists for this user"),MAX_PENDING_INVITES_REACHED:X("MAX_PENDING_INVITES_REACHED","Maximum pending invites ({max}) reached for this tenant"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};function _x(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function bs(t,e){let{tenantId:r,invitedBy:n,inviteeUserId:i,inviteeEmail:s,inviteePhone:o,roles:a,perms:c,authPerm:l,displayName:d,givenName:p,familyName:m,jobTitle:E}=t,v=e.plugins.database,b=await ut({tenantId:r,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:v.tenantMembers});if(!b.ok)return u(b.errors,b.meta);if(l!==void 0&&(l&se.CHANGE_MEMBER_PERMISSION)!==0&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());if(a?.includes("owner")&&!b.data.isOwner)return u(qt.CANNOT_ESCALATE_PERMISSIONS());let k=await hi(l,r,v.tenants);if(!k.ok)return u(k.errors,k.meta);if(!i&&!s&&!o)return u(qt.INVITEE_REQUIRED());if(i){let R=await v.users.getById(i);if(!R.ok)return u(R.errors,R.meta);if(!R.data)return u(qt.INVITEE_USER_NOT_FOUND({userId:i}));let N=await v.tenantMembers.get(r,i);if(!N.ok)return u(N.errors,N.meta);if(N.data&&N.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER());let O=await v.tenantInvites.findByTenantAndUserId(r,i);if(!O.ok)return u(O.errors,O.meta);if(O.data)return u(qt.INVITE_ALREADY_EXISTS())}if(s){let R=await v.identities.get("email",s);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndEmail(r,s);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}if(o){let R=await v.identities.get("phone",o);if(!R.ok)return u(R.errors,R.meta);if(R.data){let O=await v.tenantMembers.get(r,R.data.userId);if(!O.ok)return u(O.errors,O.meta);if(O.data&&O.data.status!==lt.REMOVED)return u(qt.ALREADY_MEMBER())}let N=await v.tenantInvites.findByTenantAndPhone(r,o);if(!N.ok)return u(N.errors,N.meta);if(N.data)return u(qt.INVITE_ALREADY_EXISTS())}let C=await v.tenantInvites.countPendingByTenant(r);if(!C.ok)return u(C.errors,C.meta);if(C.data>=e.security.maxPendingInvitesPerTenant)return u(qt.MAX_PENDING_INVITES_REACHED({max:String(e.security.maxPendingInvitesPerTenant)}));let L,B,G,j=await v.users.getById(n);j.ok&&j.data&&(j.data.displayName!==void 0&&(L=j.data.displayName),j.data.contactEmail!==void 0&&(B=j.data.contactEmail));let $=await v.userTenantProfiles.get(r,n);$.ok&&$.data&&($.data.displayName!==void 0&&(L=$.data.displayName),$.data.jobTitle!==void 0&&(G=$.data.jobTitle));let te=Zt.DEFAULT,A=await v.tenants.get(r);A.ok&&A.data&&(te=A.data.type);let x=v.tenantInvites.generateInviteId(),S=_x(),y=new Date(Date.now()+e.security.inviteExpirationMinutes*60*1e3),_={id:x,tenantId:r,tenantType:te,invitedById:n,status:ar.PENDING,inviteToken:S,expiresAt:y};L!==void 0&&(_.invitedByName=L),B!==void 0&&(_.invitedByEmail=B),G!==void 0&&(_.invitedByJobTitle=G),i!==void 0&&(_.inviteeUserId=i),s!==void 0&&(_.inviteeEmail=s),o!==void 0&&(_.inviteePhone=o),a!==void 0&&(_.roles=a),c!==void 0&&(_.perms=c),l!==void 0&&(_.authPerm=l),d!==void 0&&(_.displayName=d),p!==void 0&&(_.givenName=p),m!==void 0&&(_.familyName=m),E!==void 0&&(_.jobTitle=E);let w=await v.tenantInvites.create(_);return w.ok?g({inviteId:x,inviteToken:S,expiresAt:y}):u(w.errors,w.meta)}async function Ss(t,e){let{tenantId:r,actorUserId:n,status:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);let a={};i!==void 0&&(a.status=i),t.limit!==void 0&&(a.limit=t.limit),t.cursor!==void 0&&(a.cursor=t.cursor);let c=await s.queries.tenantInvites.listByTenant(r,Object.keys(a).length>0?a:void 0);return c.ok?g(c.data,c.meta):u(c.errors,c.meta)}async function Ns(t,e){let{tenantId:r,actorUserId:n}=t,i=e.plugins.database,s=await ut({tenantId:r,actorUserId:n,requiredPerm:se.VIEW_MEMBERS},{tenantMembers:i.tenantMembers});if(!s.ok)return u(s.errors,s.meta);let o={};t.limit!==void 0&&(o.limit=t.limit),t.cursor!==void 0&&(o.cursor=t.cursor);let a=await i.queries.tenantMembers.listByTenant(r,Object.keys(o).length>0?o:void 0);return a.ok?g(a.data,a.meta):u(a.errors,a.meta)}async function ol(t,e){let{userId:r}=t,n=e.plugins.database,i={};t.tenantType!==void 0&&(i.tenantType=t.tenantType),t.parentTenantId!==void 0&&(i.parentTenantId=t.parentTenantId),t.limit!==void 0&&(i.limit=t.limit),t.cursor!==void 0&&(i.cursor=t.cursor);let s=await n.queries.tenants.listByUser(r,Object.keys(i).length>0?i:void 0);return s.ok?g(s.data,s.meta):u(s.errors,s.meta)}var gi={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_REMOVE_LAST_OWNER:T("CANNOT_REMOVE_LAST_OWNER","Cannot remove the last owner of the tenant"),CANNOT_REMOVE_SELF:T("CANNOT_REMOVE_SELF","Cannot remove yourself from the tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Only an owner can remove another owner"),DATABASE_ERROR:V.DATABASE_ERROR};async function ws(t,e){let{tenantId:r,userId:n,actorUserId:i}=t,s=e.plugins.database,o=await ut({tenantId:r,actorUserId:i,requiredPerm:se.REMOVE_MEMBERS},{tenantMembers:s.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(i===n)return u(gi.CANNOT_REMOVE_SELF());let a=await s.tenantMembers.get(r,n);if(!a.ok)return u(a.errors,a.meta);if(!a.data)return u(gi.MEMBER_NOT_FOUND());let c=a.data;if(c.isOwner&&!o.data.isOwner)return u(gi.CANNOT_MODIFY_OWNER());if(c.isOwner){let d=await s.tenantMembers.listByTenant(r);if(!d.ok)return u(d.errors,d.meta);if(d.data.filter(m=>m.isOwner&&m.status===lt.ACTIVE).length<=1)return u(gi.CANNOT_REMOVE_LAST_OWNER())}let l=await s.tenantMembers.remove(r,n);return l.ok?(await s.userTenantProfiles.remove(r,n),g(void 0)):u(l.errors,l.meta)}var ea={INVITE_NOT_FOUND:T("INVITE_NOT_FOUND","Invite not found"),INVITE_NOT_PENDING:T("INVITE_NOT_PENDING","Invite is no longer pending"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rs(t,e){let{inviteId:r,revokedBy:n}=t,i=e.plugins.database,s=await i.tenantInvites.getById(r);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(ea.INVITE_NOT_FOUND());let o=await ut({tenantId:s.data.tenantId,actorUserId:n,requiredPerm:se.INVITE_MEMBERS},{tenantMembers:i.tenantMembers});if(!o.ok)return u(o.errors,o.meta);if(s.data.status!==ar.PENDING)return u(ea.INVITE_NOT_PENDING());let a=await i.tenantInvites.updateStatus(r,{status:ar.REVOKED,revokedAt:new Date});return a.ok?g(void 0):u(a.errors,a.meta)}var Mn={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the permissions of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own permissions"),CANNOT_ESCALATE_PERMISSIONS:T("CANNOT_ESCALATE_PERMISSIONS","Only the tenant owner can grant CHANGE_MEMBER_PERMISSION"),DATABASE_ERROR:V.DATABASE_ERROR};async function Os(t,e){let{tenantId:r,userId:n,actorUserId:i,role:s,perms:o,authPerm:a}=t,c=t.roles??(s!==void 0?[s]:void 0),l=e.plugins.database,d=await ut({tenantId:r,actorUserId:i,requiredPerm:se.CHANGE_MEMBER_PERMISSION},{tenantMembers:l.tenantMembers});if(!d.ok)return u(d.errors,d.meta);let p=d.data;if(i===n)return u(Mn.CANNOT_MODIFY_SELF());let m=await l.tenantMembers.get(r,n);if(!m.ok)return u(m.errors,m.meta);if(!m.data)return u(Mn.MEMBER_NOT_FOUND());if(m.data.isOwner)return u(Mn.CANNOT_MODIFY_OWNER());if(a!==void 0&&!p.isOwner&&(a&se.CHANGE_MEMBER_PERMISSION)!==0)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());if(c?.includes("owner")&&!p.isOwner)return u(Mn.CANNOT_ESCALATE_PERMISSIONS());let E=await hi(a,r,l.tenants);if(!E.ok)return u(E.errors,E.meta);let v={};if(c!==void 0&&(v.roles=c),o!==void 0&&(v.perms=o),a!==void 0&&(v.authPerm=a),Object.keys(v).length>0){let b=await l.tenantMembers.updatePermissions(r,n,v);if(!b.ok)return u(b.errors,b.meta)}return g(void 0)}var ta={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","Member not found in tenant"),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify the status of a tenant owner"),CANNOT_MODIFY_SELF:T("CANNOT_MODIFY_SELF","Cannot modify your own status"),DATABASE_ERROR:V.DATABASE_ERROR};async function Rd(t,e){let{tenantId:r,userId:n,actorUserId:i,status:s}=t,o=e.plugins.database,a=await ut({tenantId:r,actorUserId:i,requiredPerm:se.UPDATE_MEMBER_STATUS},{tenantMembers:o.tenantMembers});if(!a.ok)return u(a.errors,a.meta);if(i===n)return u(ta.CANNOT_MODIFY_SELF());let c=await o.tenantMembers.get(r,n);if(!c.ok)return u(c.errors,c.meta);if(!c.data)return u(ta.MEMBER_NOT_FOUND());if(c.data.isOwner)return u(ta.CANNOT_MODIFY_OWNER());let l=await o.tenantMembers.updateStatus(r,n,s);return l.ok?g(void 0):u(l.errors,l.meta)}var al={MEMBER_NOT_FOUND:T("MEMBER_NOT_FOUND","User is not a member of this tenant"),PROFILE_NOT_FOUND:T("PROFILE_NOT_FOUND","Tenant profile not found"),DATABASE_ERROR:V.DATABASE_ERROR};async function ks(t,e){let{tenantId:r,userId:n,...i}=t,s=e.plugins.database,o=await s.tenantMembers.get(r,n);if(!o.ok)return u(o.errors,o.meta);if(!o.data)return u(al.MEMBER_NOT_FOUND());let a=o.data,c=a.isOwner||Zo(a.authPerm,se.UPDATE_MEMBER_PROFILE),l={};i.contactEmail!==void 0&&(l.contactEmail=i.contactEmail),i.contactPhone!==void 0&&(l.contactPhone=i.contactPhone),i.displayName!==void 0&&(l.displayName=i.displayName,l.displayNameSource="user"),i.givenName!==void 0&&(l.givenName=i.givenName),i.familyName!==void 0&&(l.familyName=i.familyName),i.avatarUrl!==void 0&&(l.avatarUrl=i.avatarUrl),i.locale!==void 0&&(l.locale=i.locale),i.bio!==void 0&&(l.bio=i.bio),i.jobTitle!==void 0&&c&&(l.jobTitle=i.jobTitle),i.metadata!==void 0&&c&&(l.metadata=i.metadata);let d=await s.userTenantProfiles.get(r,n);if(!d.ok)return u(d.errors,d.meta);if(!d.data){let m=await s.userTenantProfiles.create({tenantId:r,userId:n,...l});return m.ok?g(void 0):u(m.errors,m.meta)}let p=await s.userTenantProfiles.update(r,n,l);return p.ok?g(void 0):u(p.errors,p.meta)}var Ix=10080,xx=100;function bx(t){return{plugins:t.auth.plugins,security:{inviteExpirationMinutes:t.auth.security.inviteExpirationMinutes??Ix,maxPendingInvitesPerTenant:t.auth.security.maxPendingInvitesPerTenant??xx}}}var $r=H({tenantId:we(h(),id(1))}),Sx=H({limit:I(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:I(h())}),Nx=we(H({inviteeEmail:I(we(h(),rn())),inviteeUserId:I(h()),inviteePhone:I(h()),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),Cc(t=>!!(t.inviteeEmail??t.inviteeUserId??t.inviteePhone),"inviteeEmail, inviteeUserId, or inviteePhone is required")),ZE=we(H({inviteId:I(h()),inviteToken:I(h())}),Cc(t=>!!(t.inviteId??t.inviteToken),"inviteId or inviteToken is required")),wx=H({inviteId:h()}),Rx=H({status:I(h()),limit:I(we(ge(),ls(Number),$e(),wn(),cs(1),as(100))),cursor:I(h())}),Ox=H({userId:h(),role:I(h()),roles:I(Z(h())),authPerms:I(Z(h()))}),kx=H({userId:h()}),Cx=H({contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))});function ey(t){let{auth:e,policy:r}=t,n=Y(r,{method:"GET",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r},handler:async E=>{let v=await yi({tenantId:E.params.tenantId,userId:E.user.id},e);if(!v.ok)return v;let b=v.data;if(!b)return g({});let{authPerm:k,...C}=b;return g({...C,authPerms:Qt(k)})}}),i=Y(r,{method:"PATCH",path:"/:tenantId/profile",auth:!0,permission:{action:0,resource:"tenant",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Cx},handler:async E=>{let v=E.params.tenantId,b=E.user.id,k={tenantId:v,userId:b},C=E.body;C.contactEmail!==void 0&&(k.contactEmail=C.contactEmail),C.contactPhone!==void 0&&(k.contactPhone=C.contactPhone),C.displayName!==void 0&&(k.displayName=C.displayName),C.givenName!==void 0&&(k.givenName=C.givenName),C.familyName!==void 0&&(k.familyName=C.familyName),C.avatarUrl!==void 0&&(k.avatarUrl=C.avatarUrl),C.locale!==void 0&&(k.locale=C.locale),C.bio!==void 0&&(k.bio=C.bio),C.jobTitle!==void 0&&(k.jobTitle=C.jobTitle),C.metadata!==void 0&&(k.metadata=C.metadata);let L=await ks(k,e);if(!L.ok)return L;let B=await yi({tenantId:v,userId:b},e);if(!B.ok)return B;let G=B.data;if(!G)return g({});let{authPerm:j,...$}=G;return g({...$,authPerms:Qt(j)})}}),s=Y(r,{method:"POST",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Nx},handler:async E=>{let{inviteeEmail:v,inviteeUserId:b,inviteePhone:k,role:C,roles:L,authPerms:B,displayName:G,givenName:j,familyName:$,jobTitle:te}=E.body,A={tenantId:E.params.tenantId,invitedBy:E.user.id};return v!==void 0&&(A.inviteeEmail=v),b!==void 0&&(A.inviteeUserId=b),k!==void 0&&(A.inviteePhone=k),C!==void 0&&(A.role=C),L!==void 0&&(A.roles=L),B!==void 0&&(A.authPerm=Ln(B)),G!==void 0&&(A.displayName=G),j!==void 0&&(A.givenName=j),$!==void 0&&(A.familyName=$),te!==void 0&&(A.jobTitle=te),bs(A,bx(t))}}),o=Y(r,{method:"GET",path:"/:tenantId/invites",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Rx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.status!==void 0&&(v.status=E.query.status),E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ss(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g(k,b.meta)}}),a=Y(r,{method:"POST",path:"/:tenantId/invites/accept",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken);let b=await _s(v,e);if(!b.ok)return b;let k=b.data;if(!k)return b;let{authPerm:C,...L}=k;return g({...L,authPerms:Qt(C)})}}),c=Y(r,{method:"POST",path:"/:tenantId/invites/decline",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.GLOBAL},input:{params:$r,body:ZE},handler:async E=>{let v={userId:E.user.id};return E.body.inviteId!==void 0&&(v.inviteId=E.body.inviteId),E.body.inviteToken!==void 0&&(v.inviteToken=E.body.inviteToken),xs(v,e)}}),l=Y(r,{method:"POST",path:"/:tenantId/invites/revoke",auth:!0,permission:{action:0,resource:"tenant_invite",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:wx},handler:async E=>Rs({inviteId:E.body.inviteId,revokedBy:E.user.id},e)}),d=Y(r,{method:"GET",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,query:Sx},handler:async E=>{let v={tenantId:E.params.tenantId,actorUserId:E.user.id};E.query.limit!==void 0&&(v.limit=E.query.limit),E.query.cursor!==void 0&&(v.cursor=E.query.cursor);let b=await Ns(v,e);if(!b.ok)return b;let k=b.data.map(({authPerm:C,...L})=>({...L,authPerms:Qt(C)}));return g({members:k},b.meta)}}),p=Y(r,{method:"PATCH",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:Ox},handler:async E=>{let v={tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id};return E.body.role!==void 0&&(v.role=E.body.role),E.body.roles!==void 0&&(v.roles=E.body.roles),E.body.authPerms!==void 0&&(v.authPerm=Ln(E.body.authPerms)),Os(v,e)}}),m=Y(r,{method:"DELETE",path:"/:tenantId/members",auth:!0,permission:{action:0,resource:"tenant_member",boundary:tt.TENANT},loadResource:async E=>({tenantId:E.params.tenantId}),input:{params:$r,body:kx},handler:async E=>ws({tenantId:E.params.tenantId,userId:E.body.userId,actorUserId:E.user.id},e)});return nd("/tenants",[n,i,s,o,a,c,l,d,p,m])}function ty(t){return Y(t.policy,{method:"PATCH",path:"/users/profile",auth:!0,input:{body:Do.updateProfile.body},handler:async e=>{if(!e.user)return u(oe.NotAuthenticated());let r=t.auth,n={userId:e.user.id};return e.body.email!==void 0&&(n.email=e.body.email),e.body.phone!==void 0&&(n.phone=e.body.phone),e.body.displayName!==void 0&&(n.displayName=e.body.displayName),e.body.givenName!==void 0&&(n.givenName=e.body.givenName),e.body.familyName!==void 0&&(n.familyName=e.body.familyName),e.body.avatarUrl!==void 0&&(n.avatarUrl=e.body.avatarUrl),e.body.locale!==void 0&&(n.locale=e.body.locale),e.body.metadata!==void 0&&(n.metadata=e.body.metadata),tl(n,r)}})}function cl(t){let e={plugins:{database:t.plugins.database,identity:t.plugins.identity},security:{verificationCodeExpiryMinutes:t.security.verificationCodeExpiryMinutes,verificationResendCooldownSeconds:t.security.verificationResendCooldownSeconds,maxChallengeAttempts:t.security.maxChallengeAttempts},system:{system:{systemId:t.system.system.systemId}}};return t.plugins.smsSystem&&(e.plugins.smsSystem=t.plugins.smsSystem),t.plugins.emailSystem&&(e.plugins.emailSystem=t.plugins.emailSystem),t.plugins.audit&&(e.plugins.audit=t.plugins.audit),t.system.email&&(e.system.email=t.system.email),e}function ry(t){return Ue(t,{method:"POST",path:"/verification/resend",auth:!1,input:{body:ui.resendVerification.body},handler:async e=>{let r=cl(t.auth),n={channel:e.body.channel,identityValue:e.body.identityValue};return e.body.previousChallengeId!==void 0&&(n.previousChallengeId=e.body.previousChallengeId),e.authContextHeader!==void 0&&(n.authContext=e.authContextHeader),fs(n,r)}})}function ny(t){return Y(t.policy,{method:"POST",path:"/verification/verify",auth:!1,input:{body:ui.verifyCode.body},handler:async e=>{let r=cl(t.auth);return hs({challengeId:e.body.challengeId,code:e.body.code},r)}})}var Od="oauth_state",Dx=600;function iy(){let t=new Uint8Array(32);crypto.getRandomValues(t);let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function sy(t,e,r){qo(t,Od,e,{httpOnly:!0,secure:r,sameSite:"Lax",path:"/",maxAge:Dx})}function Px(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function oy(t,e){let r=bd(t,Od);return jo(t,Od,{path:"/"}),!r||!e?!1:Px(r,e)}function Ux(t){let e=t.req.header("x-forwarded-for");if(e){let r=e.split(",")[0]?.trim();if(r)return r}return t.req.header("cf-connecting-ip")??t.req.header("x-real-ip")??"unknown"}async function Lx(t,e){if(e.length!==0)try{let r=await t.req.raw.clone().json();for(let n of e){let i=r[n];if(typeof i=="string"&&i.length>0)return i.toLowerCase().trim()}}catch{}}function ay(t,e){let{limit:r,windowMs:n,keyPrefix:i,identityFields:s=[]}=e;return async(o,a)=>{let c=t.plugins.rateLimiter;if(!c)return a();let l=Ux(o),d=await Lx(o,s),p=[`${i}:ip:${l}`];d&&p.push(`${i}:id:${d}`);for(let m of p){let E=await c.consume(m,{limit:r,windowMs:n});if(!E.allowed){let v=Math.ceil(E.retryAfterMs/1e3);return o.json({errors:[{code:"RATE_LIMIT_EXCEEDED",message:"Too many requests, please try again later"}]},429,{"Retry-After":String(v)})}}return a()}}function Le(t,e){let{method:r,path:n}=e.routeMeta,i=r.toLowerCase();t[i](n,e)}function cy(t,e,r={}){let n=Object.keys(r).length===0,i=o=>n||r[o]!==!1;t.get("/health",o=>o.json({ok:!0},200));let s=(o,a)=>t.use(o,ay(e.auth,a));if(s("/auth/authenticate",{keyPrefix:"login",limit:10,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/register",{keyPrefix:"register",limit:5,windowMs:6e4,identityFields:["identityValue"]}),s("/auth/complete-challenge",{keyPrefix:"complete-challenge",limit:20,windowMs:6e4}),s("/auth/complete-mfa-challenge",{keyPrefix:"complete-mfa",limit:20,windowMs:6e4}),s("/auth/issue-mfa-challenge",{keyPrefix:"issue-mfa",limit:10,windowMs:6e4}),s("/password/forgot",{keyPrefix:"forgot",limit:5,windowMs:3e5,identityFields:["email"]}),s("/password/forgot",{keyPrefix:"forgot-cd",limit:1,windowMs:6e4,identityFields:["email"]}),s("/password/reset",{keyPrefix:"reset",limit:10,windowMs:6e4}),s("/verification/resend",{keyPrefix:"resend",limit:5,windowMs:3e5}),s("/oauth/callback",{keyPrefix:"oauth-callback",limit:20,windowMs:6e4}),s("/oauth/state",{keyPrefix:"oauth-state",limit:30,windowMs:6e4}),i("auth")&&(Le(t,gE(e)),Le(t,bE(e)),Le(t,_E(e)),Le(t,xE(e)),Le(t,IE(e)),Le(t,SE(e)),Le(t,vE(e)),Le(t,AE(e)),Le(t,TE(e))),i("password")&&(Le(t,qE(e)),Le(t,jE(e)),Le(t,GE(e))),i("verification")&&(Le(t,ny(e)),Le(t,ry(e))),i("sessions")&&(Le(t,YE(e)),Le(t,JE(e)),Le(t,XE(e))),i("mfa")&&(Le(t,LE(e)),Le(t,KE(e)),Le(t,PE(e)),Le(t,UE(e)),Le(t,ME(e))),i("oauth")){let o=e.refreshTokenCookie?.secure??!0;t.post("/oauth/state",a=>{let c=iy();return sy(a,c,o),a.json({data:{state:c}},200)}),t.use("/oauth/callback",async(a,c)=>{let l;try{let d=await a.req.raw.clone().json();typeof d.state=="string"&&(l=d.state)}catch{l=void 0}return l!==void 0&&!oy(a,l)?a.json({errors:[{code:"OAUTH_STATE_MISMATCH",message:"Invalid OAuth state"}]},403):c()}),Le(t,VE(e)),Le(t,FE(e)),Le(t,BE(e)),Le(t,HE(e))}i("users")&&Le(t,ty(e)),i("tenants")&&t.route("",ey(e))}function kd(t){td(Fh);let{auth:e,policy:r,tokenStrategy:n="body",refreshTokenCookie:i,trustedOrigins:s,features:o}=t,a={auth:e,policy:r,tokenStrategy:n};i&&(a.refreshTokenCookie=i),s&&s.length>0&&(a.trustedOrigins=s);let c=e.security.tokenAudiences?.cookieNames;if(c){let d={cookieNames:c};e.security.systemTenantId&&(d.systemTenantId=e.security.systemTenantId),a.audienceCookieNames=d}let l=new Vr;return cy(l,a,o),l}async function Kn(t,e,r,n){let i=await ut({tenantId:e,actorUserId:t,requiredPerm:r},{tenantMembers:n.tenantMembers});if(!i.ok)return u(i.errors,i.meta);let s=await n.tenants.get(e);return s.ok?s.data?s.data.type!==Zt.SYSTEM?u(kt.ACCOUNT_PERMS_SYSTEM_ONLY()):g({actor:i.data}):u(kt.TENANT_NOT_FOUND()):u(s.errors,s.meta)}var fn={CANNOT_REMOVE_ACTIVE_ACCOUNT:T("CANNOT_REMOVE_ACTIVE_ACCOUNT","Cannot remove an active account. Suspend or delete the account first."),CANNOT_MODIFY_OWNER:T("CANNOT_MODIFY_OWNER","Cannot modify a system tenant owner. Only another owner can perform this action."),INVALID_STATUS:T("INVALID_STATUS","Invalid account status. Must be active, suspended, or deleted."),NO_CHANGES:T("NO_CHANGES","At least one field must be provided")};var Mx=new Set([ye.ACTIVE,ye.SUSPENDED,ye.DELETED]);async function Cd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=t.status??"active",s={};t.limit!==void 0&&(s.limit=t.limit),t.cursor!==void 0&&(s.cursor=t.cursor);let o=await r.users.getByStatus(i,s);if(!o.ok)return u(o.errors,o.meta);let a=[];for(let c of o.data){let l=await r.users.getById(c);if(l.ok&&l.data){let d=l.data,p={id:d.id,status:d.status,createdAt:d.createdAt,updatedAt:d.updatedAt};d.contactEmail!==void 0&&(p.contactEmail=d.contactEmail),d.contactPhone!==void 0&&(p.contactPhone=d.contactPhone),d.displayName!==void 0&&(p.displayName=d.displayName),a.push(p)}}return g(a,o.meta)}async function Dd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.VIEW_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.users.getById(t.userId);if(!i.ok)return u(i.errors,i.meta);if(!i.data)return u(V.NOT_FOUND());let s=i.data,o=await r.userAuths.get(t.userId),a={id:s.id,status:s.status,createdAt:s.createdAt,updatedAt:s.updatedAt,mfaRequired:o.ok&&o.data?o.data.mfaRequired:!1,mfaMethods:o.ok&&o.data?o.data.mfaMethods:null};return s.contactEmail!==void 0&&(a.contactEmail=s.contactEmail),s.contactPhone!==void 0&&(a.contactPhone=s.contactPhone),s.displayName!==void 0&&(a.displayName=s.displayName),s.givenName!==void 0&&(a.givenName=s.givenName),s.familyName!==void 0&&(a.familyName=s.familyName),s.avatarUrl!==void 0&&(a.avatarUrl=s.avatarUrl),s.locale!==void 0&&(a.locale=s.locale),s.username!==void 0&&(a.username=s.username),s.metadata!==void 0&&(a.metadata=s.metadata),g(a)}async function Pd(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_PROFILE,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(!(t.displayName!==void 0||t.givenName!==void 0||t.familyName!==void 0||t.avatarUrl!==void 0||t.locale!==void 0||t.contactEmail!==void 0||t.contactPhone!==void 0||t.metadata!==void 0))return u(fn.NO_CHANGES());let a={};t.displayName!==void 0&&(a.displayName=t.displayName),t.givenName!==void 0&&(a.givenName=t.givenName),t.familyName!==void 0&&(a.familyName=t.familyName),t.avatarUrl!==void 0&&(a.avatarUrl=t.avatarUrl),t.locale!==void 0&&(a.locale=t.locale),t.contactEmail!==void 0&&(a.contactEmail=t.contactEmail),t.contactPhone!==void 0&&(a.contactPhone=t.contactPhone),t.metadata!==void 0&&(a.metadata=t.metadata);let c=await r.users.updateProfile(t.userId,a);return c.ok?g(void 0):u(c.errors,c.meta)}async function Ud(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.UPDATE_ACCOUNT_STATUS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);if(!Mx.has(t.status))return u(fn.INVALID_STATUS());let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.userAuths.updateStatus(t.userId,t.status);if(!o.ok)return u(o.errors,o.meta);let a=await r.users.syncAuthStatus(t.userId,t.status);return a.ok?g(void 0):u(a.errors,a.meta)}async function Ld(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.RESET_ACCOUNT_CREDENTIALS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.userAuths.get(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());let o=await r.credentials.getByUserId(t.userId);if(!o.ok)return u(o.errors,o.meta);for(let a of o.data){if(t.credentialType!==void 0&&a.type!==t.credentialType)continue;let c=await r.credentials.remove(a.id);if(!c.ok)return u(c.errors,c.meta)}if(t.credentialType===void 0){let a=await r.userAuths.updateMfaSettings(t.userId,{mfaRequired:!1,mfaMethods:[]});if(!a.ok)return u(a.errors,a.meta)}return g(void 0)}async function Md(t,e){let r=e.plugins.database,n=await Kn(t.actorUserId,t.systemTenantId,se.REMOVE_ACCOUNTS,{tenantMembers:r.tenantMembers,tenants:r.tenants});if(!n.ok)return u(n.errors,n.meta);let i=await r.tenantMembers.get(t.systemTenantId,t.userId);if(i.ok&&i.data?.isOwner&&!n.data.actor.isOwner)return u(fn.CANNOT_MODIFY_OWNER());let s=await r.users.getById(t.userId);if(!s.ok)return u(s.errors,s.meta);if(!s.data)return u(V.NOT_FOUND());if(s.data.status===ye.ACTIVE)return u(fn.CANNOT_REMOVE_ACTIVE_ACCOUNT());let o=await r.credentials.getByUserId(t.userId);if(o.ok)for(let l of o.data)await r.credentials.remove(l.id);let a=await r.identities.getByUserId(t.userId);if(a.ok)for(let l of a.data)await r.identities.remove(l.type,l.value);await r.userAuths.remove(t.userId);let c=await r.users.remove(t.userId);return c.ok?g(void 0):u(c.errors,c.meta)}var Ir=H({message:I(h())}),ly=H({message:I(h()),tenantId:h(),userId:h()}),Kd={tenantId:h(),userId:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),displayNameSource:I(Xt(["user","admin","system"])),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))},uy=H({...Kd,status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),memberUpdatedAt:h(),profileUpdatedAt:I(h())}),Kx=H({...Kd,createdAt:h(),updatedAt:h()}),Hx=H({tenantId:h(),userId:h(),status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),isOwner:_t(),createdAt:h(),updatedAt:h(),tenantProfile:I(Kx)}),dy=Z(Hx),py=H({tenantId:h(),userId:h()}),Fx=H({...Kd,status:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerm:I($e()),isOwner:_t(),createdAt:h(),updatedAt:h()}),fy=Z(Fx),Vx=H({id:h(),name:I(h()),email:I(h()),jobTitle:I(h())}),my=H({id:h(),tenantId:h(),invitedBy:Vx,inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:Z(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h()),status:h(),expiresAt:h(),createdAt:h(),updatedAt:h()}),hy=Z(my),Ey=H({inviteId:h(),inviteToken:h(),expiresAt:h()}),yy=H({tenantId:h(),userId:h()}),gy=H({invites:Z(my)}),Bx=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),status:h(),createdAt:h(),updatedAt:h()}),vy=Z(Bx),Ay=H({id:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),status:h(),createdAt:h(),updatedAt:h(),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),username:I(h()),metadata:I(me(h(),ge())),mfaRequired:_t(),mfaMethods:ci(Z(h()))});var ll={limit:I(we($e(),wn())),cursor:I(h())},qx={method:"POST",path:"/tenant/bootstrap-owner",kind:"data",body:H({tenantId:h(),userId:h(),tenantType:I(h()),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),displayNameSource:I(Xt(["user","admin","system"])),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))}),response:ly},jx={method:"POST",path:"/tenant/profile",kind:"data",body:H({tenantId:h(),userId:h()}),response:uy},Gx={method:"POST",path:"/tenant/profile/update",kind:"data",body:H({tenantId:h(),userId:h(),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),bio:I(h()),jobTitle:I(h()),metadata:I(me(h(),ge()))}),response:Ir},$x={method:"POST",path:"/tenant/members/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),...ll}),response:dy},Wx={method:"POST",path:"/tenant/members/update-status",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),status:Xt(["invited","active","suspended","removed"])}),response:Ir},zx={method:"POST",path:"/tenant/members/update-permission",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h()))}),response:Ir},Jx={method:"POST",path:"/tenant/members/remove",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h()}),response:Ir},Yx={method:"POST",path:"/tenant/members/add",kind:"data",body:H({tenantId:h(),userId:h(),actorUserId:h(),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h())),contactEmail:I(h()),contactPhone:I(h()),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),jobTitle:I(h()),bio:I(h()),metadata:I(me(h(),ge()))}),response:py},Xx={method:"POST",path:"/tenant/invites/list",kind:"data",body:H({tenantId:h(),actorUserId:h(),status:I(Xt(["pending","accepted","declined","revoked","expired"])),...ll}),response:hy},Qx={method:"POST",path:"/tenant/invites/create",kind:"data",body:H({tenantId:h(),invitedBy:h(),inviteeUserId:I(h()),inviteeEmail:I(h()),inviteePhone:I(h()),roles:I(Z(h())),perms:I(me(h(),$e())),authPerms:I(Z(h())),displayName:I(h()),givenName:I(h()),familyName:I(h()),jobTitle:I(h())}),response:Ey},_y=H({userId:h(),inviteId:I(h()),inviteToken:I(h())}),Zx={method:"POST",path:"/tenant/invites/accept",kind:"data",body:_y,response:yy},eb={method:"POST",path:"/tenant/invites/decline",kind:"data",body:_y,response:Ir},tb={method:"POST",path:"/tenant/invites/revoke",kind:"data",body:H({inviteId:h(),revokedBy:h()}),response:Ir},rb={method:"POST",path:"/tenant/invites/check-pending",kind:"data",body:H({email:I(h()),phone:I(h())}),response:gy},nb={method:"POST",path:"/user/tenants/list",kind:"data",body:H({userId:h(),tenantType:I(h()),parentTenantId:I(h()),...ll}),response:fy},Cs={actorUserId:h(),systemTenantId:h()},ib={method:"POST",path:"/accounts/list",kind:"data",body:H({...Cs,status:I(Xt(["active","inactive"])),...ll}),response:vy},sb={method:"POST",path:"/accounts/get",kind:"data",body:H({...Cs,userId:h()}),response:Ay},ob={method:"POST",path:"/accounts/update-profile",kind:"data",body:H({...Cs,userId:h(),displayName:I(h()),givenName:I(h()),familyName:I(h()),avatarUrl:I(h()),locale:I(h()),contactEmail:I(h()),contactPhone:I(h()),metadata:I(me(h(),ge()))}),response:Ir},ab={method:"POST",path:"/accounts/update-status",kind:"data",body:H({...Cs,userId:h(),status:Xt(["active","suspended","deleted"])}),response:Ir},cb={method:"POST",path:"/accounts/reset-credentials",kind:"data",body:H({...Cs,userId:h(),credentialType:I(h())}),response:Ir},lb={method:"POST",path:"/accounts/remove",kind:"data",body:H({...Cs,userId:h()}),response:Ir},Je={bootstrapTenantOwner:qx,getTenantProfile:jx,updateTenantProfile:Gx,listTenantMembers:$x,updateTenantMemberStatus:Wx,updateTenantMemberPermission:zx,removeTenantMember:Jx,addMemberToTenant:Yx,listTenantInvites:Xx,inviteToTenant:Qx,acceptInvite:Zx,declineInvite:eb,revokeInvite:tb,checkPendingInvites:rb,listUserTenants:nb,listAccounts:ib,getAccount:sb,updateAccountProfile:ob,updateAccountStatus:ab,resetAccountCredentials:cb,removeAccount:lb};var ub=3,db=10080,pb=100;function fb(t){return{plugins:t.plugins,security:{inviteExpirationMinutes:t.security.inviteExpirationMinutes??db,maxPendingInvitesPerTenant:t.security.maxPendingInvitesPerTenant??pb}}}function Ds(t){return{plugins:{database:t.plugins.database}}}function mb(t){return Zu({auth:{defaultMethods:["jwt"],jwt:{algorithm:t.alg??"EdDSA",publicKey:t.publicKeyJwk,audience:t.audience??"internal",...t.issuer!==void 0?{issuer:t.issuer}:{}}}})}function Hd(t){let{auth:e,internal:r}=t,n=mb(r),i=new Vr;i.use("/*",async(y,_)=>{let w=y.req.header("Authorization");if(!w){await _();return}let R=w.match(/^Bearer\s+(.+)$/i);if(!R){await _();return}let O=R[1].split(".");if(O.length!==3||!O[1]){await _();return}let P;try{let U=O[1].replace(/-/g,"+").replace(/_/g,"/");P=JSON.parse(atob(U))}catch{await _();return}if(P.typ!==ub)return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Service token required"}]},403);if(r.requiredRoles&&r.requiredRoles.length>0){let U=P.roles,K=Array.isArray(U)?U:[];if(!r.requiredRoles.some(J=>K.includes(J)))return y.json({ok:!1,errors:[{code:"FORBIDDEN",message:"Insufficient service roles"}]},403)}await _()});let s=Y(n,{method:"POST",path:"/tenant/bootstrap-owner",auth:!0,input:{body:Je.bootstrapTenantOwner.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId};return y.body.tenantType!==void 0&&(_.tenantType=y.body.tenantType),y.body.contactEmail!==void 0&&(_.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(_.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.displayNameSource!==void 0&&(_.displayNameSource=y.body.displayNameSource),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(_.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(_.locale=y.body.locale),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(_.bio=y.body.bio),y.body.metadata!==void 0&&(_.metadata=y.body.metadata),il(_,e)}}),o=Y(n,{method:"POST",path:"/tenant/profile",auth:!0,input:{body:Je.getTenantProfile.body},handler:async y=>{let _=await yi({tenantId:y.body.tenantId,userId:y.body.userId},e);if(!_.ok)return _;let w=_.data;if(!w)return _;let{authPerm:R,...N}=w;return g({...N,authPerms:Qt(R)})}}),a=Y(n,{method:"POST",path:"/tenant/profile/update",auth:!0,input:{body:Je.updateTenantProfile.body},handler:async y=>{let{tenantId:_,userId:w,...R}=y.body,N={tenantId:_,userId:w};return R.contactEmail!==void 0&&(N.contactEmail=R.contactEmail),R.contactPhone!==void 0&&(N.contactPhone=R.contactPhone),R.displayName!==void 0&&(N.displayName=R.displayName),R.givenName!==void 0&&(N.givenName=R.givenName),R.familyName!==void 0&&(N.familyName=R.familyName),R.avatarUrl!==void 0&&(N.avatarUrl=R.avatarUrl),R.locale!==void 0&&(N.locale=R.locale),R.bio!==void 0&&(N.bio=R.bio),R.jobTitle!==void 0&&(N.jobTitle=R.jobTitle),R.metadata!==void 0&&(N.metadata=R.metadata),ks(N,e)}}),c=Y(n,{method:"POST",path:"/tenant/members/list",auth:!0,input:{body:Je.listTenantMembers.body},handler:async y=>{let _={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await Ns(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),l=Y(n,{method:"POST",path:"/tenant/members/update-status",auth:!0,input:{body:Je.updateTenantMemberStatus.body},handler:async y=>Rd({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId,status:y.body.status},e)}),d=Y(n,{method:"POST",path:"/tenant/members/update-permission",auth:!0,input:{body:Je.updateTenantMemberPermission.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),Os(_,e)}}),p=Y(n,{method:"POST",path:"/tenant/members/remove",auth:!0,input:{body:Je.removeTenantMember.body},handler:async y=>ws({tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId},e)}),m=Y(n,{method:"POST",path:"/tenant/members/add",auth:!0,input:{body:Je.addMemberToTenant.body},handler:async y=>{let _={tenantId:y.body.tenantId,userId:y.body.userId,actorUserId:y.body.actorUserId};return y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),y.body.contactEmail!==void 0&&(_.contactEmail=y.body.contactEmail),y.body.contactPhone!==void 0&&(_.contactPhone=y.body.contactPhone),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.avatarUrl!==void 0&&(_.avatarUrl=y.body.avatarUrl),y.body.locale!==void 0&&(_.locale=y.body.locale),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),y.body.bio!==void 0&&(_.bio=y.body.bio),y.body.metadata!==void 0&&(_.metadata=y.body.metadata),nl(_,e)}}),E=Y(n,{method:"POST",path:"/tenant/invites/list",auth:!0,input:{body:Je.listTenantInvites.body},handler:async y=>{let _={tenantId:y.body.tenantId,actorUserId:y.body.actorUserId};y.body.status!==void 0&&(_.status=y.body.status),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await Ss(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),v=Y(n,{method:"POST",path:"/tenant/invites/create",auth:!0,input:{body:Je.inviteToTenant.body},handler:async y=>{let _={tenantId:y.body.tenantId,invitedBy:y.body.invitedBy};return y.body.inviteeUserId!==void 0&&(_.inviteeUserId=y.body.inviteeUserId),y.body.inviteeEmail!==void 0&&(_.inviteeEmail=y.body.inviteeEmail),y.body.inviteePhone!==void 0&&(_.inviteePhone=y.body.inviteePhone),y.body.roles!==void 0&&(_.roles=y.body.roles),y.body.perms!==void 0&&(_.perms=y.body.perms),y.body.authPerms!==void 0&&(_.authPerm=Ln(y.body.authPerms)),y.body.displayName!==void 0&&(_.displayName=y.body.displayName),y.body.givenName!==void 0&&(_.givenName=y.body.givenName),y.body.familyName!==void 0&&(_.familyName=y.body.familyName),y.body.jobTitle!==void 0&&(_.jobTitle=y.body.jobTitle),bs(_,fb(e))}}),b=Y(n,{method:"POST",path:"/tenant/invites/accept",auth:!0,input:{body:Je.acceptInvite.body},handler:async y=>{let _={userId:y.body.userId};y.body.inviteId!==void 0&&(_.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(_.inviteToken=y.body.inviteToken);let w=await _s(_,e);if(!w.ok)return w;let R=w.data;if(!R)return w;let{authPerm:N,...O}=R;return g({...O,authPerms:Qt(N)})}}),k=Y(n,{method:"POST",path:"/tenant/invites/decline",auth:!0,input:{body:Je.declineInvite.body},handler:async y=>{let _={userId:y.body.userId};return y.body.inviteId!==void 0&&(_.inviteId=y.body.inviteId),y.body.inviteToken!==void 0&&(_.inviteToken=y.body.inviteToken),xs(_,e)}}),C=Y(n,{method:"POST",path:"/tenant/invites/revoke",auth:!0,input:{body:Je.revokeInvite.body},handler:async y=>Rs({inviteId:y.body.inviteId,revokedBy:y.body.revokedBy},e)}),L=Y(n,{method:"POST",path:"/tenant/invites/check-pending",auth:!0,input:{body:Je.checkPendingInvites.body},handler:async y=>{let _={};return y.body.email!==void 0&&(_.email=y.body.email),y.body.phone!==void 0&&(_.phone=y.body.phone),sl(_,e)}}),B=Y(n,{method:"POST",path:"/user/tenants/list",auth:!0,input:{body:Je.listUserTenants.body},handler:async y=>{let _={userId:y.body.userId};y.body.tenantType!==void 0&&(_.tenantType=y.body.tenantType),y.body.parentTenantId!==void 0&&(_.parentTenantId=y.body.parentTenantId),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor);let w=await ol(_,e);if(!w.ok)return w;let R=w.data.map(({authPerm:N,...O})=>({...O,authPerms:Qt(N)}));return g(R,w.meta)}}),G=Y(n,{method:"POST",path:"/accounts/list",auth:!0,input:{body:Je.listAccounts.body},handler:async y=>{let _={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId};return y.body.status!==void 0&&(_.status=y.body.status),y.body.limit!==void 0&&(_.limit=y.body.limit),y.body.cursor!==void 0&&(_.cursor=y.body.cursor),Cd(_,Ds(e))}}),j=Y(n,{method:"POST",path:"/accounts/get",auth:!0,input:{body:Je.getAccount.body},handler:async y=>Dd({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))}),$=Y(n,{method:"POST",path:"/accounts/update-profile",auth:!0,input:{body:Je.updateAccountProfile.body},handler:async y=>{let{actorUserId:_,systemTenantId:w,userId:R,...N}=y.body,O={actorUserId:_,systemTenantId:w,userId:R};return N.displayName!==void 0&&(O.displayName=N.displayName),N.givenName!==void 0&&(O.givenName=N.givenName),N.familyName!==void 0&&(O.familyName=N.familyName),N.avatarUrl!==void 0&&(O.avatarUrl=N.avatarUrl),N.locale!==void 0&&(O.locale=N.locale),N.contactEmail!==void 0&&(O.contactEmail=N.contactEmail),N.contactPhone!==void 0&&(O.contactPhone=N.contactPhone),N.metadata!==void 0&&(O.metadata=N.metadata),Pd(O,Ds(e))}}),te=Y(n,{method:"POST",path:"/accounts/update-status",auth:!0,input:{body:Je.updateAccountStatus.body},handler:async y=>Ud({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId,status:y.body.status},Ds(e))}),A=Y(n,{method:"POST",path:"/accounts/reset-credentials",auth:!0,input:{body:Je.resetAccountCredentials.body},handler:async y=>{let _={actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId};return y.body.credentialType!==void 0&&(_.credentialType=y.body.credentialType),Ld(_,Ds(e))}}),x=Y(n,{method:"POST",path:"/accounts/remove",auth:!0,input:{body:Je.removeAccount.body},handler:async y=>Md({actorUserId:y.body.actorUserId,systemTenantId:y.body.systemTenantId,userId:y.body.userId},Ds(e))});function S(y){let{method:_,path:w}=y.routeMeta,R=_.toLowerCase();i[R](w,y)}return S(s),S(o),S(a),S(c),S(l),S(d),S(p),S(m),S(E),S(v),S(b),S(k),S(C),S(L),S(B),S(G),S(j),S($),S(te),S(A),S(x),i}var Iy=t=>{let e="",r=new Uint8Array(t);for(let n=0,i=r.length;n<i;n++)e+=String.fromCharCode(r[n]);return btoa(e)},xy=t=>{let e=atob(t),r=new Uint8Array(new ArrayBuffer(e.length)),n=e.length/2;for(let i=0,s=e.length-1;i<=n;i++,s--)r[i]=e.charCodeAt(i),r[s]=e.charCodeAt(s);return r};function ra(t){return/[^\x00-\x7F]/.test(t)?encodeURIComponent(t):t}var hb=t=>t.requestContext;var Fd=(t,{isContentTypeBinary:e}={isContentTypeBinary:void 0})=>async(r,n)=>{let i=xb(r),s,o;try{s=i.createRequest(r),o=hb(r)}catch(c){console.error("Error processing request:",c);let l=c instanceof TypeError?new Response("Invalid request",{status:400}):new Response("Internal Server Error",{status:500});return i.createResult(r,l,{isContentTypeBinary:e})}let a=await t.fetch(s,{event:r,requestContext:o,lambdaContext:n});return i.createResult(r,a,{isContentTypeBinary:e})},ul=class{getHeaderValue(t,e){return t?Array.isArray(t[e])?t[e][0]:t[e]:void 0}getDomainName(t){if(t.requestContext&&"domainName"in t.requestContext)return t.requestContext.domainName;let e=this.getHeaderValue(t.headers,"host");if(e)return e;let r="multiValueHeaders"in t?t.multiValueHeaders:{};return this.getHeaderValue(r,"host")}createRequest(t){let e=this.getQueryString(t),r=this.getDomainName(t),n=this.getPath(t),i=`https://${r}${n}`,s=e?`${i}?${e}`:i,o=this.getHeaders(t),a=this.getMethod(t),c={headers:o,method:a};if(t.body){let l=t.isBase64Encoded?xy(t.body):new TextEncoder().encode(t.body);c.body=l,o.set("content-length",l.length.toString())}return new Request(s,c)}async createResult(t,e,r){let n=e.headers.get("content-type"),i=r.isContentTypeBinary??by,s=!!(n&&i(n));if(!s){let c=e.headers.get("content-encoding");s=wb(c)}let a={body:s?Iy(await e.arrayBuffer()):await e.text(),statusCode:e.status,isBase64Encoded:s,..."multiValueHeaders"in t&&t.multiValueHeaders?{multiValueHeaders:{}}:{headers:{}}};return this.setCookies(t,e,a),a.multiValueHeaders?e.headers.forEach((c,l)=>{a.multiValueHeaders[l]=[c]}):e.headers.forEach((c,l)=>{a.headers[l]=c}),a}setCookies(t,e,r){if(e.headers.has("set-cookie")){let n=e.headers.getSetCookie?e.headers.getSetCookie():Array.from(e.headers.entries()).filter(([i])=>i==="set-cookie").map(([,i])=>i);Array.isArray(n)&&(this.setCookiesToResult(r,n),e.headers.delete("set-cookie"))}}},Eb=class extends ul{getPath(t){return t.rawPath}getMethod(t){return t.requestContext.http.method}getQueryString(t){return t.rawQueryString}getCookies(t,e){Array.isArray(t.cookies)&&e.set("Cookie",t.cookies.join("; "))}setCookiesToResult(t,e){t.cookies=e}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,n);return e}},yb=new Eb,gb=class extends ul{getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>r.map(n=>`${encodeURIComponent(e)}=${encodeURIComponent(n)}`).join("&")).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${encodeURIComponent(e)}=${encodeURIComponent(r||"")}`).join("&")}getCookies(t,e){}getHeaders(t){let e=new Headers;if(this.getCookies(t,e),t.headers)for(let[r,n]of Object.entries(t.headers))n&&e.set(r,ra(n));if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}setCookiesToResult(t,e){t.multiValueHeaders={"set-cookie":e}}},vb=new gb,Ab=class extends ul{getHeaders(t){let e=new Headers;if(t.multiValueHeaders){for(let[r,n]of Object.entries(t.multiValueHeaders))if(n&&Array.isArray(n)){let i=ra(n.join("; "));e.set(r,i)}}else for(let[r,n]of Object.entries(t.headers??{}))n&&e.set(r,ra(n));return e}getPath(t){return t.path}getMethod(t){return t.httpMethod}getQueryString(t){return t.multiValueQueryStringParameters?Object.entries(t.multiValueQueryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r.join(`&${e}=`)}`).join("&"):Object.entries(t.queryStringParameters||{}).filter(([,e])=>e).map(([e,r])=>`${e}=${r}`).join("&")}getCookies(t,e){let r;t.multiValueHeaders?r=t.multiValueHeaders.cookie?.join("; "):r=t.headers?t.headers.cookie:void 0,r&&e.append("Cookie",r)}setCookiesToResult(t,e){t.multiValueHeaders?t.multiValueHeaders["set-cookie"]=e:t.headers["set-cookie"]=e[0]}},Tb=new Ab,_b=class extends ul{getPath(t){return t.path}getMethod(t){return t.method}getQueryString(){return""}getHeaders(t){let e=new Headers;if(t.headers){for(let[r,n]of Object.entries(t.headers))if(n){let i=e.get(r);n.forEach(s=>{let o=ra(s);return(!i||!i.includes(o))&&e.append(r,o)})}}return e}getCookies(){}setCookiesToResult(t,e){t.headers={...t.headers,"set-cookie":e}}},Ib=new _b,xb=t=>bb(t)?Tb:Sb(t)?yb:Nb(t)?Ib:vb,bb=t=>t.requestContext?Object.hasOwn(t.requestContext,"elb"):!1,Sb=t=>Object.hasOwn(t,"rawPath"),Nb=t=>t.requestContext?Object.hasOwn(t.requestContext,"serviceArn"):!1,by=t=>!/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(t),wb=t=>t===null?!1:/^(gzip|deflate|compress|br)/.test(t);var Sy=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...t},r=(i=>typeof i=="string"?i==="*"?()=>i:s=>i===s?s:null:typeof i=="function"?i:s=>i.includes(s)?s:null)(e.origin),n=(i=>typeof i=="function"?i:Array.isArray(i)?()=>i:()=>[])(e.allowMethods);return async function(s,o){function a(l,d){s.res.headers.set(l,d)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),e.credentials&&a("Access-Control-Allow-Credentials","true"),e.exposeHeaders?.length&&a("Access-Control-Expose-Headers",e.exposeHeaders.join(",")),s.req.method==="OPTIONS"){e.origin!=="*"&&a("Vary","Origin"),e.maxAge!=null&&a("Access-Control-Max-Age",e.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let d=e.allowHeaders;if(!d?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(d=p.split(/\s*,\s*/))}return d?.length&&(a("Access-Control-Allow-Headers",d.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await o(),e.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};var Rb={systemTenantId:"__system__",maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,maxLockoutDurationMinutes:1440,maxConcurrentSessions:5,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenRotationEnabled:!0,verifySessionOnAuth:!0,refreshTokenGraceWindowMs:1e4,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,maxVerificationCodeFailAttempts:5,verificationCodeExpiryMinutes:10,verificationResendCooldownSeconds:60,maxMfaAttempts:5,mfaCredentialLockoutDurationMinutes:15,mfaChallengeExpiryMinutes:5,maxChallengeAttempts:3,tenantSelectionTokenLifetimeMinutes:5,inviteExpirationMinutes:10080,maxPendingInvitesPerTenant:100,hideDetailedAuthErrors:!0};function vi(t={}){let e={...Rb,...t};return t.accountLockDuration!==void 0&&t.lockoutDurationMinutes===void 0&&(e.lockoutDurationMinutes=Math.floor(t.accountLockDuration/6e4)),t.sessionDuration!==void 0&&t.refreshTokenLifetimeMinutes===void 0&&(e.refreshTokenLifetimeMinutes=Math.floor(t.sessionDuration/6e4)),t.allowMultipleSessions!==void 0&&t.maxConcurrentSessions===void 0&&(e.maxConcurrentSessions=t.allowMultipleSessions?5:1),e}var Vd={LOW:vi({maxFailedAttempts:10,lockoutDurationMinutes:5,progressiveLockoutEnabled:!1,passwordMinLength:6,requireSpecialChars:!1,requireUppercase:!1,requireLowercase:!1,requireNumbers:!1,accessTokenLifetimeMinutes:1440,refreshTokenLifetimeMinutes:129600,refreshTokenGraceWindowMs:3e4}),MEDIUM:vi({maxFailedAttempts:5,lockoutDurationMinutes:30,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:2,passwordMinLength:8,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:60,refreshTokenLifetimeMinutes:43200,refreshTokenGraceWindowMs:1e4}),HIGH:vi({maxFailedAttempts:3,lockoutDurationMinutes:60,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:3,maxLockoutDurationMinutes:2880,maxConcurrentSessions:2,passwordMinLength:12,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:30,refreshTokenLifetimeMinutes:10080,refreshTokenGraceWindowMs:5e3}),EXTREME:vi({maxFailedAttempts:2,lockoutDurationMinutes:120,progressiveLockoutEnabled:!0,progressiveLockoutMultiplier:4,maxLockoutDurationMinutes:10080,maxConcurrentSessions:1,passwordMinLength:16,requireSpecialChars:!0,requireUppercase:!0,requireLowercase:!0,requireNumbers:!0,accessTokenLifetimeMinutes:15,refreshTokenLifetimeMinutes:1440,refreshTokenGraceWindowMs:3e3})};var Ny={policy:{auditEnabled:!0,deviceTrackingEnabled:!0,sessionRotationEnabled:!0},version:"1.0.0"};function Bd(t,e={}){return{system:t,policy:{...Ny.policy,...e.policy??{}},version:e.version??Ny.version,...e.email&&{email:e.email}}}var wy=[{name:"token",required:!0,dependencies:[]},{name:"database",required:!0,dependencies:[]},{name:"emailSystem",required:!0,dependencies:[]}],Ry=[{name:"emailTransport",required:!1,dependencies:[]},{name:"emailTemplateRepository",required:!1,dependencies:[]},{name:"emailTemplateRenderer",required:!1,dependencies:[]},{name:"deviceParser",required:!1,dependencies:[]},{name:"audit",required:!1,dependencies:["deviceParser"]},{name:"mfa",required:!1,dependencies:["token"]}],qd=[...wy,...Ry];var cr=class extends Error{pluginName;constructor(e,r){super(`Plugin validation failed for '${e}': ${r}`),this.pluginName=e,this.name="PluginValidationError"}};function Oy(t,e){if(!t||typeof t!="object")throw new cr(e,"Plugin must be an object");if(!t.name||typeof t.name!="string")throw new cr(e,'Plugin must have a valid "name" field (string)');if(!t.version||typeof t.version!="string")throw new cr(e,'Plugin must have a valid "version" field (string)');if(t.initialize!==void 0&&typeof t.initialize!="function")throw new cr(e,'"initialize" must be a function if provided');if(t.cleanup!==void 0&&typeof t.cleanup!="function")throw new cr(e,'"cleanup" must be a function if provided');if(t.health!==void 0&&typeof t.health!="function")throw new cr(e,'"health" must be a function if provided')}function ky(t,e,r){for(let n of r){if(!(n in t))throw new cr(e,`Missing required method: ${n}`);if(typeof t[n]!="function")throw new cr(e,`"${n}" must be a function`)}}var Cy={token:["sign","verify","signAccessToken","verifyAccessToken","signRefreshToken","verifyRefreshToken"],emailSystem:["send"]};function Dy(t,e){let r=t;if(e==="deviceParser"){let i=typeof r.parseDeviceInfo=="function",s=typeof r.parseUserAgent=="function";if(!i&&!s)throw new cr(String(e),"Device parser plugin must implement parseDeviceInfo()");return void 0}let n=Cy[e];n&&ky(t,String(e),n)}function jd(t,e){Oy(t,String(e)),Dy(t,e)}var Py={debug:0,info:1,warn:2,error:3},dl=class{enabled;prefix;minLevel;constructor(e){this.enabled=e.enabled,this.prefix=e.prefix??"[auth-core]",this.minLevel=Py[e.minLevel??"debug"]}shouldLog(e){return this.enabled&&Py[e]>=this.minLevel}format(e,r,...n){let i=new Date().toISOString(),s=e.toUpperCase().padEnd(5);return`${this.prefix} [${i}] ${s} ${r}`}debug(e,...r){this.shouldLog("debug")&&console.debug(this.format("debug",e),...r)}info(e,...r){this.shouldLog("info")&&console.info(this.format("info",e),...r)}warn(e,...r){this.shouldLog("warn")&&console.warn(this.format("warn",e),...r)}error(e,...r){this.shouldLog("error")&&console.error(this.format("error",e),...r)}time(e){this.enabled&&console.time(`${this.prefix} ${e}`)}timeEnd(e){this.enabled&&console.timeEnd(`${this.prefix} ${e}`)}group(e){this.enabled&&console.group(`${this.prefix} ${e}`)}groupEnd(){this.enabled&&console.groupEnd()}};function Uy(t){return new dl(t)}var pl=new dl({enabled:!1});function Ps(t){let e=t.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);if(!e)return null;let r={major:parseInt(e[1],10),minor:parseInt(e[2],10),patch:parseInt(e[3],10)};return e[4]&&(r.prerelease=e[4]),r}function Ai(t,e){let r=Ps(t),n=Ps(e);if(!r||!n)throw new Error(`Invalid version format: ${r?e:t}`);return r.major!==n.major?r.major>n.major?1:-1:r.minor!==n.minor?r.minor>n.minor?1:-1:r.patch!==n.patch?r.patch>n.patch?1:-1:r.prerelease&&!n.prerelease?-1:!r.prerelease&&n.prerelease?1:r.prerelease&&n.prerelease?r.prerelease.localeCompare(n.prerelease):0}function Ly(t,e){if(e==="*")return!0;if(!e.match(/[<>=^~*x]/))return Ai(t,e)===0;if(e.startsWith("^")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&Ai(t,r)>=0}if(e.startsWith("~")){let r=e.slice(1),n=Ps(r),i=Ps(t);return!n||!i?!1:i.major===n.major&&i.minor===n.minor&&Ai(t,r)>=0}if(e.includes("x")||e.includes("X")){let r=e.toLowerCase().split("."),n=t.split(".");for(let i=0;i<r.length;i++){if(r[i]==="x")return!0;if(r[i]!==n[i])return!1}return!0}return e.startsWith(">=")?Ai(t,e.slice(2))>=0:e.startsWith(">")?Ai(t,e.slice(1))>0:e.startsWith("<=")?Ai(t,e.slice(2))<=0:e.startsWith("<")?Ai(t,e.slice(1))<0:!1}function Ob(t){return t===null||typeof t!="object"?!1:Object.getPrototypeOf(t)===Object.prototype||Object.getPrototypeOf(t)===null}function kb(t,e){if(!e||typeof e!="object")throw new Error(`OAuth provider '${t}' must be an object implementing OAuthProviderPlugin`);if(typeof e.name!="string"||e.name.length===0)throw new Error(`OAuth provider '${t}' is missing a valid name`);if(typeof e.version!="string"||e.version.length===0)throw new Error(`OAuth provider '${t}' is missing a valid version`);if(typeof e.getAuthorizationUrl!="function")throw new Error(`OAuth provider '${t}' must implement getAuthorizationUrl()`);if(typeof e.exchangeCodeForToken!="function")throw new Error(`OAuth provider '${t}' must implement exchangeCodeForToken()`);if(typeof e.getUserProfile!="function")throw new Error(`OAuth provider '${t}' must implement getUserProfile()`)}function Us(t){if(t==null)return;if(t instanceof Map){for(let[n,i]of t.entries())Gd(n,i);return t}let e=[];if(Ob(t))e.push(...Object.entries(t));else if(typeof t!="string"&&typeof t[Symbol.iterator]=="function")for(let n of t)e.push(n);else throw new Error("oauthProviders must be a Map, a plain object, or an iterable of [name, provider] pairs");let r=new Map;for(let n of e){if(!Array.isArray(n))throw new Error("oauthProviders iterable must yield [name, provider] tuples");let[i,s]=n;Gd(i,s),r.set(i,s)}return r}function Gd(t,e){if(typeof t!="string"||t.length===0)throw new Error("oauthProviders entries must use non-empty string keys");kb(t,e)}function $d(t,e){Gd(t,e)}function fl(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="factory"}function ml(t){return typeof t=="object"&&t!==null&&"__type"in t&&t.__type==="lazy"}async function Wd(t,e={},r,n=pl,i={}){n.time("Build Plugin Registry"),n.info("Starting plugin registry build"),n.debug(`Total descriptors: ${t.length}`),n.debug(`Overrides provided: ${Object.keys(e).length}`),await r?.beforeInit?.();let s=new Map;for(let v of t)s.set(v.name,v);let o=new Map,a=new Map;for(let v of s.keys())o.set(v,0),a.set(v,[]);for(let v of s.values()){let b=v.dependencies??[];for(let k of b){let C=typeof k=="string"?k:k.name,L=typeof k=="string"?void 0:k.version;if(!s.has(C))throw new Error(`Plugin '${String(v.name)}' depends on '${String(C)}' which is not defined`);if(L){let B=s.get(C);if(B.version&&!Ly(B.version,L))throw new Error(`Plugin '${String(v.name)}' requires '${String(C)}' ${L}, but version ${B.version} is provided`)}a.get(C).push(v.name),o.set(v.name,(o.get(v.name)??0)+1)}}let c=[];for(let[v,b]of o.entries())b===0&&c.push(v);let l=[];for(;c.length>0;){let v=c.shift();l.push(v);for(let b of a.get(v)??[]){let k=(o.get(b)??0)-1;o.set(b,k),k===0&&c.push(b)}}if(l.length!==s.size)throw n.error("Circular dependency detected"),new Error("Circular plugin dependency detected");n.debug("Initialization order:",l.map(String).join(" -> "));let d={},p={get(v){if(!d[v])throw new Error(`Plugin '${String(v)}' not found or not yet initialized`);return d[v]},has(v){return v in d},getRegistry(){return d}};for(let v of l){n.group(`Initializing plugin: ${String(v)}`),n.time(`Plugin: ${String(v)}`);let b=s.get(v),k=e[v],C=null;if(k!==void 0?(n.debug("Using override"),fl(k)?(n.debug("Creating from factory wrapper"),C=await k.create(p)):ml(k)?(n.debug("Lazy loading plugin"),C=await k.load()):(n.debug("Using direct instance"),C=k)):b.factory?(n.debug("Creating from descriptor factory"),C=await b.factory(p)):b.instance&&(n.debug("Using descriptor instance"),C=b.instance),!C&&b.required)throw new Error(`Required plugin '${String(v)}' is missing`);if(C){if(v==="mfa")n.debug("Skipping validation for registry-type plugin");else{n.debug("Validating plugin");try{jd(C,v),n.debug("Validation passed")}catch(G){throw n.error("Validation failed:",G),new Error(`Plugin '${String(v)}' validation failed: ${G instanceof Error?G.message:String(G)}`)}}d[v]=C;let B=C;B.initialize&&(n.debug("Calling plugin initialize()"),await B.initialize()),n.info(`Plugin '${String(v)}' initialized successfully`)}else n.warn(`Plugin '${String(v)}' is null/undefined`);n.timeEnd(`Plugin: ${String(v)}`),n.groupEnd()}if(e.identity&&(n.debug("Adding identity registry from overrides"),d.identity=e.identity),e.credential&&(n.debug("Adding credential registry from overrides"),d.credential=e.credential),i.extraEntries&&Object.assign(d,i.extraEntries),!Cb(d))throw new Error("Plugin registry is incomplete - missing required plugins");let m=d,E=Us(m.oauthProviders);if(!E){let v=e.oauthProviders;v!==void 0&&!fl(v)&&!ml(v)?E=Us(v)??new Map:E=new Map}return m.oauthProviders=E,await r?.afterInit?.(m),n.timeEnd("Build Plugin Registry"),n.info("Plugin registry build completed successfully"),m}function Cb(t){let e=["identity","credential","token","emailSystem","database"];for(let r of e)if(!t[r])return console.error(`[DEBUG] Missing required plugin: ${r}`),console.error("[DEBUG] Available plugins:",Object.keys(t)),!1;return!0}async function zd(t,e){await e?.beforeDispose?.(t);let r=Object.values(t).filter(n=>n!==null&&typeof n=="object"&&"cleanup"in n);for(let n of r.reverse())n.cleanup&&await n.cleanup();await e?.afterDispose?.()}async function na(t){let e=t.debug?Uy({enabled:!0,prefix:"[auth-core SDK]"}):pl;e.time("Create Auth SDK"),e.info("Initializing Auth SDK"),e.debug("Building plugin registry");let r=Us(t.oauthProviders),n=r?{oauthProviders:r}:void 0,i=await Wd(qd,t.plugins,t.hooks,e,n?{extraEntries:n}:void 0);e.debug("Creating security settings");let s=vi(t.security??{});e.debug("Security level:",s.maxFailedAttempts>5?"High":"Standard"),e.debug("Creating system configuration");let o=Bd({systemId:t.systemId,environment:t.system.environment,...t.system.instanceId&&{instanceId:t.system.instanceId}},{...t.policy&&{policy:t.policy},...t.version&&{version:t.version},...t.email&&{email:t.email}});return e.debug("Environment:",o.system.environment),e.info("Auth SDK initialized successfully"),e.timeEnd("Create Auth SDK"),{plugins:i,security:s,system:o,async healthCheck(){let a=[];for(let[l,d]of Object.entries(i)){if(!d||typeof d!="object")continue;let p=d,m={name:String(l),healthy:!0};if(p.health)try{let E=await p.health();m.healthy=E,E||(m.error=`Plugin '${l}' health check failed`)}catch(E){m.healthy=!1,m.error=E instanceof Error?E.message:"Health check threw error"}a.push(m)}return{healthy:a.every(l=>l.healthy),plugins:a,timestamp:new Date}},async dispose(){await zd(i,t.hooks)},registerOAuthProvider(a,c){if(typeof a!="string"||a.length===0)throw new Error("registerOAuthProvider requires a non-empty provider name");$d(a,c),i.oauthProviders.set(a,c)},unregisterOAuthProvider(a){return i.oauthProviders.delete(a)},getOAuthProviders(){return i.oauthProviders}}}var El=[];function ia(t){let e=process.env[t];return e||(El.push(t),"")}function Jd(t,e){return e?ia(t):process.env[t]??""}function My(t){let e=process.env[t];if(!e)return{};try{let r=JSON.parse(e);if(r&&typeof r=="object"&&!Array.isArray(r))return r}catch{}throw new Error(`${t} must be a JSON object`)}function Lb(t){let e=My(t),r={};for(let[n,i]of Object.entries(e)){if(typeof i!="string")throw new Error(`${t}.${n} must be a string`);r[n]=i}return r}var Mb=process.env.SMTP_MODE==="smtp"?"smtp":"console",Ti=process.env.EMAIL_MODE;if(Ti&&Ti!=="queue"&&Ti!=="smtp"&&Ti!=="console")throw new Error(`Unsupported EMAIL_MODE: ${Ti}`);var Ls=Ti||Mb,Kb=Ls==="console"?"console":"smtp",Yd=process.env.EMAIL_QUEUE_PROVIDER||"aws-sqs",yl=process.env.EMAIL_EVENT_ENVELOPE||"generic";if(Ls==="queue"&&Yd!=="aws-sqs")throw new Error(`Unsupported EMAIL_QUEUE_PROVIDER: ${Yd}`);if(yl!=="generic"&&yl!=="snapshot-auth-v1")throw new Error(`Unsupported EMAIL_EVENT_ENVELOPE: ${yl}`);function hl(t,e){if(t){if(t==="body"||t==="cookie"||t==="both")return t;throw new Error(`${e} must be one of body|cookie|both, got: ${t}`)}}function Hb(){let t=hl(process.env.REFRESH_TOKEN_STRATEGY,"REFRESH_TOKEN_STRATEGY"),e=hl(process.env.REFRESH_TOKEN_STRATEGY_CUSTOMER,"REFRESH_TOKEN_STRATEGY_CUSTOMER"),r=hl(process.env.REFRESH_TOKEN_STRATEGY_TENANT,"REFRESH_TOKEN_STRATEGY_TENANT"),n=hl(process.env.REFRESH_TOKEN_STRATEGY_SYSTEM,"REFRESH_TOKEN_STRATEGY_SYSTEM");if(e||r||n){let i=t??"body";return{customer:e??i,tenant:r??i,system:n??i}}return t??"cookie"}var sa=Hb(),Fb=typeof sa=="string"?sa==="cookie"||sa==="both":Object.values(sa).some(t=>t==="cookie"||t==="both"),F={dynamodbTableName:ia("DYNAMODB_TABLE_NAME"),dynamodbEndpoint:process.env.DYNAMODB_ENDPOINT,awsRegion:ia("AWS_REGION"),jwtAlgorithm:process.env.JWT_ALGORITHM||"EdDSA",jwtPrivateKey:ia("JWT_PRIVATE_KEY"),jwtPublicKey:ia("JWT_PUBLIC_KEY"),jwtIssuer:process.env.JWT_ISSUER||process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",jwtAccessTokenAudience:process.env.JWT_ACCESS_TOKEN_AUDIENCE||"access",jwtRefreshTokenAudience:process.env.JWT_REFRESH_TOKEN_AUDIENCE||"refresh",smtp:{host:process.env.SMTP_HOST||"smtp.gmail.com",port:parseInt(process.env.SMTP_PORT||"587",10),user:Jd("SMTP_USER",Ls==="smtp"),pass:Jd("SMTP_PASS",Ls==="smtp"),from:process.env.SMTP_FROM||"Auth Craft <noreply@yourapp.com>",secure:process.env.SMTP_SECURE==="true",mode:Kb},email:{mode:Ls,queue:{provider:Yd,url:Jd("EMAIL_QUEUE_URL",Ls==="queue"),region:process.env.EMAIL_QUEUE_REGION,envelope:yl,sourceSystem:process.env.EMAIL_EVENT_SOURCE||"auth-craft",eventTypeMap:Lb("EMAIL_EVENT_TYPE_MAP"),defaultMetadata:My("EMAIL_DEFAULT_METADATA")}},oauth:{facebook:process.env.FACEBOOK_CLIENT_ID&&process.env.FACEBOOK_CLIENT_SECRET?{clientId:process.env.FACEBOOK_CLIENT_ID,clientSecret:process.env.FACEBOOK_CLIENT_SECRET,redirectUri:process.env.FACEBOOK_REDIRECT_URI||"http://localhost:3000/auth/oauth/facebook/callback"}:void 0,google:process.env.GOOGLE_CLIENT_ID&&process.env.GOOGLE_CLIENT_SECRET?{clientId:process.env.GOOGLE_CLIENT_ID,clientSecret:process.env.GOOGLE_CLIENT_SECRET,redirectUri:process.env.GOOGLE_REDIRECT_URI||"http://localhost:3000/auth/oauth/google/callback"}:void 0},port:parseInt(process.env.PORT||"3000",10),host:process.env.HOST||"0.0.0.0",nodeEnv:process.env.NODE_ENV||"development",appBasePath:process.env.APP_BASE_PATH||"",auth:{systemName:process.env.AUTH_SYSTEM_NAME||"auth-hono-dynamodb-lambda",appUrl:process.env.APP_URL||"http://localhost:3000",supportEmail:process.env.SUPPORT_EMAIL||"support@yourapp.com",appVersion:process.env.APP_VERSION||"1.0.0",tokens:{accessTokenLifetimeMinutes:parseInt(process.env.ACCESS_TOKEN_LIFETIME_MINUTES||"15",10),refreshTokenLifetimeMinutes:parseInt(process.env.REFRESH_TOKEN_LIFETIME_MINUTES||"10080",10),refreshTokenStrategy:sa,...Fb?{refreshTokenCookie:{name:process.env.REFRESH_TOKEN_COOKIE_NAME||"refresh_token",httpOnly:process.env.REFRESH_TOKEN_COOKIE_HTTP_ONLY!=="false",secure:process.env.REFRESH_TOKEN_COOKIE_SECURE!=="false",sameSite:process.env.REFRESH_TOKEN_COOKIE_SAME_SITE||"strict",path:process.env.REFRESH_TOKEN_COOKIE_PATH||"/",...process.env.REFRESH_TOKEN_COOKIE_MAX_AGE?{maxAge:parseInt(process.env.REFRESH_TOKEN_COOKIE_MAX_AGE,10)}:{},...process.env.REFRESH_TOKEN_COOKIE_DOMAIN?{domain:process.env.REFRESH_TOKEN_COOKIE_DOMAIN}:{}}}:{}},verificationCodeLifetimeMinutes:parseInt(process.env.VERIFICATION_CODE_LIFETIME_MINUTES||"10",10),verificationResendCooldownSeconds:parseInt(process.env.VERIFICATION_RESEND_COOLDOWN_SECONDS||"60",10)},features:{auditEnabled:process.env.AUDIT_ENABLED==="true",deviceTracking:process.env.DEVICE_TRACKING!=="false"},security:{maxLoginAttempts:parseInt(process.env.MAX_LOGIN_ATTEMPTS||"5",10),lockoutDurationMinutes:parseInt(process.env.LOCKOUT_DURATION_MINUTES||"30",10),requireVerifiedIdentity:process.env.REQUIRE_VERIFIED_IDENTITY!=="false",verifySessionOnAuth:process.env.VERIFY_SESSION_ON_AUTH==="true",systemTenantId:process.env.SYSTEM_TENANT_ID||"__system__",tokenAudiences:{customer:process.env.TOKEN_AUD_CUSTOMER||"customer",tenant:process.env.TOKEN_AUD_TENANT||"tenant",system:process.env.TOKEN_AUD_SYSTEM||"system",cookieNames:{customer:process.env.REFRESH_COOKIE_CUSTOMER||"refresh_token",tenant:process.env.REFRESH_COOKIE_TENANT||"refresh_token_tenant",system:process.env.REFRESH_COOKIE_SYSTEM||"refresh_token_system"}}},corsOrigins:process.env.CORS_ORIGINS?.split(",")||[],gatewaySecret:process.env.GATEWAY_SECRET||"",gatewayJwt:{publicKeyHex:process.env.GATEWAY_JWT_PUBLIC_KEY_HEX||"",issuer:process.env.GATEWAY_JWT_ISSUER||"bff-worker",audience:process.env.GATEWAY_JWT_AUDIENCE||"auth-craft:backend",header:process.env.GATEWAY_JWT_HEADER||"x-gateway-auth"},internal:{publicKey:process.env.INTERNAL_JWT_PUBLIC_KEY||"",alg:process.env.INTERNAL_JWT_ALG||"EdDSA",audience:process.env.INTERNAL_JWT_AUDIENCE||"auth-craft:internal",issuer:process.env.INTERNAL_JWT_ISSUER||"auth-craft",serviceRoutePath:process.env.SERVICE_ROUTE_PATH||"/internal"}};function Ky(){if(El.length>0){let t=El.map(e=>`  - ${e}`).join(`
-`);throw new Error(`Missing required environment variables (${El.length}):
-${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SECRET must be set in production (it gates direct access to the backend).")}function Xd(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Vb(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function gl(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Vb(r)}async function Qd(t,e){let r=await gl(t);if(r.length!==e.length)return!1;let n=0;for(let i=0;i<r.length;i++)n|=r.charCodeAt(i)^e.charCodeAt(i);return n===0}var Bb="otp",Hy={INVALID_CODE:T("OTP_INVALID_CODE","M\xE3 x\xE1c th\u1EF1c kh\xF4ng h\u1EE3p l\u1EC7"),MISSING_CHALLENGE_CONTEXT:T("OTP_MISSING_CHALLENGE_CONTEXT","Thi\u1EBFu ng\u1EEF c\u1EA3nh challenge \u0111\u1EC3 x\xE1c th\u1EF1c m\xE3")};function qb(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function Fy(t={}){let e=t.codeLength??6,r=t.codeLifetimeMinutes??10;return{name:"email-otp-credential",version:"1.0.0",credentialType:Bb,challengeType:"verification-code",async create(){return g({value:"",data:null})},async update(){return g({})},async verify(n){if(n.credentialValue===void 0||n.credentialValue===""){let o=Xd(e),a=await gl(o),c=new Date(Date.now()+r*60*1e3);return g({userId:n.userId,intents:[{kind:"notification.sendCode",payload:{to:n.identityValue,code:o,method:"email"}}],nextStep:{type:"verification-code",phase:"verify_credential",data:{codeHash:a,expiresAt:c,sentTo:qb(n.identityValue)},expiresAt:c}})}let i=n.metadata?.codeHash;return i?await Qd(n.credentialValue,i)?g({userId:n.userId,intents:[]}):u(Hy.INVALID_CODE()):u(Hy.MISSING_CHALLENGE_CONTEXT())}}}function jb(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"&&"BYTES_PER_ELEMENT"in t&&t.BYTES_PER_ELEMENT===1}function yt(t,e=""){if(typeof t!="number"){let r=e&&`"${e}" `;throw new TypeError(`${r}expected number, got ${typeof t}`)}if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new RangeError(`${r}expected integer >= 0, got ${t}`)}}function mn(t,e,r=""){let n=jb(t),i=t?.length,s=e!==void 0;if(!n||s&&i!==e){let o=r&&`"${r}" `,a=s?` of length ${e}`:"",c=n?`length=${i}`:`type=${typeof t}`,l=o+"expected Uint8Array"+a+", got "+c;throw n?new RangeError(l):new TypeError(l)}return t}function vl(t){if(typeof t!="function"||typeof t.create!="function")throw new TypeError("Hash must wrapped by utils.createHasher");if(yt(t.outputLen),yt(t.blockLen),t.outputLen<1)throw new Error('"outputLen" must be >= 1');if(t.blockLen<1)throw new Error('"blockLen" must be >= 1')}function hn(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function Ms(t,e){mn(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new RangeError('"digestInto() output" expected to be of length >='+r)}function Ks(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function jt(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Hs(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function xr(t,e){return t<<32-e|t>>>e}function xe(t,e){return t<<e|t>>>32-e>>>0}var Gb=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;function $b(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Wb(t){for(let e=0;e<t.length;e++)t[e]=$b(t[e]);return t}var Fs=Gb?t=>t:Wb;function zb(t){if(typeof t!="string")throw new TypeError("string expected");return new Uint8Array(new TextEncoder().encode(t))}function Zd(t,e=""){return typeof t=="string"?zb(t):mn(t,void 0,e)}function Al(t,e){if(e!==void 0&&{}.toString.call(e)!=="[object Object]")throw new TypeError("options must be object or undefined");return Object.assign(t,e)}function Tl(t,e={}){let r=(i,s)=>t(s).update(i).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.canXOF=n.canXOF,r.create=i=>t(i),Object.assign(r,e),Object.freeze(r)}function ep(t=32){yt(t,"bytesLength");let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");if(t>65536)throw new RangeError(`"bytesLength" expected <= 65536, got ${t}`);return e.getRandomValues(new Uint8Array(t))}var _l=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])});var Il=class{oHash;iHash;blockLen;outputLen;canXOF=!1;finished=!1;destroyed=!1;constructor(e,r){if(vl(e),mn(r,void 0,"key"),this.iHash=e.create(),typeof this.iHash.update!="function")throw new Error("Expected instance of class which extends utils.Hash");this.blockLen=this.iHash.blockLen,this.outputLen=this.iHash.outputLen;let n=this.blockLen,i=new Uint8Array(n);i.set(r.length>n?e.create().update(r).digest():r);for(let s=0;s<i.length;s++)i[s]^=54;this.iHash.update(i),this.oHash=e.create();for(let s=0;s<i.length;s++)i[s]^=106;this.oHash.update(i),jt(i)}update(e){return hn(this),this.iHash.update(e),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let r=e.subarray(0,this.outputLen);this.iHash.digestInto(r),this.oHash.update(r),this.oHash.digestInto(r),this.destroy()}digest(){let e=new Uint8Array(this.oHash.outputLen);return this.digestInto(e),e}_cloneInto(e){e||=Object.create(Object.getPrototypeOf(this),{});let{oHash:r,iHash:n,finished:i,destroyed:s,blockLen:o,outputLen:a}=this;return e=e,e.finished=i,e.destroyed=s,e.blockLen=o,e.outputLen=a,e.oHash=r._cloneInto(e.oHash),e.iHash=n._cloneInto(e.iHash),e}clone(){return this._cloneInto()}destroy(){this.destroyed=!0,this.oHash.destroy(),this.iHash.destroy()}},Vy=(()=>{let t=((e,r,n)=>new Il(e,r).update(n).digest());return t.create=(e,r)=>new Il(e,r),t})();function Yb(t,e,r,n){vl(t);let i=Al({dkLen:32,asyncTick:10},n),{c:s,dkLen:o,asyncTick:a}=i;if(yt(s,"c"),yt(o,"dkLen"),yt(a,"asyncTick"),s<1)throw new Error("iterations (c) must be >= 1");if(o<1)throw new Error('"dkLen" must be >= 1');if(o>(2**32-1)*t.outputLen)throw new Error("derived key too long");let c=Zd(e,"password"),l=Zd(r,"salt"),d=new Uint8Array(o),p=Vy.create(t,c),m=p._cloneInto().update(l);return{c:s,dkLen:o,asyncTick:a,DK:d,PRF:p,PRFSalt:m}}function Xb(t,e,r,n,i){return t.destroy(),e.destroy(),n&&n.destroy(),jt(i),r}function tp(t,e,r,n){let{c:i,dkLen:s,DK:o,PRF:a,PRFSalt:c}=Yb(t,e,r,n),l,d=new Uint8Array(4),p=Hs(d),m=new Uint8Array(a.outputLen);for(let E=1,v=0;v<s;E++,v+=a.outputLen){let b=o.subarray(v,v+a.outputLen);p.setInt32(0,E,!1),(l=c._cloneInto(l)).update(d).digestInto(m),b.set(m.subarray(0,b.length));for(let k=1;k<i;k++){a._cloneInto(l).update(m).digestInto(m);for(let C=0;C<b.length;C++)b[C]^=m[C]}}return Xb(a,c,o,l,m)}function By(t,e,r){return t&e^~t&r}function qy(t,e,r){return t&e^t&r^e&r}var xl=class{blockLen;outputLen;canXOF=!1;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,i){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=i,this.buffer=new Uint8Array(e),this.view=Hs(this.buffer)}update(e){hn(this),mn(e);let{view:r,buffer:n,blockLen:i}=this,s=e.length;for(let o=0;o<s;){let a=Math.min(i-this.pos,s-o);if(a===i){let c=Hs(e);for(;i<=s-o;o+=i)this.process(c,o);continue}n.set(e.subarray(o,o+a),this.pos),this.pos+=a,o+=a,this.pos===i&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){hn(this),Ms(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:i,isLE:s}=this,{pos:o}=this;r[o++]=128,jt(this.buffer.subarray(o)),this.padOffset>i-o&&(this.process(n,0),o=0);for(let p=o;p<i;p++)r[p]=0;n.setBigUint64(i-8,BigInt(this.length*8),s),this.process(n,0);let a=Hs(e),c=this.outputLen;if(c%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let l=c/4,d=this.get();if(l>d.length)throw new Error("_sha2: outputLen bigger than state");for(let p=0;p<l;p++)a.setUint32(4*p,d[p],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||=new this.constructor,e.set(...this.get());let{blockLen:r,buffer:n,length:i,finished:s,destroyed:o,pos:a}=this;return e.destroyed=o,e.finished=s,e.length=i,e.pos=a,i%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}},En=Uint32Array.from([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]);var bl=BigInt(4294967295),jy=BigInt(32);function Qb(t,e=!1){return e?{h:Number(t&bl),l:Number(t>>jy&bl)}:{h:Number(t>>jy&bl)|0,l:Number(t&bl)|0}}function Gy(t,e=!1){let r=t.length,n=new Uint32Array(r),i=new Uint32Array(r);for(let s=0;s<r;s++){let{h:o,l:a}=Qb(t[s],e);[n[s],i[s]]=[o,a]}return[n,i]}var $y=(t,e,r)=>t<<r|e>>>32-r,Wy=(t,e,r)=>e<<r|t>>>32-r,zy=(t,e,r)=>e<<r-32|t>>>64-r,Jy=(t,e,r)=>t<<r-32|e>>>64-r;var Zb=Uint32Array.from([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Hn=new Uint32Array(64),rp=class extends xl{constructor(e){super(64,e,8,!1)}get(){let{A:e,B:r,C:n,D:i,E:s,F:o,G:a,H:c}=this;return[e,r,n,i,s,o,a,c]}set(e,r,n,i,s,o,a,c){this.A=e|0,this.B=r|0,this.C=n|0,this.D=i|0,this.E=s|0,this.F=o|0,this.G=a|0,this.H=c|0}process(e,r){for(let p=0;p<16;p++,r+=4)Hn[p]=e.getUint32(r,!1);for(let p=16;p<64;p++){let m=Hn[p-15],E=Hn[p-2],v=xr(m,7)^xr(m,18)^m>>>3,b=xr(E,17)^xr(E,19)^E>>>10;Hn[p]=b+Hn[p-7]+v+Hn[p-16]|0}let{A:n,B:i,C:s,D:o,E:a,F:c,G:l,H:d}=this;for(let p=0;p<64;p++){let m=xr(a,6)^xr(a,11)^xr(a,25),E=d+m+By(a,c,l)+Zb[p]+Hn[p]|0,b=(xr(n,2)^xr(n,13)^xr(n,22))+qy(n,i,s)|0;d=l,l=c,c=a,a=o+E|0,o=s,s=i,i=n,n=E+b|0}n=n+this.A|0,i=i+this.B|0,s=s+this.C|0,o=o+this.D|0,a=a+this.E|0,c=c+this.F|0,l=l+this.G|0,d=d+this.H|0,this.set(n,i,s,o,a,c,l,d)}roundClean(){jt(Hn)}destroy(){this.destroyed=!0,this.set(0,0,0,0,0,0,0,0),jt(this.buffer)}},np=class extends rp{A=En[0]|0;B=En[1]|0;C=En[2]|0;D=En[3]|0;E=En[4]|0;F=En[5]|0;G=En[6]|0;H=En[7]|0;constructor(){super(32)}};var ip=Tl(()=>new np,_l(1));function Yy(t,e,r,n,i,s){let o=t[e++]^r[n++],a=t[e++]^r[n++],c=t[e++]^r[n++],l=t[e++]^r[n++],d=t[e++]^r[n++],p=t[e++]^r[n++],m=t[e++]^r[n++],E=t[e++]^r[n++],v=t[e++]^r[n++],b=t[e++]^r[n++],k=t[e++]^r[n++],C=t[e++]^r[n++],L=t[e++]^r[n++],B=t[e++]^r[n++],G=t[e++]^r[n++],j=t[e++]^r[n++],$=o,te=a,A=c,x=l,S=d,y=p,_=m,w=E,R=v,N=b,O=k,P=C,U=L,K=B,W=G,J=j;for(let de=0;de<8;de+=2)S^=xe($+U|0,7),R^=xe(S+$|0,9),U^=xe(R+S|0,13),$^=xe(U+R|0,18),N^=xe(y+te|0,7),K^=xe(N+y|0,9),te^=xe(K+N|0,13),y^=xe(te+K|0,18),W^=xe(O+_|0,7),A^=xe(W+O|0,9),_^=xe(A+W|0,13),O^=xe(_+A|0,18),x^=xe(J+P|0,7),w^=xe(x+J|0,9),P^=xe(w+x|0,13),J^=xe(P+w|0,18),te^=xe($+x|0,7),A^=xe(te+$|0,9),x^=xe(A+te|0,13),$^=xe(x+A|0,18),_^=xe(y+S|0,7),w^=xe(_+y|0,9),S^=xe(w+_|0,13),y^=xe(S+w|0,18),P^=xe(O+N|0,7),R^=xe(P+O|0,9),N^=xe(R+P|0,13),O^=xe(N+R|0,18),U^=xe(J+W|0,7),K^=xe(U+J|0,9),W^=xe(K+U|0,13),J^=xe(W+K|0,18);i[s++]=o+$|0,i[s++]=a+te|0,i[s++]=c+A|0,i[s++]=l+x|0,i[s++]=d+S|0,i[s++]=p+y|0,i[s++]=m+_|0,i[s++]=E+w|0,i[s++]=v+R|0,i[s++]=b+N|0,i[s++]=k+O|0,i[s++]=C+P|0,i[s++]=L+U|0,i[s++]=B+K|0,i[s++]=G+W|0,i[s++]=j+J|0}function sp(t,e,r,n,i){let s=n+0,o=n+16*i;for(let a=0;a<16;a++)r[o+a]=t[e+(2*i-1)*16+a];for(let a=0;a<i;a++,s+=16,e+=16)Yy(r,o,t,e,r,s),a>0&&(o+=16),Yy(r,s,t,e+=16,r,o)}function eS(t,e,r){let n=Al({dkLen:32,asyncTick:10,maxmem:1073742848},r),{N:i,r:s,p:o,dkLen:a,asyncTick:c,maxmem:l,onProgress:d}=n;if(yt(i,"N"),yt(s,"r"),yt(o,"p"),yt(a,"dkLen"),yt(c,"asyncTick"),yt(l,"maxmem"),d!==void 0&&typeof d!="function")throw new Error("progressCb must be a function");let p=128*s,m=p/4,E=Math.pow(2,32);if(i<=1||(i&i-1)!==0||i>E)throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');if(o<1||o>(E-1)*32/p)throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');if(a<1||a>(E-1)*32)throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');let v=p*(i+o+1);if(v>l)throw new Error('"maxmem" limit was hit: memUsed(128*r*(N+p+1))='+v+", maxmem="+l);let b=tp(ip,t,e,{c:1,dkLen:p*o}),k=Ks(b),C=Ks(new Uint8Array(p*i)),L=Ks(new Uint8Array(p)),B=()=>{};if(d){let G=2*i*o,j=Math.max(Math.floor(G/1e4),1),$=0;B=()=>{$++,d&&(!($%j)||$===G)&&d($/G)}}return{N:i,r:s,p:o,dkLen:a,blockSize32:m,V:C,B32:k,B:b,tmp:L,blockMixCb:B,asyncTick:c}}function tS(t,e,r,n,i){let s=tp(ip,t,r,{c:1,dkLen:e});return jt(r,n,i),s}function Sl(t,e,r){let{N:n,r:i,p:s,dkLen:o,blockSize32:a,V:c,B32:l,B:d,tmp:p,blockMixCb:m}=eS(t,e,r);Fs(l);for(let E=0;E<s;E++){let v=a*E;for(let b=0;b<a;b++)c[b]=l[v+b];for(let b=0,k=0;b<n-1;b++)sp(c,k,c,k+=a,i),m();sp(c,(n-1)*a,l,v,i),m();for(let b=0;b<n;b++){let k=(l[v+a-16]&n-1)>>>0;for(let C=0;C<a;C++)p[C]=l[v+C]^c[k*a+C];sp(p,0,l,v,i),m()}}return Fs(l),tS(t,o,d,c,p)}var rS={N:2**15,r:8,p:1,dkLen:32,saltLength:32},nS={N:2**14,r:8,p:1};function Xy(t,e,r){return`${t.N}.${t.r}.${t.p}.${Qy(e)}.${Qy(r)}`}function iS(t){let e=t.split(".");if(e.length===5){let[r,n,i,s,o]=e,a=Number(r),c=Number(n),l=Number(i);return!Number.isInteger(a)||a<2||(a&a-1)!==0||!Number.isInteger(c)||c<1||!Number.isInteger(l)||l<1?null:{params:{N:a,r:c,p:l},salt:Nl(s),expected:Nl(o)}}if(e.length===2){let[r,n]=e;return{params:nS,salt:Nl(r),expected:Nl(n)}}return null}function Qy(t){let e=String.fromCharCode(...t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Nl(t){let e=t.replace(/-/g,"+").replace(/_/g,"/")+"==".slice(0,(4-t.length%4)%4),r=atob(e),n=new Uint8Array(r.length);for(let i=0;i<r.length;i++)n[i]=r.charCodeAt(i);return n}function Zy(t={}){let e={...rS,...t},r=new TextEncoder;return{name:"password-credential",version:"1.0.0",credentialType:"password",async create(n){try{if(!n.value||typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let i=ep(e.saltLength),s=await Sl(r.encode(n.value),i,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),o=Xy({N:e.N,r:e.r,p:e.p},i,s);return g({value:o,data:n.metadata??null})}catch(i){let s=i instanceof Error?i.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${s}`}])}},async update(n,i){if(!n.value)return g({});try{if(typeof n.value!="string"||n.value.length===0)return u([{code:"PASSWORD_REQUIRED",message:"Password must be a non-empty string"}]);let s=ep(e.saltLength),o=await Sl(r.encode(n.value),s,{N:e.N,r:e.r,p:e.p,dkLen:e.dkLen}),a=Xy({N:e.N,r:e.r,p:e.p},s,o);return g({value:a,...n.data&&{data:n.data}})}catch(s){let o=s instanceof Error?s.message:"Unknown error";return u([{code:"PASSWORD_HASH_FAILED",message:`Failed to hash password: ${o}`}])}},async verify(n){try{if(!n.credential?.value)return u([{code:"CREDENTIAL_NOT_FOUND",message:"Password credential not found"}]);if(!n.credentialValue||typeof n.credentialValue!="string")return u([{code:"CREDENTIAL_VALUE_REQUIRED",message:"Password is required"}]);let i=iS(n.credential.value);if(!i)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash format"}]);let{params:s,salt:o,expected:a}=i;if(o.length!==e.saltLength||a.length!==e.dkLen)return u([{code:"INVALID_CREDENTIAL_FORMAT",message:"Invalid password hash size"}]);let c=await Sl(r.encode(n.credentialValue),o,{N:s.N,r:s.r,p:s.p,dkLen:e.dkLen});if(c.length!==a.length)return u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}]);let l=0;for(let p=0;p<c.length;p++)l|=(c[p]??0)^(a[p]??0);return l===0?g({userId:n.userId,credentialId:"password"}):u([{code:"INVALID_CREDENTIALS",message:"Invalid password"}])}catch(i){return console.error("Password verification error:",i),u([{code:"PASSWORD_VERIFY_FAILED",message:"Failed to verify password"}])}}}}var tg=Pf(eg(),1);function rg(){return{name:"device-parser-plugin-ua-parser",version:"1.0.0",parseDeviceInfo(t){if(!t)return{deviceName:"Unknown Device",browser:"",os:""};let r=new tg.default(t).getResult(),n="unknown";r.device.type==="mobile"?n="mobile":r.device.type==="tablet"?n="tablet":r.os.name&&(n="desktop");let i="Unknown Device";r.device.model&&r.device.vendor?i=`${r.device.vendor} ${r.device.model}`:r.device.model?i=r.device.model:r.device.vendor?i=`${r.device.vendor} Device`:r.os.name&&r.os.version?i=`${r.os.name} ${r.os.version}`:r.os.name?i=r.os.name:i=`${n.charAt(0).toUpperCase()+n.slice(1)} Device`;let s=r.browser.name??"",o=r.os.name??"";return{deviceName:i,browser:s,os:o,browserName:s,osName:o}}}}import{createHash as sS}from"node:crypto";import{SendMessageCommand as oS,SQSClient as aS}from"@aws-sdk/client-sqs";var cS={verification:"email.verification","email-verification":"email.verification","password-reset":"email.password-reset","mfa-code":"email.mfa-code","security-alert":"email.security-alert"};var Rl=class{client;config;name="email-system-aws-sqs";version="1.0.0";constructor(e){this.config=e,this.client=e.client??new aS(e.region?{region:e.region}:{})}async send(e){try{let r=Array.isArray(e.to)?e.to:[e.to];for(let n of r){let i=this.toQueueEvent(e,n,r.length>1);await this.client.send(new oS({QueueUrl:this.config.queueUrl,MessageBody:JSON.stringify(i),...this.config.messageGroupId?{MessageGroupId:this.config.messageGroupId}:{}})),console.log("[Email][SQS] Email event queued",{eventId:i.eventId,eventType:i.eventType,recipientDomain:lS(n)})}return g(void 0)}catch(r){return u({code:"EMAIL_QUEUE_ERROR",message:r instanceof Error?r.message:"Failed to queue email event"})}}toQueueEvent(e,r,n=!1){let i=e.variables??{},s=this.config.eventTypeMap?.[e.template]??cS[e.template]??e.template,o=_i(i.eventId)??_i(i.challengeId)??crypto.randomUUID(),a=n?`${o}:${uS(r)}`:o,c=_i(i.locale),l=_i(i.traceId)??a,d=dS(this.config.defaultMetadata,i),p=pS(i);if(this.config.envelope==="snapshot-auth-v1"){let m=_i(d?.tenantId),E=_i(d?.tenantType),v=_i(i.userId);return{kind:"auth",schemaVersion:1,eventId:a,eventType:s,to:r,...v?{userId:v}:{},...m?{tenantId:m}:{},...E?{tenantType:E}:{},...c?{locale:c}:{},traceId:l,occurredAt:Math.floor(Date.now()/1e3),data:p}}return{kind:"email",eventId:a,eventType:s,sourceSystem:this.config.sourceSystem??"auth-craft",to:r,...c?{locale:c}:{},traceId:l,issuedAt:new Date().toISOString(),...d?{metadata:d}:{},data:p}}};function _i(t){return typeof t=="string"&&t.length>0?t:void 0}function lS(t){return t.split("@")[1]||"(unknown)"}function uS(t){return sS("sha256").update(t).digest("hex").slice(0,16)}function dS(t,e){let r={...t??{}};for(let n of["userId","tenantId","tenantType"])e[n]!==void 0&&(r[n]=e[n]);return Object.keys(r).length>0?r:void 0}function pS(t){let e={};for(let[r,n]of Object.entries(t))["eventId","locale","traceId","userId","tenantId","tenantType"].includes(r)||(e[r]=n);return e}var aa=class t{static createAwsSqs(e){return new Rl(e)}static create(e){return t.createAwsSqs(e.sqs)}};var Qv=Pf(Xv(),1);var Ll=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=Qv.default.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,s;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),s=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),s=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",s=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",s=r.text||""}let o={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:s,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(o),g(void 0)}catch(r){return u({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
+Invalid`)}},FromEmailAddress:"invalid@invalid",Destination:{ToAddresses:["invalid@invalid"]}};return this.getRegion(()=>{let s;try{let a=new this.ses.SendEmailCommand(o);s=this.ses.sesClient.send(a)}catch(a){setImmediate(()=>i(a));return}s.then(()=>setImmediate(()=>i(null))).catch(a=>setImmediate(()=>i(a)))}),r}},iT=Um;var o0=()=>(process.env.ETHEREAL_API||"https://api.nodemailer.com").replace(/\/+$/,""),s0=()=>(process.env.ETHEREAL_WEB||"https://ethereal.email").replace(/\/+$/,""),a0=()=>(process.env.ETHEREAL_API_KEY||"").replace(/\s*/g,"")||null,c0=()=>["true","yes","y","1"].includes((process.env.ETHEREAL_CACHE||"yes").toString().trim().toLowerCase()),Ts=!1;function l0(t,e){let r;if(typeof t=="object"&&typeof t.send!="function"||typeof t=="string"&&/^(smtps?|direct):/i.test(t)){let n=typeof t=="string"?t:t.url;if(n){let i=gs(n);r=typeof t=="object"?Or(!1,et({},t,o=>o==="url"),i):i}else r=t;if(r.pool)t=new ZA(r);else if(r.sendmail)t=new tT(r);else if(r.streamTransport)t=new rT(r);else if(r.jsonTransport)t=new nT(r);else if(r.SES){let i=r.SES;if(i.ses&&i.aws){let o=new Error("Using legacy SES configuration, expecting @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/");throw o.code=Es,o}t=new iT(r)}else t=new eT(r)}return new $A(t,r,e)}function u0(t,e){let r;!e&&typeof t=="function"&&(e=t,t=!1),e||(r=new Promise((p,f)=>{e=Mt(p,f)}));let n=e;if(c0()&&Ts)return setImmediate(()=>n(null,Ts)),r;t=t||o0();let i=[],o=0,s={},a={requestor:Ku,version:Xe},c=a0();c&&(s.Authorization="Bearer "+c);let l={contentType:"application/json",method:"POST",headers:s,body:Buffer.from(JSON.stringify(a))};/^https:/i.test(t)&&(l.tls={rejectUnauthorized:!0});let u=ui(t+"/user",l);return u.on("readable",()=>{let p;for(;(p=u.read())!==null;)i.push(p),o+=p.length}),u.once("error",p=>n(p)),u.once("end",()=>{let p=Buffer.concat(i,o),f;try{f=JSON.parse(p.toString())}catch(m){return n(m)}if(f.status!=="success"||f.error)return n(new Error(f.error||"Request failed"));delete f.status,Ts=f,n(null,Ts)}),r}function d0(t){if(!t||!t.response)return!1;let e=new Map,r=t.response.toString();if(r.length>2&&r.charAt(r.length-1)==="]"){let n=r.indexOf("[",r.lastIndexOf("]",r.length-2)+1);n>=0&&n<r.length-2&&r.substring(n+1,r.length-1).replace(/\b([A-Z0-9]+)=([^\s]+)/g,(o,s,a)=>(e.set(s,a),o))}return e.has("STATUS")&&e.has("MSGID")?(Ts&&Ts.web||s0())+"/message/"+e.get("MSGID"):!1}var p0={createTransport:l0,createTestAccount:u0,getTestMessageUrl:d0},oT=p0;var cd=class{transporter;config;name="email-system-direct-smtp";version="1.0.0";constructor(e){this.config=e,this.transporter=oT.createTransport({host:e.host,port:e.port,secure:e.secure||!1,auth:e.auth,tls:e.tls})}async initialize(){await this.transporter.verify()}async send(e){try{let r=e,n,i,o;switch(e.template){case"verification":{let a=e.variables?.code;n="X\xE1c th\u1EF1c t\xE0i kho\u1EA3n c\u1EE7a b\u1EA1n",i=this.getVerificationEmailTemplate(a),o=`M\xE3 x\xE1c th\u1EF1c c\u1EE7a b\u1EA1n l\xE0: ${a}`;break}case"password-reset":{let a=e.variables?.token;n="\u0110\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u",i=this.getPasswordResetEmailTemplate(a),o=`\u0110\u1EC3 \u0111\u1EB7t l\u1EA1i m\u1EADt kh\u1EA9u, h\xE3y s\u1EED d\u1EE5ng token sau: ${a}`;break}case"custom":n=e.variables?.subject||e.subject||"Th\xF4ng b\xE1o",i=e.variables?.html||r.html||"",o=e.variables?.text||r.text||"";break;default:n=e.subject||"Th\xF4ng b\xE1o",i=r.html||"",o=r.text||""}let s={from:`${this.config.fromName||""} <${this.config.fromEmail}>`,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:n,text:o,html:i,replyTo:r.replyTo,cc:r.cc?Array.isArray(r.cc)?r.cc.join(", "):r.cc:void 0,bcc:r.bcc?Array.isArray(r.bcc)?r.bcc.join(", "):r.bcc:void 0};return await this.transporter.sendMail(s),T(void 0)}catch(r){return d({code:"EMAIL_SEND_ERROR",message:r instanceof Error?r.message:"Failed to send email"})}}async cleanup(){this.transporter.close()}getVerificationEmailTemplate(e){return`
       <!DOCTYPE html>
       <html>
       <head>
@@ -126,10 +128,10 @@ ${t}`)}if(F.nodeEnv==="production"&&!F.gatewaySecret)throw new Error("GATEWAY_SE
         </div>
       </body>
       </html>
-    `}};var Ea=class t{static createDirectSmtp(e){return new Ll(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var Rw={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function Zv(t={}){let e={...Rw,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let s=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${s}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return u([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return u([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return u([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let s=i.split("@");if(s.length!==2)return u([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[o,a]=s;return!o||o.length>64?u([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?u([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):g()}}}function Zp(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function Ow(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function ef(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return Ow(r)}var tf="email",Ml={EMAIL_SYSTEM_NOT_AVAILABLE:T("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:T("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:T("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:T("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function kw(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function eA(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:tf,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return u(Ml.EMAIL_SYSTEM_NOT_AVAILABLE());let s=await i.plugins.database.users.getById(n.userId),o=s.ok&&s.data?s.data.contactEmail:void 0;if(!o)return u(Ml.RECIPIENT_NOT_FOUND());let a=Zp(e),c=await ef(a);return(await i.plugins.emailSystem.send({to:o,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?u(Ml.SEND_FAILED()):g({codeHash:c,maskedRecipient:kw(o)})},async issueChallenge(n){return g({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(tf)?[tf]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Ml.USE_CHALLENGE_CODE_HASH())}}}var tA="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function Kl(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let s="";for(let o of i)s+=tA[o%tA.length];r.push(s)}return r}function Cw(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Hl(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return Cw(r)}function Dw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function rf(t,e){let r=await Hl(t),n=null;for(let i of e)Dw(r,i)&&(n=i);return n}var nf="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function rA(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let s of e){let o=nf.indexOf(s);if(o===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|o,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function nA(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=nf[r>>>e&31];return e>0&&(n+=nf[r<<5-e&31]),n}function Fl(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),nA(e)}function Pw(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function Uw(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,Pw(e))),s=i[i.length-1]&15;return(((i[s]&127)<<24|(i[s+1]&255)<<16|(i[s+2]&255)<<8|i[s+3]&255)%10**r).toString().padStart(r,"0")}async function Vl(t,e,r=Date.now(),n={}){let i=n.period??30,s=n.digits??6,o=n.window??1,a=e.trim();if(a.length!==s||!/^\d+$/u.test(a))return!1;let c=rA(t),l=Math.floor(r/1e3/i),d=!1;for(let p=-o;p<=o;p++){let m=await Uw(c,l+p,s);Lw(m,a)&&(d=!0)}return d}function Lw(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function iA(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var sf="totp",Mw={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function sA(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:sf,requiresServerDelivery:!1,generateSecret(){return Fl()},generateBackupCodes(i){return Kl(i||r)},async issueChallenge(i){return g({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(sf)?[sf]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return u(Mw.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let s=Fl(),o=Kl(r),a=await Promise.all(o.map(p=>Hl(p))),c=i.data.accountName??i.userId,l=iA({secretBase32:s,accountName:c,issuer:e});return g({secret:s,otpauthUri:l,backupCodes:o,credentialData:{secret:s,backupCodeHashes:a}})},async verifyWithCredentials(i){let s=i.credentialData,o=i.data.code?.trim();if(!o||!s?.secret)return g({verified:!1,data:{}});if(await Vl(s.secret,o,Date.now(),{window:n}))return g({verified:!0,data:{}});let c=s.backupCodeHashes??[];if(c.length>0){let l=await rf(o,c);if(l)return g({verified:!0,data:{usedBackupCodeHash:l}})}return g({verified:!1,data:{}})},async verifyCredential(i,s){let o=i.data.code,a=i.data.secret;if(!o||!a)return g({verified:!1,data:{}});let c=await Vl(a,o,Date.now(),{window:n});return g({verified:c,data:{}})}}}var of={scopes:["email","public_profile"],apiVersion:"v18.0"};var Yr={INVALID_CODE:T("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:T("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function af(t={}){let{scopes:e=of.scopes,apiVersion:r=of.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,s){let o=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...s&&{state:s}});return`${n.AUTHORIZATION}?${o.toString()}`},async exchangeCodeForToken(i,s){try{if(!i)return u(Yr.INVALID_CODE());let o=new URLSearchParams({client_id:s.clientId,client_secret:s.clientSecret,code:i,redirect_uri:s.redirectUri}),a=await fetch(`${n.TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return g({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(o){return console.error("Facebook token exchange error:",o),u(Yr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=["id","email","name","first_name","last_name","picture","locale"],o=new URLSearchParams({fields:s.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return u(Yr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return g(l)}catch(s){return console.error("Facebook user profile error:",s),u(Yr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return u(Yr.INVALID_TOKEN());let s=`${t.appId}|${t.appSecret}`,o=new URLSearchParams({input_token:i,access_token:s}),a=await fetch(`${n.DEBUG_TOKEN}?${o.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):u(Yr.INVALID_TOKEN()):u(Yr.INVALID_TOKEN())}catch(s){return console.error("Facebook token verification error:",s),u(Yr.INVALID_TOKEN())}}}}var Bl={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},bi={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var et={INVALID_CODE:T("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:T("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:T("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:T("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:T("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:T("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:T("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:T("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function Kw(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function Hw(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=Kw(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function cf(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=Bl.scopes,accessType:s=Bl.accessType,includeGrantedScopes:o=Bl.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let d=c?.clientId??e,p=c?.redirectUri??n;if(!d||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let m=new URLSearchParams({client_id:d,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:s,...l&&{state:l},...a&&{prompt:a},...o&&{include_granted_scopes:"true"}});return`${bi.AUTHORIZATION}?${m.toString()}`},async exchangeCodeForToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r,m=l?.redirectUri??n;try{if(!c)return u(et.INVALID_CODE());if(!d||!p||!m)return u(et.MISSING_CONFIG());let E=new URLSearchParams({client_id:d,client_secret:p,code:c,redirect_uri:m,grant_type:"authorization_code"}),v=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:E.toString()});if(!v.ok)return console.error("Google token exchange failed with status:",v.status),u(et.TOKEN_EXCHANGE_FAILED());let b=await v.json();return g({accessToken:b.access_token,...b.refresh_token&&{refreshToken:b.refresh_token},...b.expires_in&&{expiresIn:b.expires_in}})}catch(E){return console.error("Google token exchange error:",E),u(et.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(bi.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),u(et.USER_PROFILE_FAILED());let d=await l.json(),p={id:d.id,...d.email&&{email:d.email},...d.verified_email!==void 0&&{emailVerified:d.verified_email},...d.name&&{name:d.name},...d.given_name&&{givenName:d.given_name},...d.family_name&&{familyName:d.family_name},...d.picture&&{avatarUrl:d.picture},...d.locale&&{locale:d.locale},provider:"google"};return g(p)}catch(l){return console.error("Google user profile error:",l),u(et.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return u(et.INVALID_TOKEN());let l=await fetch(`${bi.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return u(et.INVALID_TOKEN());let d=await l.json();return parseInt(d.expires_in,10)<=0?u(et.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),u(et.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return u(et.INVALID_CREDENTIAL());let l=await fetch(`${bi.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),u(et.INVALID_CREDENTIAL());let d=await l.json();if(!e)return u(et.MISSING_CONFIG());if(d.aud!==e)return u(et.INVALID_CREDENTIAL());if(parseInt(d.expires_in,10)<=0)return u(et.INVALID_CREDENTIAL());let m=d.email_verified==="true",E=Hw(c),v={id:d.sub,...d.email&&{email:d.email},...d.email&&{emailVerified:m},...E?.name&&{name:E.name},...E?.given_name&&{givenName:E.given_name},...E?.family_name&&{familyName:E.family_name},...E?.picture&&{avatarUrl:E.picture},...E?.locale&&{locale:E.locale},provider:"google"};return g(v)}catch(l){return console.error("Google credential verification error:",l),u(et.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let d=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return u(et.INVALID_TOKEN());if(!d||!p)return u(et.MISSING_CONFIG());let m=new URLSearchParams({client_id:d,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),E=await fetch(bi.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google refresh token failed with status:",E.status),u(et.REFRESH_TOKEN_FAILED());let v=await E.json();return g({accessToken:v.access_token,...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google refresh token error:",m),u(et.REFRESH_TOKEN_FAILED())}}}}function oA(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function s(){if(n===0)return;let o=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(d=>d>o);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(s,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(o,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let d=Date.now(),p=d-l,m=e.get(o)??{hits:[]},E=m.hits.filter(v=>v>p);if(E.length>=c){let v=E[0]??d,b=Math.max(0,v+l-d);return m.hits=E,e.set(o,m),{allowed:!1,remaining:0,retryAfterMs:b,limit:c}}return E.push(d),m.hits=E,e.set(o,m),{allowed:!0,remaining:c-E.length,retryAfterMs:0,limit:c}},async reset(o){e.delete(o)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as a0,DynamoDBClient as c0}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as l0}from"@aws-sdk/lib-dynamodb";var M={DatabaseConnectionError:T("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:X("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:X("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:X("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:X("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:T("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:T("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:X("INVALID_DATA","Invalid data: {reason}"),Timeout:T("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:T("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:X("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:X("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function ne(t){return t.getTime()}function z(t){return new Date(t)}function aA(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function ya(t){return t instanceof Date?aA(t.getTime()):aA(t)}function lf(t){return t<Date.now()}function Nr(t){return t?ne(t):null}function Ht(t){return t==null?null:z(t)}function Ft(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function wr(t){let e=[],r=[],n={},i={},s=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let d=`#${c}`;if(n[d]=c,l==null)r.push(d);else{let p=`:val${s}`;e.push(`${d} = ${p}`),i[p]=l,s++}}let o=[];return e.length>0&&o.push(`SET ${e.join(", ")}`),r.length>0&&o.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:o.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function uf(t="PK"){return`attribute_not_exists(${t})`}var df={USER:"USR"},ce={USER:`${df.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Ve={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},St="#",D={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Ve.AUTH,USER_PROFILE_SK:()=>Ve.PROFILE,USER_MFA_SK:t=>`${Ve.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Ve.MFA}${t}${St}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Ve.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Ve.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Ve.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Ve.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Ve.METADATA,SESSION_SK:()=>Ve.METADATA,PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${St}${e}`,PROVIDER_METADATA_SK:()=>Ve.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Ve.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Ve.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Ve.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Ve.PROVIDER.length),r=e.indexOf(St);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Ve.MFA.length),r=e.indexOf(St);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Ve.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${St}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${df.USER}${St}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Ve.PROVIDER}${t}${St}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${St}${e}${St}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${St}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${St}${e??"ROOT"}${St}${r}${St}${n}`},f={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},Se={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},ql={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${St}${e}`,extractCreatedAt:t=>{let e=t.indexOf(St),r=e===-1?t:t.slice(0,e);return Number(r)}};import{DeleteCommand as sR,GetCommand as oR,PutCommand as aR,UpdateCommand as TA}from"@aws-sdk/lib-dynamodb";var Fw=BigInt(0),ga=BigInt(1),Vw=BigInt(2),Bw=BigInt(7),qw=BigInt(256),jw=BigInt(113),uA=[],dA=[],pA=[];for(let t=0,e=ga,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],uA.push(2*(5*n+r)),dA.push((t+1)*(t+2)/2%64);let i=Fw;for(let s=0;s<7;s++)e=(e<<ga^(e>>Bw)*jw)%qw,e&Vw&&(i^=ga<<(ga<<BigInt(s))-ga);pA.push(i)}var fA=Gy(pA,!0),Gw=fA[0],$w=fA[1],cA=(t,e,r)=>r>32?zy(t,e,r):$y(t,e,r),lA=(t,e,r)=>r>32?Jy(t,e,r):Wy(t,e,r);function Ww(t,e=24){if(yt(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let o=0;o<10;o++)r[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let a=(o+8)%10,c=(o+2)%10,l=r[c],d=r[c+1],p=cA(l,d,1)^r[a],m=lA(l,d,1)^r[a+1];for(let E=0;E<50;E+=10)t[o+E]^=p,t[o+E+1]^=m}let i=t[2],s=t[3];for(let o=0;o<24;o++){let a=dA[o],c=cA(i,s,a),l=lA(i,s,a),d=uA[o];i=t[d],s=t[d+1],t[d]=c,t[d+1]=l}for(let o=0;o<50;o+=10){let a=t[o],c=t[o+1],l=t[o+2],d=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&a,t[o+7]^=~t[o+9]&c,t[o+8]^=~a&l,t[o+9]^=~c&d}t[0]^=Gw[n],t[1]^=$w[n]}jt(r)}var pf=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=s,yt(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=Ks(this.state)}clone(){return this._cloneInto()}keccak(){Fs(this.state32),Ww(this.state32,this.rounds),Fs(this.state32),this.posOut=0,this.pos=0}update(e){hn(this),mn(e);let{blockLen:r,state:n}=this,i=e.length;for(let s=0;s<i;){let o=Math.min(r-this.pos,i-s);for(let a=0;a<o;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){hn(this,!1),mn(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,s=e.length;i<s;){this.posOut>=n&&this.keccak();let o=Math.min(n-this.posOut,s-i);e.set(r.subarray(this.posOut,this.posOut+o),i),this.posOut+=o,i+=o}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return yt(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(Ms(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,jt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:s,enableXOF:o}=this;return e||=new t(r,n,i,o,s),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=i,e.enableXOF=o,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},zw=(t,e,r,n={})=>Tl(()=>new pf(e,t,r),n);var mA=zw(6,72,64,_l(10));var Jw=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,ff=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",hA=Gt+"Number primitive has more than 15 significant digits: ",Rr=1e14,ue=14,mf=9007199254740991,hf=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],Bn=1e7,vt=1e9;function EA(t){var e,r,n,i=L.prototype={constructor:L,toString:null,valueOf:null},s=new L(1),o=20,a=4,c=-7,l=21,d=-1e7,p=1e7,m=!1,E=1,v=0,b={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},k="0123456789abcdefghijklmnopqrstuvwxyz",C=!0;function L(A,x){var S,y,_,w,R,N,O,P,U=this;if(!(U instanceof L))return new L(A,x);if(x==null){if(A&&A._isBigNumber===!0){U.s=A.s,!A.c||A.e>p?U.c=U.e=null:A.e<d?U.c=[U.e=0]:(U.e=A.e,U.c=A.c.slice());return}if((N=typeof A=="number")&&A*0==0){if(U.s=1/A<0?(A=-A,-1):1,A===~~A){for(w=0,R=A;R>=10;R/=10,w++);w>p?U.c=U.e=null:(U.e=w,U.c=[A]);return}P=String(A)}else{if(!Jw.test(P=String(A)))return n(U,P,N);U.s=P.charCodeAt(0)==45?(P=P.slice(1),-1):1}(w=P.indexOf("."))>-1&&(P=P.replace(".","")),(R=P.search(/e/i))>0?(w<0&&(w=R),w+=+P.slice(R+1),P=P.substring(0,R)):w<0&&(w=P.length)}else{if(We(x,2,k.length,"Base"),x==10&&C)return U=new L(A),$(U,o+U.e+1,a);if(P=String(A),N=typeof A=="number"){if(A*0!=0)return n(U,P,N,x);if(U.s=1/A<0?(P=P.slice(1),-1):1,L.DEBUG&&P.replace(/^0\.0*|\./,"").length>15)throw Error(hA+A)}else U.s=P.charCodeAt(0)===45?(P=P.slice(1),-1):1;for(S=k.slice(0,x),w=R=0,O=P.length;R<O;R++)if(S.indexOf(y=P.charAt(R))<0){if(y=="."){if(R>w){w=O;continue}}else if(!_&&(P==P.toUpperCase()&&(P=P.toLowerCase())||P==P.toLowerCase()&&(P=P.toUpperCase()))){_=!0,R=-1,w=0;continue}return n(U,String(A),N,x)}N=!1,P=r(P,x,10,U.s),(w=P.indexOf("."))>-1?P=P.replace(".",""):w=P.length}for(R=0;P.charCodeAt(R)===48;R++);for(O=P.length;P.charCodeAt(--O)===48;);if(P=P.slice(R,++O)){if(O-=R,N&&L.DEBUG&&O>15&&(A>mf||A!==pr(A)))throw Error(hA+U.s*A);if((w=w-R-1)>p)U.c=U.e=null;else if(w<d)U.c=[U.e=0];else{if(U.e=w,U.c=[],R=(w+1)%ue,w<0&&(R+=ue),R<O){for(R&&U.c.push(+P.slice(0,R)),O-=ue;R<O;)U.c.push(+P.slice(R,R+=ue));R=ue-(P=P.slice(R)).length}else R-=O;for(;R--;P+="0");U.c.push(+P)}}else U.c=[U.e=0]}L.clone=EA,L.ROUND_UP=0,L.ROUND_DOWN=1,L.ROUND_CEIL=2,L.ROUND_FLOOR=3,L.ROUND_HALF_UP=4,L.ROUND_HALF_DOWN=5,L.ROUND_HALF_EVEN=6,L.ROUND_HALF_CEIL=7,L.ROUND_HALF_FLOOR=8,L.EUCLID=9,L.config=L.set=function(A){var x,S;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(S=A[x],We(S,0,vt,x),o=S),A.hasOwnProperty(x="ROUNDING_MODE")&&(S=A[x],We(S,0,8,x),a=S),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(S=A[x],S&&S.pop?(We(S[0],-vt,0,x),We(S[1],0,vt,x),c=S[0],l=S[1]):(We(S,-vt,vt,x),c=-(l=S<0?-S:S))),A.hasOwnProperty(x="RANGE"))if(S=A[x],S&&S.pop)We(S[0],-vt,-1,x),We(S[1],1,vt,x),d=S[0],p=S[1];else if(We(S,-vt,vt,x),S)d=-(p=S<0?-S:S);else throw Error(Gt+x+" cannot be zero: "+S);if(A.hasOwnProperty(x="CRYPTO"))if(S=A[x],S===!!S)if(S)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))m=S;else throw m=!S,Error(Gt+"crypto unavailable");else m=S;else throw Error(Gt+x+" not true or false: "+S);if(A.hasOwnProperty(x="MODULO_MODE")&&(S=A[x],We(S,0,9,x),E=S),A.hasOwnProperty(x="POW_PRECISION")&&(S=A[x],We(S,0,vt,x),v=S),A.hasOwnProperty(x="FORMAT"))if(S=A[x],typeof S=="object")b=S;else throw Error(Gt+x+" not an object: "+S);if(A.hasOwnProperty(x="ALPHABET"))if(S=A[x],typeof S=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(S))C=S.slice(0,10)=="0123456789",k=S;else throw Error(Gt+x+" invalid: "+S)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:o,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[d,p],CRYPTO:m,MODULO_MODE:E,POW_PRECISION:v,FORMAT:b,ALPHABET:k}},L.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!L.DEBUG)return!0;var x,S,y=A.c,_=A.e,w=A.s;e:if({}.toString.call(y)=="[object Array]"){if((w===1||w===-1)&&_>=-vt&&_<=vt&&_===pr(_)){if(y[0]===0){if(_===0&&y.length===1)return!0;break e}if(x=(_+1)%ue,x<1&&(x+=ue),String(y[0]).length==x){for(x=0;x<y.length;x++)if(S=y[x],S<0||S>=Rr||S!==pr(S))break e;if(S!==0)return!0}}}else if(y===null&&_===null&&(w===null||w===1||w===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},L.maximum=L.max=function(){return G(arguments,-1)},L.minimum=L.min=function(){return G(arguments,1)},L.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(S){var y,_,w,R,N,O=0,P=[],U=new L(s);if(S==null?S=o:We(S,0,vt),R=ff(S/ue),m)if(crypto.getRandomValues){for(y=crypto.getRandomValues(new Uint32Array(R*=2));O<R;)N=y[O]*131072+(y[O+1]>>>11),N>=9e15?(_=crypto.getRandomValues(new Uint32Array(2)),y[O]=_[0],y[O+1]=_[1]):(P.push(N%1e14),O+=2);O=R/2}else if(crypto.randomBytes){for(y=crypto.randomBytes(R*=7);O<R;)N=(y[O]&31)*281474976710656+y[O+1]*1099511627776+y[O+2]*4294967296+y[O+3]*16777216+(y[O+4]<<16)+(y[O+5]<<8)+y[O+6],N>=9e15?crypto.randomBytes(7).copy(y,O):(P.push(N%1e14),O+=7);O=R/7}else throw m=!1,Error(Gt+"crypto unavailable");if(!m)for(;O<R;)N=x(),N<9e15&&(P[O++]=N%1e14);for(R=P[--O],S%=ue,R&&S&&(N=hf[ue-S],P[O]=pr(R/N)*N);P[O]===0;P.pop(),O--);if(O<0)P=[w=0];else{for(w=-1;P[0]===0;P.splice(0,1),w-=ue);for(O=1,N=P[0];N>=10;N/=10,O++);O<ue&&(w-=ue-O)}return U.e=w,U.c=P,U}})(),L.sum=function(){for(var A=1,x=arguments,S=new L(x[0]);A<x.length;)S=S.plus(x[A++]);return S},r=(function(){var A="0123456789";function x(S,y,_,w){for(var R,N=[0],O,P=0,U=S.length;P<U;){for(O=N.length;O--;N[O]*=y);for(N[0]+=w.indexOf(S.charAt(P++)),R=0;R<N.length;R++)N[R]>_-1&&(N[R+1]==null&&(N[R+1]=0),N[R+1]+=N[R]/_|0,N[R]%=_)}return N.reverse()}return function(S,y,_,w,R){var N,O,P,U,K,W,J,de,ke=S.indexOf("."),He=o,fe=a;for(ke>=0&&(U=v,v=0,S=S.replace(".",""),de=new L(y),W=de.pow(S.length-ke),v=U,de.c=x(yn(dr(W.c),W.e,"0"),10,_,A),de.e=de.c.length),J=x(S,y,_,R?(N=k,A):(N=A,k)),P=U=J.length;J[--U]==0;J.pop());if(!J[0])return N.charAt(0);if(ke<0?--P:(W.c=J,W.e=P,W.s=w,W=e(W,de,He,fe,_),J=W.c,K=W.r,P=W.e),O=P+He+1,ke=J[O],U=_/2,K=K||O<0||J[O+1]!=null,K=fe<4?(ke!=null||K)&&(fe==0||fe==(W.s<0?3:2)):ke>U||ke==U&&(fe==4||K||fe==6&&J[O-1]&1||fe==(W.s<0?8:7)),O<1||!J[0])S=K?yn(N.charAt(1),-He,N.charAt(0)):N.charAt(0);else{if(J.length=O,K)for(--_;++J[--O]>_;)J[O]=0,O||(++P,J=[1].concat(J));for(U=J.length;!J[--U];);for(ke=0,S="";ke<=U;S+=N.charAt(J[ke++]));S=yn(S,P,N.charAt(0))}return S}})(),e=(function(){function A(y,_,w){var R,N,O,P,U=0,K=y.length,W=_%Bn,J=_/Bn|0;for(y=y.slice();K--;)O=y[K]%Bn,P=y[K]/Bn|0,R=J*O+P*W,N=W*O+R%Bn*Bn+U,U=(N/w|0)+(R/Bn|0)+J*P,y[K]=N%w;return U&&(y=[U].concat(y)),y}function x(y,_,w,R){var N,O;if(w!=R)O=w>R?1:-1;else for(N=O=0;N<w;N++)if(y[N]!=_[N]){O=y[N]>_[N]?1:-1;break}return O}function S(y,_,w,R){for(var N=0;w--;)y[w]-=N,N=y[w]<_[w]?1:0,y[w]=N*R+y[w]-_[w];for(;!y[0]&&y.length>1;y.splice(0,1));}return function(y,_,w,R,N){var O,P,U,K,W,J,de,ke,He,fe,Ne,at,Ri,gn,Oi,Nt,Gn,wt=y.s==_.s?1:-1,Ye=y.c,Me=_.c;if(!Ye||!Ye[0]||!Me||!Me[0])return new L(!y.s||!_.s||(Ye?Me&&Ye[0]==Me[0]:!Me)?NaN:Ye&&Ye[0]==0||!Me?wt*0:wt/0);for(ke=new L(wt),He=ke.c=[],P=y.e-_.e,wt=w+P+1,N||(N=Rr,P=fr(y.e/ue)-fr(_.e/ue),wt=wt/ue|0),U=0;Me[U]==(Ye[U]||0);U++);if(Me[U]>(Ye[U]||0)&&P--,wt<0)He.push(1),K=!0;else{for(gn=Ye.length,Nt=Me.length,U=0,wt+=2,W=pr(N/(Me[0]+1)),W>1&&(Me=A(Me,W,N),Ye=A(Ye,W,N),Nt=Me.length,gn=Ye.length),Ri=Nt,fe=Ye.slice(0,Nt),Ne=fe.length;Ne<Nt;fe[Ne++]=0);Gn=Me.slice(),Gn=[0].concat(Gn),Oi=Me[0],Me[1]>=N/2&&Oi++;do{if(W=0,O=x(Me,fe,Nt,Ne),O<0){if(at=fe[0],Nt!=Ne&&(at=at*N+(fe[1]||0)),W=pr(at/Oi),W>1)for(W>=N&&(W=N-1),J=A(Me,W,N),de=J.length,Ne=fe.length;x(J,fe,de,Ne)==1;)W--,S(J,Nt<de?Gn:Me,de,N),de=J.length,O=1;else W==0&&(O=W=1),J=Me.slice(),de=J.length;if(de<Ne&&(J=[0].concat(J)),S(fe,J,Ne,N),Ne=fe.length,O==-1)for(;x(Me,fe,Nt,Ne)<1;)W++,S(fe,Nt<Ne?Gn:Me,Ne,N),Ne=fe.length}else O===0&&(W++,fe=[0]);He[U++]=W,fe[0]?fe[Ne++]=Ye[Ri]||0:(fe=[Ye[Ri]],Ne=1)}while((Ri++<gn||fe[0]!=null)&&wt--);K=fe[0]!=null,He[0]||He.splice(0,1)}if(N==Rr){for(U=1,wt=He[0];wt>=10;wt/=10,U++);$(ke,w+(ke.e=U+P*ue-1)+1,R,K)}else ke.e=P,ke.r=+K;return ke}})();function B(A,x,S,y){var _,w,R,N,O;if(S==null?S=a:We(S,0,8),!A.c)return A.toString();if(_=A.c[0],R=A.e,x==null)O=dr(A.c),O=y==1||y==2&&(R<=c||R>=l)?Gl(O,R):yn(O,R,"0");else if(A=$(new L(A),x,S),w=A.e,O=dr(A.c),N=O.length,y==1||y==2&&(x<=w||w<=c)){for(;N<x;O+="0",N++);O=Gl(O,w)}else if(x-=R+(y===2&&w>R),O=yn(O,w,"0"),w+1>N){if(--x>0)for(O+=".";x--;O+="0");}else if(x+=w-N,x>0)for(w+1==N&&(O+=".");x--;O+="0");return A.s<0&&_?"-"+O:O}function G(A,x){for(var S,y,_=1,w=new L(A[0]);_<A.length;_++)y=new L(A[_]),(!y.s||(S=Si(w,y))===x||S===0&&w.s===x)&&(w=y);return w}function j(A,x,S){for(var y=1,_=x.length;!x[--_];x.pop());for(_=x[0];_>=10;_/=10,y++);return(S=y+S*ue-1)>p?A.c=A.e=null:S<d?A.c=[A.e=0]:(A.e=S,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,S=/^\.([^.]+)$/,y=/^-?(Infinity|NaN)$/,_=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(w,R,N,O){var P,U=N?R:R.replace(_,"");if(y.test(U))w.s=isNaN(U)?null:U<0?-1:1;else{if(!N&&(U=U.replace(A,function(K,W,J){return P=(J=J.toLowerCase())=="x"?16:J=="b"?2:8,!O||O==P?W:K}),O&&(P=O,U=U.replace(x,"$1").replace(S,"0.$1")),R!=U))return new L(U,P);if(L.DEBUG)throw Error(Gt+"Not a"+(O?" base "+O:"")+" number: "+R);w.s=null}w.c=w.e=null}})();function $(A,x,S,y){var _,w,R,N,O,P,U,K=A.c,W=hf;if(K){e:{for(_=1,N=K[0];N>=10;N/=10,_++);if(w=x-_,w<0)w+=ue,R=x,O=K[P=0],U=pr(O/W[_-R-1]%10);else if(P=ff((w+1)/ue),P>=K.length)if(y){for(;K.length<=P;K.push(0));O=U=0,_=1,w%=ue,R=w-ue+1}else break e;else{for(O=N=K[P],_=1;N>=10;N/=10,_++);w%=ue,R=w-ue+_,U=R<0?0:pr(O/W[_-R-1]%10)}if(y=y||x<0||K[P+1]!=null||(R<0?O:O%W[_-R-1]),y=S<4?(U||y)&&(S==0||S==(A.s<0?3:2)):U>5||U==5&&(S==4||y||S==6&&(w>0?R>0?O/W[_-R]:0:K[P-1])%10&1||S==(A.s<0?8:7)),x<1||!K[0])return K.length=0,y?(x-=A.e+1,K[0]=W[(ue-x%ue)%ue],A.e=-x||0):K[0]=A.e=0,A;if(w==0?(K.length=P,N=1,P--):(K.length=P+1,N=W[ue-w],K[P]=R>0?pr(O/W[_-R]%W[R])*N:0),y)for(;;)if(P==0){for(w=1,R=K[0];R>=10;R/=10,w++);for(R=K[0]+=N,N=1;R>=10;R/=10,N++);w!=N&&(A.e++,K[0]==Rr&&(K[0]=1));break}else{if(K[P]+=N,K[P]!=Rr)break;K[P--]=0,N=1}for(w=K.length;K[--w]===0;K.pop());}A.e>p?A.c=A.e=null:A.e<d&&(A.c=[A.e=0])}return A}function te(A){var x,S=A.e;return S===null?A.toString():(x=dr(A.c),x=S<=c||S>=l?Gl(x,S):yn(x,S,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new L(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Si(this,new L(A,x))},i.decimalPlaces=i.dp=function(A,x){var S,y,_,w=this;if(A!=null)return We(A,0,vt),x==null?x=a:We(x,0,8),$(new L(w),A+w.e+1,x);if(!(S=w.c))return null;if(y=((_=S.length-1)-fr(this.e/ue))*ue,_=S[_])for(;_%10==0;_/=10,y--);return y<0&&(y=0),y},i.dividedBy=i.div=function(A,x){return e(this,new L(A,x),o,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new L(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var S,y,_,w,R,N,O,P,U,K=this;if(A=new L(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+te(A));if(x!=null&&(x=new L(x)),N=A.e>14,!K.c||!K.c[0]||K.c[0]==1&&!K.e&&K.c.length==1||!A.c||!A.c[0])return U=new L(Math.pow(+te(K),N?A.s*(2-jl(A)):+te(A))),x?U.mod(x):U;if(O=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new L(NaN);y=!O&&K.isInteger()&&x.isInteger(),y&&(K=K.mod(x))}else{if(A.e>9&&(K.e>0||K.e<-1||(K.e==0?K.c[0]>1||N&&K.c[1]>=24e7:K.c[0]<8e13||N&&K.c[0]<=9999975e7)))return w=K.s<0&&jl(A)?-0:0,K.e>-1&&(w=1/w),new L(O?1/w:w);v&&(w=ff(v/ue+2))}for(N?(S=new L(.5),O&&(A.s=1),P=jl(A)):(_=Math.abs(+te(A)),P=_%2),U=new L(s);;){if(P){if(U=U.times(K),!U.c)break;w?U.c.length>w&&(U.c.length=w):y&&(U=U.mod(x))}if(_){if(_=pr(_/2),_===0)break;P=_%2}else if(A=A.times(S),$(A,A.e+1,1),A.e>14)P=jl(A);else{if(_=+te(A),_===0)break;P=_%2}K=K.times(K),w?K.c&&K.c.length>w&&(K.c.length=w):y&&(K=K.mod(x))}return y?U:(O&&(U=s.div(U)),x?U.mod(x):w?$(U,v,a,R):U)},i.integerValue=function(A){var x=new L(this);return A==null?A=a:We(A,0,8),$(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Si(this,new L(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Si(this,new L(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Si(this,new L(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/ue)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Si(this,new L(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Si(this,new L(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var S,y,_,w,R=this,N=R.s;if(A=new L(A,x),x=A.s,!N||!x)return new L(NaN);if(N!=x)return A.s=-x,R.plus(A);var O=R.e/ue,P=A.e/ue,U=R.c,K=A.c;if(!O||!P){if(!U||!K)return U?(A.s=-x,A):new L(K?R:NaN);if(!U[0]||!K[0])return K[0]?(A.s=-x,A):new L(U[0]?R:a==3?-0:0)}if(O=fr(O),P=fr(P),U=U.slice(),N=O-P){for((w=N<0)?(N=-N,_=U):(P=O,_=K),_.reverse(),x=N;x--;_.push(0));_.reverse()}else for(y=(w=(N=U.length)<(x=K.length))?N:x,N=x=0;x<y;x++)if(U[x]!=K[x]){w=U[x]<K[x];break}if(w&&(_=U,U=K,K=_,A.s=-A.s),x=(y=K.length)-(S=U.length),x>0)for(;x--;U[S++]=0);for(x=Rr-1;y>N;){if(U[--y]<K[y]){for(S=y;S&&!U[--S];U[S]=x);--U[S],U[y]+=Rr}U[y]-=K[y]}for(;U[0]==0;U.splice(0,1),--P);return U[0]?j(A,U,P):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var S,y,_=this;return A=new L(A,x),!_.c||!A.s||A.c&&!A.c[0]?new L(NaN):!A.c||_.c&&!_.c[0]?new L(_):(E==9?(y=A.s,A.s=1,S=e(_,A,0,3),A.s=y,S.s*=y):S=e(_,A,0,E),A=_.minus(S.times(A)),!A.c[0]&&E==1&&(A.s=_.s),A)},i.multipliedBy=i.times=function(A,x){var S,y,_,w,R,N,O,P,U,K,W,J,de,ke,He,fe=this,Ne=fe.c,at=(A=new L(A,x)).c;if(!Ne||!at||!Ne[0]||!at[0])return!fe.s||!A.s||Ne&&!Ne[0]&&!at||at&&!at[0]&&!Ne?A.c=A.e=A.s=null:(A.s*=fe.s,!Ne||!at?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(y=fr(fe.e/ue)+fr(A.e/ue),A.s*=fe.s,O=Ne.length,K=at.length,O<K&&(de=Ne,Ne=at,at=de,_=O,O=K,K=_),_=O+K,de=[];_--;de.push(0));for(ke=Rr,He=Bn,_=K;--_>=0;){for(S=0,W=at[_]%He,J=at[_]/He|0,R=O,w=_+R;w>_;)P=Ne[--R]%He,U=Ne[R]/He|0,N=J*P+U*W,P=W*P+N%He*He+de[w]+S,S=(P/ke|0)+(N/He|0)+J*U,de[w--]=P%ke;de[w]=S}return S?++y:de.splice(0,1),j(A,de,y)},i.negated=function(){var A=new L(this);return A.s=-A.s||null,A},i.plus=function(A,x){var S,y=this,_=y.s;if(A=new L(A,x),x=A.s,!_||!x)return new L(NaN);if(_!=x)return A.s=-x,y.minus(A);var w=y.e/ue,R=A.e/ue,N=y.c,O=A.c;if(!w||!R){if(!N||!O)return new L(_/0);if(!N[0]||!O[0])return O[0]?A:new L(N[0]?y:_*0)}if(w=fr(w),R=fr(R),N=N.slice(),_=w-R){for(_>0?(R=w,S=O):(_=-_,S=N),S.reverse();_--;S.push(0));S.reverse()}for(_=N.length,x=O.length,_-x<0&&(S=O,O=N,N=S,x=_),_=0;x;)_=(N[--x]=N[x]+O[x]+_)/Rr|0,N[x]=Rr===N[x]?0:N[x]%Rr;return _&&(N=[_].concat(N),++R),j(A,N,R)},i.precision=i.sd=function(A,x){var S,y,_,w=this;if(A!=null&&A!==!!A)return We(A,1,vt),x==null?x=a:We(x,0,8),$(new L(w),A,x);if(!(S=w.c))return null;if(_=S.length-1,y=_*ue+1,_=S[_]){for(;_%10==0;_/=10,y--);for(_=S[0];_>=10;_/=10,y++);}return A&&w.e+1>y&&(y=w.e+1),y},i.shiftedBy=function(A){return We(A,-mf,mf),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,S,y,_,w=this,R=w.c,N=w.s,O=w.e,P=o+4,U=new L("0.5");if(N!==1||!R||!R[0])return new L(!N||N<0&&(!R||R[0])?NaN:R?w:1/0);if(N=Math.sqrt(+te(w)),N==0||N==1/0?(x=dr(R),(x.length+O)%2==0&&(x+="0"),N=Math.sqrt(+x),O=fr((O+1)/2)-(O<0||O%2),N==1/0?x="5e"+O:(x=N.toExponential(),x=x.slice(0,x.indexOf("e")+1)+O),S=new L(x)):S=new L(N+""),S.c[0]){for(O=S.e,N=O+P,N<3&&(N=0);;)if(_=S,S=U.times(_.plus(e(w,_,P,1))),dr(_.c).slice(0,N)===(x=dr(S.c)).slice(0,N))if(S.e<O&&--N,x=x.slice(N-3,N+1),x=="9999"||!y&&x=="4999"){if(!y&&($(_,_.e+o+2,0),_.times(_).eq(w))){S=_;break}P+=4,N+=4,y=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&($(S,S.e+o+2,1),A=!S.times(S).eq(w));break}}return $(S,S.e+o+1,a,A)},i.toExponential=function(A,x){return A!=null&&(We(A,0,vt),A++),B(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(We(A,0,vt),A=A+this.e+1),B(this,A,x)},i.toFormat=function(A,x,S){var y,_=this;if(S==null)A!=null&&x&&typeof x=="object"?(S=x,x=null):A&&typeof A=="object"?(S=A,A=x=null):S=b;else if(typeof S!="object")throw Error(Gt+"Argument not an object: "+S);if(y=_.toFixed(A,x),_.c){var w,R=y.split("."),N=+S.groupSize,O=+S.secondaryGroupSize,P=S.groupSeparator||"",U=R[0],K=R[1],W=_.s<0,J=W?U.slice(1):U,de=J.length;if(O&&(w=N,N=O,O=w,de-=w),N>0&&de>0){for(w=de%N||N,U=J.substr(0,w);w<de;w+=N)U+=P+J.substr(w,N);O>0&&(U+=P+J.slice(w)),W&&(U="-"+U)}y=K?U+(S.decimalSeparator||"")+((O=+S.fractionGroupSize)?K.replace(new RegExp("\\d{"+O+"}\\B","g"),"$&"+(S.fractionGroupSeparator||"")):K):U}return(S.prefix||"")+y+(S.suffix||"")},i.toFraction=function(A){var x,S,y,_,w,R,N,O,P,U,K,W,J=this,de=J.c;if(A!=null&&(N=new L(A),!N.isInteger()&&(N.c||N.s!==1)||N.lt(s)))throw Error(Gt+"Argument "+(N.isInteger()?"out of range: ":"not an integer: ")+te(N));if(!de)return new L(J);for(x=new L(s),P=S=new L(s),y=O=new L(s),W=dr(de),w=x.e=W.length-J.e-1,x.c[0]=hf[(R=w%ue)<0?ue+R:R],A=!A||N.comparedTo(x)>0?w>0?x:P:N,R=p,p=1/0,N=new L(W),O.c[0]=0;U=e(N,x,0,1),_=S.plus(U.times(y)),_.comparedTo(A)!=1;)S=y,y=_,P=O.plus(U.times(_=P)),O=_,x=N.minus(U.times(_=x)),N=_;return _=e(A.minus(S),y,0,1),O=O.plus(_.times(P)),S=S.plus(_.times(y)),O.s=P.s=J.s,w=w*2,K=e(P,y,w,a).minus(J).abs().comparedTo(e(O,S,w,a).minus(J).abs())<1?[P,y]:[O,S],p=R,K},i.toNumber=function(){return+te(this)},i.toPrecision=function(A,x){return A!=null&&We(A,1,vt),B(this,A,x,2)},i.toString=function(A){var x,S=this,y=S.s,_=S.e;return _===null?y?(x="Infinity",y<0&&(x="-"+x)):x="NaN":(A==null?x=_<=c||_>=l?Gl(dr(S.c),_):yn(dr(S.c),_,"0"):A===10&&C?(S=$(new L(S),o+_+1,a),x=yn(dr(S.c),S.e,"0")):(We(A,2,k.length,"Base"),x=r(yn(dr(S.c),_,"0"),10,A,y,!0)),y<0&&S.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return te(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&L.set(t),L}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,s=t[0]+"";n<i;){for(e=t[n++]+"",r=ue-e.length;r--;e="0"+e);s+=e}for(i=s.length;s.charCodeAt(--i)===48;);return s.slice(0,i+1||1)}function Si(t,e){var r,n,i=t.c,s=e.c,o=t.s,a=e.s,c=t.e,l=e.e;if(!o||!a)return null;if(r=i&&!i[0],n=s&&!s[0],r||n)return r?n?0:-a:o;if(o!=a)return o;if(r=o<0,n=c==l,!i||!s)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=s.length)?c:l,o=0;o<a;o++)if(i[o]!=s[o])return i[o]>s[o]^r?1:-1;return c==l?0:c>l^r?1:-1}function We(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function jl(t){var e=t.c.length-1;return fr(t.e/ue)==e&&t.c[e]%2!=0}function Gl(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function yn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var Yw=EA(),yA=Yw;var Xw=24,va=32,Qw=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,yf=Qw(),Ef=(t=4,e=yf)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function Zw(t){let e=new yA(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var vA=(t="")=>{let e=new TextEncoder;return Zw(mA(e.encode(t))).toString(36).slice(1)},gA=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),eR=t=>gA[Math.floor(t()*gA.length)],tR=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=yf}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Ef(va,e):Ef(va,e);return vA(n).substring(0,va)},rR=t=>()=>t++,nR=476782367,AA=({random:t=yf,counter:e=rR(Math.floor(t()*nR)),length:r=Xw,fingerprint:n=tR({random:t})}={})=>{if(r>va)throw new Error(`Length must be between 2 and ${va}. Received: ${r}`);return function(){let s=eR(t),o=Date.now().toString(36),a=e().toString(36),c=Ef(r,t),l=`${o+c+a+n}`;return`${s+vA(l).substring(1,r)}`}},At=iR(AA);function iR(t){let e;return()=>(e||(e=t()),e())}function Aa(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Pe(t){return Aa(t)==="ConditionalCheckFailedException"}var Ta=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return At()}async get(e){try{let r=await this.docClient.send(new oR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()}}));if(!r.Item)return g(null);let n=this.unmarshall(r.Item);return lf(ne(n.expiresAt))?g(null):g(n)}catch{return u(M.DatabaseQueryError({query:"get challenge"}))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:z(r)},s=ne(e.expiresAt),o=Math.floor((s+this.ttlGracePeriod)/1e3);return await this.docClient.send(new aR({TableName:this.tableName,Item:this.marshall(i,o)})),g(i)}catch{return u(M.DatabaseQueryError({query:"create challenge"}))}}async update(e,r){try{let n=[],i={},s={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=f.METHOD,s[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=f.PHASE,s[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=f.CODE_HASH,s[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=f.CHALLENGE_STATUS,s[":challengeStatus"]=r.status),n.length===0?g(void 0):(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g(void 0))}catch{return u(M.DatabaseQueryError({query:"update challenge"}))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let o=(await this.docClient.send(new TA({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":f.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[f.ATTEMPTS]??0;return g(o)}catch(s){return Pe(s)?u(M.AttemptsExceeded()):u(M.DatabaseQueryError({query:"increment challenge attempts"}))}}async remove(e){try{return await this.docClient.send(new sR({TableName:this.tableName,Key:{[f.PK]:D.CHALLENGE_PK(e),[f.SK]:D.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":f.PK}})),g(void 0)}catch(r){return Pe(r)?g(void 0):u(M.DatabaseQueryError({query:"remove challenge"}))}}marshall(e,r){let n={[f.PK]:D.CHALLENGE_PK(e.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:e.userId,[f.PURPOSE]:e.purpose,[f.CHALLENGE_STATUS]:e.status,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.TTL]:r};return e.tenantId&&(n[f.TENANT_ID]=e.tenantId),e.phase&&(n[f.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[f.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[f.METHOD]=e.method),e.codeHash&&(n[f.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[f.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[f.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[f.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[f.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[f.COUNTRY]=e.country),e.city&&(n[f.CITY]=e.city),e.metadata&&(n[f.METADATA]=e.metadata),e.flowKey&&(n[f.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[f.PK]),userId:e[f.USER_ID],purpose:e[f.PURPOSE],status:e[f.CHALLENGE_STATUS],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT])};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.PHASE]&&(n.phase=e[f.PHASE]),e[f.ALLOWED_METHODS]&&(n.allowedMethods=e[f.ALLOWED_METHODS]),e[f.METHOD]&&(n.method=e[f.METHOD]),e[f.CODE_HASH]&&(n.codeHash=e[f.CODE_HASH]),e[f.ATTEMPTS]!==void 0&&(n.attempts=e[f.ATTEMPTS]),e[f.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[f.MAX_ATTEMPTS]),e[f.IDENTITY_TYPE]&&(n.identityType=e[f.IDENTITY_TYPE]),e[f.IDENTITY_VALUE]&&(n.identityValue=e[f.IDENTITY_VALUE]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.FLOW_KEY]&&(n.flowKey=e[f.FLOW_KEY]),n}};import{BatchGetCommand as cR,DeleteCommand as lR,GetCommand as uR,PutCommand as dR,QueryCommand as $l,UpdateCommand as pR}from"@aws-sdk/lib-dynamodb";var _a=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return At()}async get(e){try{let r=await this.docClient.send(new uR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get credential"}))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return g(null);let i=n.Items[0];if(!i)return g(null);let s=le.credentialId(i[f.PK]);return this.get(s)}catch{return u(M.DatabaseQueryError({query:"get credential by user and type"}))}}async getByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(o=>le.credentialId(o[f.PK])),i=await this.batchGet(n);if(i.ok===!1)return u(i.errors,i.meta);if(!i.data)return g([]);let s=i.data.filter(o=>o!==null);return g(s)}catch{return u(M.DatabaseQueryError({query:"get credentials by user"}))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new dR({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(i)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"credential"})):u(M.DatabaseQueryError({query:"create credential"}))}}async update(e,r){try{let n=ae(),i=[],s={},o={};return i.push(`#${f.UPDATED_AT} = :updatedAt`),s[`#${f.UPDATED_AT}`]=f.UPDATED_AT,o[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${f.CREDENTIAL_VALUE} = :value`),s[`#${f.CREDENTIAL_VALUE}`]=f.CREDENTIAL_VALUE,o[":value"]=r.value),r.data!==void 0&&(i.push(`#${f.METADATA} = :data`),s[`#${f.METADATA}`]=f.METADATA,o[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${f.REVOKED_AT} = :revokedAt`),s[`#${f.REVOKED_AT}`]=f.REVOKED_AT,o[":revokedAt"]=r.revokedAt?ne(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${f.LAST_USED_AT} = :lastUsedAt`),s[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,o[":lastUsedAt"]=r.lastUsedAt?ne(r.lastUsedAt):null),await this.docClient.send(new pR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"update credential"}))}}async remove(e){try{return await this.docClient.send(new lR({TableName:this.tableName,Key:{[f.PK]:D.CREDENTIAL_PK(e),[f.SK]:D.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(r){return Pe(r)?u(M.NotFound({entity:"credential",id:e})):u(M.DatabaseQueryError({query:"delete credential"}))}}async hasType(e,r){try{let n=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk AND begins_with(${f.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":D.USER_PK(e),":typePrefix":D.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return g((n.Count||0)>0)}catch{return u(M.DatabaseQueryError({query:"check credential type"}))}}async countByUserId(e){try{let r=await this.docClient.send(new $l({TableName:this.tableName,IndexName:Se.USER_CREDENTIALS,KeyConditionExpression:`${f.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count credentials"}))}}async batchGet(e){if(e.length===0)return g([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let o=(await this.docClient.send(new cR({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[f.PK]:D.CREDENTIAL_PK(c),[f.SK]:D.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of o){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return g(n)}catch{return u(M.DatabaseQueryError({query:"batch get credentials"}))}}marshall(e){let r={[f.PK]:D.CREDENTIAL_PK(e.id),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(e.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(e.type,e.id),[f.USER_ID]:e.userId,[f.CREDENTIAL_VALUE]:e.value,[f.METADATA]:e.data,[f.REVOKED_AT]:e.revokedAt?ne(e.revokedAt):null,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)};return e.lastUsedAt&&(r[f.LAST_USED_AT]=ne(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[f.PK]),n=le.credentialTypeFromUserSK(e[f.CREDENTIAL_USER_SK]);return{id:r,userId:e[f.USER_ID],type:n,value:e[f.CREDENTIAL_VALUE],data:e[f.METADATA]||{},revokedAt:Ht(e[f.REVOKED_AT]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT]),lastUsedAt:Ht(e[f.LAST_USED_AT])}}};import{BatchGetCommand as fR,DeleteCommand as mR,GetCommand as hR,PutCommand as ER,QueryCommand as yR,UpdateCommand as gf}from"@aws-sdk/lib-dynamodb";function vf(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Nr(t.lastFailedAt),lockedUntil:Nr(t.lockedUntil)}}function _A(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Ht(n.lastFailedAt),lockedUntil:Ht(n.lockedUntil)};return e}function IA(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=vf(n));return e}var Ia=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new hR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}}));if(!n.Item)return g(null);let i=this.unmarshall(n.Item);return g(i)}catch(n){return console.error("[DynamoDB] identities.get error:",n),u(M.DatabaseQueryError({query:"get identity"}))}}async getByUserId(e){try{let r=await this.docClient.send(new yR({TableName:this.tableName,IndexName:Se.USER_IDENTITIES,KeyConditionExpression:`${f.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":D.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let s=this.unmarshall(i);s!==null&&n.push(s)}return g(n)}catch{return u(M.DatabaseQueryError({query:"get identities by userId"}))}}async create(e){try{let r=ae(),n={...e,createdAt:z(r),updatedAt:z(r)};return await this.docClient.send(new ER({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"identity"})):u(M.DatabaseQueryError({query:"create identity"}))}}async update(e,r,n){try{let i=[],s=[],o={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),o["#loginEnabled"]=f.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Nr(n.verifiedAt);l===null?(s.push("#verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),o["#verifiedAt"]=f.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),o["#guards"]=f.GUARDS,a[":guards"]=IA(n.guards)),n.pendingVerification!==void 0&&(o["#pendingVerification"]=f.PENDING_VERIFICATION,n.pendingVerification===null?s.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),o["#updatedAt"]=f.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),s.length>0&&c.push(`REMOVE ${s.join(", ")}`),await this.docClient.send(new gf({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update identity"}))}}async remove(e,r){try{return await this.docClient.send(new mR({TableName:this.tableName,Key:{[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove identity"}))}}async updateGuard(e,r,n,i){let s={[f.PK]:D.IDENTITY_PK(e,r),[f.SK]:D.IDENTITY_SK()};try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":f.GUARDS,"#guardKey":n,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guard":vf(i),":updatedAt":ae()}})),g(void 0)}catch(o){if(Pe(o))try{return await this.docClient.send(new gf({TableName:this.tableName,Key:s,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":f.GUARDS,"#updatedAt":f.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:vf(i)},":updatedAt":ae()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update guard"}))}return u(M.DatabaseQueryError({query:"update guard"}))}}async batchGet(e){try{if(e.length===0)return g([]);let n=(await this.docClient.send(new fR({RequestItems:{[this.tableName]:{Keys:e.map(({type:o,value:a})=>({[f.PK]:D.IDENTITY_PK(o,a),[f.SK]:D.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let o of n){let a=this.unmarshall(o);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let s=e.map(({type:o,value:a})=>{let c=`${o}#${a}`;return i.get(c)||null});return g(s)}catch{return u(M.DatabaseQueryError({query:"batch get identities"}))}}marshall(e){let r={[f.PK]:D.IDENTITY_PK(e.type,e.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(e.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(e.type,e.value),[f.USER_ID]:e.userId,[f.LOGIN_ENABLED]:e.loginEnabled,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)},n=Nr(e.verifiedAt);return n!==null&&(r[f.VERIFIED_AT]=n),r[f.GUARDS]=IA(e.guards),e.pendingVerification&&(r[f.PENDING_VERIFICATION]=Ft({...e.pendingVerification,expiresAt:ne(e.pendingVerification.expiresAt),resendAvailableAt:Nr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[f.PK]);if(!r){let n=e[f.IDENTITY_USER_SK]?le.userIndexSKInfo(e[f.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:_A(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[f.PK],GSI1SK:e[f.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[f.USER_ID],loginEnabled:e[f.LOGIN_ENABLED],verifiedAt:Ht(e[f.VERIFIED_AT]),guards:_A(e[f.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[f.PENDING_VERIFICATION]),createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:z(r.expiresAt),resendAvailableAt:Ht(r.resendAvailableAt)}}};import{TransactWriteCommand as gR}from"@aws-sdk/lib-dynamodb";var xa=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=At(),i=ne(e.challenge.expiresAt),s=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new gR({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,s))]})),g(void 0)}catch(r){return Aa(r)==="TransactionCanceledException"||Pe(r)?u(M.UniqueConstraintViolation({field:"registration"})):u(M.DatabaseQueryError({query:"create email verification registration transaction"}))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ft(e),ConditionExpression:`attribute_not_exists(${f.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[f.PK]:D.USER_PK(e.profile.id),[f.SK]:D.USER_PROFILE_SK(),userStatus:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[f.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[f.PK]:D.USER_PK(e.userAuth.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[f.CREATED_AT]:r,[f.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[f.PK]:D.IDENTITY_PK(n.type,n.value),[f.SK]:D.IDENTITY_SK(),[f.IDENTITY_USER_PK]:D.USER_INDEX_PK(n.userId),[f.IDENTITY_USER_SK]:D.USER_INDEX_SK(n.type,n.value),[f.USER_ID]:n.userId,[f.LOGIN_ENABLED]:n.loginEnabled,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.PENDING_VERIFICATION]:Ft({...n.pendingVerification,expiresAt:ne(n.pendingVerification.expiresAt),resendAvailableAt:Nr(n.pendingVerification.resendAvailableAt)})},s=Nr(n.verifiedAt);return s!==null&&(i[f.VERIFIED_AT]=s),i[f.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,s={[f.PK]:D.CREDENTIAL_PK(r),[f.SK]:D.CREDENTIAL_SK(),[f.CREDENTIAL_USER_PK]:D.USER_PK(i.userId),[f.CREDENTIAL_USER_SK]:D.CREDENTIAL_USER_SK(i.type,r),[f.USER_ID]:i.userId,[f.CREDENTIAL_VALUE]:i.value,[f.METADATA]:i.data,[f.REVOKED_AT]:i.revokedAt?ne(i.revokedAt):null,[f.CREATED_AT]:n,[f.UPDATED_AT]:n};return i.lastUsedAt&&(s[f.LAST_USED_AT]=ne(i.lastUsedAt)),s}marshallChallenge(e,r,n){let i=e.challenge,s={[f.PK]:D.CHALLENGE_PK(i.id),[f.SK]:D.CHALLENGE_SK(),[f.USER_ID]:i.userId,[f.PURPOSE]:i.purpose,[f.CHALLENGE_STATUS]:i.status,[f.EXPIRES_AT]:ne(i.expiresAt),[f.CREATED_AT]:r,[f.TTL]:n};return i.tenantId&&(s[f.TENANT_ID]=i.tenantId),i.phase&&(s[f.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(s[f.ALLOWED_METHODS]=i.allowedMethods),i.method&&(s[f.METHOD]=i.method),i.codeHash&&(s[f.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(s[f.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(s[f.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(s[f.IDENTITY_TYPE]=i.identityType),i.identityValue&&(s[f.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(s[f.DEVICE_LABEL]=i.deviceLabel),i.country&&(s[f.COUNTRY]=i.country),i.city&&(s[f.CITY]=i.city),i.metadata&&(s[f.METADATA]=i.metadata),i.flowKey&&(s[f.FLOW_KEY]=i.flowKey),s}};import{DynamoDBClient as TR}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as _R,GetCommand as SA,PutCommand as IR,QueryCommand as ba,UpdateCommand as js}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as vR}from"@aws-sdk/lib-dynamodb";var xA=100,bA=5;function AR(t){return new Promise(e=>setTimeout(e,t))}async function qs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=xA){let s=r.slice(i,i+xA),o=0;for(;s.length>0;){let a=await t.send(new vR({RequestItems:{[e]:{Keys:s}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(o+=1,o>bA)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${bA} retries`);s=l,await AR(2**o*25)}}return n}var Sa=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new TR({});this.docClient=e.docClient||_R.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return At()}generateTokenId(){return At()}async get(e){try{let r=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()}}));return r.Item?g(this.unmarshall(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get session"}))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),s={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},o=ya(ne(e.expiresAt)+this.ttlGracePeriod),a=ql.sessionSK(r,n);return await this.docClient.send(new IR({TableName:this.tableName,Item:this.marshall(s,o,a)})),g(s)}catch{return u(M.DatabaseQueryError({query:"create session"}))}}async update(e,r){try{let n=[],i={},s={};if(r.tokenId!==void 0&&(n.push(`#${f.TOKEN_ID} = :tokenId`),i[`#${f.TOKEN_ID}`]=f.TOKEN_ID,s[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${f.EXPIRES_AT} = :expiresAt`),i[`#${f.EXPIRES_AT}`]=f.EXPIRES_AT,s[":expiresAt"]=ne(r.expiresAt);let o=ya(ne(r.expiresAt)+this.ttlGracePeriod);n.push(`#${f.TTL} = :ttl`),i[`#${f.TTL}`]=f.TTL,s[":ttl"]=o}return r.lastUsedAt!==void 0&&(n.push(`#${f.LAST_USED_AT} = :lastUsedAt`),i[`#${f.LAST_USED_AT}`]=f.LAST_USED_AT,s[":lastUsedAt"]=ne(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${f.METADATA} = :metadata`),i[`#${f.METADATA}`]=f.METADATA,s[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${f.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${f.PREVIOUS_TOKEN_ID}`]=f.PREVIOUS_TOKEN_ID,s[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${f.ROTATED_AT} = :rotatedAt`),i[`#${f.ROTATED_AT}`]=f.ROTATED_AT,s[":rotatedAt"]=r.rotatedAt),n.length===0?g():(await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:s})),g())}catch{return u(M.DatabaseQueryError({query:"update session"}))}}async rotateToken(e,r,n){try{let i=ya(ne(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.TOKEN_ID} = :tokenId, #${f.PREVIOUS_TOKEN_ID} = :previousTokenId, #${f.ROTATED_AT} = :rotatedAt, #${f.EXPIRES_AT} = :expiresAt, #${f.LAST_USED_AT} = :lastUsedAt, #${f.TTL} = :ttl`,ConditionExpression:`#${f.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.PREVIOUS_TOKEN_ID}`]:f.PREVIOUS_TOKEN_ID,[`#${f.ROTATED_AT}`]:f.ROTATED_AT,[`#${f.EXPIRES_AT}`]:f.EXPIRES_AT,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT,[`#${f.TTL}`]:f.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":ne(n.expiresAt),":lastUsedAt":ne(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),g(!0)}catch(i){return Pe(i)?g(!1):u(M.DatabaseQueryError({query:"rotate session token"}))}}async switchTenant(e,r){try{let n=[`#${f.TENANT_ID} = :tenantId`,`#${f.TOKEN_ID} = :tokenId`,`#${f.LAST_USED_AT} = :lastUsedAt`],i=[],s={[`#${f.TENANT_ID}`]:f.TENANT_ID,[`#${f.TOKEN_ID}`]:f.TOKEN_ID,[`#${f.LAST_USED_AT}`]:f.LAST_USED_AT},o={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};s[`#${f.TENANT_TYPE}`]=f.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${f.TENANT_TYPE} = :tenantType`),o[":tenantType"]=r.tenantType):i.push(`#${f.TENANT_TYPE}`),s[`#${f.PERM}`]=f.PERM,r.perms!==void 0?(n.push(`#${f.PERM} = :perms`),o[":perms"]=JSON.stringify(r.perms)):i.push(`#${f.PERM}`),s[`#${f.ROLES}`]=f.ROLES,r.roles!==void 0?(n.push(`#${f.ROLES} = :roles`),o[":roles"]=r.roles):i.push(`#${f.ROLES}`),s["#revokedAt"]=f.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:`attribute_exists(${f.PK}) AND attribute_not_exists(#revokedAt)`})),g()}catch(n){return Pe(n)?u(M.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):u(M.DatabaseQueryError({query:"switch tenant"}))}}async revoke(e){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date)},ConditionExpression:`attribute_exists(${f.PK})`})),g()}catch(r){return Pe(r)?g():u(M.DatabaseQueryError({query:"revoke session"}))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(e),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ConditionExpression:`#${f.USER_ID} = :userId AND attribute_not_exists(#${f.REVOKED_AT})`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.USER_ID}`]:f.USER_ID,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":ne(new Date),":userId":r}})),g()}catch(n){return Pe(n)?g():u(M.DatabaseQueryError({query:"revoke session by user"}))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.USER_SESSIONS,KeyConditionExpression:`${f.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":D.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find sessions by user"}))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!s.Items||s.Items.length===0){let E={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return g([],{pagination:E})}let a=s.Items.map(E=>le.sessionId(E[f.PK])).map(E=>({[f.PK]:D.SESSION_PK(E),[f.SK]:D.SESSION_SK()})),l=(await qs(this.docClient,this.tableName,a)).map(E=>this.unmarshall(E)),d=!!s.LastEvaluatedKey,p=d?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null,m={type:"cursor",limit:n,count:l.length,hasNext:d,hasPrev:!!r?.cursor,cursor:p};return g(l,{pagination:m})}catch{return u(M.DatabaseQueryError({query:"find active sessions by user"}))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return g([]);let n=r.Items.map(i=>{let s=le.sessionId(i[f.PK]),o=ql.extractCreatedAt(i[f.ACTIVE_SESSION_SK]);return{id:s,createdAt:new Date(o)}});return g(n)}catch{return u(M.DatabaseQueryError({query:"get active sessions for limit"}))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=ne(new Date),i=await Promise.allSettled(e.map(o=>this.docClient.send(new js({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(o),[f.SK]:D.SESSION_SK()},UpdateExpression:`SET #${f.REVOKED_AT} = :revokedAt REMOVE #${f.ACTIVE_SESSION_PK}, #${f.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${f.REVOKED_AT}`]:f.REVOKED_AT,[`#${f.ACTIVE_SESSION_PK}`]:f.ACTIVE_SESSION_PK,[`#${f.ACTIVE_SESSION_SK}`]:f.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),s=0;for(let o of i)o.status==="fulfilled"?s+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Aa(o.reason)});return s}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return g(0);let i=n.Items.map(o=>le.sessionId(o[f.PK])).filter(o=>!r||o!==r),s=await this.revokeSessionsByIds(i,"revokeAllByUserId");return g(s)}catch{return u(M.DatabaseQueryError({query:"revoke all sessions by user"}))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return g(r)}catch{return u(M.DatabaseQueryError({query:"revoke batch sessions"}))}}async countByUserId(e){try{let r=await this.docClient.send(new ba({TableName:this.tableName,IndexName:Se.ACTIVE_SESSIONS,KeyConditionExpression:`${f.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return g(r.Count||0)}catch{return u(M.DatabaseQueryError({query:"count active sessions by user"}))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new SA({TableName:this.tableName,Key:{[f.PK]:D.SESSION_PK(r),[f.SK]:D.SESSION_SK()},ProjectionExpression:`${f.TOKEN_ID}, ${f.REVOKED_AT}, ${f.EXPIRES_AT}`}));if(!n.Item)return g(!1);let i=n.Item,s=i[f.TOKEN_ID]===e&&!i[f.REVOKED_AT]&&z(i[f.EXPIRES_AT])>new Date;return g(s)}catch{return u(M.DatabaseQueryError({query:"check token active"}))}}marshall(e,r,n){let i={[f.PK]:D.SESSION_PK(e.id),[f.SK]:D.SESSION_SK(),[f.USER_SESSION_PK]:D.USER_PK(e.userId),[f.USER_SESSION_SK]:n,...!e.revokedAt&&{[f.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[f.ACTIVE_SESSION_SK]:n},[f.USER_ID]:e.userId,[f.TOKEN_ID]:e.tokenId,[f.EXPIRES_AT]:ne(e.expiresAt),[f.CREATED_AT]:ne(e.createdAt),[f.LAST_USED_AT]:ne(e.lastUsedAt),[f.TTL]:r};return e.tenantId&&(i[f.TENANT_ID]=e.tenantId),e.tenantType&&(i[f.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[f.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[f.ROLES]=e.roles),e.deviceLabel&&(i[f.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[f.COUNTRY]=e.country),e.city&&(i[f.CITY]=e.city),e.metadata&&(i[f.METADATA]=e.metadata),e.revokedAt&&(i[f.REVOKED_AT]=ne(e.revokedAt)),e.previousTokenId&&(i[f.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[f.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[f.PK]),userId:e[f.USER_ID],tokenId:e[f.TOKEN_ID],expiresAt:z(e[f.EXPIRES_AT]),createdAt:z(e[f.CREATED_AT]),lastUsedAt:z(e[f.LAST_USED_AT]),revokedAt:e[f.REVOKED_AT]?z(e[f.REVOKED_AT]):null};return e[f.TENANT_ID]&&(n.tenantId=e[f.TENANT_ID]),e[f.TENANT_TYPE]&&(n.tenantType=e[f.TENANT_TYPE]),e[f.PERM]!==void 0&&(n.perms=JSON.parse(e[f.PERM])),e[f.ROLES]!==void 0&&(n.roles=e[f.ROLES]),e[f.DEVICE_LABEL]&&(n.deviceLabel=e[f.DEVICE_LABEL]),e[f.COUNTRY]&&(n.country=e[f.COUNTRY]),e[f.CITY]&&(n.city=e[f.CITY]),e[f.METADATA]&&(n.metadata=e[f.METADATA]),e[f.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[f.PREVIOUS_TOKEN_ID]),e[f.ROTATED_AT]!==void 0&&(n.rotatedAt=e[f.ROTATED_AT]),n}};import{QueryCommand as xR}from"@aws-sdk/lib-dynamodb";var Na=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new xR(o)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch(n){return console.error("[DynamoDBTenantInviteQuery.listByTenant] Error:",n instanceof Error?n.message:n),u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(i.declinedAt=z(e.declinedAt)),e.revokedAt&&(i.revokedAt=z(e.revokedAt)),i}};import{GetCommand as NA,PutCommand as bR,QueryCommand as qn,UpdateCommand as SR}from"@aws-sdk/lib-dynamodb";var NR=10080*60*1e3,wa=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:z(e.expiresAt),createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[f.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=z(e.acceptedAt)),e.declinedAt&&(n.declinedAt=z(e.declinedAt)),e.revokedAt&&(n.revokedAt=z(e.revokedAt)),n}generateInviteId(){return At()}async getById(e){try{let r=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()}}));return r.Item?g(this.mapItemToEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getById invite"}))}}async getByToken(e){try{let n=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":f.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return g(null);let i=n[0],s=await this.docClient.send(new NA({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return s.Item?g(this.mapItemToEntity(s.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"getByToken invite"}))}}async create(e){try{let r=ae(),n=ne(e.expiresAt),i=Math.floor((n+NR)/1e3),s={PK:D.INVITE_PK(e.id),SK:D.INVITE_SK(),[f.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[f.INVITED_BY_ID]:e.invitedById,[f.INVITE_STATUS]:e.status,[f.INVITE_TOKEN]:e.inviteToken,[f.EXPIRES_AT]:n,[f.CREATED_AT]:r,[f.UPDATED_AT]:r,[f.TTL]:i,[f.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[f.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[f.INVITE_TOKEN_GSI]:e.inviteToken},o={};e.invitedByName&&(o.name=e.invitedByName),e.invitedByEmail&&(o.email=e.invitedByEmail),e.invitedByJobTitle&&(o.jobTitle=e.invitedByJobTitle),Object.keys(o).length>0&&(s[f.INVITED_BY_INFO]=o),e.inviteeUserId&&(s[f.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(s[f.INVITEE_EMAIL]=e.inviteeEmail,s[f.INVITEE_EMAIL_GSI]=e.inviteeEmail,s[f.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(s[f.INVITEE_PHONE]=e.inviteePhone,s[f.INVITEE_PHONE_GSI]=e.inviteePhone,s[f.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(s[f.ROLES]=e.roles),e.perms!==void 0&&(s[f.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(s[f.AUTH_PERM]=e.authPerm),e.displayName&&(s[f.DISPLAY_NAME]=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.jobTitle&&(s.jobTitle=e.jobTitle),await this.docClient.send(new bR({TableName:this.tableName,Item:s,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:z(r),updatedAt:z(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),g(a)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"invite id"})):u(M.UnknownError({message:r.message}))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],s={"#inviteStatus":f.INVITE_STATUS,"#inviteTenantSk":f.INVITE_TENANT_SK,"#updatedAt":f.UPDATED_AT},o={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),s["#acceptedAt"]=f.ACCEPTED_AT,o[":acceptedAt"]=ne(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),s["#declinedAt"]=f.DECLINED_AT,o[":declinedAt"]=ne(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),s["#revokedAt"]=f.REVOKED_AT,o[":revokedAt"]=ne(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),s["#inviteTokenGsi"]=f.INVITE_TOKEN_GSI,s["#inviteeEmailGsi"]=f.INVITEE_EMAIL_GSI,s["#inviteeEmailTenantSk"]=f.INVITEE_EMAIL_TENANT_SK,s["#inviteePhoneGsi"]=f.INVITEE_PHONE_GSI,s["#inviteePhoneTenantSk"]=f.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new SR({TableName:this.tableName,Key:{PK:D.INVITE_PK(e),SK:D.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantInvite",id:e})):u(M.UnknownError({message:n.message}))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":f.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndEmail"}))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":f.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndPhone"}))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK,"#inviteeUserId":f.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?g(null):g(this.mapItemToEntity(i[0]))}catch{return u(M.DatabaseQueryError({query:"findByTenantAndUserId"}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":f.INVITE_TENANT_PK},s={":pk":Ae.INVITE_TENANT_PK(e)},o={TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:s,ScanIndexForward:!1,Limit:n};r?.cursor&&(o.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(o.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=f.INVITE_TENANT_SK,s[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new qn(o)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,d=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:d,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant"}))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":f.INVITEE_EMAIL_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByEmail"}))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":f.INVITEE_PHONE_GSI,"#expiresAt":f.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return g([]);let s=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await qs(this.docClient,this.tableName,s)).map(c=>this.mapItemToEntity(c));return g(a)}catch{return u(M.DatabaseQueryError({query:"findPendingByPhone"}))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new qn({TableName:this.tableName,IndexName:Se.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":f.INVITE_TENANT_PK,"#sk":f.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return g(r.Count??0)}catch{return u(M.DatabaseQueryError({query:"countPendingByTenant"}))}}async expireOld(e){return g(0)}};import{QueryCommand as wR}from"@aws-sdk/lib-dynamodb";var Ra=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=(await this.docClient.send(new wR(i))).Items||[],a=[],c=new Map;for(let E of o){let v=E.SK;if(v.startsWith(Ve.TENANT_PROFILE)){let b=le.tenantProfileUserId(v);c.set(b,E)}else v.startsWith(ce.USER)&&a.push(E)}a.sort((E,v)=>v.createdAt-E.createdAt);let l=a.slice(0,n),d=a.length>n,p=l.map(E=>{let v=le.tenantMemberUserId(E.SK),b=c.get(v);return this.toListItem(E,e,v,b)}),m=d&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:d,cursor:m,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByTenant query"}))}}toListItem(e,r,n,i){let s={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};if(e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm),i){let o={tenantId:r,userId:n,createdAt:z(i.createdAt),updatedAt:z(i.updatedAt)};i.contactEmail&&(o.contactEmail=i.contactEmail),i.contactPhone&&(o.contactPhone=i.contactPhone),i.displayName&&(o.displayName=i.displayName),i.displayNameSource&&(o.displayNameSource=i.displayNameSource),i.givenName&&(o.givenName=i.givenName),i.familyName&&(o.familyName=i.familyName),i.avatarUrl&&(o.avatarUrl=i.avatarUrl),i.locale&&(o.locale=i.locale),i.jobTitle&&(o.jobTitle=i.jobTitle),i.bio&&(o.bio=i.bio),i.metadata&&(o.metadata=JSON.parse(i.metadata)),s.tenantProfile=o}return s}};import{DeleteCommand as RR,DynamoDBDocumentClient as OR,GetCommand as wA,PutCommand as kR,QueryCommand as CR,TransactWriteCommand as DR,UpdateCommand as RA}from"@aws-sdk/lib-dynamodb";var Oa=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=OR.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)}}));if(!n.Item)return g(null);let i=this.mapItemToEntity(n.Item);return g(i)}catch{return u(M.DatabaseQueryError({query:"get"}))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ft({PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new DR({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:D.TENANT_MEMBER_PK(e.tenantId),SK:D.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new kR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?u(M.UniqueConstraintViolation({field:"tenant owner"})):u(M.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant member"})):u(M.UnknownError({message:r.message}))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async updateStatus(e,r,n){try{return await this.docClient.send(new RA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=await this.docClient.send(new CR(i)),o=(s.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!s.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return mr(o,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){let i=n instanceof Error?`${n.name}: ${n.message}`:String(n);return console.error("[DynamoDBTenantMemberRepository.listByTenant] Error:",i),u(M.DatabaseQueryError({query:`listByTenant \u2014 ${i}`}))}}async hasOwner(e){try{let r=await this.docClient.send(new wA({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_OWNER_MARKER_SK()}}));return g(!!r.Item)}catch{return u(M.DatabaseQueryError({query:"hasOwner"}))}}async remove(e,r){try{return await this.docClient.send(new RR({TableName:this.tableName,Key:{PK:D.TENANT_MEMBER_PK(e),SK:D.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"TenantMember",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};import{BatchGetCommand as PR,QueryCommand as UR}from"@aws-sdk/lib-dynamodb";var ka=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Zt.DEFAULT,s=r?.parentTenantId,o=s?`${i}#${s}#`:`${i}#`,a={TableName:this.tableName,IndexName:Se.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":o},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new UR(a)),l=c.Items??[],d=await this.fetchProfileMap(e,l),p=l.map(v=>this.toListItem(v,e,d)),m=!!c.LastEvaluatedKey,E=m?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:m,cursor:E,prevCursor:r?.cursor??null})}catch{return u(M.DatabaseQueryError({query:"listByUser query"}))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(o=>({PK:D.TENANT_PROFILE_PK(le.tenantId(o.PK)),SK:D.TENANT_PROFILE_SK(e)})),s=await this.docClient.send(new PR({RequestItems:{[this.tableName]:{Keys:i}}}));for(let o of s.Responses?.[this.tableName]??[]){let a=o,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),s={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(s.authPerm=e.authPerm);let o=n.get(i);return o&&(o.contactEmail&&(s.contactEmail=o.contactEmail),o.contactPhone&&(s.contactPhone=o.contactPhone),o.displayName&&(s.displayName=o.displayName),o.displayNameSource&&(s.displayNameSource=o.displayNameSource),o.givenName&&(s.givenName=o.givenName),o.familyName&&(s.familyName=o.familyName),o.avatarUrl&&(s.avatarUrl=o.avatarUrl),o.locale&&(s.locale=o.locale),o.jobTitle&&(s.jobTitle=o.jobTitle),o.bio&&(s.bio=o.bio),o.metadata&&(s.metadata=JSON.parse(o.metadata))),s}};import{DeleteCommand as LR,GetCommand as MR,PutCommand as KR,UpdateCommand as HR}from"@aws-sdk/lib-dynamodb";var Ca=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return At()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new MR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()}}));return r.Item?g(this.toEntity(r.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get tenant"}))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ft({PK:D.TENANT_PK(r),SK:D.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new KR({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"tenant"})):u(M.UnknownError({message:r.message}))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o}=wr(n);return await this.docClient.send(new HR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:s,ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:n.message}))}}async delete(e){try{return await this.docClient.send(new LR({TableName:this.tableName,Key:{PK:D.TENANT_PK(e),SK:D.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"Tenant",id:e})):u(M.UnknownError({message:r.message}))}}async list(){return u(M.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return u(M.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return u(M.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as FR,GetCommand as VR,PutCommand as BR,UpdateCommand as Wl}from"@aws-sdk/lib-dynamodb";var Da=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new VR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}}));return r.Item?g(this.unmarshall(r.Item,e)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user auth"}))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new BR({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${f.PK})`})),g(n)}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"userAuth"})):u(M.DatabaseQueryError({query:"create user auth"}))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update user auth status"}))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa required"}))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa methods"}))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new Wl({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${f.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${f.UPDATED_AT}`]:f.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${f.PK})`})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userAuth",id:e})):u(M.DatabaseQueryError({query:"update mfa settings"}))}}async remove(e){try{return await this.docClient.send(new FR({TableName:this.tableName,Key:{[f.PK]:D.USER_PK(e),[f.SK]:D.USER_AUTH_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user auth"}))}}marshall(e){return{[f.PK]:D.USER_PK(e.userId),[f.SK]:D.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[f.CREATED_AT]:ne(e.createdAt),[f.UPDATED_AT]:ne(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:z(e[f.CREATED_AT]),updatedAt:z(e[f.UPDATED_AT])}}};import{DynamoDBDocumentClient as qR,DeleteCommand as jR,GetCommand as GR,PutCommand as $R,QueryCommand as OA,UpdateCommand as Af}from"@aws-sdk/lib-dynamodb";function Gs(t,e){return e?D.USER_MFA_WITH_ID_SK(t,e):D.USER_MFA_SK(t)}var Pa=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=qR.from(e)}toDynamoDBItem(e){let r={PK:D.USER_PK(e.userId),SK:Gs(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:z(e.createdAt),verifiedAt:Ht(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Ht(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Ht(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Ht(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Gs(r,n),s=await this.docClient.send(new GR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}}));return s.Item?g(this.fromDynamoDBItem(s.Item,e)):g(null)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.get error:",i),u(M.DatabaseQueryError({query:"get MFA authenticator"}))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":Ve.MFA}},s=((await this.docClient.send(new OA(r))).Items??[]).map(o=>this.fromDynamoDBItem(o,e));return g(s)}catch(r){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserId error:",r),u(M.DatabaseQueryError({query:"find MFA authenticators by user"}))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":D.USER_PK(e),":skPrefix":`${Ve.MFA}${r}`}},o=((await this.docClient.send(new OA(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return g(o)}catch(n){return console.error("DynamoDBUserMFAAuthenticatorRepository.findByUserIdAndMethod error:",n),u(M.DatabaseQueryError({query:"find MFA authenticators by method"}))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=At());let n=this.toDynamoDBItem(r);return await this.docClient.send(new $R({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),g(this.fromDynamoDBItem(n,e.userId))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"MFA authenticator"})):(console.error("DynamoDBUserMFAAuthenticatorRepository.create error:",r),u(M.DatabaseQueryError({query:"create MFA authenticator"})))}}async update(e,r,n,i){try{let s=Gs(r,n),o=[],a={},c={};if(i.label!==void 0&&(o.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(o.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(o.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(o.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(o.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(o.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(o.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(o.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),o.length===0)return g(void 0);let l={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:s},UpdateExpression:`SET ${o.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new Af(l)),g(void 0)}catch(s){return console.error("DynamoDBUserMFAAuthenticatorRepository.update error:",s),u(M.DatabaseQueryError({query:"update MFA authenticator"}))}}async remove(e,r,n){try{let i=Gs(r,n);return await this.docClient.send(new jR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i}})),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.remove error:",i),u(M.DatabaseQueryError({query:"remove MFA authenticator"}))}}async incrementFailedAttempts(e,r,n,i,s){try{let o=Gs(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},d={":zero":0,":inc":1,":lastFailedAt":a};s!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",d[":lockedUntil"]=a+s*60*1e3,d[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:o},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:d};return await this.docClient.send(new Af(p)),g(void 0)}catch(o){return console.error("DynamoDBUserMFAAuthenticatorRepository.incrementFailedAttempts error:",o),u(M.DatabaseQueryError({query:"increment failed attempts"}))}}async resetFailedAttempts(e,r,n){try{let i=Gs(r,n),s={TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new Af(s)),g(void 0)}catch(i){return console.error("DynamoDBUserMFAAuthenticatorRepository.resetFailedAttempts error:",i),u(M.DatabaseQueryError({query:"reset failed attempts"}))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as WR,DynamoDBDocumentClient as zR,GetCommand as JR,PutCommand as YR,QueryCommand as kA,UpdateCommand as CA}from"@aws-sdk/lib-dynamodb";var Ua=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=zR.from(e)}generateUserId(){return At()}async getById(e){try{let r=await this.docClient.send(new JR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}}));if(!r.Item)return g(null);let n=r.Item;if(n.deletedAt)return g(null);let s={id:le.userId(n.PK),status:n.userStatus,createdAt:z(n.createdAt),updatedAt:z(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:z(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return g(s)}catch{return u(M.DatabaseQueryError({query:"getById user"}))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",s={PK:D.USER_PK(n),SK:D.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(s.contactEmail=e.contactEmail),e.contactPhone&&(s.contactPhone=e.contactPhone),e.username&&(s.username=e.username),e.displayName&&(s.displayName=e.displayName),e.givenName&&(s.givenName=e.givenName),e.familyName&&(s.familyName=e.familyName),e.avatarUrl&&(s.avatarUrl=e.avatarUrl),e.locale&&(s.locale=e.locale),e.metadata&&(s.metadata=JSON.stringify(e.metadata)),s[f.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),s[f.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new YR({TableName:this.tableName,Item:Ft(s),ConditionExpression:uf("PK")}));let o={id:n,status:i,createdAt:z(r),updatedAt:z(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return g(o)}catch{return u(M.DatabaseQueryError({query:"create user"}))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return g(void 0);i.updatedAt=n;let s=wr(i);return await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:s.UpdateExpression,ExpressionAttributeNames:s.ExpressionAttributeNames,ExpressionAttributeValues:s.ExpressionAttributeValues})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"updateProfile"}))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return u(M.DatabaseQueryError({query:"invalid pagination cursor"}))}let s=Ae.USER_STATUS_PK(e),o=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":s},Limit:n,ExclusiveStartKey:i})),a=[];if(o.Items&&o.Items.length>0)for(let d of o.Items){let p=le.userId(d.PK);a.push(p)}let c=!!o.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return g(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch{return u(M.DatabaseQueryError({query:"get users by status"}))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new kA({TableName:this.tableName,IndexName:Se.USERS_BY_STATUS,KeyConditionExpression:`${f.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return g(n.Count||0)}catch{return u(M.DatabaseQueryError({query:"count users by status"}))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${f.UPDATED_AT} = :updatedAt, #${f.USER_STATUS_PK} = :statusPk, #${f.USER_STATUS_SK} = :statusSk`,s={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",s[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new CA({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${f.UPDATED_AT}`]:f.UPDATED_AT,[`#${f.USER_STATUS_PK}`]:f.USER_STATUS_PK,[`#${f.USER_STATUS_SK}`]:f.USER_STATUS_SK},ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),g(void 0)}catch(n){return Pe(n)?u(M.NotFound({entity:"userProfile",id:e})):u(M.DatabaseQueryError({query:"sync auth status"}))}}async remove(e){try{return await this.docClient.send(new WR({TableName:this.tableName,Key:{PK:D.USER_PK(e),SK:D.USER_PROFILE_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"remove user profile"}))}}};import{DeleteCommand as XR,DynamoDBDocumentClient as QR,GetCommand as ZR,PutCommand as e0,QueryCommand as t0,UpdateCommand as r0}from"@aws-sdk/lib-dynamodb";var La=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=QR.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:z(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:D.PROVIDER_PK(e.provider,e.externalId),SK:D.PROVIDER_METADATA_SK(),userProviderPk:D.USER_PK(e.userId),userProviderSk:D.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?ne(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ft(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new ZR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}}));return n.Item?g(this.mapItemToUserProviderLink(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"find provider by external id"}))}}async findByUserId(e){try{let r=await this.docClient.send(new t0({TableName:this.tableName,IndexName:Se.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":f.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":D.USER_PK(e)}}));return!r.Items||r.Items.length===0?g([]):g(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch{return u(M.DatabaseQueryError({query:"find providers by user id"}))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new e0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),g(this.mapItemToUserProviderLink(n))}catch(r){return Pe(r)?u(M.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):u(M.DatabaseQueryError({query:"create user provider"}))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return g(void 0);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new r0({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"update user provider"}))}}async remove(e,r){try{return await this.docClient.send(new XR({TableName:this.tableName,Key:{PK:D.PROVIDER_PK(e,r),SK:D.PROVIDER_METADATA_SK()}})),g(void 0)}catch{return u(M.DatabaseQueryError({query:"delete user provider"}))}}};import{DeleteCommand as n0,GetCommand as i0,PutCommand as s0,UpdateCommand as o0}from"@aws-sdk/lib-dynamodb";var Ma=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:z(e.createdAt),updatedAt:z(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new i0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)}}));return n.Item?g(this.mapItemToEntity(n.Item)):g(null)}catch{return u(M.DatabaseQueryError({query:"get user tenant profile"}))}}async create(e){try{let r=ae(),n={PK:D.TENANT_PROFILE_PK(e.tenantId),SK:D.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new s0({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:z(r),updatedAt:z(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),g(i)}catch(r){return r.name==="ConditionalCheckFailedException"?u(M.UniqueConstraintViolation({field:"user tenant profile"})):u(M.UnknownError({message:r.message}))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a}=wr(i);return await this.docClient.send(new o0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},UpdateExpression:s,ExpressionAttributeNames:o,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:i.message}))}}async remove(e,r){try{return await this.docClient.send(new n0({TableName:this.tableName,Key:{PK:D.TENANT_PROFILE_PK(e),SK:D.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),g(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?u(M.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):u(M.UnknownError({message:n.message}))}}};var Tf=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new c0(e.clientConfig||{});let r=l0.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ua(this.client,this.tableName),this.sessions=new Sa({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new La(this.client,this.tableName),this.userMfaAuthenticators=new Pa(this.client,this.tableName),this.challenges=new Ta({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new Ia({docClient:r,tableName:this.tableName}),this.credentials=new _a({docClient:r,tableName:this.tableName}),this.registration=new xa({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Da({docClient:r,tableName:this.tableName}),this.tenantMembers=new Oa(this.client,this.tableName),this.tenantInvites=new wa({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new Ma(r,this.tableName),this.tenants=new Ca({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new Na({docClient:r,tableName:this.tableName}),tenantMembers:new Ra({docClient:r,tableName:this.tableName}),tenants:new ka({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new a0({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function DA(t){return new Tf(t)}ho();var _f=1,PA=2,UA=3,LA="auth-craft:internal";async function u0(t){let e=t.replace(/^0x/,""),r=KA(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let s=`-----BEGIN PRIVATE KEY-----
+    `}};var oc=class t{static createDirectSmtp(e){return new cd(e)}static create(e){return t.createDirectSmtp(e.smtp)}};var f0={allowPlusAddressing:!0,allowDots:!0,requireTLD:!0};function sT(t={}){let e={...f0,...t},n=(()=>{if(t.customRegex)return t.customRegex;let i="[a-zA-Z0-9_\\-]";e.allowDots?(i+="+",i=`(${i}\\.?)+`):i+="+",e.allowPlusAddressing&&(i=`${i}(\\+[a-zA-Z0-9_\\-]+)?`);let o=e.requireTLD?"[a-zA-Z0-9][a-zA-Z0-9\\-]*\\.[a-zA-Z]{2,}":"[a-zA-Z0-9][a-zA-Z0-9\\-\\.]*";return new RegExp(`^${i}@${o}$`)})();return{name:"email-identity",version:"1.0.0",identityType:"email",normalize(i){return i.toLowerCase().trim()},validate(i){if(!i||i.trim().length===0)return d([{code:"EMAIL_REQUIRED",message:"Email address is required"}]);if(i.length>254)return d([{code:"EMAIL_TOO_LONG",message:"Email address is too long (max 254 characters)"}]);if(!n.test(i))return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);if(i.includes(".."))return d([{code:"INVALID_EMAIL_FORMAT",message:"Email address cannot contain consecutive dots"}]);let o=i.split("@");if(o.length!==2)return d([{code:"INVALID_EMAIL_FORMAT",message:"Invalid email address format"}]);let[s,a]=o;return!s||s.length>64?d([{code:"EMAIL_LOCAL_PART_TOO_LONG",message:"Email local part is too long (max 64 characters)"}]):a&&a.length>253?d([{code:"EMAIL_DOMAIN_TOO_LONG",message:"Email domain is too long (max 253 characters)"}]):T()}}}function Lm(t=6){let e="";for(;e.length<t;){let r=new Uint8Array(t);crypto.getRandomValues(r);for(let n=0;n<r.length&&e.length<t;n++){let i=r[n];i>=250||(e+=(i%10).toString())}}return e}function m0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function Mm(t){let e=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",e);return m0(r)}var Km="email",ld={EMAIL_SYSTEM_NOT_AVAILABLE:_("MFA_EMAIL_SYSTEM_NOT_AVAILABLE","Email system is not configured"),RECIPIENT_NOT_FOUND:_("MFA_EMAIL_RECIPIENT_NOT_FOUND","No email address on file for this user"),SEND_FAILED:_("MFA_EMAIL_SEND_FAILED","Failed to send the verification email"),USE_CHALLENGE_CODE_HASH:_("MFA_EMAIL_USE_CHALLENGE_CODE_HASH","Email MFA codes are verified against the challenge code hash, not stored credentials")};function h0(t){let[e,r]=t.split("@");return!e||!r?"***":`${e.slice(0,1)}***@${r}`}function aT(t={}){let e=t.codeLength??6,r=t.template??"mfa-email-code";return{name:"email-mfa",version:"1.0.0",method:Km,requiresServerDelivery:!0,async sendCode(n,i){if(!i.plugins.emailSystem)return d(ld.EMAIL_SYSTEM_NOT_AVAILABLE());let o=await i.plugins.database.users.getById(n.userId),s=o.ok&&o.data?o.data.contactEmail:void 0;if(!s)return d(ld.RECIPIENT_NOT_FOUND());let a=Lm(e),c=await Mm(a);return(await i.plugins.emailSystem.send({to:s,template:r,variables:{code:a,purpose:"mfa"}})).ok===!1?d(ld.SEND_FAILED()):T({codeHash:c,maskedRecipient:h0(s)})},async issueChallenge(n){return T({challengeId:`email_${Date.now()}`,methods:n.availableMethods.includes(Km)?[Km]:n.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(ld.USE_CHALLENGE_CODE_HASH())}}}var cT="ABCDEFGHIJKLMNPQRSTUVWXYZ23456789";function ud(t=10,e=10){let r=[];for(let n=0;n<t;n++){let i=new Uint8Array(e);crypto.getRandomValues(i);let o="";for(let s of i)o+=cT[s%cT.length];r.push(o)}return r}function E0(t){return Array.from(new Uint8Array(t)).map(e=>e.toString(16).padStart(2,"0")).join("")}async function dd(t){let e=new TextEncoder().encode(t.toUpperCase().trim()),r=await crypto.subtle.digest("SHA-256",e);return E0(r)}function y0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Hm(t,e){let r=await dd(t),n=null;for(let i of e)y0(r,i)&&(n=i);return n}var Fm="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function lT(t){let e=t.toUpperCase().replace(/=+$/u,"").replace(/\s+/gu,""),r=0,n=0,i=[];for(let o of e){let s=Fm.indexOf(o);if(s===-1)throw new Error("Invalid base32 character in TOTP secret");n=n<<5|s,r+=5,r>=8&&(r-=8,i.push(n>>>r&255))}return new Uint8Array(i)}function uT(t){let e=0,r=0,n="";for(let i of t)for(r=r<<8|i,e+=8;e>=5;)e-=5,n+=Fm[r>>>e&31];return e>0&&(n+=Fm[r<<5-e&31]),n}function pd(t=20){let e=new Uint8Array(t);return crypto.getRandomValues(e),uT(e)}function g0(t){let e=new Uint8Array(8),r=t;for(let n=7;n>=0;n--)e[n]=r&255,r=Math.floor(r/256);return e}async function v0(t,e,r){let n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-1"},!1,["sign"]),i=new Uint8Array(await crypto.subtle.sign("HMAC",n,g0(e))),o=i[i.length-1]&15;return(((i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255)%10**r).toString().padStart(r,"0")}async function fd(t,e,r=Date.now(),n={}){let i=n.period??30,o=n.digits??6,s=n.window??1,a=e.trim();if(a.length!==o||!/^\d+$/u.test(a))return!1;let c=lT(t),l=Math.floor(r/1e3/i),u=!1;for(let p=-s;p<=s;p++){let f=await v0(c,l+p,o);A0(f,a)&&(u=!0)}return u}function A0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}function dT(t){let e=encodeURIComponent(`${t.issuer}:${t.accountName}`),r=new URLSearchParams({secret:t.secretBase32,issuer:t.issuer,algorithm:"SHA1",digits:String(t.digits??6),period:String(t.period??30)});return`otpauth://totp/${e}?${r.toString()}`}var Vm="totp",T0={USE_VERIFY_WITH_CREDENTIALS:{code:"TOTP_USE_VERIFY_WITH_CREDENTIALS",message:"TOTP verification requires credential data; call verifyWithCredentials()"}};function pT(t={}){let e=t.issuer??"Auth Craft",r=t.backupCodeCount??10,n=t.window??1;return{name:"totp-mfa",version:"1.0.0",method:Vm,requiresServerDelivery:!1,generateSecret(){return pd()},generateBackupCodes(i){return ud(i||r)},async issueChallenge(i){return T({challengeId:`totp_${Date.now()}`,methods:i.availableMethods.includes(Vm)?[Vm]:i.availableMethods,expiresAt:new Date(Date.now()+300*1e3)})},async verify(){return d(T0.USE_VERIFY_WITH_CREDENTIALS)},async setup(i){let o=pd(),s=ud(r),a=await Promise.all(s.map(p=>dd(p))),c=i.data.accountName??i.userId,l=dT({secretBase32:o,accountName:c,issuer:e});return T({secret:o,otpauthUri:l,backupCodes:s,credentialData:{secret:o,backupCodeHashes:a}})},async verifyWithCredentials(i){let o=i.credentialData,s=i.data.code?.trim();if(!s||!o?.secret)return T({verified:!1,data:{}});if(await fd(o.secret,s,Date.now(),{window:n}))return T({verified:!0,data:{}});let c=o.backupCodeHashes??[];if(c.length>0){let l=await Hm(s,c);if(l)return T({verified:!0,data:{usedBackupCodeHash:l}})}return T({verified:!1,data:{}})},async verifyCredential(i,o){let s=i.data.code,a=i.data.secret;if(!s||!a)return T({verified:!1,data:{}});let c=await fd(a,s,Date.now(),{window:n});return T({verified:c,data:{}})}}}var Bm={scopes:["email","public_profile"],apiVersion:"v18.0"};var Zr={INVALID_CODE:_("FACEBOOK_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("FACEBOOK_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("FACEBOOK_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("FACEBOOK_INVALID_TOKEN","Invalid access token"),MISSING_CONFIG:_("FACEBOOK_MISSING_CONFIG","Missing required Facebook OAuth configuration")};function jm(t={}){let{scopes:e=Bm.scopes,apiVersion:r=Bm.apiVersion}=t,n={AUTHORIZATION:`https://www.facebook.com/${r}/dialog/oauth`,TOKEN:`https://graph.facebook.com/${r}/oauth/access_token`,USER_INFO:`https://graph.facebook.com/${r}/me`,DEBUG_TOKEN:`https://graph.facebook.com/${r}/debug_token`};return{name:"facebook-oauth-provider",version:"1.0.0",getAuthorizationUrl(i,o){let s=new URLSearchParams({client_id:i.clientId,redirect_uri:i.redirectUri,scope:(i.scopes??e).join(","),response_type:"code",...o&&{state:o}});return`${n.AUTHORIZATION}?${s.toString()}`},async exchangeCodeForToken(i,o){try{if(!i)return d(Zr.INVALID_CODE());let s=new URLSearchParams({client_id:o.clientId,client_secret:o.clientSecret,code:i,redirect_uri:o.redirectUri}),a=await fetch(`${n.TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.TOKEN_EXCHANGE_FAILED());let c=await a.json();return T({accessToken:c.access_token,...c.expires_in&&{expiresIn:c.expires_in}})}catch(s){return console.error("Facebook token exchange error:",s),d(Zr.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=["id","email","name","first_name","last_name","picture","locale"],s=new URLSearchParams({fields:o.join(","),access_token:i}),a=await fetch(`${n.USER_INFO}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});if(!a.ok)return d(Zr.USER_PROFILE_FAILED());let c=await a.json(),l={id:c.id,...c.email&&{email:c.email},...c.email&&{emailVerified:!1},...c.name&&{name:c.name},...c.first_name&&{givenName:c.first_name},...c.last_name&&{familyName:c.last_name},...c.picture?.data?.url&&{avatarUrl:c.picture.data.url},...c.locale&&{locale:c.locale},provider:"facebook"};return T(l)}catch(o){return console.error("Facebook user profile error:",o),d(Zr.USER_PROFILE_FAILED())}},async verifyAccessToken(i){try{if(!i)return d(Zr.INVALID_TOKEN());let o=`${t.appId}|${t.appSecret}`,s=new URLSearchParams({input_token:i,access_token:o}),a=await fetch(`${n.DEBUG_TOKEN}?${s.toString()}`,{method:"GET",headers:{Accept:"application/json"}});return a.ok?(await a.json()).data.is_valid?this.getUserProfile(i):d(Zr.INVALID_TOKEN()):d(Zr.INVALID_TOKEN())}catch(o){return console.error("Facebook token verification error:",o),d(Zr.INVALID_TOKEN())}}}}var md={scopes:["openid","email","profile"],accessType:"online",includeGrantedScopes:!1},Ji={AUTHORIZATION:"https://accounts.google.com/o/oauth2/v2/auth",TOKEN:"https://oauth2.googleapis.com/token",USER_INFO:"https://www.googleapis.com/oauth2/v2/userinfo",TOKEN_INFO:"https://oauth2.googleapis.com/tokeninfo",REVOKE:"https://oauth2.googleapis.com/revoke"};var tt={INVALID_CODE:_("GOOGLE_INVALID_CODE","Invalid authorization code"),TOKEN_EXCHANGE_FAILED:_("GOOGLE_TOKEN_EXCHANGE_FAILED","Failed to exchange code for token"),USER_PROFILE_FAILED:_("GOOGLE_USER_PROFILE_FAILED","Failed to fetch user profile"),INVALID_TOKEN:_("GOOGLE_INVALID_TOKEN","Invalid access token"),INVALID_CREDENTIAL:_("GOOGLE_INVALID_CREDENTIAL","Invalid ID token or credential"),CREDENTIAL_VERIFICATION_FAILED:_("GOOGLE_CREDENTIAL_VERIFICATION_FAILED","Failed to verify credential"),REFRESH_TOKEN_FAILED:_("GOOGLE_REFRESH_TOKEN_FAILED","Failed to refresh access token"),MISSING_CONFIG:_("GOOGLE_MISSING_CONFIG","Missing required Google OAuth configuration")};function _0(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=e.length%4;if(r){if(r===1)throw new Error("Invalid base64url string");e+=new Array(5-r).join("=")}try{return decodeURIComponent(atob(e).split("").map(n=>`%${`00${n.charCodeAt(0).toString(16)}`.slice(-2)}`).join(""))}catch{throw new Error("Failed to decode base64url")}}function I0(t){try{let e=t.split(".");if(e.length!==3)return null;let r=e[1];if(!r)return null;let n=_0(r);return JSON.parse(n)}catch(e){return console.error("Failed to decode JWT:",e),null}}function Gm(t={}){let{clientId:e,clientSecret:r,redirectUri:n,scopes:i=md.scopes,accessType:o=md.accessType,includeGrantedScopes:s=md.includeGrantedScopes,prompt:a}=t;return{name:"google-oauth-provider",version:"1.0.0",getAuthorizationUrl(c,l){let u=c?.clientId??e,p=c?.redirectUri??n;if(!u||!p)throw new Error("Google OAuth: clientId and redirectUri are required");let f=new URLSearchParams({client_id:u,redirect_uri:p,response_type:"code",scope:(c?.scopes??i).join(" "),access_type:o,...l&&{state:l},...a&&{prompt:a},...s&&{include_granted_scopes:"true"}});return`${Ji.AUTHORIZATION}?${f.toString()}`},async exchangeCodeForToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r,f=l?.redirectUri??n;try{if(!c)return d(tt.INVALID_CODE());if(!u||!p||!f)return d(tt.MISSING_CONFIG());let m=new URLSearchParams({client_id:u,client_secret:p,code:c,redirect_uri:f,grant_type:"authorization_code"}),E=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:m.toString()});if(!E.ok)return console.error("Google token exchange failed with status:",E.status),d(tt.TOKEN_EXCHANGE_FAILED());let v=await E.json();return T({accessToken:v.access_token,...v.refresh_token&&{refreshToken:v.refresh_token},...v.expires_in&&{expiresIn:v.expires_in}})}catch(m){return console.error("Google token exchange error:",m),d(tt.TOKEN_EXCHANGE_FAILED())}},async getUserProfile(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(Ji.USER_INFO,{method:"GET",headers:{Authorization:`Bearer ${c}`,Accept:"application/json"}});if(!l.ok)return console.error("Google user profile failed with status:",l.status),d(tt.USER_PROFILE_FAILED());let u=await l.json(),p={id:u.id,...u.email&&{email:u.email},...u.verified_email!==void 0&&{emailVerified:u.verified_email},...u.name&&{name:u.name},...u.given_name&&{givenName:u.given_name},...u.family_name&&{familyName:u.family_name},...u.picture&&{avatarUrl:u.picture},...u.locale&&{locale:u.locale},provider:"google"};return T(p)}catch(l){return console.error("Google user profile error:",l),d(tt.USER_PROFILE_FAILED())}},async verifyAccessToken(c){try{if(!c)return d(tt.INVALID_TOKEN());let l=await fetch(`${Ji.TOKEN_INFO}?access_token=${c}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return d(tt.INVALID_TOKEN());let u=await l.json();return parseInt(u.expires_in,10)<=0?d(tt.INVALID_TOKEN()):this.getUserProfile(c)}catch(l){return console.error("Google token verification error:",l),d(tt.INVALID_TOKEN())}},async verifyCredential(c){try{if(!c)return d(tt.INVALID_CREDENTIAL());let l=await fetch(`${Ji.TOKEN_INFO}?id_token=${encodeURIComponent(c)}`,{method:"GET",headers:{Accept:"application/json"}});if(!l.ok)return console.error("Google credential verification failed with status:",l.status),d(tt.INVALID_CREDENTIAL());let u=await l.json();if(!e)return d(tt.MISSING_CONFIG());if(u.aud!==e)return d(tt.INVALID_CREDENTIAL());if(parseInt(u.expires_in,10)<=0)return d(tt.INVALID_CREDENTIAL());let f=u.email_verified==="true",m=I0(c),E={id:u.sub,...u.email&&{email:u.email},...u.email&&{emailVerified:f},...m?.name&&{name:m.name},...m?.given_name&&{givenName:m.given_name},...m?.family_name&&{familyName:m.family_name},...m?.picture&&{avatarUrl:m.picture},...m?.locale&&{locale:m.locale},provider:"google"};return T(E)}catch(l){return console.error("Google credential verification error:",l),d(tt.CREDENTIAL_VERIFICATION_FAILED())}},async refreshAccessToken(c,l){let u=l?.clientId??e,p=l?.clientSecret??r;try{if(!c)return d(tt.INVALID_TOKEN());if(!u||!p)return d(tt.MISSING_CONFIG());let f=new URLSearchParams({client_id:u,client_secret:p,refresh_token:c,grant_type:"refresh_token"}),m=await fetch(Ji.TOKEN,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!m.ok)return console.error("Google refresh token failed with status:",m.status),d(tt.REFRESH_TOKEN_FAILED());let E=await m.json();return T({accessToken:E.access_token,...E.expires_in&&{expiresIn:E.expires_in}})}catch(f){return console.error("Google refresh token error:",f),d(tt.REFRESH_TOKEN_FAILED())}}}}function fT(t={}){let e=new Map,r=t.sweepIntervalMs??6e4,n=0,i;function o(){if(n===0)return;let s=Date.now()-n;for(let[a,c]of e){let l=c.hits.filter(u=>u>s);l.length===0?e.delete(a):c.hits=l}}return r>0&&(i=setInterval(o,r),i.unref?.()),{name:"rate-limiter-memory",version:"1.0.0",async consume(s,a){let{limit:c,windowMs:l}=a;l>n&&(n=l);let u=Date.now(),p=u-l,f=e.get(s)??{hits:[]},m=f.hits.filter(E=>E>p);if(m.length>=c){let E=m[0]??u,v=Math.max(0,E+l-u);return f.hits=m,e.set(s,f),{allowed:!1,remaining:0,retryAfterMs:v,limit:c}}return m.push(u),f.hits=m,e.set(s,f),{allowed:!0,remaining:c-m.length,retryAfterMs:0,limit:c}},async reset(s){e.delete(s)},async cleanup(){i&&clearInterval(i),e.clear()}}}import{DescribeTableCommand as XO,DynamoDBClient as QO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as ZO}from"@aws-sdk/lib-dynamodb";var te={DatabaseConnectionError:_("DATABASE_CONNECTION_ERROR","Failed to connect to database"),DatabaseQueryError:Q("DATABASE_QUERY_ERROR","Database query execution failed: {query}"),NotFound:Q("REPOSITORY_NOT_FOUND","{entity} with {id} not found"),UniqueConstraintViolation:Q("UNIQUE_CONSTRAINT_VIOLATION","Record with this {field} already exists"),ForeignKeyViolation:Q("FOREIGN_KEY_VIOLATION","Referenced {field} does not exist"),RecordLocked:_("RECORD_LOCKED","Record is currently locked by another operation"),DeadlockDetected:_("DEADLOCK_DETECTED","Transaction deadlock detected"),InvalidData:Q("INVALID_DATA","Invalid data: {reason}"),Timeout:_("REPOSITORY_TIMEOUT","Database operation timed out"),AttemptsExceeded:_("ATTEMPTS_EXCEEDED","Attempt limit reached"),TransactionFailed:Q("TRANSACTION_FAILED","Transaction failed: {reason}"),UnknownError:Q("REPOSITORY_UNKNOWN_ERROR","Unexpected database error: {message}")};function re(t){return t.getTime()}function J(t){return new Date(t)}function mT(t){return Math.floor(t/1e3)}function ae(){return Date.now()}function sc(t){return t instanceof Date?mT(t.getTime()):mT(t)}function $m(t){return t<Date.now()}function Cr(t){return t?re(t):null}function Kt(t){return t==null?null:J(t)}function Ht(t){let e={};for(let[r,n]of Object.entries(t))n!=null&&(e[r]=n);return e}function Pr(t){let e=[],r=[],n={},i={},o=0;for(let[c,l]of Object.entries(t)){if(c==="PK"||c==="SK")continue;let u=`#${c}`;if(n[u]=c,l==null)r.push(u);else{let p=`:val${o}`;e.push(`${u} = ${p}`),i[p]=l,o++}}let s=[];return e.length>0&&s.push(`SET ${e.join(", ")}`),r.length>0&&s.push(`REMOVE ${r.join(", ")}`),{UpdateExpression:s.join(" "),ExpressionAttributeNames:n,ExpressionAttributeValues:i}}function qm(t="PK"){return`attribute_not_exists(${t})`}var Wm={USER:"USR"},ce={USER:`${Wm.USER}#`,SESSION:"SES#",PROVIDER:"PRV#",CHALLENGE:"CHL#",IDENTITY:"IDT#",CREDENTIAL:"CRD#",TENANT:"TNT#",INVITE:"INV#"},Be={METADATA:"MD",AUTH:"AUTH",PROFILE:"PROF",PROVIDER:"PRV#",MFA:"MFA#",TENANT_PROFILE:"TPRF#",OWNER:"OWNER"},Tt="#",U={USER_PK:t=>`${ce.USER}${t}`,USER_AUTH_SK:()=>Be.AUTH,USER_PROFILE_SK:()=>Be.PROFILE,USER_MFA_SK:t=>`${Be.MFA}${t}`,USER_MFA_WITH_ID_SK:(t,e)=>`${Be.MFA}${t}${Tt}${e}`,TENANT_MEMBER_PK:t=>`${ce.TENANT}${t}`,TENANT_MEMBER_SK:t=>`${ce.USER}${t}`,TENANT_OWNER_MARKER_SK:()=>Be.OWNER,TENANT_PK:t=>`${ce.TENANT}${t}`,TENANT_SK:()=>Be.METADATA,INVITE_PK:t=>`${ce.INVITE}${t}`,INVITE_SK:()=>Be.METADATA,TENANT_PROFILE_PK:t=>`${ce.TENANT}${t}`,TENANT_PROFILE_SK:t=>`${Be.TENANT_PROFILE}${ce.USER}${t}`,SESSION_PK:t=>`${ce.SESSION}${t}`,SESSION_METADATA_SK:()=>Be.METADATA,SESSION_SK:()=>Be.METADATA,PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,PROVIDER_PK:(t,e)=>`${ce.PROVIDER}${t}${Tt}${e}`,PROVIDER_METADATA_SK:()=>Be.METADATA,CHALLENGE_PK:t=>`${ce.CHALLENGE}${t}`,CHALLENGE_SK:()=>Be.METADATA,IDENTITY_PK:(t,e)=>`${ce.IDENTITY}${t}#${e}`,IDENTITY_SK:()=>Be.METADATA,CREDENTIAL_PK:t=>`${ce.CREDENTIAL}${t}`,CREDENTIAL_SK:()=>Be.METADATA,CREDENTIAL_TYPE_PREFIX:t=>`${ce.CREDENTIAL}${t}#`,CREDENTIAL_USER_SK:(t,e)=>`${ce.CREDENTIAL}${t}#${e}`,USER_INDEX_PK:t=>`${ce.USER}${t}`,USER_INDEX_SK:(t,e)=>`${ce.IDENTITY}${t}#${e}`},le={userId:t=>t.slice(ce.USER.length),sessionId:t=>t.slice(ce.SESSION.length),providerPKInfo:t=>{let e=t.slice(ce.PROVIDER.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},providerInfo:t=>{let e=t.slice(Be.PROVIDER.length),r=e.indexOf(Tt);if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{provider:n,externalId:i}},mfaSKInfo:t=>{let e=t.slice(Be.MFA.length),r=e.indexOf(Tt);if(r===-1)return{method:e};let n=e.slice(0,r),i=e.slice(r+1);return{method:n,id:i}},tenantId:t=>t.slice(ce.TENANT.length),tenantMemberUserId:t=>t.slice(ce.USER.length),challengeIdFromPK:t=>t.slice(ce.CHALLENGE.length),inviteId:t=>t.slice(ce.INVITE.length),tenantProfileUserId:t=>t.slice(Be.TENANT_PROFILE.length+ce.USER.length),identityPKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}},credentialId:t=>t.slice(ce.CREDENTIAL.length),credentialTypeFromUserSK:t=>{let e=t.slice(ce.CREDENTIAL.length),r=e.indexOf("#");return r===-1?"":e.slice(0,r)},userIndexSKInfo:t=>{let e=t.slice(ce.IDENTITY.length),r=e.indexOf("#");if(r===-1)return null;let n=e.slice(0,r),i=e.slice(r+1);return{type:n,value:i}}};var Ae={ACTIVE_SESSION_PK:t=>`${ce.USER}${t}`,ACTIVE_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_SESSION_PK:t=>`${ce.USER}${t}`,USER_SESSION_SK:(t,e)=>`${t}${Tt}${e}`,USER_STATUS_PK:t=>{let e=t===ye.ACTIVE?"ACTIVE":"INACTIVE";return`${Wm.USER}${Tt}${e}`},USER_STATUS_SK:t=>t,USER_PROVIDER_PK:t=>`${ce.USER}${t}`,USER_PROVIDER_SK:(t,e)=>`${Be.PROVIDER}${t}${Tt}${e}`,INVITE_TENANT_PK:t=>`${ce.TENANT}${t}`,INVITE_TENANT_SK:(t,e,r)=>`${t}${Tt}${e}${Tt}${r}`,INVITE_TENANT_STATUS_PREFIX:t=>`${t}${Tt}`,USER_TENANT_PK:t=>`${ce.USER}${t}`,USER_TENANT_SK:(t,e,r,n)=>`${t}${Tt}${e??"ROOT"}${Tt}${r}${Tt}${n}`},h={PK:"PK",SK:"SK",TTL:"TTL",ACTIVE_SESSION_PK:"activeSessionPk",ACTIVE_SESSION_SK:"activeSessionSk",USER_SESSION_PK:"userSessionPk",USER_SESSION_SK:"userSessionSk",USER_STATUS_PK:"userStatusPk",USER_STATUS_SK:"userStatusSk",USER_PROVIDER_PK:"userProviderPk",USER_PROVIDER_SK:"userProviderSk",USER_ID:"userId",TENANT_ID:"tenantId",TENANT_TYPE:"tenantType",AUDIENCE:"audience",PURPOSE:"purpose",CHALLENGE_STATUS:"challengeStatus",PHASE:"phase",ALLOWED_METHODS:"allowedMethods",METHOD:"method",IDENTITY_TYPE:"identityType",IDENTITY_VALUE:"identityValue",CODE_HASH:"codeHash",ATTEMPTS:"attempts",MAX_ATTEMPTS:"maxAttempts",METADATA:"metadata",FLOW_KEY:"flowKey",EXPIRES_AT:"expiresAt",CREATED_AT:"createdAt",TOKEN_ID:"tokenId",PREVIOUS_TOKEN_ID:"previousTokenId",ROTATED_AT:"rotatedAt",LAST_USED_AT:"lastUsedAt",REVOKED_AT:"revokedAt",ROLE:"role",ROLES:"roles",PERM:"perm",AUTH_PERM:"authPerm",IS_OWNER:"isOwner",DEVICE_LABEL:"deviceLabel",COUNTRY:"country",CITY:"city",IDENTITY_USER_PK:"identityUserPk",IDENTITY_USER_SK:"identityUserSk",LOGIN_ENABLED:"loginEnabled",VERIFIED_AT:"verifiedAt",GUARDS:"guards",PENDING_VERIFICATION:"pendingVerification",UPDATED_AT:"updatedAt",CREDENTIAL_USER_PK:"credentialUserPk",CREDENTIAL_USER_SK:"credentialUserSk",CREDENTIAL_VALUE:"value",INVITE_STATUS:"inviteStatus",INVITE_TOKEN:"inviteToken",INVITED_BY_ID:"invitedById",INVITED_BY_INFO:"invitedByInfo",INVITEE_USER_ID:"inviteeUserId",INVITEE_EMAIL:"inviteeEmail",INVITEE_PHONE:"inviteePhone",ACCEPTED_AT:"acceptedAt",DECLINED_AT:"declinedAt",INVITE_TENANT_PK:"inviteTenantPk",INVITE_TENANT_SK:"inviteTenantSk",INVITE_TOKEN_GSI:"inviteTokenGsi",INVITEE_EMAIL_GSI:"inviteeEmailGsi",INVITEE_EMAIL_TENANT_SK:"inviteeEmailTenantSk",INVITEE_PHONE_GSI:"inviteePhoneGsi",INVITEE_PHONE_TENANT_SK:"inviteePhoneTenantSk",USER_TENANT_PK:"userTenantPk",USER_TENANT_SK:"userTenantSk",DISPLAY_NAME:"displayName",AVATAR_URL:"avatarUrl",TITLE:"title",BIO:"bio"},hd={sessionSK:(t,e)=>`${t instanceof Date?t.getTime():t}${Tt}${e}`,extractCreatedAt:t=>{let e=t.indexOf(Tt),r=e===-1?t:t.slice(0,e);return Number(r)}};var ue={ACTIVE_SESSIONS:"GSI_ActiveSessions",USER_SESSIONS:"GSI_UserSessions",USERS_BY_STATUS:"GSI_UsersByStatus",USER_PROVIDERS:"GSI_UserProviders",USER_IDENTITIES:"GSI_UserIdentities",USER_CREDENTIALS:"GSI_UserCredentials",TENANT_INVITES:"GSI_TenantInvites",INVITE_TOKEN:"GSI_InviteToken",INVITEE_EMAIL:"GSI_InviteeEmail",INVITEE_PHONE:"GSI_InviteePhone",USER_TENANTS:"GSI_UserTenants"},We="S",x0={partitionKey:{name:"PK",type:We},sortKey:{name:"SK",type:We},ttlAttribute:"TTL",globalSecondaryIndexes:[{indexName:ue.ACTIVE_SESSIONS,partitionKey:{name:"activeSessionPk",type:We},sortKey:{name:"activeSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USER_SESSIONS,partitionKey:{name:"userSessionPk",type:We},sortKey:{name:"userSessionSk",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.USERS_BY_STATUS,partitionKey:{name:"userStatusPk",type:We},sortKey:{name:"userStatusSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["displayName","createdAt"]}},{indexName:ue.USER_PROVIDERS,partitionKey:{name:"userProviderPk",type:We},sortKey:{name:"userProviderSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userId","externalEmail","externalName","createdAt"]}},{indexName:ue.USER_IDENTITIES,partitionKey:{name:"identityUserPk",type:We},sortKey:{name:"identityUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["loginEnabled","verifiedAt","createdAt"]}},{indexName:ue.USER_CREDENTIALS,partitionKey:{name:"credentialUserPk",type:We},sortKey:{name:"credentialUserSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["revokedAt","createdAt"]}},{indexName:ue.USER_TENANTS,partitionKey:{name:"userTenantPk",type:We},sortKey:{name:"userTenantSk",type:We},projection:{type:"INCLUDE",nonKeyAttributes:["userStatus","role","roles","perm","authPerm","isOwner","createdAt","updatedAt"]}},{indexName:ue.TENANT_INVITES,partitionKey:{name:"inviteTenantPk",type:We},sortKey:{name:"inviteTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITE_TOKEN,partitionKey:{name:"inviteTokenGsi",type:We},projection:{type:"KEYS_ONLY"}},{indexName:ue.INVITEE_EMAIL,partitionKey:{name:"inviteeEmailGsi",type:We},sortKey:{name:"inviteeEmailTenantSk",type:We},projection:{type:"ALL"}},{indexName:ue.INVITEE_PHONE,partitionKey:{name:"inviteePhoneGsi",type:We},sortKey:{name:"inviteePhoneTenantSk",type:We},projection:{type:"ALL"}}]};import{DeleteCommand as J0,GetCommand as Y0,PutCommand as X0,UpdateCommand as RT}from"@aws-sdk/lib-dynamodb";var b0=BigInt(0),ac=BigInt(1),S0=BigInt(2),w0=BigInt(7),N0=BigInt(256),R0=BigInt(113),yT=[],gT=[],vT=[];for(let t=0,e=ac,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],yT.push(2*(5*n+r)),gT.push((t+1)*(t+2)/2%64);let i=b0;for(let o=0;o<7;o++)e=(e<<ac^(e>>w0)*R0)%N0,e&S0&&(i^=ac<<(ac<<BigInt(o))-ac);vT.push(i)}var AT=Ov(vT,!0),O0=AT[0],k0=AT[1],C0=(t,e,r)=>t<<r|e>>>32-r,P0=(t,e,r)=>e<<r|t>>>32-r,D0=(t,e,r)=>e<<r-32|t>>>64-r,U0=(t,e,r)=>t<<r-32|e>>>64-r,hT=(t,e,r)=>r>32?D0(t,e,r):C0(t,e,r),ET=(t,e,r)=>r>32?U0(t,e,r):P0(t,e,r),_s=new Uint32Array(10);function L0(t,e=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(t.length!==50)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(Ye(e,"rounds"),e<1||e>24)throw new Error('"rounds" expected integer 1..24');for(let r=24-e;r<24;r++){for(let o=0;o<10;o++)_s[o]=t[o]^t[o+10]^t[o+20]^t[o+30]^t[o+40];for(let o=0;o<10;o+=2){let s=(o+8)%10,a=(o+2)%10,c=_s[a],l=_s[a+1],u=hT(c,l,1)^_s[s],p=ET(c,l,1)^_s[s+1];for(let f=0;f<50;f+=10)t[o+f]^=u,t[o+f+1]^=p}let n=t[2],i=t[3];for(let o=0;o<24;o++){let s=gT[o],a=hT(n,i,s),c=ET(n,i,s),l=yT[o];n=t[l],i=t[l+1],t[l]=a,t[l+1]=c}for(let o=0;o<50;o+=10){let s=t[o],a=t[o+1],c=t[o+2],l=t[o+3];t[o]^=~t[o+2]&t[o+4],t[o+1]^=~t[o+3]&t[o+5],t[o+2]^=~t[o+4]&t[o+6],t[o+3]^=~t[o+5]&t[o+7],t[o+4]^=~t[o+6]&t[o+8],t[o+5]^=~t[o+7]&t[o+9],t[o+6]^=~t[o+8]&s,t[o+7]^=~t[o+9]&a,t[o+8]^=~s&c,t[o+9]^=~a&l}t[0]^=O0[r],t[1]^=k0[r]}Nt(_s)}var zm=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(e,r,n,i=!1,o=24){if(Ye(e,"blockLen"),Ye(r,"suffix"),Ye(o,"rounds"),wv(i,"enableXOF"),this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=i,this.canXOF=i,this.rounds=o,Ye(n,"outputLen"),!(0<e&&e<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=ji(this.state)}clone(){return this._cloneInto()}keccak(){fs(this.state32),L0(this.state32,this.rounds),fs(this.state32),this.posOut=0,this.pos=0}update(e){xn(this),In(e);let{blockLen:r,state:n,state32:i}=this,o=e.length,s=r%4===0&&e.byteOffset%4===0,a=r/4,c=s&&o>=r?ji(e):void 0;for(let l=0;l<o;){if(c!==void 0&&this.pos===0&&l%4===0&&o-l>=r){for(let p=0,f=l/4;p<a;p++)i[p]^=c[f+p];l+=r,this.pos=r,this.keccak();continue}let u=Math.min(r-this.pos,o-l);for(let p=0;p<u;p++)n[this.pos++]^=e[l++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:i}=this;e[n]^=r,(r&128)!==0&&n===i-1&&this.keccak(),e[i-1]^=128,this.keccak()}writeInto(e){xn(this,!1),In(e),this.finish();let r=this.state,{blockLen:n}=this;for(let i=0,o=e.length;i<o;){this.posOut>=n&&this.keccak();let s=Math.min(n-this.posOut,o-i);e.set(r.subarray(this.posOut,this.posOut+s),i),this.posOut+=s,i+=s}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(e)}xof(e){return Ye(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(ds(e,this),this.finished)throw new Error("digest() was already called");this.writeInto(e.length===this.outputLen?e:e.subarray(0,this.outputLen)),this.destroy()}digest(){let e=new Uint8Array(this.outputLen);return this.digestInto(e),e}destroy(){this.destroyed=!0,Nt(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:i,rounds:o,enableXOF:s}=this;return e||=new t(r,n,i,s,o),e.blockLen=r,e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=o,e.suffix=n,e.outputLen=i,e.enableXOF=s,e.canXOF=this.canXOF,e.destroyed=this.destroyed,e}},M0=(t,e,r,n={})=>Ru(()=>new zm(e,t,r),n);var TT=M0(6,72,64,Ou(10));var K0=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,Jm=Math.ceil,pr=Math.floor,Gt="[BigNumber Error] ",_T=Gt+"Number primitive has more than 15 significant digits: ",Dr=1e14,de=14,Ym=9007199254740991,Xm=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],pi=1e7,mt=1e9;function IT(t){var e,r,n,i=R.prototype={constructor:R,toString:null,valueOf:null},o=new R(1),s=20,a=4,c=-7,l=21,u=-1e7,p=1e7,f=!1,m=1,E=0,v={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xA0",suffix:""},N="0123456789abcdefghijklmnopqrstuvwxyz",S=!0;function R(A,x){var b,g,I,O,P,k,C,D,L=this;if(!(L instanceof R))return new R(A,x);if(x==null){if(A&&A._isBigNumber===!0){L.s=A.s,!A.c||A.e>p?L.c=L.e=null:A.e<u?L.c=[L.e=0]:(L.e=A.e,L.c=A.c.slice());return}if((k=typeof A=="number")&&A*0==0){if(L.s=1/A<0?(A=-A,-1):1,A===~~A){for(O=0,P=A;P>=10;P/=10,O++);O>p?L.c=L.e=null:(L.e=O,L.c=[A]);return}D=String(A)}else{if(!K0.test(D=String(A)))return n(L,D,k);L.s=D.charCodeAt(0)==45?(D=D.slice(1),-1):1}(O=D.indexOf("."))>-1&&(D=D.replace(".","")),(P=D.search(/e/i))>0?(O<0&&(O=P),O+=+D.slice(P+1),D=D.substring(0,P)):O<0&&(O=D.length)}else{if(ze(x,2,N.length,"Base"),x==10&&S)return L=new R(A),V(L,s+L.e+1,a);if(D=String(A),k=typeof A=="number"){if(A*0!=0)return n(L,D,k,x);if(L.s=1/A<0?(D=D.slice(1),-1):1,R.DEBUG&&D.replace(/^0\.0*|\./,"").length>15)throw Error(_T+A)}else L.s=D.charCodeAt(0)===45?(D=D.slice(1),-1):1;for(b=N.slice(0,x),O=P=0,C=D.length;P<C;P++)if(b.indexOf(g=D.charAt(P))<0){if(g=="."){if(P>O){O=C;continue}}else if(!I&&(D==D.toUpperCase()&&(D=D.toLowerCase())||D==D.toLowerCase()&&(D=D.toUpperCase()))){I=!0,P=-1,O=0;continue}return n(L,String(A),k,x)}k=!1,D=r(D,x,10,L.s),(O=D.indexOf("."))>-1?D=D.replace(".",""):O=D.length}for(P=0;D.charCodeAt(P)===48;P++);for(C=D.length;D.charCodeAt(--C)===48;);if(D=D.slice(P,++C)){if(C-=P,k&&R.DEBUG&&C>15&&(A>Ym||A!==pr(A)))throw Error(_T+L.s*A);if((O=O-P-1)>p)L.c=L.e=null;else if(O<u)L.c=[L.e=0];else{if(L.e=O,L.c=[],P=(O+1)%de,O<0&&(P+=de),P<C){for(P&&L.c.push(+D.slice(0,P)),C-=de;P<C;)L.c.push(+D.slice(P,P+=de));P=de-(D=D.slice(P)).length}else P-=C;for(;P--;D+="0");L.c.push(+D)}}else L.c=[L.e=0]}R.clone=IT,R.ROUND_UP=0,R.ROUND_DOWN=1,R.ROUND_CEIL=2,R.ROUND_FLOOR=3,R.ROUND_HALF_UP=4,R.ROUND_HALF_DOWN=5,R.ROUND_HALF_EVEN=6,R.ROUND_HALF_CEIL=7,R.ROUND_HALF_FLOOR=8,R.EUCLID=9,R.config=R.set=function(A){var x,b;if(A!=null)if(typeof A=="object"){if(A.hasOwnProperty(x="DECIMAL_PLACES")&&(b=A[x],ze(b,0,mt,x),s=b),A.hasOwnProperty(x="ROUNDING_MODE")&&(b=A[x],ze(b,0,8,x),a=b),A.hasOwnProperty(x="EXPONENTIAL_AT")&&(b=A[x],b&&b.pop?(ze(b[0],-mt,0,x),ze(b[1],0,mt,x),c=b[0],l=b[1]):(ze(b,-mt,mt,x),c=-(l=b<0?-b:b))),A.hasOwnProperty(x="RANGE"))if(b=A[x],b&&b.pop)ze(b[0],-mt,-1,x),ze(b[1],1,mt,x),u=b[0],p=b[1];else if(ze(b,-mt,mt,x),b)u=-(p=b<0?-b:b);else throw Error(Gt+x+" cannot be zero: "+b);if(A.hasOwnProperty(x="CRYPTO"))if(b=A[x],b===!!b)if(b)if(typeof crypto<"u"&&crypto&&(crypto.getRandomValues||crypto.randomBytes))f=b;else throw f=!b,Error(Gt+"crypto unavailable");else f=b;else throw Error(Gt+x+" not true or false: "+b);if(A.hasOwnProperty(x="MODULO_MODE")&&(b=A[x],ze(b,0,9,x),m=b),A.hasOwnProperty(x="POW_PRECISION")&&(b=A[x],ze(b,0,mt,x),E=b),A.hasOwnProperty(x="FORMAT"))if(b=A[x],typeof b=="object")v=b;else throw Error(Gt+x+" not an object: "+b);if(A.hasOwnProperty(x="ALPHABET"))if(b=A[x],typeof b=="string"&&!/^.?$|[+\-.\s]|(.).*\1/.test(b))S=b.slice(0,10)=="0123456789",N=b;else throw Error(Gt+x+" invalid: "+b)}else throw Error(Gt+"Object expected: "+A);return{DECIMAL_PLACES:s,ROUNDING_MODE:a,EXPONENTIAL_AT:[c,l],RANGE:[u,p],CRYPTO:f,MODULO_MODE:m,POW_PRECISION:E,FORMAT:v,ALPHABET:N}},R.isBigNumber=function(A){if(!A||A._isBigNumber!==!0)return!1;if(!R.DEBUG)return!0;var x,b,g=A.c,I=A.e,O=A.s;e:if({}.toString.call(g)=="[object Array]"){if((O===1||O===-1)&&I>=-mt&&I<=mt&&I===pr(I)){if(g[0]===0){if(I===0&&g.length===1)return!0;break e}if(x=(I+1)%de,x<1&&(x+=de),String(g[0]).length==x){for(x=0;x<g.length;x++)if(b=g[x],b<0||b>=Dr||b!==pr(b))break e;if(b!==0)return!0}}}else if(g===null&&I===null&&(O===null||O===1||O===-1))return!0;throw Error(Gt+"Invalid BigNumber: "+A)},R.maximum=R.max=function(){return K(arguments,-1)},R.minimum=R.min=function(){return K(arguments,1)},R.random=(function(){var A=9007199254740992,x=Math.random()*A&2097151?function(){return pr(Math.random()*A)}:function(){return(Math.random()*1073741824|0)*8388608+(Math.random()*8388608|0)};return function(b){var g,I,O,P,k,C=0,D=[],L=new R(o);if(b==null?b=s:ze(b,0,mt),P=Jm(b/de),f)if(crypto.getRandomValues){for(g=crypto.getRandomValues(new Uint32Array(P*=2));C<P;)k=g[C]*131072+(g[C+1]>>>11),k>=9e15?(I=crypto.getRandomValues(new Uint32Array(2)),g[C]=I[0],g[C+1]=I[1]):(D.push(k%1e14),C+=2);C=P/2}else if(crypto.randomBytes){for(g=crypto.randomBytes(P*=7);C<P;)k=(g[C]&31)*281474976710656+g[C+1]*1099511627776+g[C+2]*4294967296+g[C+3]*16777216+(g[C+4]<<16)+(g[C+5]<<8)+g[C+6],k>=9e15?crypto.randomBytes(7).copy(g,C):(D.push(k%1e14),C+=7);C=P/7}else throw f=!1,Error(Gt+"crypto unavailable");if(!f)for(;C<P;)k=x(),k<9e15&&(D[C++]=k%1e14);for(P=D[--C],b%=de,P&&b&&(k=Xm[de-b],D[C]=pr(P/k)*k);D[C]===0;D.pop(),C--);if(C<0)D=[O=0];else{for(O=-1;D[0]===0;D.splice(0,1),O-=de);for(C=1,k=D[0];k>=10;k/=10,C++);C<de&&(O-=de-C)}return L.e=O,L.c=D,L}})(),R.sum=function(){for(var A=1,x=arguments,b=new R(x[0]);A<x.length;)b=b.plus(x[A++]);return b},r=(function(){var A="0123456789";function x(b,g,I,O){for(var P,k=[0],C,D=0,L=b.length;D<L;){for(C=k.length;C--;k[C]*=g);for(k[0]+=O.indexOf(b.charAt(D++)),P=0;P<k.length;P++)k[P]>I-1&&(k[P+1]==null&&(k[P+1]=0),k[P+1]+=k[P]/I|0,k[P]%=I)}return k.reverse()}return function(b,g,I,O,P){var k,C,D,L,H,z,Y,pe,Oe=b.indexOf("."),Fe=s,me=a;for(Oe>=0&&(L=E,E=0,b=b.replace(".",""),pe=new R(g),z=pe.pow(b.length-Oe),E=L,pe.c=x(wn(dr(z.c),z.e,"0"),10,I,A),pe.e=pe.c.length),Y=x(b,g,I,P?(k=N,A):(k=A,N)),D=L=Y.length;Y[--L]==0;Y.pop());if(!Y[0])return k.charAt(0);if(Oe<0?--D:(z.c=Y,z.e=D,z.s=O,z=e(z,pe,Fe,me,I),Y=z.c,H=z.r,D=z.e),C=D+Fe+1,Oe=Y[C],L=I/2,H=H||C<0||Y[C+1]!=null,H=me<4?(Oe!=null||H)&&(me==0||me==(z.s<0?3:2)):Oe>L||Oe==L&&(me==4||H||me==6&&Y[C-1]&1||me==(z.s<0?8:7)),C<1||!Y[0])b=H?wn(k.charAt(1),-Fe,k.charAt(0)):k.charAt(0);else{if(Y.length=C,H)for(--I;++Y[--C]>I;)Y[C]=0,C||(++D,Y=[1].concat(Y));for(L=Y.length;!Y[--L];);for(Oe=0,b="";Oe<=L;b+=k.charAt(Y[Oe++]));b=wn(b,D,k.charAt(0))}return b}})(),e=(function(){function A(g,I,O){var P,k,C,D,L=0,H=g.length,z=I%pi,Y=I/pi|0;for(g=g.slice();H--;)C=g[H]%pi,D=g[H]/pi|0,P=Y*C+D*z,k=z*C+P%pi*pi+L,L=(k/O|0)+(P/pi|0)+Y*D,g[H]=k%O;return L&&(g=[L].concat(g)),g}function x(g,I,O,P){var k,C;if(O!=P)C=O>P?1:-1;else for(k=C=0;k<O;k++)if(g[k]!=I[k]){C=g[k]>I[k]?1:-1;break}return C}function b(g,I,O,P){for(var k=0;O--;)g[O]-=k,k=g[O]<I[O]?1:0,g[O]=k*P+g[O]-I[O];for(;!g[0]&&g.length>1;g.splice(0,1));}return function(g,I,O,P,k){var C,D,L,H,z,Y,pe,Oe,Fe,me,we,st,Zi,kn,eo,_t,yi,It=g.s==I.s?1:-1,Qe=g.c,Ke=I.c;if(!Qe||!Qe[0]||!Ke||!Ke[0])return new R(!g.s||!I.s||(Qe?Ke&&Qe[0]==Ke[0]:!Ke)?NaN:Qe&&Qe[0]==0||!Ke?It*0:It/0);for(Oe=new R(It),Fe=Oe.c=[],D=g.e-I.e,It=O+D+1,k||(k=Dr,D=fr(g.e/de)-fr(I.e/de),It=It/de|0),L=0;Ke[L]==(Qe[L]||0);L++);if(Ke[L]>(Qe[L]||0)&&D--,It<0)Fe.push(1),H=!0;else{for(kn=Qe.length,_t=Ke.length,L=0,It+=2,z=pr(k/(Ke[0]+1)),z>1&&(Ke=A(Ke,z,k),Qe=A(Qe,z,k),_t=Ke.length,kn=Qe.length),Zi=_t,me=Qe.slice(0,_t),we=me.length;we<_t;me[we++]=0);yi=Ke.slice(),yi=[0].concat(yi),eo=Ke[0],Ke[1]>=k/2&&eo++;do{if(z=0,C=x(Ke,me,_t,we),C<0){if(st=me[0],_t!=we&&(st=st*k+(me[1]||0)),z=pr(st/eo),z>1)for(z>=k&&(z=k-1),Y=A(Ke,z,k),pe=Y.length,we=me.length;x(Y,me,pe,we)==1;)z--,b(Y,_t<pe?yi:Ke,pe,k),pe=Y.length,C=1;else z==0&&(C=z=1),Y=Ke.slice(),pe=Y.length;if(pe<we&&(Y=[0].concat(Y)),b(me,Y,we,k),we=me.length,C==-1)for(;x(Ke,me,_t,we)<1;)z++,b(me,_t<we?yi:Ke,we,k),we=me.length}else C===0&&(z++,me=[0]);Fe[L++]=z,me[0]?me[we++]=Qe[Zi]||0:(me=[Qe[Zi]],we=1)}while((Zi++<kn||me[0]!=null)&&It--);H=me[0]!=null,Fe[0]||Fe.splice(0,1)}if(k==Dr){for(L=1,It=Fe[0];It>=10;It/=10,L++);V(Oe,O+(Oe.e=L+D*de-1)+1,P,H)}else Oe.e=D,Oe.r=+H;return Oe}})();function M(A,x,b,g){var I,O,P,k,C;if(b==null?b=a:ze(b,0,8),!A.c)return A.toString();if(I=A.c[0],P=A.e,x==null)C=dr(A.c),C=g==1||g==2&&(P<=c||P>=l)?yd(C,P):wn(C,P,"0");else if(A=V(new R(A),x,b),O=A.e,C=dr(A.c),k=C.length,g==1||g==2&&(x<=O||O<=c)){for(;k<x;C+="0",k++);C=yd(C,O)}else if(x-=P+(g===2&&O>P),C=wn(C,O,"0"),O+1>k){if(--x>0)for(C+=".";x--;C+="0");}else if(x+=O-k,x>0)for(O+1==k&&(C+=".");x--;C+="0");return A.s<0&&I?"-"+C:C}function K(A,x){for(var b,g,I=1,O=new R(A[0]);I<A.length;I++)g=new R(A[I]),(!g.s||(b=Yi(O,g))===x||b===0&&O.s===x)&&(O=g);return O}function B(A,x,b){for(var g=1,I=x.length;!x[--I];x.pop());for(I=x[0];I>=10;I/=10,g++);return(b=g+b*de-1)>p?A.c=A.e=null:b<u?A.c=[A.e=0]:(A.e=b,A.c=x),A}n=(function(){var A=/^(-?)0([xbo])(?=\w[\w.]*$)/i,x=/^([^.]+)\.$/,b=/^\.([^.]+)$/,g=/^-?(Infinity|NaN)$/,I=/^\s*\+(?=[\w.])|^\s+|\s+$/g;return function(O,P,k,C){var D,L=k?P:P.replace(I,"");if(g.test(L))O.s=isNaN(L)?null:L<0?-1:1;else{if(!k&&(L=L.replace(A,function(H,z,Y){return D=(Y=Y.toLowerCase())=="x"?16:Y=="b"?2:8,!C||C==D?z:H}),C&&(D=C,L=L.replace(x,"$1").replace(b,"0.$1")),P!=L))return new R(L,D);if(R.DEBUG)throw Error(Gt+"Not a"+(C?" base "+C:"")+" number: "+P);O.s=null}O.c=O.e=null}})();function V(A,x,b,g){var I,O,P,k,C,D,L,H=A.c,z=Xm;if(H){e:{for(I=1,k=H[0];k>=10;k/=10,I++);if(O=x-I,O<0)O+=de,P=x,C=H[D=0],L=pr(C/z[I-P-1]%10);else if(D=Jm((O+1)/de),D>=H.length)if(g){for(;H.length<=D;H.push(0));C=L=0,I=1,O%=de,P=O-de+1}else break e;else{for(C=k=H[D],I=1;k>=10;k/=10,I++);O%=de,P=O-de+I,L=P<0?0:pr(C/z[I-P-1]%10)}if(g=g||x<0||H[D+1]!=null||(P<0?C:C%z[I-P-1]),g=b<4?(L||g)&&(b==0||b==(A.s<0?3:2)):L>5||L==5&&(b==4||g||b==6&&(O>0?P>0?C/z[I-P]:0:H[D-1])%10&1||b==(A.s<0?8:7)),x<1||!H[0])return H.length=0,g?(x-=A.e+1,H[0]=z[(de-x%de)%de],A.e=-x||0):H[0]=A.e=0,A;if(O==0?(H.length=D,k=1,D--):(H.length=D+1,k=z[de-O],H[D]=P>0?pr(C/z[I-P]%z[P])*k:0),g)for(;;)if(D==0){for(O=1,P=H[0];P>=10;P/=10,O++);for(P=H[0]+=k,k=1;P>=10;P/=10,k++);O!=k&&(A.e++,H[0]==Dr&&(H[0]=1));break}else{if(H[D]+=k,H[D]!=Dr)break;H[D--]=0,k=1}for(O=H.length;H[--O]===0;H.pop());}A.e>p?A.c=A.e=null:A.e<u&&(A.c=[A.e=0])}return A}function $(A){var x,b=A.e;return b===null?A.toString():(x=dr(A.c),x=b<=c||b>=l?yd(x,b):wn(x,b,"0"),A.s<0?"-"+x:x)}return i.absoluteValue=i.abs=function(){var A=new R(this);return A.s<0&&(A.s=1),A},i.comparedTo=function(A,x){return Yi(this,new R(A,x))},i.decimalPlaces=i.dp=function(A,x){var b,g,I,O=this;if(A!=null)return ze(A,0,mt),x==null?x=a:ze(x,0,8),V(new R(O),A+O.e+1,x);if(!(b=O.c))return null;if(g=((I=b.length-1)-fr(this.e/de))*de,I=b[I])for(;I%10==0;I/=10,g--);return g<0&&(g=0),g},i.dividedBy=i.div=function(A,x){return e(this,new R(A,x),s,a)},i.dividedToIntegerBy=i.idiv=function(A,x){return e(this,new R(A,x),0,1)},i.exponentiatedBy=i.pow=function(A,x){var b,g,I,O,P,k,C,D,L,H=this;if(A=new R(A),A.c&&!A.isInteger())throw Error(Gt+"Exponent not an integer: "+$(A));if(x!=null&&(x=new R(x)),k=A.e>14,!H.c||!H.c[0]||H.c[0]==1&&!H.e&&H.c.length==1||!A.c||!A.c[0])return L=new R(Math.pow(+$(H),k?A.s*(2-Ed(A)):+$(A))),x?L.mod(x):L;if(C=A.s<0,x){if(x.c?!x.c[0]:!x.s)return new R(NaN);g=!C&&H.isInteger()&&x.isInteger(),g&&(H=H.mod(x))}else{if(A.e>9&&(H.e>0||H.e<-1||(H.e==0?H.c[0]>1||k&&H.c[1]>=24e7:H.c[0]<8e13||k&&H.c[0]<=9999975e7)))return O=H.s<0&&Ed(A)?-0:0,H.e>-1&&(O=1/O),new R(C?1/O:O);E&&(O=Jm(E/de+2))}for(k?(b=new R(.5),C&&(A.s=1),D=Ed(A)):(I=Math.abs(+$(A)),D=I%2),L=new R(o);;){if(D){if(L=L.times(H),!L.c)break;O?L.c.length>O&&(L.c.length=O):g&&(L=L.mod(x))}if(I){if(I=pr(I/2),I===0)break;D=I%2}else if(A=A.times(b),V(A,A.e+1,1),A.e>14)D=Ed(A);else{if(I=+$(A),I===0)break;D=I%2}H=H.times(H),O?H.c&&H.c.length>O&&(H.c.length=O):g&&(H=H.mod(x))}return g?L:(C&&(L=o.div(L)),x?L.mod(x):O?V(L,E,a,P):L)},i.integerValue=function(A){var x=new R(this);return A==null?A=a:ze(A,0,8),V(x,x.e+1,A)},i.isEqualTo=i.eq=function(A,x){return Yi(this,new R(A,x))===0},i.isFinite=function(){return!!this.c},i.isGreaterThan=i.gt=function(A,x){return Yi(this,new R(A,x))>0},i.isGreaterThanOrEqualTo=i.gte=function(A,x){return(x=Yi(this,new R(A,x)))===1||x===0},i.isInteger=function(){return!!this.c&&fr(this.e/de)>this.c.length-2},i.isLessThan=i.lt=function(A,x){return Yi(this,new R(A,x))<0},i.isLessThanOrEqualTo=i.lte=function(A,x){return(x=Yi(this,new R(A,x)))===-1||x===0},i.isNaN=function(){return!this.s},i.isNegative=function(){return this.s<0},i.isPositive=function(){return this.s>0},i.isZero=function(){return!!this.c&&this.c[0]==0},i.minus=function(A,x){var b,g,I,O,P=this,k=P.s;if(A=new R(A,x),x=A.s,!k||!x)return new R(NaN);if(k!=x)return A.s=-x,P.plus(A);var C=P.e/de,D=A.e/de,L=P.c,H=A.c;if(!C||!D){if(!L||!H)return L?(A.s=-x,A):new R(H?P:NaN);if(!L[0]||!H[0])return H[0]?(A.s=-x,A):new R(L[0]?P:a==3?-0:0)}if(C=fr(C),D=fr(D),L=L.slice(),k=C-D){for((O=k<0)?(k=-k,I=L):(D=C,I=H),I.reverse(),x=k;x--;I.push(0));I.reverse()}else for(g=(O=(k=L.length)<(x=H.length))?k:x,k=x=0;x<g;x++)if(L[x]!=H[x]){O=L[x]<H[x];break}if(O&&(I=L,L=H,H=I,A.s=-A.s),x=(g=H.length)-(b=L.length),x>0)for(;x--;L[b++]=0);for(x=Dr-1;g>k;){if(L[--g]<H[g]){for(b=g;b&&!L[--b];L[b]=x);--L[b],L[g]+=Dr}L[g]-=H[g]}for(;L[0]==0;L.splice(0,1),--D);return L[0]?B(A,L,D):(A.s=a==3?-1:1,A.c=[A.e=0],A)},i.modulo=i.mod=function(A,x){var b,g,I=this;return A=new R(A,x),!I.c||!A.s||A.c&&!A.c[0]?new R(NaN):!A.c||I.c&&!I.c[0]?new R(I):(m==9?(g=A.s,A.s=1,b=e(I,A,0,3),A.s=g,b.s*=g):b=e(I,A,0,m),A=I.minus(b.times(A)),!A.c[0]&&m==1&&(A.s=I.s),A)},i.multipliedBy=i.times=function(A,x){var b,g,I,O,P,k,C,D,L,H,z,Y,pe,Oe,Fe,me=this,we=me.c,st=(A=new R(A,x)).c;if(!we||!st||!we[0]||!st[0])return!me.s||!A.s||we&&!we[0]&&!st||st&&!st[0]&&!we?A.c=A.e=A.s=null:(A.s*=me.s,!we||!st?A.c=A.e=null:(A.c=[0],A.e=0)),A;for(g=fr(me.e/de)+fr(A.e/de),A.s*=me.s,C=we.length,H=st.length,C<H&&(pe=we,we=st,st=pe,I=C,C=H,H=I),I=C+H,pe=[];I--;pe.push(0));for(Oe=Dr,Fe=pi,I=H;--I>=0;){for(b=0,z=st[I]%Fe,Y=st[I]/Fe|0,P=C,O=I+P;O>I;)D=we[--P]%Fe,L=we[P]/Fe|0,k=Y*D+L*z,D=z*D+k%Fe*Fe+pe[O]+b,b=(D/Oe|0)+(k/Fe|0)+Y*L,pe[O--]=D%Oe;pe[O]=b}return b?++g:pe.splice(0,1),B(A,pe,g)},i.negated=function(){var A=new R(this);return A.s=-A.s||null,A},i.plus=function(A,x){var b,g=this,I=g.s;if(A=new R(A,x),x=A.s,!I||!x)return new R(NaN);if(I!=x)return A.s=-x,g.minus(A);var O=g.e/de,P=A.e/de,k=g.c,C=A.c;if(!O||!P){if(!k||!C)return new R(I/0);if(!k[0]||!C[0])return C[0]?A:new R(k[0]?g:I*0)}if(O=fr(O),P=fr(P),k=k.slice(),I=O-P){for(I>0?(P=O,b=C):(I=-I,b=k),b.reverse();I--;b.push(0));b.reverse()}for(I=k.length,x=C.length,I-x<0&&(b=C,C=k,k=b,x=I),I=0;x;)I=(k[--x]=k[x]+C[x]+I)/Dr|0,k[x]=Dr===k[x]?0:k[x]%Dr;return I&&(k=[I].concat(k),++P),B(A,k,P)},i.precision=i.sd=function(A,x){var b,g,I,O=this;if(A!=null&&A!==!!A)return ze(A,1,mt),x==null?x=a:ze(x,0,8),V(new R(O),A,x);if(!(b=O.c))return null;if(I=b.length-1,g=I*de+1,I=b[I]){for(;I%10==0;I/=10,g--);for(I=b[0];I>=10;I/=10,g++);}return A&&O.e+1>g&&(g=O.e+1),g},i.shiftedBy=function(A){return ze(A,-Ym,Ym),this.times("1e"+A)},i.squareRoot=i.sqrt=function(){var A,x,b,g,I,O=this,P=O.c,k=O.s,C=O.e,D=s+4,L=new R("0.5");if(k!==1||!P||!P[0])return new R(!k||k<0&&(!P||P[0])?NaN:P?O:1/0);if(k=Math.sqrt(+$(O)),k==0||k==1/0?(x=dr(P),(x.length+C)%2==0&&(x+="0"),k=Math.sqrt(+x),C=fr((C+1)/2)-(C<0||C%2),k==1/0?x="5e"+C:(x=k.toExponential(),x=x.slice(0,x.indexOf("e")+1)+C),b=new R(x)):b=new R(k+""),b.c[0]){for(C=b.e,k=C+D,k<3&&(k=0);;)if(I=b,b=L.times(I.plus(e(O,I,D,1))),dr(I.c).slice(0,k)===(x=dr(b.c)).slice(0,k))if(b.e<C&&--k,x=x.slice(k-3,k+1),x=="9999"||!g&&x=="4999"){if(!g&&(V(I,I.e+s+2,0),I.times(I).eq(O))){b=I;break}D+=4,k+=4,g=1}else{(!+x||!+x.slice(1)&&x.charAt(0)=="5")&&(V(b,b.e+s+2,1),A=!b.times(b).eq(O));break}}return V(b,b.e+s+1,a,A)},i.toExponential=function(A,x){return A!=null&&(ze(A,0,mt),A++),M(this,A,x,1)},i.toFixed=function(A,x){return A!=null&&(ze(A,0,mt),A=A+this.e+1),M(this,A,x)},i.toFormat=function(A,x,b){var g,I=this;if(b==null)A!=null&&x&&typeof x=="object"?(b=x,x=null):A&&typeof A=="object"?(b=A,A=x=null):b=v;else if(typeof b!="object")throw Error(Gt+"Argument not an object: "+b);if(g=I.toFixed(A,x),I.c){var O,P=g.split("."),k=+b.groupSize,C=+b.secondaryGroupSize,D=b.groupSeparator||"",L=P[0],H=P[1],z=I.s<0,Y=z?L.slice(1):L,pe=Y.length;if(C&&(O=k,k=C,C=O,pe-=O),k>0&&pe>0){for(O=pe%k||k,L=Y.substr(0,O);O<pe;O+=k)L+=D+Y.substr(O,k);C>0&&(L+=D+Y.slice(O)),z&&(L="-"+L)}g=H?L+(b.decimalSeparator||"")+((C=+b.fractionGroupSize)?H.replace(new RegExp("\\d{"+C+"}\\B","g"),"$&"+(b.fractionGroupSeparator||"")):H):L}return(b.prefix||"")+g+(b.suffix||"")},i.toFraction=function(A){var x,b,g,I,O,P,k,C,D,L,H,z,Y=this,pe=Y.c;if(A!=null&&(k=new R(A),!k.isInteger()&&(k.c||k.s!==1)||k.lt(o)))throw Error(Gt+"Argument "+(k.isInteger()?"out of range: ":"not an integer: ")+$(k));if(!pe)return new R(Y);for(x=new R(o),D=b=new R(o),g=C=new R(o),z=dr(pe),O=x.e=z.length-Y.e-1,x.c[0]=Xm[(P=O%de)<0?de+P:P],A=!A||k.comparedTo(x)>0?O>0?x:D:k,P=p,p=1/0,k=new R(z),C.c[0]=0;L=e(k,x,0,1),I=b.plus(L.times(g)),I.comparedTo(A)!=1;)b=g,g=I,D=C.plus(L.times(I=D)),C=I,x=k.minus(L.times(I=x)),k=I;return I=e(A.minus(b),g,0,1),C=C.plus(I.times(D)),b=b.plus(I.times(g)),C.s=D.s=Y.s,O=O*2,H=e(D,g,O,a).minus(Y).abs().comparedTo(e(C,b,O,a).minus(Y).abs())<1?[D,g]:[C,b],p=P,H},i.toNumber=function(){return+$(this)},i.toPrecision=function(A,x){return A!=null&&ze(A,1,mt),M(this,A,x,2)},i.toString=function(A){var x,b=this,g=b.s,I=b.e;return I===null?g?(x="Infinity",g<0&&(x="-"+x)):x="NaN":(A==null?x=I<=c||I>=l?yd(dr(b.c),I):wn(dr(b.c),I,"0"):A===10&&S?(b=V(new R(b),s+I+1,a),x=wn(dr(b.c),b.e,"0")):(ze(A,2,N.length,"Base"),x=r(wn(dr(b.c),I,"0"),10,A,g,!0)),g<0&&b.c[0]&&(x="-"+x)),x},i.valueOf=i.toJSON=function(){return $(this)},i._isBigNumber=!0,i[Symbol.toStringTag]="BigNumber",i[Symbol.for("nodejs.util.inspect.custom")]=i.valueOf,t!=null&&R.set(t),R}function fr(t){var e=t|0;return t>0||t===e?e:e-1}function dr(t){for(var e,r,n=1,i=t.length,o=t[0]+"";n<i;){for(e=t[n++]+"",r=de-e.length;r--;e="0"+e);o+=e}for(i=o.length;o.charCodeAt(--i)===48;);return o.slice(0,i+1||1)}function Yi(t,e){var r,n,i=t.c,o=e.c,s=t.s,a=e.s,c=t.e,l=e.e;if(!s||!a)return null;if(r=i&&!i[0],n=o&&!o[0],r||n)return r?n?0:-a:s;if(s!=a)return s;if(r=s<0,n=c==l,!i||!o)return n?0:!i^r?1:-1;if(!n)return c>l^r?1:-1;for(a=(c=i.length)<(l=o.length)?c:l,s=0;s<a;s++)if(i[s]!=o[s])return i[s]>o[s]^r?1:-1;return c==l?0:c>l^r?1:-1}function ze(t,e,r,n){if(t<e||t>r||t!==pr(t))throw Error(Gt+(n||"Argument")+(typeof t=="number"?t<e||t>r?" out of range: ":" not an integer: ":" not a primitive number: ")+String(t))}function Ed(t){var e=t.c.length-1;return fr(t.e/de)==e&&t.c[e]%2!=0}function yd(t,e){return(t.length>1?t.charAt(0)+"."+t.slice(1):t)+(e<0?"e":"e+")+e}function wn(t,e,r){var n,i;if(e<0){for(i=r+".";++e;i+=r);t=i+t}else if(n=t.length,++e>n){for(i=r,e-=n;--e;i+=r);t+=i}else e<n&&(t=t.slice(0,e)+"."+t.slice(e));return t}var H0=IT(),xT=H0;var F0=24,cc=32,V0=()=>typeof globalThis<"u"&&globalThis.crypto&&typeof globalThis.crypto.getRandomValues=="function"?()=>{let t=new Uint32Array(1);return globalThis.crypto.getRandomValues(t),t[0]/4294967296}:Math.random,Zm=V0(),Qm=(t=4,e=Zm)=>{let r="";for(;r.length<t;)r=r+Math.floor(e()*36).toString(36);return r};function B0(t){let e=new xT(0);for(let r of t.values())e=e.multipliedBy(256).plus(r);return e}var ST=(t="")=>{let e=new TextEncoder;return B0(TT(e.encode(t))).toString(36).slice(1)},bT=Array.from({length:26},(t,e)=>String.fromCharCode(e+97)),j0=t=>bT[Math.floor(t()*bT.length)],G0=({globalObj:t=typeof global<"u"?global:typeof window<"u"?window:{},random:e=Zm}={})=>{let r=Object.keys(t).toString(),n=r.length?r+Qm(cc,e):Qm(cc,e);return ST(n).substring(0,cc)},$0=t=>()=>t++,q0=476782367,wT=({random:t=Zm,counter:e=$0(Math.floor(t()*q0)),length:r=F0,fingerprint:n=G0({random:t})}={})=>{if(r>cc)throw new Error(`Length must be between 2 and ${cc}. Received: ${r}`);return function(){let o=j0(t),s=Date.now().toString(36),a=e().toString(36),c=Qm(r,t),l=`${s+c+a+n}`;return`${o+ST(l).substring(1,r)}`}},ht=W0(wT);function W0(t){let e;return()=>(e||(e=t()),e())}function Is(t){if(typeof t=="object"&&t!==null&&"name"in t){let{name:e}=t;return typeof e=="string"?e:void 0}}function Ce(t){return Is(t)==="ConditionalCheckFailedException"}function z0(t){let e=Is(t),r=t instanceof Error?t.message:typeof t=="string"?t:void 0;return[e,r].filter(Boolean).join(": ")||String(t)}function NT(t,e){console.error(`[repo-plugin-dynamodb] ${t} failed \u2014 ${z0(e)}`)}function G(t,e){return NT(t,e),te.DatabaseQueryError({query:t})}function Rt(t,e){return NT(t,e),te.UnknownError({message:t})}var lc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}generateChallengeId(){return ht()}async get(e){try{let r=await this.docClient.send(new Y0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()}}));if(!r.Item)return T(null);let n=this.unmarshall(r.Item);return $m(re(n.expiresAt))?T(null):T(n)}catch(r){return d(G("get challenge",r))}}async create(e){try{let r=ae(),n=e.id||this.generateChallengeId(),i={...e,id:n,createdAt:J(r)},o=re(e.expiresAt),s=Math.floor((o+this.ttlGracePeriod)/1e3);return await this.docClient.send(new X0({TableName:this.tableName,Item:this.marshall(i,s)})),T(i)}catch(r){return d(G("create challenge",r))}}async update(e,r){try{let n=[],i={},o={};return r.method!==void 0&&(n.push("#method = :method"),i["#method"]=h.METHOD,o[":method"]=r.method),r.phase!==void 0&&(n.push("#phase = :phase"),i["#phase"]=h.PHASE,o[":phase"]=r.phase),r.codeHash!==void 0&&(n.push("#codeHash = :codeHash"),i["#codeHash"]=h.CODE_HASH,o[":codeHash"]=r.codeHash),r.status!==void 0&&(n.push("#challengeStatus = :challengeStatus"),i["#challengeStatus"]=h.CHALLENGE_STATUS,o[":challengeStatus"]=r.status),n.length===0?T(void 0):(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T(void 0))}catch(n){return d(G("update challenge",n))}}async incrementAttempts(e,r){let n={":zero":0,":inc":1},i;r!==void 0&&(i="attribute_not_exists(#attempts) OR #attempts < :max",n[":max"]=r);try{let s=(await this.docClient.send(new RT({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},UpdateExpression:"SET #attempts = if_not_exists(#attempts, :zero) + :inc",...i?{ConditionExpression:i}:{},ExpressionAttributeNames:{"#attempts":h.ATTEMPTS},ExpressionAttributeValues:n,ReturnValues:"UPDATED_NEW"}))).Attributes?.[h.ATTEMPTS]??0;return T(s)}catch(o){return Ce(o)?d(te.AttemptsExceeded()):d(G("increment challenge attempts",o))}}async remove(e){try{return await this.docClient.send(new J0({TableName:this.tableName,Key:{[h.PK]:U.CHALLENGE_PK(e),[h.SK]:U.CHALLENGE_SK()},ConditionExpression:"attribute_exists(#pk)",ExpressionAttributeNames:{"#pk":h.PK}})),T(void 0)}catch(r){return Ce(r)?T(void 0):d(G("remove challenge",r))}}marshall(e,r){let n={[h.PK]:U.CHALLENGE_PK(e.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:e.userId,[h.PURPOSE]:e.purpose,[h.CHALLENGE_STATUS]:e.status,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.TTL]:r};return e.tenantId&&(n[h.TENANT_ID]=e.tenantId),e.phase&&(n[h.PHASE]=e.phase),e.allowedMethods&&e.allowedMethods.length>0&&(n[h.ALLOWED_METHODS]=e.allowedMethods),e.method&&(n[h.METHOD]=e.method),e.codeHash&&(n[h.CODE_HASH]=e.codeHash),e.attempts!==void 0&&(n[h.ATTEMPTS]=e.attempts),e.maxAttempts!==void 0&&(n[h.MAX_ATTEMPTS]=e.maxAttempts),e.identityType&&(n[h.IDENTITY_TYPE]=e.identityType),e.identityValue&&(n[h.IDENTITY_VALUE]=e.identityValue),e.deviceLabel&&(n[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(n[h.COUNTRY]=e.country),e.city&&(n[h.CITY]=e.city),e.metadata&&(n[h.METADATA]=e.metadata),e.flowKey&&(n[h.FLOW_KEY]=e.flowKey),n}unmarshall(e){let n={id:le.challengeIdFromPK(e[h.PK]),userId:e[h.USER_ID],purpose:e[h.PURPOSE],status:e[h.CHALLENGE_STATUS],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT])};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.PHASE]&&(n.phase=e[h.PHASE]),e[h.ALLOWED_METHODS]&&(n.allowedMethods=e[h.ALLOWED_METHODS]),e[h.METHOD]&&(n.method=e[h.METHOD]),e[h.CODE_HASH]&&(n.codeHash=e[h.CODE_HASH]),e[h.ATTEMPTS]!==void 0&&(n.attempts=e[h.ATTEMPTS]),e[h.MAX_ATTEMPTS]!==void 0&&(n.maxAttempts=e[h.MAX_ATTEMPTS]),e[h.IDENTITY_TYPE]&&(n.identityType=e[h.IDENTITY_TYPE]),e[h.IDENTITY_VALUE]&&(n.identityValue=e[h.IDENTITY_VALUE]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.FLOW_KEY]&&(n.flowKey=e[h.FLOW_KEY]),n}};import{BatchGetCommand as Q0,DeleteCommand as Z0,GetCommand as eO,PutCommand as tO,QueryCommand as gd,UpdateCommand as rO}from"@aws-sdk/lib-dynamodb";var uc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateCredentialId(){return ht()}async get(e){try{let r=await this.docClient.send(new eO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get credential",r))}}async getByUserIdAndType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Limit:1}));if(!n.Items||n.Items.length===0)return T(null);let i=n.Items[0];if(!i)return T(null);let o=le.credentialId(i[h.PK]);return this.get(o)}catch(n){return d(G("get credential by user and type",n))}}async getByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)}}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(s=>le.credentialId(s[h.PK])),i=await this.batchGet(n);if(i.ok===!1)return d(i.errors,i.meta);if(!i.data)return T([]);let o=i.data.filter(s=>s!==null);return T(o)}catch(r){return d(G("get credentials by user",r))}}async create(e){try{let r=ae(),n=this.generateCredentialId(),i={revokedAt:null,lastUsedAt:null,...e,id:n,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new tO({TableName:this.tableName,Item:this.marshall(i),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(i)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"credential"})):d(G("create credential",r))}}async update(e,r){try{let n=ae(),i=[],o={},s={};return i.push(`#${h.UPDATED_AT} = :updatedAt`),o[`#${h.UPDATED_AT}`]=h.UPDATED_AT,s[":updatedAt"]=n,r.value!==void 0&&(i.push(`#${h.CREDENTIAL_VALUE} = :value`),o[`#${h.CREDENTIAL_VALUE}`]=h.CREDENTIAL_VALUE,s[":value"]=r.value),r.data!==void 0&&(i.push(`#${h.METADATA} = :data`),o[`#${h.METADATA}`]=h.METADATA,s[":data"]=r.data),r.revokedAt!==void 0&&(i.push(`#${h.REVOKED_AT} = :revokedAt`),o[`#${h.REVOKED_AT}`]=h.REVOKED_AT,s[":revokedAt"]=r.revokedAt?re(r.revokedAt):null),r.lastUsedAt!==void 0&&(i.push(`#${h.LAST_USED_AT} = :lastUsedAt`),o[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,s[":lastUsedAt"]=r.lastUsedAt?re(r.lastUsedAt):null),await this.docClient.send(new rO({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},UpdateExpression:`SET ${i.join(", ")}`,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"credential",id:e})):d(G("update credential",n))}}async remove(e){try{return await this.docClient.send(new Z0({TableName:this.tableName,Key:{[h.PK]:U.CREDENTIAL_PK(e),[h.SK]:U.CREDENTIAL_SK()},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(r){return Ce(r)?d(te.NotFound({entity:"credential",id:e})):d(G("delete credential",r))}}async hasType(e,r){try{let n=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk AND begins_with(${h.CREDENTIAL_USER_SK}, :typePrefix)`,ExpressionAttributeValues:{":userPk":U.USER_PK(e),":typePrefix":U.CREDENTIAL_TYPE_PREFIX(r)},Select:"COUNT",Limit:1}));return T((n.Count||0)>0)}catch(n){return d(G("check credential type",n))}}async countByUserId(e){try{let r=await this.docClient.send(new gd({TableName:this.tableName,IndexName:ue.USER_CREDENTIALS,KeyConditionExpression:`${h.CREDENTIAL_USER_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count credentials",r))}}async batchGet(e){if(e.length===0)return T([]);try{let r=[];for(let i=0;i<e.length;i+=100)r.push(e.slice(i,i+100));let n=[];for(let i of r){let s=(await this.docClient.send(new Q0({RequestItems:{[this.tableName]:{Keys:i.map(c=>({[h.PK]:U.CREDENTIAL_PK(c),[h.SK]:U.CREDENTIAL_SK()}))}}}))).Responses?.[this.tableName]||[],a=new Map;for(let c of s){let l=this.unmarshall(c);a.set(l.id,l)}for(let c of i)n.push(a.get(c)||null)}return T(n)}catch(r){return d(G("batch get credentials",r))}}marshall(e){let r={[h.PK]:U.CREDENTIAL_PK(e.id),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(e.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(e.type,e.id),[h.USER_ID]:e.userId,[h.CREDENTIAL_VALUE]:e.value,[h.METADATA]:e.data,[h.REVOKED_AT]:e.revokedAt?re(e.revokedAt):null,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)};return e.lastUsedAt&&(r[h.LAST_USED_AT]=re(e.lastUsedAt)),r}unmarshall(e){let r=le.credentialId(e[h.PK]),n=le.credentialTypeFromUserSK(e[h.CREDENTIAL_USER_SK]);return{id:r,userId:e[h.USER_ID],type:n,value:e[h.CREDENTIAL_VALUE],data:e[h.METADATA]||{},revokedAt:Kt(e[h.REVOKED_AT]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT]),lastUsedAt:Kt(e[h.LAST_USED_AT])}}};import{BatchGetCommand as nO,DeleteCommand as iO,GetCommand as oO,PutCommand as sO,QueryCommand as aO,UpdateCommand as eh}from"@aws-sdk/lib-dynamodb";function th(t){return{failedAttempts:t.failedAttempts,lastFailedAt:Cr(t.lastFailedAt),lockedUntil:Cr(t.lockedUntil)}}function OT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))e[r]={failedAttempts:n.failedAttempts??0,lastFailedAt:Kt(n.lastFailedAt),lockedUntil:Kt(n.lockedUntil)};return e}function kT(t){if(!t)return{};let e={};for(let[r,n]of Object.entries(t))n&&(e[r]=th(n));return e}var dc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e,r){try{let n=await this.docClient.send(new oO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}}));if(!n.Item)return T(null);let i=this.unmarshall(n.Item);return T(i)}catch(n){return d(G("get identity",n))}}async getByUserId(e){try{let r=await this.docClient.send(new aO({TableName:this.tableName,IndexName:ue.USER_IDENTITIES,KeyConditionExpression:`${h.IDENTITY_USER_PK} = :pk`,ExpressionAttributeValues:{":pk":U.USER_INDEX_PK(e)}})),n=[];for(let i of r.Items||[]){let o=this.unmarshall(i);o!==null&&n.push(o)}return T(n)}catch(r){return d(G("get identities by userId",r))}}async create(e){try{let r=ae(),n={...e,createdAt:J(r),updatedAt:J(r)};return await this.docClient.send(new sO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:"attribute_not_exists(PK)"})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"identity"})):d(G("create identity",r))}}async update(e,r,n){try{let i=[],o=[],s={},a={};if(n.loginEnabled!==void 0&&(i.push("#loginEnabled = :loginEnabled"),s["#loginEnabled"]=h.LOGIN_ENABLED,a[":loginEnabled"]=n.loginEnabled),n.verifiedAt!==void 0){let l=Cr(n.verifiedAt);l===null?(o.push("#verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT):(i.push("#verifiedAt = :verifiedAt"),s["#verifiedAt"]=h.VERIFIED_AT,a[":verifiedAt"]=l)}n.guards!==void 0&&(i.push("#guards = :guards"),s["#guards"]=h.GUARDS,a[":guards"]=kT(n.guards)),n.pendingVerification!==void 0&&(s["#pendingVerification"]=h.PENDING_VERIFICATION,n.pendingVerification===null?o.push("#pendingVerification"):(i.push("#pendingVerification = :pendingVerification"),a[":pendingVerification"]=Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)}))),i.push("#updatedAt = :updatedAt"),s["#updatedAt"]=h.UPDATED_AT,a[":updatedAt"]=ae();let c=[];return i.length>0&&c.push(`SET ${i.join(", ")}`),o.length>0&&c.push(`REMOVE ${o.join(", ")}`),await this.docClient.send(new eh({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()},UpdateExpression:c.join(" "),ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update identity",i))}}async remove(e,r){try{return await this.docClient.send(new iO({TableName:this.tableName,Key:{[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()}})),T(void 0)}catch(n){return d(G("remove identity",n))}}async updateGuard(e,r,n,i){let o={[h.PK]:U.IDENTITY_PK(e,r),[h.SK]:U.IDENTITY_SK()};try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards.#guardKey = :guard, #updatedAt = :updatedAt",ConditionExpression:"attribute_exists(#guards)",ExpressionAttributeNames:{"#guards":h.GUARDS,"#guardKey":n,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guard":th(i),":updatedAt":ae()}})),T(void 0)}catch(s){if(Ce(s))try{return await this.docClient.send(new eh({TableName:this.tableName,Key:o,UpdateExpression:"SET #guards = :guards, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#guards":h.GUARDS,"#updatedAt":h.UPDATED_AT},ExpressionAttributeValues:{":guards":{[n]:th(i)},":updatedAt":ae()}})),T(void 0)}catch(a){return d(G("update guard",a))}return d(G("update guard",s))}}async batchGet(e){try{if(e.length===0)return T([]);let n=(await this.docClient.send(new nO({RequestItems:{[this.tableName]:{Keys:e.map(({type:s,value:a})=>({[h.PK]:U.IDENTITY_PK(s,a),[h.SK]:U.IDENTITY_SK()}))}}}))).Responses?.[this.tableName]||[],i=new Map;for(let s of n){let a=this.unmarshall(s);if(a!==null){let c=`${a.type}#${a.value}`;i.set(c,a)}}let o=e.map(({type:s,value:a})=>{let c=`${s}#${a}`;return i.get(c)||null});return T(o)}catch(r){return d(G("batch get identities",r))}}marshall(e){let r={[h.PK]:U.IDENTITY_PK(e.type,e.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(e.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(e.type,e.value),[h.USER_ID]:e.userId,[h.LOGIN_ENABLED]:e.loginEnabled,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)},n=Cr(e.verifiedAt);return n!==null&&(r[h.VERIFIED_AT]=n),r[h.GUARDS]=kT(e.guards),e.pendingVerification&&(r[h.PENDING_VERIFICATION]=Ht({...e.pendingVerification,expiresAt:re(e.pendingVerification.expiresAt),resendAvailableAt:Cr(e.pendingVerification.resendAvailableAt)})),r}unmarshall(e){let r=le.identityPKInfo(e[h.PK]);if(!r){let n=e[h.IDENTITY_USER_SK]?le.userIndexSKInfo(e[h.IDENTITY_USER_SK]):null;return n?{type:n.type,value:n.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}:(console.warn("Invalid identity item format, skipping:",{PK:e[h.PK],GSI1SK:e[h.IDENTITY_USER_SK]}),null)}return{type:r.type,value:r.value,userId:e[h.USER_ID],loginEnabled:e[h.LOGIN_ENABLED],verifiedAt:Kt(e[h.VERIFIED_AT]),guards:OT(e[h.GUARDS]),pendingVerification:this.unmarshallPendingVerification(e[h.PENDING_VERIFICATION]),createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}unmarshallPendingVerification(e){if(!e||typeof e!="object")return null;let r=e;return{challengeId:r.challengeId,purpose:r.purpose,channel:r.channel,expiresAt:J(r.expiresAt),resendAvailableAt:Kt(r.resendAvailableAt)}}};import{TransactWriteCommand as cO}from"@aws-sdk/lib-dynamodb";var pc=class{docClient;tableName;ttlGracePeriod;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||3600*1e3}async createEmailVerificationRegistration(e){try{let r=ae(),n=ht(),i=re(e.challenge.expiresAt),o=Math.floor((i+this.ttlGracePeriod)/1e3);return await this.docClient.send(new cO({TransactItems:[this.putItem(this.marshallProfile(e,r)),this.putItem(this.marshallUserAuth(e,r)),this.putItem(this.marshallIdentity(e,r)),this.putItem(this.marshallCredential(e,n,r)),this.putItem(this.marshallChallenge(e,r,o))]})),T(void 0)}catch(r){return Is(r)==="TransactionCanceledException"||Ce(r)?d(te.UniqueConstraintViolation({field:"registration"})):d(G("create email verification registration transaction",r))}}putItem(e){return{Put:{TableName:this.tableName,Item:Ht(e),ConditionExpression:`attribute_not_exists(${h.PK})`}}}marshallProfile(e,r){let n=e.profile.status,i={[h.PK]:U.USER_PK(e.profile.id),[h.SK]:U.USER_PROFILE_SK(),userStatus:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.USER_STATUS_PK]:Ae.USER_STATUS_PK(n),[h.USER_STATUS_SK]:Ae.USER_STATUS_SK(e.profile.id)};return e.profile.contactEmail&&(i.contactEmail=e.profile.contactEmail),e.profile.contactPhone&&(i.contactPhone=e.profile.contactPhone),e.profile.username&&(i.username=e.profile.username),e.profile.displayName&&(i.displayName=e.profile.displayName),e.profile.givenName&&(i.givenName=e.profile.givenName),e.profile.familyName&&(i.familyName=e.profile.familyName),e.profile.avatarUrl&&(i.avatarUrl=e.profile.avatarUrl),e.profile.locale&&(i.locale=e.profile.locale),e.profile.metadata&&(i.metadata=JSON.stringify(e.profile.metadata)),i}marshallUserAuth(e,r){return{[h.PK]:U.USER_PK(e.userAuth.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userAuth.userStatus,mfaRequired:e.userAuth.mfaRequired,mfaMethods:e.userAuth.mfaMethods,[h.CREATED_AT]:r,[h.UPDATED_AT]:r}}marshallIdentity(e,r){let n=e.identity,i={[h.PK]:U.IDENTITY_PK(n.type,n.value),[h.SK]:U.IDENTITY_SK(),[h.IDENTITY_USER_PK]:U.USER_INDEX_PK(n.userId),[h.IDENTITY_USER_SK]:U.USER_INDEX_SK(n.type,n.value),[h.USER_ID]:n.userId,[h.LOGIN_ENABLED]:n.loginEnabled,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.PENDING_VERIFICATION]:Ht({...n.pendingVerification,expiresAt:re(n.pendingVerification.expiresAt),resendAvailableAt:Cr(n.pendingVerification.resendAvailableAt)})},o=Cr(n.verifiedAt);return o!==null&&(i[h.VERIFIED_AT]=o),i[h.GUARDS]=n.guards??{},i}marshallCredential(e,r,n){let i=e.credential,o={[h.PK]:U.CREDENTIAL_PK(r),[h.SK]:U.CREDENTIAL_SK(),[h.CREDENTIAL_USER_PK]:U.USER_PK(i.userId),[h.CREDENTIAL_USER_SK]:U.CREDENTIAL_USER_SK(i.type,r),[h.USER_ID]:i.userId,[h.CREDENTIAL_VALUE]:i.value,[h.METADATA]:i.data,[h.REVOKED_AT]:i.revokedAt?re(i.revokedAt):null,[h.CREATED_AT]:n,[h.UPDATED_AT]:n};return i.lastUsedAt&&(o[h.LAST_USED_AT]=re(i.lastUsedAt)),o}marshallChallenge(e,r,n){let i=e.challenge,o={[h.PK]:U.CHALLENGE_PK(i.id),[h.SK]:U.CHALLENGE_SK(),[h.USER_ID]:i.userId,[h.PURPOSE]:i.purpose,[h.CHALLENGE_STATUS]:i.status,[h.EXPIRES_AT]:re(i.expiresAt),[h.CREATED_AT]:r,[h.TTL]:n};return i.tenantId&&(o[h.TENANT_ID]=i.tenantId),i.phase&&(o[h.PHASE]=i.phase),i.allowedMethods&&i.allowedMethods.length>0&&(o[h.ALLOWED_METHODS]=i.allowedMethods),i.method&&(o[h.METHOD]=i.method),i.codeHash&&(o[h.CODE_HASH]=i.codeHash),i.attempts!==void 0&&(o[h.ATTEMPTS]=i.attempts),i.maxAttempts!==void 0&&(o[h.MAX_ATTEMPTS]=i.maxAttempts),i.identityType&&(o[h.IDENTITY_TYPE]=i.identityType),i.identityValue&&(o[h.IDENTITY_VALUE]=i.identityValue),i.deviceLabel&&(o[h.DEVICE_LABEL]=i.deviceLabel),i.country&&(o[h.COUNTRY]=i.country),i.city&&(o[h.CITY]=i.city),i.metadata&&(o[h.METADATA]=i.metadata),i.flowKey&&(o[h.FLOW_KEY]=i.flowKey),o}};import{DynamoDBClient as dO}from"@aws-sdk/client-dynamodb";import{DynamoDBDocumentClient as pO,GetCommand as DT,PutCommand as fO,QueryCommand as fc,UpdateCommand as bs}from"@aws-sdk/lib-dynamodb";import{BatchGetCommand as lO}from"@aws-sdk/lib-dynamodb";var CT=100,PT=5;function uO(t){return new Promise(e=>setTimeout(e,t))}async function xs(t,e,r){if(r.length===0)return[];let n=[];for(let i=0;i<r.length;i+=CT){let o=r.slice(i,i+CT),s=0;for(;o.length>0;){let a=await t.send(new lO({RequestItems:{[e]:{Keys:o}}})),c=a.Responses?.[e];c&&n.push(...c);let l=a.UnprocessedKeys?.[e]?.Keys;if(!l||l.length===0)break;if(s+=1,s>PT)throw new Error(`BatchGet left ${l.length} unprocessed keys after ${PT} retries`);o=l,await uO(2**s*25)}}return n}var mc=class{docClient;tableName;ttlGracePeriod;constructor(e){let r=e.client||new dO({});this.docClient=e.docClient||pO.from(r),this.tableName=e.tableName,this.ttlGracePeriod=e.ttlGracePeriod||10080*60*1e3}generateSessionId(){return ht()}generateTokenId(){return ht()}async get(e){try{let r=await this.docClient.send(new DT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()}}));return r.Item?T(this.unmarshall(r.Item)):T(null)}catch(r){return d(G("get session",r))}}async create(e){try{let r=ae(),n=e.id||this.generateSessionId(),i=e.tokenId||this.generateTokenId(),o={...e,id:n,tokenId:i,revokedAt:null,createdAt:new Date(r),lastUsedAt:new Date(r)},s=sc(re(e.expiresAt)+this.ttlGracePeriod),a=hd.sessionSK(r,n);return await this.docClient.send(new fO({TableName:this.tableName,Item:this.marshall(o,s,a)})),T(o)}catch(r){return d(G("create session",r))}}async update(e,r){try{let n=[],i={},o={};if(r.tokenId!==void 0&&(n.push(`#${h.TOKEN_ID} = :tokenId`),i[`#${h.TOKEN_ID}`]=h.TOKEN_ID,o[":tokenId"]=r.tokenId),r.expiresAt!==void 0){n.push(`#${h.EXPIRES_AT} = :expiresAt`),i[`#${h.EXPIRES_AT}`]=h.EXPIRES_AT,o[":expiresAt"]=re(r.expiresAt);let s=sc(re(r.expiresAt)+this.ttlGracePeriod);n.push(`#${h.TTL} = :ttl`),i[`#${h.TTL}`]=h.TTL,o[":ttl"]=s}return r.lastUsedAt!==void 0&&(n.push(`#${h.LAST_USED_AT} = :lastUsedAt`),i[`#${h.LAST_USED_AT}`]=h.LAST_USED_AT,o[":lastUsedAt"]=re(r.lastUsedAt)),r.metadata!==void 0&&(n.push(`#${h.METADATA} = :metadata`),i[`#${h.METADATA}`]=h.METADATA,o[":metadata"]=r.metadata),r.previousTokenId!==void 0&&(n.push(`#${h.PREVIOUS_TOKEN_ID} = :previousTokenId`),i[`#${h.PREVIOUS_TOKEN_ID}`]=h.PREVIOUS_TOKEN_ID,o[":previousTokenId"]=r.previousTokenId),r.rotatedAt!==void 0&&(n.push(`#${h.ROTATED_AT} = :rotatedAt`),i[`#${h.ROTATED_AT}`]=h.ROTATED_AT,o[":rotatedAt"]=r.rotatedAt),n.length===0?T():(await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET ${n.join(", ")}`,ExpressionAttributeNames:i,ExpressionAttributeValues:o})),T())}catch(n){return d(G("update session",n))}}async rotateToken(e,r,n){try{let i=sc(re(n.expiresAt)+this.ttlGracePeriod);return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.TOKEN_ID} = :tokenId, #${h.PREVIOUS_TOKEN_ID} = :previousTokenId, #${h.ROTATED_AT} = :rotatedAt, #${h.EXPIRES_AT} = :expiresAt, #${h.LAST_USED_AT} = :lastUsedAt, #${h.TTL} = :ttl`,ConditionExpression:`#${h.TOKEN_ID} = :expectedCurrentTokenId`,ExpressionAttributeNames:{[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.PREVIOUS_TOKEN_ID}`]:h.PREVIOUS_TOKEN_ID,[`#${h.ROTATED_AT}`]:h.ROTATED_AT,[`#${h.EXPIRES_AT}`]:h.EXPIRES_AT,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT,[`#${h.TTL}`]:h.TTL},ExpressionAttributeValues:{":tokenId":n.tokenId,":previousTokenId":n.previousTokenId,":rotatedAt":n.rotatedAt,":expiresAt":re(n.expiresAt),":lastUsedAt":re(n.lastUsedAt),":ttl":i,":expectedCurrentTokenId":r}})),T(!0)}catch(i){return Ce(i)?T(!1):d(G("rotate session token",i))}}async switchTenant(e,r){try{let n=[`#${h.TENANT_ID} = :tenantId`,`#${h.TOKEN_ID} = :tokenId`,`#${h.LAST_USED_AT} = :lastUsedAt`],i=[],o={[`#${h.TENANT_ID}`]:h.TENANT_ID,[`#${h.TOKEN_ID}`]:h.TOKEN_ID,[`#${h.LAST_USED_AT}`]:h.LAST_USED_AT},s={":tenantId":r.tenantId,":tokenId":r.tokenId,":lastUsedAt":ae()};o[`#${h.TENANT_TYPE}`]=h.TENANT_TYPE,r.tenantType!==void 0?(n.push(`#${h.TENANT_TYPE} = :tenantType`),s[":tenantType"]=r.tenantType):i.push(`#${h.TENANT_TYPE}`),o[`#${h.PERM}`]=h.PERM,r.perms!==void 0?(n.push(`#${h.PERM} = :perms`),s[":perms"]=JSON.stringify(r.perms)):i.push(`#${h.PERM}`),o[`#${h.ROLES}`]=h.ROLES,r.roles!==void 0?(n.push(`#${h.ROLES} = :roles`),s[":roles"]=r.roles):i.push(`#${h.ROLES}`),o["#revokedAt"]=h.REVOKED_AT;let a=`SET ${n.join(", ")}${i.length>0?` REMOVE ${i.join(", ")}`:""}`;return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:a,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:`attribute_exists(${h.PK}) AND attribute_not_exists(#revokedAt)`})),T()}catch(n){return Ce(n)?d(te.DatabaseQueryError({query:"switch tenant - session not found or revoked"})):d(G("switch tenant",n))}}async revoke(e){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date)},ConditionExpression:`attribute_exists(${h.PK})`})),T()}catch(r){return Ce(r)?T():d(G("revoke session",r))}}async revokeByIdAndUserId(e,r){try{return await this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(e),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ConditionExpression:`#${h.USER_ID} = :userId AND attribute_not_exists(#${h.REVOKED_AT})`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.USER_ID}`]:h.USER_ID,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":re(new Date),":userId":r}})),T()}catch(n){return Ce(n)?T():d(G("revoke session by user",n))}}async findByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.USER_SESSIONS,KeyConditionExpression:`${h.USER_SESSION_PK} = :userPk`,ExpressionAttributeValues:{":userPk":U.USER_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find sessions by user",n))}}async findActiveByUserId(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Limit:n,ExclusiveStartKey:i,ScanIndexForward:!1}));if(!o.Items||o.Items.length===0){let m={type:"cursor",limit:n,count:0,hasNext:!1,hasPrev:!!r?.cursor,cursor:null};return T([],{pagination:m})}let a=o.Items.map(m=>le.sessionId(m[h.PK])).map(m=>({[h.PK]:U.SESSION_PK(m),[h.SK]:U.SESSION_SK()})),l=(await xs(this.docClient,this.tableName,a)).map(m=>this.unmarshall(m)),u=!!o.LastEvaluatedKey,p=u?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null,f={type:"cursor",limit:n,count:l.length,hasNext:u,hasPrev:!!r?.cursor,cursor:p};return T(l,{pagination:f})}catch(n){return d(G("find active sessions by user",n))}}async getActiveSessionsForLimit(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},ScanIndexForward:!0}));if(!r.Items||r.Items.length===0)return T([]);let n=r.Items.map(i=>{let o=le.sessionId(i[h.PK]),s=hd.extractCreatedAt(i[h.ACTIVE_SESSION_SK]);return{id:o,createdAt:new Date(s)}});return T(n)}catch(r){return d(G("get active sessions for limit",r))}}async revokeSessionsByIds(e,r){if(e.length===0)return 0;let n=re(new Date),i=await Promise.allSettled(e.map(s=>this.docClient.send(new bs({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(s),[h.SK]:U.SESSION_SK()},UpdateExpression:`SET #${h.REVOKED_AT} = :revokedAt REMOVE #${h.ACTIVE_SESSION_PK}, #${h.ACTIVE_SESSION_SK}`,ExpressionAttributeNames:{[`#${h.REVOKED_AT}`]:h.REVOKED_AT,[`#${h.ACTIVE_SESSION_PK}`]:h.ACTIVE_SESSION_PK,[`#${h.ACTIVE_SESSION_SK}`]:h.ACTIVE_SESSION_SK},ExpressionAttributeValues:{":revokedAt":n}})))),o=0;for(let s of i)s.status==="fulfilled"?o+=1:console.error(`[session-repo] ${r}: session revoke failed (may remain active):`,{name:Is(s.reason)});return o}async revokeAllByUserId(e,r){try{let n=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)}}));if(!n.Items||n.Items.length===0)return T(0);let i=n.Items.map(s=>le.sessionId(s[h.PK])).filter(s=>!r||s!==r),o=await this.revokeSessionsByIds(i,"revokeAllByUserId");return T(o)}catch(n){return d(G("revoke all sessions by user",n))}}async revokeBatch(e){try{let r=await this.revokeSessionsByIds(e,"revokeBatch");return T(r)}catch(r){return d(G("revoke batch sessions",r))}}async countByUserId(e){try{let r=await this.docClient.send(new fc({TableName:this.tableName,IndexName:ue.ACTIVE_SESSIONS,KeyConditionExpression:`${h.ACTIVE_SESSION_PK} = :activePk`,ExpressionAttributeValues:{":activePk":Ae.ACTIVE_SESSION_PK(e)},Select:"COUNT"}));return T(r.Count||0)}catch(r){return d(G("count active sessions by user",r))}}async isTokenActive(e,r){try{let n=await this.docClient.send(new DT({TableName:this.tableName,Key:{[h.PK]:U.SESSION_PK(r),[h.SK]:U.SESSION_SK()},ProjectionExpression:`${h.TOKEN_ID}, ${h.REVOKED_AT}, ${h.EXPIRES_AT}`}));if(!n.Item)return T(!1);let i=n.Item,o=i[h.TOKEN_ID]===e&&!i[h.REVOKED_AT]&&J(i[h.EXPIRES_AT])>new Date;return T(o)}catch(n){return d(G("check token active",n))}}marshall(e,r,n){let i={[h.PK]:U.SESSION_PK(e.id),[h.SK]:U.SESSION_SK(),[h.USER_SESSION_PK]:U.USER_PK(e.userId),[h.USER_SESSION_SK]:n,...!e.revokedAt&&{[h.ACTIVE_SESSION_PK]:Ae.ACTIVE_SESSION_PK(e.userId),[h.ACTIVE_SESSION_SK]:n},[h.USER_ID]:e.userId,[h.TOKEN_ID]:e.tokenId,[h.EXPIRES_AT]:re(e.expiresAt),[h.CREATED_AT]:re(e.createdAt),[h.LAST_USED_AT]:re(e.lastUsedAt),[h.TTL]:r};return e.tenantId&&(i[h.TENANT_ID]=e.tenantId),e.tenantType&&(i[h.TENANT_TYPE]=e.tenantType),e.perms!==void 0&&(i[h.PERM]=JSON.stringify(e.perms)),e.roles!==void 0&&(i[h.ROLES]=e.roles),e.deviceLabel&&(i[h.DEVICE_LABEL]=e.deviceLabel),e.country&&(i[h.COUNTRY]=e.country),e.city&&(i[h.CITY]=e.city),e.metadata&&(i[h.METADATA]=e.metadata),e.revokedAt&&(i[h.REVOKED_AT]=re(e.revokedAt)),e.previousTokenId&&(i[h.PREVIOUS_TOKEN_ID]=e.previousTokenId),e.rotatedAt!==void 0&&(i[h.ROTATED_AT]=e.rotatedAt),i}unmarshall(e){let n={id:le.sessionId(e[h.PK]),userId:e[h.USER_ID],tokenId:e[h.TOKEN_ID],expiresAt:J(e[h.EXPIRES_AT]),createdAt:J(e[h.CREATED_AT]),lastUsedAt:J(e[h.LAST_USED_AT]),revokedAt:e[h.REVOKED_AT]?J(e[h.REVOKED_AT]):null};return e[h.TENANT_ID]&&(n.tenantId=e[h.TENANT_ID]),e[h.TENANT_TYPE]&&(n.tenantType=e[h.TENANT_TYPE]),e[h.PERM]!==void 0&&(n.perms=JSON.parse(e[h.PERM])),e[h.ROLES]!==void 0&&(n.roles=e[h.ROLES]),e[h.DEVICE_LABEL]&&(n.deviceLabel=e[h.DEVICE_LABEL]),e[h.COUNTRY]&&(n.country=e[h.COUNTRY]),e[h.CITY]&&(n.city=e[h.CITY]),e[h.METADATA]&&(n.metadata=e[h.METADATA]),e[h.PREVIOUS_TOKEN_ID]&&(n.previousTokenId=e[h.PREVIOUS_TOKEN_ID]),e[h.ROTATED_AT]!==void 0&&(n.rotatedAt=e[h.ROTATED_AT]),n}};import{QueryCommand as mO}from"@aws-sdk/lib-dynamodb";var hc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new mO(s)),c=(a.Items||[]).map(p=>this.toListItem(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e){let r=le.inviteId(e.PK),n={id:e.invitedById};e.invitedByInfo&&(e.invitedByInfo.name&&(n.name=e.invitedByInfo.name),e.invitedByInfo.email&&(n.email=e.invitedByInfo.email),e.invitedByInfo.jobTitle&&(n.jobTitle=e.invitedByInfo.jobTitle));let i={id:r,tenantId:e.tenantId,invitedBy:n,status:e.inviteStatus,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.inviteeUserId&&(i.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(i.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(i.inviteePhone=e.inviteePhone),e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),e.displayName&&(i.displayName=e.displayName),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.jobTitle&&(i.jobTitle=e.jobTitle),e.acceptedAt&&(i.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(i.declinedAt=J(e.declinedAt)),e.revokedAt&&(i.revokedAt=J(e.revokedAt)),i}};import{GetCommand as UT,PutCommand as hO,QueryCommand as fi,UpdateCommand as EO}from"@aws-sdk/lib-dynamodb";var yO=10080*60*1e3,Ec=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}mapItemToEntity(e){let n={id:le.inviteId(e.PK),tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.inviteStatus,inviteToken:e.inviteToken,expiresAt:J(e.expiresAt),createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.inviteeUserId&&(n.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(n.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(n.inviteePhone=e.inviteePhone),e.roles!==void 0&&(n.roles=e.roles);let i=e[h.PERM];return i!==void 0&&(n.perms=JSON.parse(i)),e.authPerm!==void 0&&(n.authPerm=e.authPerm),e.displayName&&(n.displayName=e.displayName),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.jobTitle&&(n.jobTitle=e.jobTitle),e.acceptedAt&&(n.acceptedAt=J(e.acceptedAt)),e.declinedAt&&(n.declinedAt=J(e.declinedAt)),e.revokedAt&&(n.revokedAt=J(e.revokedAt)),n}generateInviteId(){return ht()}async getById(e){try{let r=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()}}));return r.Item?T(this.mapItemToEntity(r.Item)):T(null)}catch(r){return d(G("getById invite",r))}}async getByToken(e){try{let n=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITE_TOKEN,KeyConditionExpression:"#inviteTokenGsi = :token",ExpressionAttributeNames:{"#inviteTokenGsi":h.INVITE_TOKEN_GSI},ExpressionAttributeValues:{":token":e},Limit:1}))).Items;if(!n||n.length===0)return T(null);let i=n[0],o=await this.docClient.send(new UT({TableName:this.tableName,Key:{PK:i.PK,SK:i.SK}}));return o.Item?T(this.mapItemToEntity(o.Item)):T(null)}catch(r){return d(G("getByToken invite",r))}}async create(e){try{let r=ae(),n=re(e.expiresAt),i=Math.floor((n+yO)/1e3),o={PK:U.INVITE_PK(e.id),SK:U.INVITE_SK(),[h.TENANT_ID]:e.tenantId,tenantType:e.tenantType,[h.INVITED_BY_ID]:e.invitedById,[h.INVITE_STATUS]:e.status,[h.INVITE_TOKEN]:e.inviteToken,[h.EXPIRES_AT]:n,[h.CREATED_AT]:r,[h.UPDATED_AT]:r,[h.TTL]:i,[h.INVITE_TENANT_PK]:Ae.INVITE_TENANT_PK(e.tenantId),[h.INVITE_TENANT_SK]:Ae.INVITE_TENANT_SK(e.status,r,e.id),[h.INVITE_TOKEN_GSI]:e.inviteToken},s={};e.invitedByName&&(s.name=e.invitedByName),e.invitedByEmail&&(s.email=e.invitedByEmail),e.invitedByJobTitle&&(s.jobTitle=e.invitedByJobTitle),Object.keys(s).length>0&&(o[h.INVITED_BY_INFO]=s),e.inviteeUserId&&(o[h.INVITEE_USER_ID]=e.inviteeUserId),e.inviteeEmail&&(o[h.INVITEE_EMAIL]=e.inviteeEmail,o[h.INVITEE_EMAIL_GSI]=e.inviteeEmail,o[h.INVITEE_EMAIL_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.inviteePhone&&(o[h.INVITEE_PHONE]=e.inviteePhone,o[h.INVITEE_PHONE_GSI]=e.inviteePhone,o[h.INVITEE_PHONE_TENANT_SK]=`${ce.TENANT}${e.tenantId}`),e.roles!==void 0&&(o[h.ROLES]=e.roles),e.perms!==void 0&&(o[h.PERM]=JSON.stringify(e.perms)),e.authPerm!==void 0&&(o[h.AUTH_PERM]=e.authPerm),e.displayName&&(o[h.DISPLAY_NAME]=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.jobTitle&&(o.jobTitle=e.jobTitle),await this.docClient.send(new hO({TableName:this.tableName,Item:o,ConditionExpression:"attribute_not_exists(PK)"}));let a={id:e.id,tenantId:e.tenantId,invitedById:e.invitedById,tenantType:e.tenantType,status:e.status,inviteToken:e.inviteToken,expiresAt:e.expiresAt,createdAt:J(r),updatedAt:J(r)};return e.inviteeUserId&&(a.inviteeUserId=e.inviteeUserId),e.inviteeEmail&&(a.inviteeEmail=e.inviteeEmail),e.inviteePhone&&(a.inviteePhone=e.inviteePhone),e.roles!==void 0&&(a.roles=e.roles),e.perms!==void 0&&(a.perms=e.perms),e.authPerm!==void 0&&(a.authPerm=e.authPerm),e.displayName&&(a.displayName=e.displayName),e.givenName&&(a.givenName=e.givenName),e.familyName&&(a.familyName=e.familyName),e.jobTitle&&(a.jobTitle=e.jobTitle),T(a)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"invite id"})):d(Rt("create invite",r))}}async updateStatus(e,r){try{let n=ae(),i=["#inviteStatus = :inviteStatus","#inviteTenantSk = :inviteTenantSk","#updatedAt = :updatedAt"],o={"#inviteStatus":h.INVITE_STATUS,"#inviteTenantSk":h.INVITE_TENANT_SK,"#updatedAt":h.UPDATED_AT},s={":inviteStatus":r.status,":inviteTenantSk":Ae.INVITE_TENANT_SK(r.status,n,e),":updatedAt":n};r.acceptedAt&&(i.push("#acceptedAt = :acceptedAt"),o["#acceptedAt"]=h.ACCEPTED_AT,s[":acceptedAt"]=re(r.acceptedAt)),r.declinedAt&&(i.push("#declinedAt = :declinedAt"),o["#declinedAt"]=h.DECLINED_AT,s[":declinedAt"]=re(r.declinedAt)),r.revokedAt&&(i.push("#revokedAt = :revokedAt"),o["#revokedAt"]=h.REVOKED_AT,s[":revokedAt"]=re(r.revokedAt));let a=[];r.status!=="pending"&&(a.push("#inviteTokenGsi","#inviteeEmailGsi","#inviteeEmailTenantSk","#inviteePhoneGsi","#inviteePhoneTenantSk"),o["#inviteTokenGsi"]=h.INVITE_TOKEN_GSI,o["#inviteeEmailGsi"]=h.INVITEE_EMAIL_GSI,o["#inviteeEmailTenantSk"]=h.INVITEE_EMAIL_TENANT_SK,o["#inviteePhoneGsi"]=h.INVITEE_PHONE_GSI,o["#inviteePhoneTenantSk"]=h.INVITEE_PHONE_TENANT_SK);let c=`SET ${i.join(", ")}`;return a.length>0&&(c+=` REMOVE ${a.join(", ")}`),await this.docClient.send(new EO({TableName:this.tableName,Key:{PK:U.INVITE_PK(e),SK:U.INVITE_SK()},UpdateExpression:c,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantInvite",id:e})):d(Rt("updateStatus invite",n))}}async findByTenantAndEmail(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email AND #inviteeEmailTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#inviteeEmailTenantSk":h.INVITEE_EMAIL_TENANT_SK},ExpressionAttributeValues:{":email":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndEmail",n))}}async findByTenantAndPhone(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone AND #inviteePhoneTenantSk = :tenantSk",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#inviteePhoneTenantSk":h.INVITEE_PHONE_TENANT_SK},ExpressionAttributeValues:{":phone":r,":tenantSk":`${ce.TENANT}${e}`},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndPhone",n))}}async findByTenantAndUserId(e,r){try{let i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",FilterExpression:"#inviteeUserId = :userId",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK,"#inviteeUserId":h.INVITEE_USER_ID},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending"),":userId":r},Limit:1}))).Items;return!i||i.length===0?T(null):T(this.mapItemToEntity(i[0]))}catch(n){return d(G("findByTenantAndUserId",n))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={"#pk":h.INVITE_TENANT_PK},o={":pk":Ae.INVITE_TENANT_PK(e)},s={TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:i,ExpressionAttributeValues:o,ScanIndexForward:!1,Limit:n};r?.cursor&&(s.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))),r?.status&&(s.KeyConditionExpression="#pk = :pk AND begins_with(#sk, :statusPrefix)",i["#sk"]=h.INVITE_TENANT_SK,o[":statusPrefix"]=Ae.INVITE_TENANT_STATUS_PREFIX(r.status));let a=await this.docClient.send(new fi(s)),c=(a.Items||[]).map(p=>this.mapItemToEntity(p)),l=!!a.LastEvaluatedKey,u=l?Buffer.from(JSON.stringify(a.LastEvaluatedKey)).toString("base64url"):null;return mr(c,{limit:n,hasNext:l,cursor:u,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async findPendingByEmail(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_EMAIL,KeyConditionExpression:"#inviteeEmailGsi = :email",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteeEmailGsi":h.INVITEE_EMAIL_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":email":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByEmail",r))}}async findPendingByPhone(e){try{let r=ae(),i=(await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.INVITEE_PHONE,KeyConditionExpression:"#inviteePhoneGsi = :phone",FilterExpression:"#expiresAt > :now",ProjectionExpression:"PK, SK",ExpressionAttributeNames:{"#inviteePhoneGsi":h.INVITEE_PHONE_GSI,"#expiresAt":h.EXPIRES_AT},ExpressionAttributeValues:{":phone":e,":now":r}}))).Items||[];if(i.length===0)return T([]);let o=i.map(c=>({PK:c.PK,SK:c.SK})),a=(await xs(this.docClient,this.tableName,o)).map(c=>this.mapItemToEntity(c));return T(a)}catch(r){return d(G("findPendingByPhone",r))}}async countPendingByTenant(e){try{let r=await this.docClient.send(new fi({TableName:this.tableName,IndexName:ue.TENANT_INVITES,KeyConditionExpression:"#pk = :pk AND begins_with(#sk, :pendingPrefix)",ExpressionAttributeNames:{"#pk":h.INVITE_TENANT_PK,"#sk":h.INVITE_TENANT_SK},ExpressionAttributeValues:{":pk":Ae.INVITE_TENANT_PK(e),":pendingPrefix":Ae.INVITE_TENANT_STATUS_PREFIX("pending")},Select:"COUNT"}));return T(r.Count??0)}catch(r){return d(G("countPendingByTenant",r))}}async expireOld(e){return T(0)}};import{QueryCommand as gO}from"@aws-sdk/lib-dynamodb";var yc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e)}};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let s=(await this.docClient.send(new gO(i))).Items||[],a=[],c=new Map;for(let m of s){let E=m.SK;if(E.startsWith(Be.TENANT_PROFILE)){let v=le.tenantProfileUserId(E);c.set(v,m)}else E.startsWith(ce.USER)&&a.push(m)}a.sort((m,E)=>E.createdAt-m.createdAt);let l=a.slice(0,n),u=a.length>n,p=l.map(m=>{let E=le.tenantMemberUserId(m.SK),v=c.get(E);return this.toListItem(m,e,E,v)}),f=u&&l.length>0?Buffer.from(JSON.stringify({PK:l[l.length-1].PK,SK:l[l.length-1].SK})).toString("base64url"):null;return mr(p,{limit:n,hasNext:u,cursor:f,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant query",n))}}toListItem(e,r,n,i){let o={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};if(e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm),i){let s={tenantId:r,userId:n,createdAt:J(i.createdAt),updatedAt:J(i.updatedAt)};i.contactEmail&&(s.contactEmail=i.contactEmail),i.contactPhone&&(s.contactPhone=i.contactPhone),i.displayName&&(s.displayName=i.displayName),i.displayNameSource&&(s.displayNameSource=i.displayNameSource),i.givenName&&(s.givenName=i.givenName),i.familyName&&(s.familyName=i.familyName),i.avatarUrl&&(s.avatarUrl=i.avatarUrl),i.locale&&(s.locale=i.locale),i.jobTitle&&(s.jobTitle=i.jobTitle),i.bio&&(s.bio=i.bio),i.metadata&&(s.metadata=JSON.parse(i.metadata)),o.tenantProfile=s}return o}};import{DeleteCommand as vO,DynamoDBDocumentClient as AO,GetCommand as LT,PutCommand as TO,QueryCommand as _O,TransactWriteCommand as IO,UpdateCommand as MT}from"@aws-sdk/lib-dynamodb";var gc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=AO.from(e)}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantMemberUserId(e.SK),i={tenantId:r,userId:n,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.roles!==void 0&&(i.roles=e.roles),e.perms!==void 0&&(i.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(i.authPerm=e.authPerm),i}async get(e,r){try{let n=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)}}));if(!n.Item)return T(null);let i=this.mapItemToEntity(n.Item);return T(i)}catch(n){return d(G("get",n))}}async create(e){try{let r=ae(),n=e.isOwner?void 0:e.authPerm,i=Ht({PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_MEMBER_SK(e.userId),userStatus:e.status,roles:e.roles,perms:e.perms!==void 0?JSON.stringify(e.perms):void 0,authPerm:n,isOwner:e.isOwner,createdAt:r,updatedAt:r,userTenantPk:Ae.USER_TENANT_PK(e.userId),userTenantSk:Ae.USER_TENANT_SK(e.tenantType??"org",e.parentTenantId,r,e.tenantId),parentTenantId:e.parentTenantId});return e.isOwner?await this.docClient.send(new IO({TransactItems:[{Put:{TableName:this.tableName,Item:{PK:U.TENANT_MEMBER_PK(e.tenantId),SK:U.TENANT_OWNER_MARKER_SK(),createdAt:r},ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}},{Put:{TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}}]})):await this.docClient.send(new TO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="TransactionCanceledException"?r.CancellationReasons?.[0]?.Code==="ConditionalCheckFailed"?d(te.UniqueConstraintViolation({field:"tenant owner"})):d(te.UniqueConstraintViolation({field:"tenant member"})):r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant member"})):d(Rt("create tenant member",r))}}async updatePermissions(e,r,n){try{let i={...n,updatedAt:ae()},{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updatePermissions tenant member",i))}}async updateStatus(e,r,n){try{return await this.docClient.send(new MT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},UpdateExpression:"SET #userStatus = :userStatus, #updatedAt = :updatedAt",ExpressionAttributeNames:{"#userStatus":"userStatus","#updatedAt":"updatedAt"},ExpressionAttributeValues:{":userStatus":n,":updatedAt":ae()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("updateStatus tenant member",i))}}async listByTenant(e,r){try{let n=Math.min(r?.limit||50,100),i={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.TENANT_MEMBER_PK(e),":skPrefix":ce.USER},Limit:n};r?.cursor&&(i.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let o=await this.docClient.send(new _O(i)),s=(o.Items||[]).map(l=>this.mapItemToEntity(l)),a=!!o.LastEvaluatedKey,c=a?Buffer.from(JSON.stringify(o.LastEvaluatedKey)).toString("base64url"):null;return mr(s,{limit:n,hasNext:a,cursor:c,prevCursor:r?.cursor??null})}catch(n){return d(G("listByTenant",n))}}async hasOwner(e){try{let r=await this.docClient.send(new LT({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_OWNER_MARKER_SK()}}));return T(!!r.Item)}catch(r){return d(G("hasOwner",r))}}async remove(e,r){try{return await this.docClient.send(new vO({TableName:this.tableName,Key:{PK:U.TENANT_MEMBER_PK(e),SK:U.TENANT_MEMBER_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"TenantMember",id:`${e}:${r}`})):d(Rt("remove tenant member",n))}}};import{BatchGetCommand as xO,QueryCommand as bO}from"@aws-sdk/lib-dynamodb";var vc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async listByUser(e,r){try{let n=Math.min(r?.limit??50,100),i=r?.tenantType??Qt.DEFAULT,o=r?.parentTenantId,s=o?`${i}#${o}#`:`${i}#`,a={TableName:this.tableName,IndexName:ue.USER_TENANTS,KeyConditionExpression:"userTenantPk = :pk AND begins_with(userTenantSk, :skPrefix)",ExpressionAttributeValues:{":pk":Ae.USER_TENANT_PK(e),":skPrefix":s},ScanIndexForward:!1,Limit:n};r?.cursor&&(a.ExclusiveStartKey=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8")));let c=await this.docClient.send(new bO(a)),l=c.Items??[],u=await this.fetchProfileMap(e,l),p=l.map(E=>this.toListItem(E,e,u)),f=!!c.LastEvaluatedKey,m=f?Buffer.from(JSON.stringify(c.LastEvaluatedKey)).toString("base64url"):null;return mr(p,{limit:n,hasNext:f,cursor:m,prevCursor:r?.cursor??null})}catch(n){return d(G("listByUser query",n))}}async fetchProfileMap(e,r){let n=new Map;if(r.length===0)return n;let i=r.map(s=>({PK:U.TENANT_PROFILE_PK(le.tenantId(s.PK)),SK:U.TENANT_PROFILE_SK(e)})),o=await this.docClient.send(new xO({RequestItems:{[this.tableName]:{Keys:i}}}));for(let s of o.Responses?.[this.tableName]??[]){let a=s,c=le.tenantId(a.PK);n.set(c,a)}return n}toListItem(e,r,n){let i=le.tenantId(e.PK),o={tenantId:i,userId:r,status:e.userStatus,isOwner:e.isOwner===!0,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=JSON.parse(e.perms)),e.authPerm!==void 0&&(o.authPerm=e.authPerm);let s=n.get(i);return s&&(s.contactEmail&&(o.contactEmail=s.contactEmail),s.contactPhone&&(o.contactPhone=s.contactPhone),s.displayName&&(o.displayName=s.displayName),s.displayNameSource&&(o.displayNameSource=s.displayNameSource),s.givenName&&(o.givenName=s.givenName),s.familyName&&(o.familyName=s.familyName),s.avatarUrl&&(o.avatarUrl=s.avatarUrl),s.locale&&(o.locale=s.locale),s.jobTitle&&(o.jobTitle=s.jobTitle),s.bio&&(o.bio=s.bio),s.metadata&&(o.metadata=JSON.parse(s.metadata))),o}};import{DeleteCommand as SO,GetCommand as wO,PutCommand as NO,UpdateCommand as RO}from"@aws-sdk/lib-dynamodb";var Ac=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}generateTenantId(){return ht()}toEntity(e){let n={id:le.tenantId(e.PK),type:e.tenantType,ownerId:e.ownerId,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.parentTenantId&&(n.parentTenantId=e.parentTenantId),n}async get(e){try{let r=await this.docClient.send(new wO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()}}));return r.Item?T(this.toEntity(r.Item)):T(null)}catch(r){return d(G("get tenant",r))}}async create(e){try{let r=e.id??this.generateTenantId(),n=ae(),i=Ht({PK:U.TENANT_PK(r),SK:U.TENANT_SK(),tenantType:e.type,parentTenantId:e.parentTenantId,ownerId:e.ownerId,createdAt:n,updatedAt:n});return await this.docClient.send(new NO({TableName:this.tableName,Item:i,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"tenant"})):d(Rt("create tenant",r))}}async update(e,r){try{let n={updatedAt:ae()};r.type!==void 0&&(n.tenantType=r.type),r.ownerId!==void 0&&(n.ownerId=r.ownerId),r.parentTenantId!==void 0&&(n.parentTenantId=r.parentTenantId===null?void 0:r.parentTenantId);let{UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s}=Pr(n);return await this.docClient.send(new RO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},UpdateExpression:i,ExpressionAttributeNames:o,ExpressionAttributeValues:s,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("update tenant",n))}}async delete(e){try{return await this.docClient.send(new SO({TableName:this.tableName,Key:{PK:U.TENANT_PK(e),SK:U.TENANT_SK()},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"Tenant",id:e})):d(Rt("delete tenant",r))}}async list(){return d(te.InvalidData({reason:"DynamoDB tenant list requires a dedicated GSI; scan is disabled"}))}async listByParent(e){return d(te.InvalidData({reason:`DynamoDB tenant listByParent(${e}) requires a dedicated GSI; scan is disabled`}))}async listRoots(){return d(te.InvalidData({reason:"DynamoDB tenant listRoots requires a dedicated GSI; scan is disabled"}))}};import{DeleteCommand as OO,GetCommand as kO,PutCommand as CO,UpdateCommand as vd}from"@aws-sdk/lib-dynamodb";var Tc=class{docClient;tableName;constructor(e){this.docClient=e.docClient,this.tableName=e.tableName}async get(e){try{let r=await this.docClient.send(new kO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}}));return r.Item?T(this.unmarshall(r.Item,e)):T(null)}catch(r){return d(G("get user auth",r))}}async create(e){try{let r=ae(),n={...e,createdAt:new Date(r),updatedAt:new Date(r)};return await this.docClient.send(new CO({TableName:this.tableName,Item:this.marshall(n),ConditionExpression:`attribute_not_exists(${h.PK})`})),T(n)}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"userAuth"})):d(G("create user auth",r))}}async updateStatus(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#userStatus":"userStatus",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":userStatus":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update user auth status",n))}}async updateMfaRequired(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa required",n))}}async updateMfaMethods(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaMethods":r,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa methods",n))}}async updateMfaSettings(e,r){try{let n=ae();return await this.docClient.send(new vd({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()},UpdateExpression:`SET #mfaRequired = :mfaRequired, #mfaMethods = :mfaMethods, #${h.UPDATED_AT} = :updatedAt`,ExpressionAttributeNames:{"#mfaRequired":"mfaRequired","#mfaMethods":"mfaMethods",[`#${h.UPDATED_AT}`]:h.UPDATED_AT},ExpressionAttributeValues:{":mfaRequired":r.mfaRequired,":mfaMethods":r.mfaMethods,":updatedAt":n},ConditionExpression:`attribute_exists(${h.PK})`})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userAuth",id:e})):d(G("update mfa settings",n))}}async remove(e){try{return await this.docClient.send(new OO({TableName:this.tableName,Key:{[h.PK]:U.USER_PK(e),[h.SK]:U.USER_AUTH_SK()}})),T(void 0)}catch(r){return d(G("remove user auth",r))}}marshall(e){return{[h.PK]:U.USER_PK(e.userId),[h.SK]:U.USER_AUTH_SK(),userStatus:e.userStatus,mfaRequired:e.mfaRequired,mfaMethods:e.mfaMethods,[h.CREATED_AT]:re(e.createdAt),[h.UPDATED_AT]:re(e.updatedAt)}}unmarshall(e,r){return{userId:r,userStatus:e.userStatus,mfaRequired:e.mfaRequired||!1,mfaMethods:e.mfaMethods||null,createdAt:J(e[h.CREATED_AT]),updatedAt:J(e[h.UPDATED_AT])}}};import{DynamoDBDocumentClient as PO,DeleteCommand as DO,GetCommand as UO,PutCommand as LO,QueryCommand as KT,UpdateCommand as rh}from"@aws-sdk/lib-dynamodb";function Ss(t,e){return e?U.USER_MFA_WITH_ID_SK(t,e):U.USER_MFA_SK(t)}var _c=class{client;tableName;docClient;constructor(e,r){this.client=e,this.tableName=r,this.docClient=PO.from(e)}toDynamoDBItem(e){let r={PK:U.USER_PK(e.userId),SK:Ss(e.method,e.id),method:e.method,data:JSON.stringify(e.data),createdAt:Date.now(),failedAttempts:0};return e.label&&(r.label=e.label),e.verifiedAt&&(r.verifiedAt=e.verifiedAt.getTime()),e.metadata&&(r.metadata=JSON.stringify(e.metadata)),r}fromDynamoDBItem(e,r){let n=le.mfaSKInfo(e.SK),i={userId:r,method:e.method,data:JSON.parse(e.data),createdAt:J(e.createdAt),verifiedAt:Kt(e.verifiedAt)??null};return n?.id&&(i.id=n.id),e.label&&(i.label=e.label),e.failedAttempts!==void 0&&(i.failedAttempts=e.failedAttempts),e.lastFailedAt!==void 0&&(i.lastFailedAt=Kt(e.lastFailedAt)),e.lockedUntil!==void 0&&(i.lockedUntil=Kt(e.lockedUntil)),e.lastUsedAt!==void 0&&(i.lastUsedAt=Kt(e.lastUsedAt)),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r,n){try{let i=Ss(r,n),o=await this.docClient.send(new UO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}}));return o.Item?T(this.fromDynamoDBItem(o.Item,e)):T(null)}catch(i){return d(G("get MFA authenticator",i))}}async findByUserId(e){try{let r={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":Be.MFA}},o=((await this.docClient.send(new KT(r))).Items??[]).map(s=>this.fromDynamoDBItem(s,e));return T(o)}catch(r){return d(G("find MFA authenticators by user",r))}}async findByUserIdAndMethod(e,r){try{let n={TableName:this.tableName,KeyConditionExpression:"PK = :pk AND begins_with(SK, :skPrefix)",ExpressionAttributeValues:{":pk":U.USER_PK(e),":skPrefix":`${Be.MFA}${r}`}},s=((await this.docClient.send(new KT(n))).Items??[]).filter(a=>a.method===r).map(a=>this.fromDynamoDBItem(a,e));return T(s)}catch(n){return d(G("find MFA authenticators by method",n))}}async create(e){try{let r={...e};e.id===void 0&&this.isMultiInstanceMethod(e.method)&&(r.id=ht());let n=this.toDynamoDBItem(r);return await this.docClient.send(new LO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"})),T(this.fromDynamoDBItem(n,e.userId))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"MFA authenticator"})):d(G("create MFA authenticator",r))}}async update(e,r,n,i){try{let o=Ss(r,n),s=[],a={},c={};if(i.label!==void 0&&(s.push("#label = :label"),a["#label"]="label",c[":label"]=i.label),i.data!==void 0&&(s.push("#data = :data"),a["#data"]="data",c[":data"]=JSON.stringify(i.data)),i.verifiedAt!==void 0&&(s.push("#verifiedAt = :verifiedAt"),a["#verifiedAt"]="verifiedAt",c[":verifiedAt"]=i.verifiedAt instanceof Date?i.verifiedAt.getTime():i.verifiedAt===null?void 0:i.verifiedAt),i.lastUsedAt!==void 0&&(s.push("#lastUsedAt = :lastUsedAt"),a["#lastUsedAt"]="lastUsedAt",c[":lastUsedAt"]=i.lastUsedAt instanceof Date?i.lastUsedAt.getTime():i.lastUsedAt===null?void 0:i.lastUsedAt),i.failedAttempts!==void 0&&(s.push("#failedAttempts = :failedAttempts"),a["#failedAttempts"]="failedAttempts",c[":failedAttempts"]=i.failedAttempts),i.lastFailedAt!==void 0&&(s.push("#lastFailedAt = :lastFailedAt"),a["#lastFailedAt"]="lastFailedAt",c[":lastFailedAt"]=i.lastFailedAt instanceof Date?i.lastFailedAt.getTime():i.lastFailedAt===null?void 0:i.lastFailedAt),i.lockedUntil!==void 0&&(s.push("#lockedUntil = :lockedUntil"),a["#lockedUntil"]="lockedUntil",c[":lockedUntil"]=i.lockedUntil instanceof Date?i.lockedUntil.getTime():i.lockedUntil===null?void 0:i.lockedUntil),i.metadata!==void 0&&(s.push("#metadata = :metadata"),a["#metadata"]="metadata",c[":metadata"]=JSON.stringify(i.metadata)),s.length===0)return T(void 0);let l={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:o},UpdateExpression:`SET ${s.join(", ")}`,ExpressionAttributeNames:a,ExpressionAttributeValues:c};return await this.docClient.send(new rh(l)),T(void 0)}catch(o){return d(G("update MFA authenticator",o))}}async remove(e,r,n){try{let i=Ss(r,n);return await this.docClient.send(new DO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i}})),T(void 0)}catch(i){return d(G("remove MFA authenticator",i))}}async incrementFailedAttempts(e,r,n,i,o){try{let s=Ss(r,n),a=Date.now(),c=["#failedAttempts = if_not_exists(#failedAttempts, :zero) + :inc","#lastFailedAt = :lastFailedAt"],l={"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt"},u={":zero":0,":inc":1,":lastFailedAt":a};o!==null&&(c.push("#lockedUntil = if_not_exists(#lockedUntil, :lockedUntil)"),l["#lockedUntil"]="lockedUntil",u[":lockedUntil"]=a+o*60*1e3,u[":maxAttempts"]=i);let p={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:s},UpdateExpression:`SET ${c.join(", ")}`,ExpressionAttributeNames:l,ExpressionAttributeValues:u};return await this.docClient.send(new rh(p)),T(void 0)}catch(s){return d(G("increment failed attempts",s))}}async resetFailedAttempts(e,r,n){try{let i=Ss(r,n),o={TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:i},UpdateExpression:"SET #failedAttempts = :zero REMOVE #lastFailedAt, #lockedUntil",ExpressionAttributeNames:{"#failedAttempts":"failedAttempts","#lastFailedAt":"lastFailedAt","#lockedUntil":"lockedUntil"},ExpressionAttributeValues:{":zero":0}};return await this.docClient.send(new rh(o)),T(void 0)}catch(i){return d(G("reset failed attempts",i))}}async unlock(e,r,n){return this.resetFailedAttempts(e,r,n)}isMultiInstanceMethod(e){return["webauthn","passkey","hardware","backup"].includes(e)}};import{DeleteCommand as MO,DynamoDBDocumentClient as KO,GetCommand as HO,PutCommand as FO,QueryCommand as HT,UpdateCommand as FT}from"@aws-sdk/lib-dynamodb";var Ic=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=KO.from(e)}generateUserId(){return ht()}async getById(e){try{let r=await this.docClient.send(new HO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}}));if(!r.Item)return T(null);let n=r.Item;if(n.deletedAt)return T(null);let o={id:le.userId(n.PK),status:n.userStatus,createdAt:J(n.createdAt),updatedAt:J(n.updatedAt),...n.deletedAt!==void 0&&{deletedAt:J(n.deletedAt)},...n.contactEmail!==void 0&&{contactEmail:n.contactEmail},...n.contactPhone!==void 0&&{contactPhone:n.contactPhone},...n.username!==void 0&&{username:n.username},...n.displayName!==void 0&&{displayName:n.displayName},...n.givenName!==void 0&&{givenName:n.givenName},...n.familyName!==void 0&&{familyName:n.familyName},...n.avatarUrl!==void 0&&{avatarUrl:n.avatarUrl},...n.locale!==void 0&&{locale:n.locale},...n.metadata!==void 0&&{metadata:JSON.parse(n.metadata)}};return T(o)}catch(r){return d(G("getById user",r))}}async create(e){try{let r=ae(),n=e.id||this.generateUserId(),i=e.status||"pending",o={PK:U.USER_PK(n),SK:U.USER_PROFILE_SK(),userStatus:i,createdAt:r,updatedAt:r};e.contactEmail&&(o.contactEmail=e.contactEmail),e.contactPhone&&(o.contactPhone=e.contactPhone),e.username&&(o.username=e.username),e.displayName&&(o.displayName=e.displayName),e.givenName&&(o.givenName=e.givenName),e.familyName&&(o.familyName=e.familyName),e.avatarUrl&&(o.avatarUrl=e.avatarUrl),e.locale&&(o.locale=e.locale),e.metadata&&(o.metadata=JSON.stringify(e.metadata)),o[h.USER_STATUS_PK]=Ae.USER_STATUS_PK(i),o[h.USER_STATUS_SK]=Ae.USER_STATUS_SK(n),await this.docClient.send(new FO({TableName:this.tableName,Item:Ht(o),ConditionExpression:qm("PK")}));let s={id:n,status:i,createdAt:J(r),updatedAt:J(r),...e.contactEmail&&{contactEmail:e.contactEmail},...e.contactPhone&&{contactPhone:e.contactPhone},...e.username&&{username:e.username},...e.displayName&&{displayName:e.displayName},...e.givenName&&{givenName:e.givenName},...e.familyName&&{familyName:e.familyName},...e.avatarUrl&&{avatarUrl:e.avatarUrl},...e.locale&&{locale:e.locale},...e.metadata&&{metadata:e.metadata}};return T(s)}catch(r){return d(G("create user",r))}}async updateProfile(e,r){try{let n=ae(),i={};if(r.contactEmail!==void 0&&(i.contactEmail=r.contactEmail),r.contactPhone!==void 0&&(i.contactPhone=r.contactPhone),r.displayName!==void 0&&(i.displayName=r.displayName),r.givenName!==void 0&&(i.givenName=r.givenName),r.familyName!==void 0&&(i.familyName=r.familyName),r.avatarUrl!==void 0&&(i.avatarUrl=r.avatarUrl),r.locale!==void 0&&(i.locale=r.locale),r.metadata!==void 0&&(i.metadata=JSON.stringify(r.metadata)),Object.keys(i).length===0)return T(void 0);i.updatedAt=n;let o=Pr(i);return await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:o.UpdateExpression,ExpressionAttributeNames:o.ExpressionAttributeNames,ExpressionAttributeValues:o.ExpressionAttributeValues})),T(void 0)}catch(n){return d(G("updateProfile",n))}}async getByStatus(e,r){try{let n=Math.min(r?.limit||50,100),i;if(r?.cursor)try{i=JSON.parse(Buffer.from(r.cursor,"base64url").toString("utf-8"))}catch{return d(te.DatabaseQueryError({query:"invalid pagination cursor"}))}let o=Ae.USER_STATUS_PK(e),s=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":o},Limit:n,ExclusiveStartKey:i})),a=[];if(s.Items&&s.Items.length>0)for(let u of s.Items){let p=le.userId(u.PK);a.push(p)}let c=!!s.LastEvaluatedKey,l=c?Buffer.from(JSON.stringify(s.LastEvaluatedKey)).toString("base64url"):null;return T(a,{pagination:{type:"cursor",limit:n,count:a.length,hasNext:c,hasPrev:!!r?.cursor,cursor:l}})}catch(n){return d(G("get users by status",n))}}async countByStatus(e){try{let r=Ae.USER_STATUS_PK(e),n=await this.docClient.send(new HT({TableName:this.tableName,IndexName:ue.USERS_BY_STATUS,KeyConditionExpression:`${h.USER_STATUS_PK} = :statusPk`,ExpressionAttributeValues:{":statusPk":r},Select:"COUNT"}));return T(n.Count||0)}catch(r){return d(G("count users by status",r))}}async syncAuthStatus(e,r){try{let n=ae(),i=`SET userStatus = :userStatus, #${h.UPDATED_AT} = :updatedAt, #${h.USER_STATUS_PK} = :statusPk, #${h.USER_STATUS_SK} = :statusSk`,o={":userStatus":r,":updatedAt":n,":statusPk":Ae.USER_STATUS_PK(r),":statusSk":Ae.USER_STATUS_SK(e)};return r===ye.DELETED?(i+=", deletedAt = :deletedAt",o[":deletedAt"]=n):i+=" REMOVE deletedAt",await this.docClient.send(new FT({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()},UpdateExpression:i,ExpressionAttributeNames:{[`#${h.UPDATED_AT}`]:h.UPDATED_AT,[`#${h.USER_STATUS_PK}`]:h.USER_STATUS_PK,[`#${h.USER_STATUS_SK}`]:h.USER_STATUS_SK},ExpressionAttributeValues:o,ConditionExpression:"attribute_exists(PK)"})),T(void 0)}catch(n){return Ce(n)?d(te.NotFound({entity:"userProfile",id:e})):d(G("sync auth status",n))}}async remove(e){try{return await this.docClient.send(new MO({TableName:this.tableName,Key:{PK:U.USER_PK(e),SK:U.USER_PROFILE_SK()}})),T(void 0)}catch(r){return d(G("remove user profile",r))}}};import{DeleteCommand as VO,DynamoDBDocumentClient as BO,GetCommand as jO,PutCommand as GO,QueryCommand as $O,UpdateCommand as qO}from"@aws-sdk/lib-dynamodb";var xc=class{tableName;docClient;constructor(e,r){this.tableName=r,this.docClient=BO.from(e)}mapItemToUserProviderLink(e){let r=le.providerPKInfo(e.PK);if(!r)throw new Error(`Invalid provider PK: ${e.PK}`);let n={userId:e.userId,provider:r.provider,externalId:r.externalId,createdAt:J(e.createdAt)};if(e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata)try{n.metadata=JSON.parse(e.metadata)}catch{}return n}mapUserProviderLinkToItem(e){let r=ae(),n={PK:U.PROVIDER_PK(e.provider,e.externalId),SK:U.PROVIDER_METADATA_SK(),userProviderPk:U.USER_PK(e.userId),userProviderSk:U.PROVIDER_PK(e.provider,e.externalId),userId:e.userId,createdAt:e.createdAt?re(e.createdAt):r};return e.externalUsername&&(n.externalUsername=e.externalUsername),e.externalEmail&&(n.externalEmail=e.externalEmail),e.externalPhone&&(n.externalPhone=e.externalPhone),e.externalName&&(n.externalName=e.externalName),e.externalAvatarUrl&&(n.externalAvatarUrl=e.externalAvatarUrl),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),Ht(n)}async findByProviderAndExternalId(e,r){try{let n=await this.docClient.send(new jO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}}));return n.Item?T(this.mapItemToUserProviderLink(n.Item)):T(null)}catch(n){return d(G("find provider by external id",n))}}async findByUserId(e){try{let r=await this.docClient.send(new $O({TableName:this.tableName,IndexName:ue.USER_PROVIDERS,KeyConditionExpression:"#pk = :pk",ExpressionAttributeNames:{"#pk":h.USER_PROVIDER_PK},ExpressionAttributeValues:{":pk":U.USER_PK(e)}}));return!r.Items||r.Items.length===0?T([]):T(r.Items.map(n=>this.mapItemToUserProviderLink(n)))}catch(r){return d(G("find providers by user id",r))}}async create(e){try{let r={...e,createdAt:new Date},n=this.mapUserProviderLinkToItem(r);return await this.docClient.send(new GO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK)"})),T(this.mapItemToUserProviderLink(n))}catch(r){return Ce(r)?d(te.UniqueConstraintViolation({field:"provider connection",message:"Provider connection already exists"})):d(G("create user provider",r))}}async update(e,r,n){try{let i={};if(n.externalUsername!==void 0&&(i.externalUsername=n.externalUsername),n.externalEmail!==void 0&&(i.externalEmail=n.externalEmail),n.externalPhone!==void 0&&(i.externalPhone=n.externalPhone),n.externalName!==void 0&&(i.externalName=n.externalName),n.externalAvatarUrl!==void 0&&(i.externalAvatarUrl=n.externalAvatarUrl),n.metadata!==void 0&&(i.metadata=JSON.stringify(n.metadata)),Object.keys(i).length===0)return T(void 0);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new qO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a})),T(void 0)}catch(i){return d(G("update user provider",i))}}async remove(e,r){try{return await this.docClient.send(new VO({TableName:this.tableName,Key:{PK:U.PROVIDER_PK(e,r),SK:U.PROVIDER_METADATA_SK()}})),T(void 0)}catch(n){return d(G("delete user provider",n))}}};import{DeleteCommand as WO,GetCommand as zO,PutCommand as JO,UpdateCommand as YO}from"@aws-sdk/lib-dynamodb";var bc=class{docClient;tableName;constructor(e,r){this.docClient=e,this.tableName=r}mapItemToEntity(e){let r=le.tenantId(e.PK),n=le.tenantProfileUserId(e.SK),i={tenantId:r,userId:n,createdAt:J(e.createdAt),updatedAt:J(e.updatedAt)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=JSON.parse(e.metadata)),i}async get(e,r){try{let n=await this.docClient.send(new zO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)}}));return n.Item?T(this.mapItemToEntity(n.Item)):T(null)}catch(n){return d(G("get user tenant profile",n))}}async create(e){try{let r=ae(),n={PK:U.TENANT_PROFILE_PK(e.tenantId),SK:U.TENANT_PROFILE_SK(e.userId),createdAt:r,updatedAt:r};e.contactEmail&&(n.contactEmail=e.contactEmail),e.contactPhone&&(n.contactPhone=e.contactPhone),e.displayName&&(n.displayName=e.displayName),e.displayNameSource&&(n.displayNameSource=e.displayNameSource),e.givenName&&(n.givenName=e.givenName),e.familyName&&(n.familyName=e.familyName),e.avatarUrl&&(n.avatarUrl=e.avatarUrl),e.locale&&(n.locale=e.locale),e.jobTitle&&(n.jobTitle=e.jobTitle),e.bio&&(n.bio=e.bio),e.metadata&&(n.metadata=JSON.stringify(e.metadata)),await this.docClient.send(new JO({TableName:this.tableName,Item:n,ConditionExpression:"attribute_not_exists(PK) AND attribute_not_exists(SK)"}));let i={tenantId:e.tenantId,userId:e.userId,createdAt:J(r),updatedAt:J(r)};return e.contactEmail&&(i.contactEmail=e.contactEmail),e.contactPhone&&(i.contactPhone=e.contactPhone),e.displayName&&(i.displayName=e.displayName),e.displayNameSource&&(i.displayNameSource=e.displayNameSource),e.givenName&&(i.givenName=e.givenName),e.familyName&&(i.familyName=e.familyName),e.avatarUrl&&(i.avatarUrl=e.avatarUrl),e.locale&&(i.locale=e.locale),e.jobTitle&&(i.jobTitle=e.jobTitle),e.bio&&(i.bio=e.bio),e.metadata&&(i.metadata=e.metadata),T(i)}catch(r){return r.name==="ConditionalCheckFailedException"?d(te.UniqueConstraintViolation({field:"user tenant profile"})):d(Rt("create user tenant profile",r))}}async update(e,r,n){try{let i={updatedAt:ae()};n.contactEmail!==void 0&&(i.contactEmail=n.contactEmail),n.contactPhone!==void 0&&(i.contactPhone=n.contactPhone),n.displayName!==void 0&&(i.displayName=n.displayName),n.displayNameSource!==void 0&&(i.displayNameSource=n.displayNameSource),n.givenName!==void 0&&(i.givenName=n.givenName),n.familyName!==void 0&&(i.familyName=n.familyName),n.avatarUrl!==void 0&&(i.avatarUrl=n.avatarUrl),n.locale!==void 0&&(i.locale=n.locale),n.jobTitle!==void 0&&(i.jobTitle=n.jobTitle),n.bio!==void 0&&(i.bio=n.bio),n.metadata!==void 0&&(i.metadata=n.metadata?JSON.stringify(n.metadata):null);let{UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a}=Pr(i);return await this.docClient.send(new YO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},UpdateExpression:o,ExpressionAttributeNames:s,ExpressionAttributeValues:a,ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(i){return i.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("update user tenant profile",i))}}async remove(e,r){try{return await this.docClient.send(new WO({TableName:this.tableName,Key:{PK:U.TENANT_PROFILE_PK(e),SK:U.TENANT_PROFILE_SK(r)},ConditionExpression:"attribute_exists(PK) AND attribute_exists(SK)"})),T(void 0)}catch(n){return n.name==="ConditionalCheckFailedException"?d(te.NotFound({entity:"UserTenantProfile",id:`${e}:${r}`})):d(Rt("remove user tenant profile",n))}}};var nh=class{name="database-dynamodb";version="1.0.0";users;sessions;userProviders;userMfaAuthenticators;challenges;identities;credentials;registration;userAuths;tenantMembers;tenantInvites;userTenantProfiles;tenants;queries;client;tableName;constructor(e){this.tableName=e.tableName,this.client=e.client||new QO(e.clientConfig||{});let r=ZO.from(this.client,{marshallOptions:{removeUndefinedValues:!0,convertClassInstanceToMap:!0}});this.users=new Ic(this.client,this.tableName),this.sessions=new mc({client:this.client,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userProviders=new xc(this.client,this.tableName),this.userMfaAuthenticators=new _c(this.client,this.tableName),this.challenges=new lc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.identities=new dc({docClient:r,tableName:this.tableName}),this.credentials=new uc({docClient:r,tableName:this.tableName}),this.registration=new pc({docClient:r,tableName:this.tableName,ttlGracePeriod:3600*1e3}),this.userAuths=new Tc({docClient:r,tableName:this.tableName}),this.tenantMembers=new gc(this.client,this.tableName),this.tenantInvites=new Ec({docClient:r,tableName:this.tableName}),this.userTenantProfiles=new bc(r,this.tableName),this.tenants=new Ac({docClient:r,tableName:this.tableName}),this.queries={tenantInvites:new hc({docClient:r,tableName:this.tableName}),tenantMembers:new yc({docClient:r,tableName:this.tableName}),tenants:new vc({docClient:r,tableName:this.tableName})}}async initialize(){}async health(){try{return await this.client.send(new XO({TableName:this.tableName})),!0}catch(e){return console.error("DynamoDB health check failed:",e),!1}}async cleanup(){this.client.destroy()}};function VT(t){return new nh(t)}ra();var ih=1,BT=2,jT=3,GT="auth-craft:internal";async function ek(t){let e=t.replace(/^0x/,""),r=qT(e),n=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]),i=new Uint8Array(n.length+r.length);i.set(n),i.set(r,n.length);let o=`-----BEGIN PRIVATE KEY-----
 `+btoa(String.fromCharCode(...i)).match(/.{1,64}/g).join(`
 `)+`
------END PRIVATE KEY-----`;return ao(s,"EdDSA")}async function d0(t){let e=t.replace(/^0x/,""),r=KA(e),n=f0(r);return it({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function If(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return u0(r)}if(r.startsWith("-----"))return ao(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function MA(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return it(JSON.parse(r),e);if(!r.includes(`
-`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return it(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return d0(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ho(),ch));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function p0(t){return new TextEncoder().encode(t)}function KA(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function f0(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var zl=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await p0(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await If(this.config.privateKey,e),i=await MA(this.config.publicKey,e),s,o;return this.config.servicePrivateKey&&this.config.servicePublicKey?(s=await If(this.config.servicePrivateKey,e),o=await MA(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(s=await If(this.config.servicePrivateKey,e),o=i):(s=n,o=i),{privateKey:n,publicKey:i,servicePrivateKey:s,servicePublicKey:o}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),s=i+r*60,o=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:o??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?PA:_f,iat:i,exp:s};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new Zi(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,s=this.config.clockTolerance??0,o={algorithms:[i],clockTolerance:s};this.config.issuer&&(o.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(o.audience=n);let{payload:a}=await bn(e,r,o);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1);return this.signJwt(s,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==_f?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,s=this.buildBasePayload(e,i,!1),o={...s};return e.roles!==void 0&&(o.roles=e.roles),e.perms!==void 0&&(o.perms=e.perms),{token:await this.signJwt(o,n.privateKey),expiresAt:s.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==_f||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,s=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(s,n.privateKey),expiresAt:s.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==PA||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,s=e.aud??this.config.serviceTokenAudience??LA,o={sub:e.sub,aud:s,iss:this.config.issuer??"",jti:e.jti,typ:UA,iat:n,exp:n+i*60};return e.roles!==void 0&&(o.roles=e.roles),this.signJwt(o,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??LA,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==UA?null:i}async initialize(){}async cleanup(){}};function xf(t){return new zl(t)}import{DynamoDBClient as m0}from"@aws-sdk/client-dynamodb";function h0(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),g(void 0)}}}function E0(){return F.email.mode==="console"?h0():F.email.mode==="queue"?aa.createAwsSqs({queueUrl:F.email.queue.url,...F.email.queue.region?{region:F.email.queue.region}:{},envelope:F.email.queue.envelope,sourceSystem:F.email.queue.sourceSystem,eventTypeMap:F.email.queue.eventTypeMap,defaultMetadata:F.email.queue.defaultMetadata}):Ea.createDirectSmtp({host:F.smtp.host,port:F.smtp.port,secure:F.smtp.secure,auth:{user:F.smtp.user,pass:F.smtp.pass},fromEmail:F.smtp.from,fromName:"Auth Craft"})}async function HA(){let t=Zy(),e=Fy({codeLifetimeMinutes:F.auth.verificationCodeLifetimeMinutes}),r=Zv(),n=xf({algorithm:F.jwtAlgorithm,privateKey:F.jwtPrivateKey,publicKey:F.jwtPublicKey,accessTokenExpiresIn:F.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:F.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:F.jwtIssuer,accessTokenAudience:F.jwtAccessTokenAudience,refreshTokenAudience:F.jwtRefreshTokenAudience,accessTokenAudiences:[F.security.tokenAudiences.customer,F.security.tokenAudiences.tenant,F.security.tokenAudiences.system],refreshTokenAudiences:[F.security.tokenAudiences.customer,F.security.tokenAudiences.tenant,F.security.tokenAudiences.system]}),i=new m0({region:F.awsRegion,...F.dynamodbEndpoint?{endpoint:F.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),s=DA({tableName:F.dynamodbTableName,client:i}),o=E0(),a=new Map;F.oauth.facebook&&a.set("facebook",af({appId:F.oauth.facebook.clientId,appSecret:F.oauth.facebook.clientSecret,redirectUri:F.oauth.facebook.redirectUri})),F.oauth.google&&a.set("google",cf({clientId:F.oauth.google.clientId,clientSecret:F.oauth.google.clientSecret,redirectUri:F.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:s,emailSystem:o,deviceParser:rg(),rateLimiter:oA(),mfa:{totp:sA({issuer:F.auth.systemName}),email:eA()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await na({systemId:F.auth.systemName,plugins:c,security:{...Vd.HIGH,maxFailedAttempts:F.security.maxLoginAttempts,lockoutDurationMinutes:F.security.lockoutDurationMinutes,requireVerifiedIdentity:F.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:F.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:F.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:F.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:F.auth.verificationResendCooldownSeconds,verifySessionOnAuth:F.security.verifySessionOnAuth,systemTenantId:F.security.systemTenantId,tokenAudiences:F.security.tokenAudiences},system:{environment:F.nodeEnv},policy:{auditEnabled:F.features.auditEnabled,deviceTrackingEnabled:F.features.deviceTracking,sessionRotationEnabled:!0},version:F.auth.appVersion,email:{appName:"Auth Craft",appUrl:F.auth.appUrl,supportEmail:F.auth.supportEmail}})}var Ka={INTERNAL_ERROR:X("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:T("INVALID_TOKEN_TYPE","Access token required")};function QA(t,e){let r=tn(e);return t.json(r.body,r.status)}function U0(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}Ky();var wi=F.appBasePath?(F.appBasePath.startsWith("/")?F.appBasePath:`/${F.appBasePath}`).replace(/\/$/,""):"",ZA=wi?`${wi}/health`:"/health",Of=null,Or=null;async function L0(){return Of||(Of=await HA(),console.log("\u2705 Auth SDK initialized")),Of}async function eT(){if(!Or){let t=await L0(),e={algorithm:F.jwtAlgorithm,publicKey:F.jwtPublicKey,issuer:F.jwtIssuer},r=gr(e),n=es({gateway:{...F.gatewayJwt.publicKeyHex?{publicKeyHex:F.gatewayJwt.publicKeyHex}:{},expectedIssuer:F.gatewayJwt.issuer,expectedAudience:F.gatewayJwt.audience,header:F.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}}}),i=Fu({auth:{jwt:{...e,verify:async(o,a)=>{let c=await r(o,a);return c.ok&&c.data.typ!==cn.Access?u(Ka.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Or=new Vr,F.nodeEnv!=="production"&&Or.use("*",async(o,a)=>{let c=o.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:o.req.method,path:o.req.path,gatewaySecret:o.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:o.res.status,duration:`${Date.now()-l}ms`}))}),F.corsOrigins.length>0&&Or.use("*",Sy({origin:F.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),F.gatewaySecret&&Or.use("*",async(o,a)=>{if(o.req.path===ZA)return a();let c=o.req.header("X-Gateway-Secret");return!c||!U0(c,F.gatewaySecret)?(F.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),o.notFound()):a()}),Or.get(ZA,o=>QA(o,g({status:"healthy",timestamp:new Date().toISOString()}))),Or.use("*",Vu);let s=kd({auth:t,policy:i,tokenStrategy:F.auth.tokens.refreshTokenStrategy,...F.auth.tokens.refreshTokenCookie?{refreshTokenCookie:F.auth.tokens.refreshTokenCookie}:{},...F.corsOrigins.length>0?{trustedOrigins:F.corsOrigins}:{}});if(Or.route(wi,s),console.log(`\u{1F510} Auth routes mounted at ${wi||"/"}`),F.internal.publicKey){let o=wi?`${wi}${F.internal.serviceRoutePath}`:F.internal.serviceRoutePath,a=Hd({auth:t,internal:{publicKeyJwk:F.internal.publicKey,alg:F.internal.alg,audience:F.internal.audience,issuer:F.internal.issuer}});Or.route(o,a),console.log(`\u{1F512} Internal routes mounted at ${o}`)}Or.onError((o,a)=>{console.error("\u274C [Error]",{message:o.message,stack:o.stack,path:a.req.path});let c=F.nodeEnv==="production"?"Internal Server Error":o.message||"Internal Server Error";return QA(a,u(Ka.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Or}var zte=async(t,e)=>{try{let r=await eT();return Fd(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=F.nodeEnv==="production"?"Internal Server Error":n,s=tn(u(Ka.INTERNAL_ERROR({message:i})));return{statusCode:s.status,body:JSON.stringify(s.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(XA(),YA));eT().then(e=>{let r=F.port,n=F.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${F.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${wi||""}`),console.log(`\u{1F511} Gateway secret: ${F.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${F.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{zte as handler};
+-----END PRIVATE KEY-----`;return ta(o,"EdDSA")}async function tk(t){let e=t.replace(/^0x/,""),r=qT(e),n=nk(r);return Vt({kty:"OKP",crv:"Ed25519",x:n},"EdDSA")}async function oh(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
+`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return ek(r)}if(r.startsWith("-----"))return ta(r,e)}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function $T(t,e){if(e==="EdDSA"){let r=t.trim();if(r.startsWith("{"))return Vt(JSON.parse(r),e);if(!r.includes(`
+`)&&!r.startsWith("-----")){try{let n=atob(r);if(n.trim().startsWith("{"))return Vt(JSON.parse(n),e)}catch{}if(/^[0-9a-fA-F]{64}$/.test(r))return tk(r)}if(r.startsWith("-----")){let{importSPKI:n}=await Promise.resolve().then(()=>(ra(),GE));return n(r,e)}}throw new Error(`Unsupported key format or algorithm: ${e}`)}async function rk(t){return new TextEncoder().encode(t)}function qT(t){let e=new Uint8Array(t.length/2);for(let r=0;r<t.length;r+=2)e[r/2]=parseInt(t.slice(r,r+2),16);return e}function nk(t){return btoa(String.fromCharCode(...t)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var Ad=class{name="jwt-token-plugin";version="1.0.0";config;keys=null;keysPromise=null;constructor(e){this.config={...e}}async ensureKeys(){return this.keys?this.keys:this.keysPromise?this.keysPromise:(this.keysPromise=this.resolveKeys(),this.keys=await this.keysPromise,this.keys)}async resolveKeys(){let e=this.config.algorithm;if(e==="HS256"||e==="HS384"||e==="HS512"){if(!this.config.secret)throw new Error("Secret is required for HMAC algorithms");let a=await rk(this.config.secret);return{privateKey:a,publicKey:a,servicePrivateKey:a,servicePublicKey:a}}if(!this.config.privateKey)throw new Error("Private key is required for EdDSA algorithm");if(!this.config.publicKey)throw new Error("Public key is required for EdDSA algorithm (cannot be derived via Web Crypto)");let n=await oh(this.config.privateKey,e),i=await $T(this.config.publicKey,e),o,s;return this.config.servicePrivateKey&&this.config.servicePublicKey?(o=await oh(this.config.servicePrivateKey,e),s=await $T(this.config.servicePublicKey,e)):this.config.servicePrivateKey?(o=await oh(this.config.servicePrivateKey,e),s=i):(o=n,s=i),{privateKey:n,publicKey:i,servicePrivateKey:o,servicePublicKey:s}}buildBasePayload(e,r,n){let i=Math.floor(Date.now()/1e3),o=i+r*60,s=e.aud??(n?this.config.refreshTokenAudience??this.config.audience:this.config.accessTokenAudience??this.config.audience),a={sub:e.sub,aud:s??"",iss:this.config.issuer??"",jti:e.jti,sid:e.sid,typ:n?BT:ih,iat:i,exp:o};return e.tid!==void 0&&(a.tid=e.tid),e.tty!==void 0&&(a.tty=e.tty),a}async signJwt(e,r){let n=this.config.algorithm;return new No(e).setProtectedHeader({alg:n,typ:"JWT"}).sign(r)}async verifyJwt(e,r,n){try{let i=this.config.algorithm,o=this.config.clockTolerance??0,s={algorithms:[i],clockTolerance:o};this.config.issuer&&(s.issuer=this.config.issuer),n&&(typeof n=="string"||n.length>0)&&(s.audience=n);let{payload:a}=await Bn(e,r,s);return a}catch{return null}}async sign(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1);return this.signJwt(o,n.privateKey)}accessVerifyAudience(){return this.config.accessTokenAudiences&&this.config.accessTokenAudiences.length>0?this.config.accessTokenAudiences:this.config.accessTokenAudience??this.config.audience}refreshVerifyAudience(){return this.config.refreshTokenAudiences&&this.config.refreshTokenAudiences.length>0?this.config.refreshTokenAudiences:this.config.refreshTokenAudience??this.config.audience}async verify(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih?null:n}async signAccessToken(e,r){let n=await this.ensureKeys(),i=r??this.config.accessTokenExpiresIn,o=this.buildBasePayload(e,i,!1),s={...o};return e.roles!==void 0&&(s.roles=e.roles),e.perms!==void 0&&(s.perms=e.perms),{token:await this.signJwt(s,n.privateKey),expiresAt:o.exp}}async verifyAccessToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.accessVerifyAudience());return!n||n.typ!==ih||!("jti"in n)?null:n}async signRefreshToken(e,r){let n=await this.ensureKeys(),i=r??this.config.refreshTokenExpiresIn,o=this.buildBasePayload(e,i,!0);return{token:await this.signJwt(o,n.privateKey),expiresAt:o.exp}}async verifyRefreshToken(e){let r=await this.ensureKeys(),n=await this.verifyJwt(e,r.publicKey,this.refreshVerifyAudience());return!n||n.typ!==BT||!("sid"in n)||!("jti"in n)?null:n}async signServiceToken(e){if(this.config.algorithm!=="EdDSA")throw new Error("signServiceToken requires EdDSA algorithm");let r=await this.ensureKeys(),n=Math.floor(Date.now()/1e3),i=this.config.serviceTokenExpiresIn??10,o=e.aud??this.config.serviceTokenAudience??GT,s={sub:e.sub,aud:o,iss:this.config.issuer??"",jti:e.jti,typ:jT,iat:n,exp:n+i*60};return e.roles!==void 0&&(s.roles=e.roles),this.signJwt(s,r.servicePrivateKey)}async verifyServiceToken(e){if(this.config.algorithm!=="EdDSA")return null;let r=await this.ensureKeys(),n=this.config.serviceTokenAudience??GT,i=await this.verifyJwt(e,r.servicePublicKey,n);return!i||i.typ!==jT?null:i}async initialize(){}async cleanup(){}};function sh(t){return new Ad(t)}import{DynamoDBClient as ik}from"@aws-sdk/client-dynamodb";function ok(){return{name:"console-email-system",version:"1.0.0",async send(t){return console.log("[Email][Console] Mock email dispatched",{to:t.to,template:t.template,subject:t.subject}),T(void 0)}}}function sk(){return j.email.mode==="console"?ok():j.email.mode==="queue"?$a.createAwsSqs({queueUrl:j.email.queue.url,...j.email.queue.region?{region:j.email.queue.region}:{},envelope:j.email.queue.envelope,sourceSystem:j.email.queue.sourceSystem,eventTypeMap:j.email.queue.eventTypeMap,defaultMetadata:j.email.queue.defaultMetadata}):oc.createDirectSmtp({host:j.smtp.host,port:j.smtp.port,secure:j.smtp.secure,auth:{user:j.smtp.user,pass:j.smtp.pass},fromEmail:j.smtp.from,fromName:"Auth Craft"})}async function WT(){let t=Kv(),e=xv({codeLifetimeMinutes:j.auth.verificationCodeLifetimeMinutes}),r=sT(),n=sh({algorithm:j.jwtAlgorithm,privateKey:j.jwtPrivateKey,publicKey:j.jwtPublicKey,accessTokenExpiresIn:j.auth.tokens.accessTokenLifetimeMinutes*60,refreshTokenExpiresIn:j.auth.tokens.refreshTokenLifetimeMinutes*60,issuer:j.jwtIssuer,accessTokenAudience:j.jwtAccessTokenAudience,refreshTokenAudience:j.jwtRefreshTokenAudience,accessTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system],refreshTokenAudiences:[j.security.tokenAudiences.customer,j.security.tokenAudiences.tenant,j.security.tokenAudiences.system]}),i=new ik({region:j.awsRegion,...j.dynamodbEndpoint?{endpoint:j.dynamodbEndpoint,credentials:{accessKeyId:"test",secretAccessKey:"test"}}:{}}),o=VT({tableName:j.dynamodbTableName,client:i}),s=sk(),a=new Map;j.oauth.facebook&&a.set("facebook",jm({appId:j.oauth.facebook.clientId,appSecret:j.oauth.facebook.clientSecret,redirectUri:j.oauth.facebook.redirectUri})),j.oauth.google&&a.set("google",Gm({clientId:j.oauth.google.clientId,clientSecret:j.oauth.google.clientSecret,redirectUri:j.oauth.google.redirectUri}));let c={identity:{email:r},credential:{password:t,otp:e},token:n,database:o,emailSystem:s,deviceParser:Vv(),rateLimiter:fT(),mfa:{totp:pT({issuer:j.auth.systemName}),email:aT()}};return a.size>0&&Object.assign(c,{oauthProviders:a}),await Va({systemId:j.auth.systemName,plugins:c,security:{...If.HIGH,maxFailedAttempts:j.security.maxLoginAttempts,lockoutDurationMinutes:j.security.lockoutDurationMinutes,requireVerifiedIdentity:j.security.requireVerifiedIdentity,accessTokenLifetimeMinutes:j.auth.tokens.accessTokenLifetimeMinutes,refreshTokenLifetimeMinutes:j.auth.tokens.refreshTokenLifetimeMinutes,verificationCodeExpiryMinutes:j.auth.verificationCodeLifetimeMinutes,verificationResendCooldownSeconds:j.auth.verificationResendCooldownSeconds,verifySessionOnAuth:j.security.verifySessionOnAuth,systemTenantId:j.security.systemTenantId,tokenAudiences:j.security.tokenAudiences},system:{environment:j.nodeEnv},policy:{auditEnabled:j.features.auditEnabled,deviceTrackingEnabled:j.features.deviceTracking,sessionRotationEnabled:!0},version:j.auth.appVersion,email:{appName:"Auth Craft",appUrl:j.auth.appUrl,supportEmail:j.auth.supportEmail}})}var Sc={INTERNAL_ERROR:Q("INTERNAL_ERROR","Internal server error: {message}"),INVALID_TOKEN_TYPE:_("INVALID_TOKEN_TYPE","Access token required")};function N_(t,e){let r=dn(e);return t.json(r.body,r.status)}function Yk(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}_v();var Qi=j.appBasePath?(j.appBasePath.startsWith("/")?j.appBasePath:`/${j.appBasePath}`).replace(/\/$/,""):"",R_=Qi?`${Qi}/health`:"/health",vh=null,Lr=null;async function Xk(){return vh||(vh=await WT(),console.log("\u2705 Auth SDK initialized")),vh}async function O_(){if(!Lr){let t=await Xk(),e={algorithm:j.jwtAlgorithm,publicKey:j.jwtPublicKey,issuer:j.jwtIssuer},r=Ar(e),n=Ro({gateway:{...j.gatewayJwt.publicKeyHex?{publicKeyHex:j.gatewayJwt.publicKeyHex}:{},expectedIssuer:j.gatewayJwt.issuer,expectedAudience:j.gatewayJwt.audience,header:j.gatewayJwt.header},accessJwt:{config:e,verifyFn:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==yn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}}}),i=gp({auth:{jwt:{...e,verify:async(s,a)=>{let c=await r(s,a);return c.ok&&c.data.typ!==yn.Access?d(Sc.INVALID_TOKEN_TYPE()):c}},customMethods:[n],defaultMethods:["jwt"]}});Lr=new Gr,j.nodeEnv!=="production"&&Lr.use("*",async(s,a)=>{let c=s.req.header("X-Request-Id")||crypto.randomUUID(),l=Date.now();console.log("\u{1F4E5} [Request]",JSON.stringify({requestId:c,method:s.req.method,path:s.req.path,gatewaySecret:s.req.header("X-Gateway-Secret")?"***":"(none)"})),await a(),console.log("\u{1F4E4} [Response]",JSON.stringify({requestId:c,status:s.res.status,duration:`${Date.now()-l}ms`}))}),j.corsOrigins.length>0&&Lr.use("*",uv({origin:j.corsOrigins,credentials:!0,allowMethods:["GET","POST","PUT","PATCH","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","X-Requested-With"]})),j.gatewaySecret&&Lr.use("*",async(s,a)=>{if(s.req.path===R_)return a();let c=s.req.header("X-Gateway-Secret");return!c||!Yk(c,j.gatewaySecret)?(j.nodeEnv!=="production"&&console.warn("\u26A0\uFE0F [Security] Invalid or missing X-Gateway-Secret"),s.notFound()):a()}),Lr.get(R_,s=>N_(s,T({status:"healthy",timestamp:new Date().toISOString()}))),Lr.use("*",vp);let o=ff({auth:t,policy:i,tokenStrategy:j.auth.tokens.refreshTokenStrategy,...j.auth.tokens.refreshTokenCookie?{refreshTokenCookie:j.auth.tokens.refreshTokenCookie}:{},...j.corsOrigins.length>0?{trustedOrigins:j.corsOrigins}:{}});if(Lr.route(Qi,o),console.log(`\u{1F510} Auth routes mounted at ${Qi||"/"}`),j.internal.publicKey){let s=Qi?`${Qi}${j.internal.serviceRoutePath}`:j.internal.serviceRoutePath,a=Tf({auth:t,internal:{publicKeyJwk:j.internal.publicKey,alg:j.internal.alg,audience:j.internal.audience,issuer:j.internal.issuer}});Lr.route(s,a),console.log(`\u{1F512} Internal routes mounted at ${s}`)}Lr.onError((s,a)=>{console.error("\u274C [Error]",{message:s.message,stack:s.stack,path:a.req.path});let c=j.nodeEnv==="production"?"Internal Server Error":s.message||"Internal Server Error";return N_(a,d(Sc.INTERNAL_ERROR({message:c})))}),console.log("\u2705 Hono app initialized")}return Lr}var Moe=async(t,e)=>{try{let r=await O_();return _f(r)(t,e)}catch(r){console.error("\u274C Lambda handler error:",r);let n=r instanceof Error?r.message:"Unknown error",i=j.nodeEnv==="production"?"Internal Server Error":n,o=dn(d(Sc.INTERNAL_ERROR({message:i})));return{statusCode:o.status,body:JSON.stringify(o.body),headers:{"Content-Type":"application/json"}}}};if(process.env.NODE_ENV!=="production"){let{serve:t}=await Promise.resolve().then(()=>(w_(),S_));O_().then(e=>{let r=j.port,n=j.host,i=n==="0.0.0.0"?"localhost":n;console.log("\u{1F680} Auth Craft Hono DynamoDB Lambda (local)"),console.log(`\u{1F4CD} Environment: ${j.nodeEnv}`),console.log(`\u{1F310} http://${i}:${r}${Qi||""}`),console.log(`\u{1F511} Gateway secret: ${j.gatewaySecret?"configured":"not set (open)"}`),console.log(`\u{1F510} Gateway JWT: ${j.gatewayJwt.publicKeyHex?"enabled":"disabled (local dev mode)"}`),t({fetch:e.fetch,port:r,hostname:n})}).catch(e=>{console.error("\u274C Failed to start local server:",e),process.exit(1)})}export{Moe as handler};
 //# sourceMappingURL=index.mjs.map